{
  "aliases": [
    "akdoortea",
    "alluring pisces",
    "applejeus",
    "appleworm",
    "apt-c-26",
    "apt-q-1",
    "beavertail",
    "bureau-1121",
    "chainveil",
    "citrine sleet",
    "cl-sta-0240",
    "cl-sta-240",
    "covellite",
    "dangerous passwords",
    "dark seoul",
    "deaddrop",
    "deceptivedevelopment",
    "dev#popper",
    "diamond sleet",
    "diamondsleet",
    "famous chollima",
    "gleaming pisces",
    "golangghost",
    "group-77",
    "guardians of peace",
    "gwisin gang",
    "hastati group",
    "hexeval loader",
    "hidden cobra",
    "invisibleferret",
    "jade sleet",
    "jumpy pisces",
    "labyrinth chollima",
    "manuscrypt",
    "moonstone sleet",
    "newromanic cyberarmy team",
    "nickel academy",
    "nickel tapestry",
    "operation darkseoul",
    "operation ghostsecret",
    "operation troy",
    "ottercookie",
    "pebbledash",
    "pondrat",
    "poolrat",
    "postnaptea",
    "promptmink",
    "pukchong",
    "purple bravo",
    "purplebravo",
    "pychollima",
    "pylangghost",
    "ref9135",
    "remotepeloader",
    "remoteperat",
    "romeogolf",
    "scoringmathtea",
    "sectora01",
    "slow pisces",
    "stardust",
    "stoatwaffle",
    "storm-1877",
    "tenacious pungsan",
    "themeforestrat",
    "tradertraitor",
    "tropidoor",
    "unc4736",
    "unc5267",
    "unc5342",
    "unit-121",
    "void dokkaebi",
    "wagemole",
    "waterplum",
    "weaselstore",
    "whois hacking team",
    "xorindex loader",
    "zinc"
  ],
  "attack_id": "G0032",
  "attack_name": "Lazarus Group",
  "attack_url": "https://attack.mitre.org/groups/G0032/",
  "counts": {
    "domain": 3836,
    "ipv4": 830,
    "url": 624,
    "url_path": 90
  },
  "first_seen": {
    "domain": {
      "0927.vercel.app": "2026-01-02",
      "0xraiseup.com": "2026-01-02",
      "1-73g.pages.dev": "2026-02-09",
      "118274-zoomid.com": "2026-01-02",
      "11stnft.click": "2024-09-02",
      "1215.vercel.app": "2026-01-02",
      "123fisd.naveicoipg.online": "2022-04-07",
      "129react.pages.dev": "2026-02-09",
      "15248636.site": "2023-10-13",
      "166-88-54-158.nip.io": "2026-07-29",
      "1688dsj.com": "2020-06-23",
      "17.docsend.store": "2026-06-19",
      "172-86-114-141.dal.priv.octovpn.net": "2025-02-12",
      "172-86-114-170.dal.priv.octovpn.net": "2026-01-02",
      "172-86-89-213.cprapid.com": "2026-07-23",
      "1drvmicrosoft.com": "2022-08-17",
      "1winfans.com": "2026-02-14",
      "247l.net": "2024-11-27",
      "260120.vercel.app": "2026-04-03",
      "2ab9.watashinonegai.ru": "2022-01-01",
      "2daojnjnp666jla6.dropfile.online": "2024-10-09",
      "3.143.24.91.sslip.io": "2026-06-19",
      "360scanner.store": "2026-01-02",
      "360share.pro": "2026-01-02",
      "3la6ol.net": "2026-06-09",
      "49rjaf1fgrlzl1t82dpxmiqmyeedl4kku5y3hjvanjleyhpo3pjmbn23q0.pages.dev": "2026-04-30",
      "4bjt2rceijktwedi.onion": "2021-04-09",
      "4w9h8ps9.naveicoipa.tech": "2022-03-30",
      "4w9h8ps9.naveicoipc.tech": "2022-03-25",
      "5l.securemypc.xyz": "2026-06-19",
      "6la0cwds.naveicoiph.online": "2022-04-11",
      "7xvc.meeting-central.online": "2024-09-10",
      "7xvc.meeting-zone.online": "2024-09-10",
      "7xvc.roomconnect.online": "2024-07-15",
      "7xvc.virtual-collab.online": "2024-08-21",
      "8190ocvswfyd57v5.docsend.online": "2024-10-09",
      "91.90.121.87.sslip.io": "2026-07-18",
      "9yxqida1b.naveicoiph.online": "2022-04-08",
      "a.videotalks.site": "2024-11-15",
      "aat1pbil.naveicoipg.online": "2022-04-07",
      "abc.meeting-central.online": "2024-09-10",
      "abc.meeting-zone.online": "2024-09-10",
      "abc.preconnection.online": "2024-05-08",
      "abc.roomconnect.online": "2024-07-15",
      "abilityscan360.com": "2026-01-02",
      "abs.twitter.expublic.linkpc.net": "2023-05-10",
      "access.support.general-meet.site": "2024-09-10",
      "accounts.ceinbase.com": "2024-09-17",
      "acoustickoala.com": "2026-01-02",
      "acroadovw.com": "2026-01-02",
      "activity-179384736.site": "2023-10-13",
      "activity-permission.online": "2023-10-13",
      "additional.work.gd": "2023-12-05",
      "additionalpublic.work.gd": "2023-12-05",
      "addrcheck.corecheckmailsrv.com": "2020-12-30",
      "ade.dropfile.online": "2024-10-09",
      "admescolassystemf.com": "2026-05-26",
      "admin-8jy8o7jbg.vercel.sh": "2026-02-20",
      "admin.alwayswelcome.online": "2024-09-10",
      "admin.chrome-browser.cloud": "2024-10-09",
      "admin.docsend.online": "2024-10-09",
      "admin.docsend.site": "2024-10-09",
      "admin.drop-box.store": "2024-11-13",
      "admin.dropfile.online": "2024-10-09",
      "admin.echelonfnd.io": "2026-01-02",
      "admin.general-meet.site": "2024-09-10",
      "admin.luckyguys.cloud": "2026-04-30",
      "admin.luckyguys.site": "2026-04-22",
      "admin.meeting-central.online": "2024-09-10",
      "admin.meeting-zone.online": "2024-09-10",
      "admin.rohapowers.com": "2026-06-10",
      "admin.support.general-meet.site": "2024-09-10",
      "admin0.docsend.store": "2026-06-19",
      "adnoc.sbs": "2026-02-14",
      "aduresi.com": "2026-01-02",
      "advantims.com": "2021-01-25",
      "advisor-ecareerflare.pages.dev": "2026-02-10",
      "advisorflux.com": "2026-01-02",
      "advisorflux.pages.dev": "2026-01-02",
      "advisornetic.com": "2026-02-10",
      "advisoryfit.com": "2026-01-02",
      "advisoryfit.pages.dev": "2026-01-02",
      "advisorygrid.com": "2026-01-02",
      "adzjvazj.naveicoipg.online": "2022-04-06",
      "ae-zoom.us": "2026-01-02",
      "ae-zooom-hegne-meetingsfromf6758s.pages.dev": "2026-01-02",
      "aeroplans.info": "2020-01-08",
      "aes-secure.net": "2026-01-02",
      "affiliate.support.general-meet.site": "2024-09-10",
      "africamall.chat": "2026-01-02",
      "ag.centoservices.cz": "2026-06-19",
      "agafilime.com": "2026-02-10",
      "agora.assessintel.com": "2026-01-02",
      "ai.coinhouse360.com": "2026-01-02",
      "aiagentnow.online": "2026-01-02",
      "aideck.net": "2021-01-15",
      "aigtech.dev": "2026-06-20",
      "aihealthchains.com": "2026-04-24",
      "aionedev.best": "2026-03-16",
      "aixstore.info": "2022-03-30",
      "ajileuowl.dliklone.online": "2023-08-25",
      "akamaicloud.com": "2026-05-27",
      "akamaitechnologies.online": "2024-09-17",
      "akaunting25709.hostkey.in": "2026-04-24",
      "alahbabgroup.com": "2019-03-27",
      "alanservice.vercel.app": "2026-04-03",
      "alchemy-api-v3.cloud": "2026-01-02",
      "alchemy.motionassess.com": "2026-01-02",
      "alchemy.onchainhiringtool.com": "2026-01-02",
      "alchemy.talentscreeningtool.com": "2026-01-02",
      "alejandro.uefa-meeting.com": "2026-01-02",
      "allgraphicart.com": "2021-05-15",
      "allinfostudio.com": "2022-01-26",
      "allow-permission.online": "2023-10-13",
      "alltaxlab.com": "2026-03-16",
      "alpcoin.anomgaming.online": "2026-01-02",
      "alpha.preconnection.online": "2024-05-08",
      "alphanonega.org": "2026-06-09",
      "alqaflah.com": "2026-06-10",
      "alticgo.com": "2022-04-19",
      "alwayswait.online": "2023-09-11",
      "alwayswait.site": "2023-09-11",
      "alwayswelcome.online": "2024-07-16",
      "amazonaws1.info": "2020-02-07",
      "amazoncojp.one": "2023-07-03",
      "amazonfiso.com": "2026-02-24",
      "amene.homepc.it": "2021-05-31",
      "amytanathorn.com": "2020-06-23",
      "analytic.dropfile.online": "2024-10-09",
      "analytics-script-git-main.vercel.sh": "2026-02-20",
      "analyzicai.com": "2026-05-29",
      "anchoragedigitalhireflow.com": "2026-01-02",
      "anchoragehireflow.com": "2026-01-02",
      "anchoragehiring.com": "2026-01-02",
      "angeldonationblog.com": "2021-01-26",
      "angeldrop.cloud": "2026-02-12",
      "angeloper.com": "2026-01-02",
      "angeloperonline.online": "2026-01-02",
      "anglerstatic.com": "2026-01-02",
      "anifintech.xyz": "2026-01-02",
      "animoca.finance": "2026-02-12",
      "ann.support.general-meet.site": "2024-09-10",
      "anomgaming.online": "2026-01-02",
      "answerpanel.org": "2026-01-02",
      "answerpart.com": "2026-01-02",
      "answerpart.pages.dev": "2026-01-02",
      "antcapital.us": "2021-03-23",
      "antifirmware.online": "2023-09-11",
      "antifirmware.site": "2023-09-11",
      "antifirmware.store": "2023-09-11",
      "antiviruscheck.site": "2023-09-11",
      "antiviruscheck.store": "2023-09-11",
      "aosm8cts.naveicoipg.online": "2022-04-06",
      "api-agent-2pqjsxiut.vercel.sh": "2026-02-20",
      "api-git-main.vercel.sh": "2026-02-20",
      "api-server-mocha.vercel.app": "2026-01-23",
      "api-sub.jrodacooker.dev": "2026-05-01",
      "api-web3-auth.vercel.app": "2026-02-25",
      "api-www-avatar-25fcc9rbk.vercel.sh": "2026-02-20",
      "api-zoom.com": "2026-01-02",
      "api.africamall.chat": "2026-01-02",
      "api.alwayswelcome.online": "2024-09-10",
      "api.auto-fixer.online": "2026-01-02",
      "api.autocamfixer.online": "2026-01-02",
      "api.autodriverfix.online": "2026-01-02",
      "api.autofixer.online": "2026-01-02",
      "api.avax-test.dev": "2026-07-22",
      "api.betterevaluation.us": "2026-02-10",
      "api.bitzone.io": "2026-01-02",
      "api.camallupdate.cloud": "2026-01-02",
      "api.camdriverhelp.club": "2026-01-02",
      "api.camdriverhub.cloud": "2026-01-02",
      "api.camdrivers.cloud": "2026-01-02",
      "api.camdriverstore.cloud": "2026-01-02",
      "api.camdriversupport.com": "2026-01-02",
      "api.camera-drive.cloud": "2024-12-29",
      "api.camera-drive.org": "2025-01-13",
      "api.cameradriverx.cloud": "2026-01-02",
      "api.camtechdrivers.com": "2026-01-02",
      "api.camtuneup.online": "2026-01-02",
      "api.chrome-browser.cloud": "2024-10-09",
      "api.cincopa.org": "2026-02-09",
      "api.cleverbiz.us": "2026-02-09",
      "api.coinhar.io": "2026-01-02",
      "api.coinpricehub.io": "2026-01-02",
      "api.crm.koliinfotech.company": "2026-01-02",
      "api.deepdriverupdate.online": "2026-01-02",
      "api.detankzone.com": "2024-10-28",
      "api.devicefixer.online": "2026-01-02",
      "api.digipairx.com": "2026-01-02",
      "api.docsend.site": "2024-10-09",
      "api.docsend.store": "2024-10-09",
      "api.drive-release.cloud": "2025-01-17",
      "api.drivercamhub.cloud": "2026-01-02",
      "api.drivercams.cloud": "2026-01-02",
      "api.drivercamsupport.com": "2026-01-02",
      "api.driversnap.cloud": "2026-01-02",
      "api.driversofthub.online": "2026-01-02",
      "api.driverstream.cloud": "2026-01-02",
      "api.drivfixer.online": "2026-01-02",
      "api.drivhost.store": "2026-01-02",
      "api.dropfile.cloud": "2024-10-09",
      "api.dropfile.online": "2024-10-09",
      "api.drvfixer.online": "2026-01-02",
      "api.elemize.us": "2026-02-09",
      "api.entergenix.com": "2026-02-09",
      "api.equisphire.com": "2026-02-10",
      "api.ethzone.io": "2026-01-02",
      "api.evalium-expertises.us": "2026-02-10",
      "api.evaluateproficiency.com": "2026-02-09",
      "api.financecap.io": "2026-01-02",
      "api.fivebit.io": "2026-01-02",
      "api.fix-drivers.online": "2026-01-02",
      "api.fixdiskpro.online": "2026-01-02",
      "api.gappeo.us": "2026-02-09",
      "api.general-meet.site": "2024-09-10",
      "api.growzy.tech": "2026-01-02",
      "api.imoda.site": "2025-01-06",
      "api.info-job.org": "2026-02-10",
      "api.introon.com": "2026-01-02",
      "api.ixcareer.video": "2026-01-02",
      "api.jobecam.org": "2026-02-10",
      "api.jobecam.us": "2026-02-10",
      "api.jquery-release.com": "2026-01-02",
      "api.jz-aws.info": "2024-12-29",
      "api.keenest.org": "2026-02-10",
      "api.luckyguys.cloud": "2026-04-30",
      "api.macamhelp.online": "2026-01-02",
      "api.medincahub.com": "2026-02-13",
      "api.meeting-zone.online": "2024-09-10",
      "api.nvidia-cloud.online": "2025-01-06",
      "api.nvidia-drive.cloud": "2024-12-29",
      "api.nvidia-release.cloud": "2025-01-06",
      "api.nvidia-release.org": "2024-12-28",
      "api.nvidia-release.us": "2024-12-29",
      "api.olaestudiocreativo.com": "2026-01-02",
      "api.onchainassess.com": "2026-01-02",
      "api.pre-screen.net": "2026-02-10",
      "api.pre-screen.online": "2026-02-10",
      "api.provideodrivers.cloud": "2026-01-02",
      "api.quant-screen.com": "2026-02-10",
      "api.quickcamfix.online": "2026-01-02",
      "api.quickdriverupdate.online": "2026-01-02",
      "api.rapiddrivers.cloud": "2026-01-02",
      "api.release-driver.online": "2026-01-02",
      "api.release-drivers.online": "2026-01-02",
      "api.releasedrive.live": "2026-01-02",
      "api.retailpackagingpartner.xyz": "2026-01-02",
      "api.sapia.us": "2026-07-21",
      "api.skilllens360.com": "2026-01-02",
      "api.smartchecker.online": "2026-01-02",
      "api.smartdriverfix.cloud": "2026-01-02",
      "api.smartdriverfixer.com": "2026-01-02",
      "api.smartdrvupdate.online": "2026-01-02",
      "api.snap-screening.com": "2026-01-02",
      "api.softechsoftwares.co.ke": "2026-02-09",
      "api.softshare.online": "2026-01-02",
      "api.stockdata.tech": "2026-01-02",
      "api.stockinfo.io": "2026-01-02",
      "api.tailora.org": "2026-02-09",
      "api.talentacq.pro": "2026-02-12",
      "api.thaibit.io": "2026-01-02",
      "api.unimeta.biz": "2026-01-02",
      "api.updatecall.live": "2026-01-02",
      "api.updatemycam.online": "2026-01-02",
      "api.updatewebcamnow.live": "2026-01-02",
      "api.vblimitedgroup.com": "2026-01-02",
      "api.vcamdriverupdate.cloud": "2026-01-02",
      "api.vcamfixer.online": "2026-01-02",
      "api.vcamsupport.cloud": "2026-01-02",
      "api.viasto.us": "2026-02-10",
      "api.videocarddrivers.cloud": "2026-01-02",
      "api.videodriverzone.cloud": "2026-01-02",
      "api.videotechdrivers.cloud": "2026-01-02",
      "api.vidtechdrivers.com": "2026-01-02",
      "api.vidtechdrv.online": "2026-01-02",
      "api.vidtechhub.cloud": "2026-01-02",
      "api.web-cam.cloud": "2026-01-02",
      "api.webcamdrivers.cloud": "2026-01-02",
      "api.webcamfix.cloud": "2026-01-02",
      "api.webcamfixer.cloud": "2026-01-02",
      "api.webcamfixer.online": "2026-01-02",
      "api.webcamwizard.cloud": "2026-01-02",
      "api.wikahmart.com": "2026-01-02",
      "api.willoassessment.com": "2024-12-28",
      "api.yourdomainhost.store": "2026-01-02",
      "api.zoom-sdk.us": "2026-01-02",
      "api.zoomsdk.us": "2026-01-02",
      "api.zynoracreative.com": "2026-01-02",
      "apkv3.clarionhpdu.top": "2022-01-01",
      "apollo.support.general-meet.site": "2024-09-10",
      "app-center.download": "2026-01-02",
      "app-solaxy.world": "2026-01-02",
      "app-zoom.website": "2026-01-02",
      "app.advisornetic.com": "2026-02-10",
      "app.aixstore.info": "2022-03-30",
      "app.alwayswelcome.online": "2024-09-10",
      "app.animoca.finance": "2026-02-12",
      "app.answerpart.com": "2026-01-02",
      "app.aptitudespro.com": "2026-02-10",
      "app.askillo.online": "2026-02-09",
      "app.avasup.com": "2026-02-10",
      "app.axionara.com": "2026-01-02",
      "app.betterevaluation.us": "2026-02-10",
      "app.blockchain-assess.com": "2024-12-28",
      "app.blockchain-checkup.com": "2025-01-07",
      "app.breezyhr.us": "2026-02-25",
      "app.caesarx.trade": "2026-05-01",
      "app.cammio.org": "2026-02-14",
      "app.carrerlilla.com": "2026-01-02",
      "app.coinhouse360.com": "2026-01-02",
      "app.compassidea.org": "2026-01-02",
      "app.crypto-assessment.com": "2024-12-28",
      "app.detankzone.com": "2024-10-28",
      "app.docsend.site": "2024-10-09",
      "app.drop-box.store": "2024-11-13",
      "app.dropfile.cloud": "2024-10-09",
      "app.dropfile.online": "2024-10-09",
      "app.eboardcareer.com": "2026-01-02",
      "app.ecareerflare.com": "2026-02-10",
      "app.ehiremeasure.com": "2026-02-09",
      "app.eskillion.com": "2026-02-09",
      "app.evalcrew.com": "2026-02-09",
      "app.evalium-expertises.us": "2026-02-10",
      "app.evaliuminsights.com": "2026-02-16",
      "app.evalixhub.com": "2026-01-02",
      "app.evalsuit.com": "2026-02-09",
      "app.evaluino.com": "2026-01-02",
      "app.evaluza.com": "2026-01-02",
      "app.expertssavingai.com": "2026-01-02",
      "app.gappeo.us": "2026-02-09",
      "app.getevalor.com": "2026-02-10",
      "app.gumlet.us": "2026-02-09",
      "app.harqen.us": "2026-02-09",
      "app.highmatch.cloud": "2026-03-12",
      "app.highmatch.pro": "2026-03-08",
      "app.hiring-interview.com": "2025-01-10",
      "app.hiringinterview.org": "2024-12-28",
      "app.hiringtalent.pro": "2024-12-28",
      "app.hirvexo.com": "2026-02-17",
      "app.insighboard.com": "2026-02-09",
      "app.interviewnest.org": "2024-12-28",
      "app.ixcareer.video": "2026-01-02",
      "app.jumpshare.online": "2026-03-12",
      "app.keenest.org": "2026-02-10",
      "app.lenvny.com": "2026-01-02",
      "app.limesurvey.us": "2026-01-02",
      "app.meeting-zone.online": "2024-09-10",
      "app.merreo.org": "2026-01-02",
      "app.pancakeswap.studio": "2026-02-17",
      "app.poweem.com": "2026-02-10",
      "app.powerwize.org": "2026-02-10",
      "app.pre-screen.net": "2026-02-10",
      "app.proficiencycert.com": "2026-01-02",
      "app.prontoquiz.org": "2026-02-10",
      "app.quick-view.org": "2026-02-10",
      "app.quickvidintro.com": "2025-01-14",
      "app.qwary.org": "2026-01-02",
      "app.recroya.com": "2026-02-17",
      "app.rev-prot.org": "2026-02-10",
      "app.rolevia.us": "2026-02-13",
      "app.scoret.net": "2026-02-09",
      "app.skill-share.org": "2025-01-16",
      "app.sloneek.us": "2026-01-02",
      "app.speedvice.com": "2026-02-10",
      "app.spiralboard.com": "2026-02-10",
      "app.stablehouses.info": "2022-09-01",
      "app.survicate.us": "2026-02-09",
      "app.toptiercrew.com": "2026-02-09",
      "app.vereoy.com": "2026-07-06",
      "app.vervoe.org": "2026-02-09",
      "app.vervoe.us": "2026-02-09",
      "app.viasto.us": "2026-02-10",
      "app.vid-crypto-assess.com": "2026-01-02",
      "app.vidcruiter.us": "2026-02-09",
      "app.videoforrecruitment.com": "2025-01-07",
      "app.videoscreening.org": "2024-12-28",
      "app.vidintroexam.com": "2025-01-12",
      "app.vinterview.org": "2025-01-07",
      "app.visionaryte.org": "2026-02-10",
      "app.weboardtals.com": "2026-02-21",
      "app.willo-interview.us": "2024-12-28",
      "app.willoassess.com": "2024-12-28",
      "app.willoassessment.com": "2024-12-28",
      "app.willocandidate.com": "2024-12-28",
      "app.willohiring.com": "2024-12-28",
      "app.willohiringtalent.org": "2024-12-29",
      "app.willomexcvip.us": "2024-12-28",
      "app.willorecruit.com": "2024-12-28",
      "app.willotalant.com": "2024-12-28",
      "app.willotalent.pro": "2024-12-28",
      "app.willotalent.us": "2024-12-28",
      "app.willotalent.xyz": "2024-12-28",
      "app.willotalentes.com": "2024-12-28",
      "app.willotalents.org": "2024-12-28",
      "app.wilo-talent.com": "2025-01-07",
      "app.wonderlic.net": "2026-02-09",
      "app.wtalents.us": "2024-12-28",
      "app.zynoracreative.com": "2026-01-02",
      "apply-blocknovas.site": "2026-01-02",
      "apply-camera.com": "2026-01-02",
      "apply.blocknovas.com": "2026-01-02",
      "apply.blocknovasllc.com": "2026-01-02",
      "apply.ecareerflare.com": "2026-02-10",
      "apply.echelonfnd.io": "2026-01-02",
      "apply.waventic.com": "2026-01-02",
      "applylens.com": "2026-01-02",
      "apps.gappeo.us": "2026-02-09",
      "appsnabia.org": "2026-05-27",
      "aptitudespro.com": "2026-02-10",
      "arbor.companydetail.online": "2023-12-05",
      "arcashop.org": "2026-01-02",
      "archax.meetingverse.app": "2023-12-04",
      "archax.privymeet.com": "2023-11-29",
      "archax.skyboxdrive.cloud": "2023-11-29",
      "archax.team-meeting.pro": "2023-12-04",
      "archax.team-meeting.xyz": "2023-12-12",
      "archax.trustmeeting.live": "2023-11-29",
      "archax.videomeethub.online": "2023-12-12",
      "archblock.candidatescope.com": "2026-01-02",
      "archblock.careerscreeners.com": "2026-01-02",
      "archblock.quickproassess.com": "2026-01-02",
      "archblock.rolefit360.com": "2026-01-02",
      "areac-agr.com": "2020-07-06",
      "argoworkflow.chrome-browser.cloud": "2024-10-09",
      "as-zoom.us": "2026-01-02",
      "ascendrix.us": "2026-01-02",
      "askillo.online": "2026-02-10",
      "asl.dropfile.online": "2024-10-09",
      "assessalign.com": "2026-01-02",
      "assessbay.com": "2026-01-02",
      "assesscrew.com": "2026-01-02",
      "assessdome.com": "2026-01-02",
      "assessforhire.com": "2026-01-02",
      "assessintel.com": "2026-01-02",
      "assessiohq.com": "2026-01-02",
      "assessmentbay.com": "2026-01-02",
      "assesspro360.com": "2026-01-02",
      "assesstoday.com": "2026-01-02",
      "assesstrack.com": "2026-01-02",
      "asset.crypto-ecosystem.world": "2023-08-09",
      "assetslib.shop": "2026-07-21",
      "assureeval.com": "2026-01-02",
      "asteara.org": "2026-06-09",
      "astraluck-vercel.vercel.app": "2026-02-20",
      "atdfinancial.com": "2025-01-10",
      "atlas.small-forest-2b0b.workers.dev": "2026-02-17",
      "atlasnode-app204.vercel.app": "2026-02-28",
      "atlasnode-ext957.vercel.app": "2026-02-28",
      "atokyonews.com": "2024-12-19",
      "attisscmo.com": "2026-01-02",
      "audiocheck.store": "2023-11-29",
      "auditprovidre.online": "2023-09-11",
      "auditprovidre.site": "2023-09-11",
      "auditprovidre.store": "2023-09-11",
      "aumentarelevisite.com": "2022-04-18",
      "aurevian.cloud": "2026-02-12",
      "auth-drive-google.vercel.app": "2026-05-21",
      "auth.dropfile.online": "2024-10-09",
      "authenticate.azure-drive.com": "2021-06-19",
      "authnsecuresystems.com": "2026-01-02",
      "authsmtp.dropfile.online": "2024-10-09",
      "auto-ai.online": "2026-01-02",
      "auto-fixer.online": "2026-01-02",
      "auto-loader.org": "2026-02-25",
      "auto-patch.tech": "2026-01-02",
      "auto-protection.cloud": "2023-01-04",
      "auto-protection.services": "2023-01-04",
      "auto-secure.cloud": "2023-01-04",
      "autocamfixer.online": "2026-01-02",
      "autodiscover.vin": "2022-01-01",
      "autodriverfix.online": "2026-01-02",
      "autofixer.online": "2026-01-02",
      "automatic.antifirmware.store": "2023-10-05",
      "autonomousconsensuspipelines.cloud": "2026-02-25",
      "autoprotect.com.se": "2023-02-09",
      "autoprotect.gb.net": "2023-01-25",
      "autoserverupdate.line.pm": "2023-10-05",
      "autoupdate.xyz": "2023-11-29",
      "avalabs-digital.online": "2026-01-02",
      "avalabs-digital.space": "2026-01-02",
      "avalabs-digital.store": "2026-01-02",
      "avalabs-hiring.online": "2026-01-02",
      "avalabs-hiring.site": "2026-01-02",
      "avalabs-hiring.space": "2026-01-02",
      "avalabs-hiring.store": "2026-01-02",
      "avalabs-hiring.world": "2026-01-02",
      "avalabs-io.online": "2026-01-02",
      "avalabs-io.space": "2026-01-02",
      "avalabs-io.store": "2026-01-02",
      "avalabs-network.live": "2026-01-02",
      "avalabs-network.online": "2026-01-02",
      "avalabs-network.space": "2026-01-02",
      "avalabs-org.online": "2026-01-02",
      "avalabs-talent.online": "2026-01-02",
      "avalabs-talent.site": "2026-01-02",
      "avalabs-talent.space": "2026-01-02",
      "avalabs-talent.store": "2026-01-02",
      "avalabs-tech.online": "2026-01-02",
      "avalabs-tech.space": "2026-01-02",
      "avalabs-tech.store": "2026-01-02",
      "avasup.com": "2026-02-10",
      "avax-test.dev": "2026-07-22",
      "aveva.roleassessor.com": "2026-01-02",
      "aviamastersnetwork.com": "2026-02-14",
      "avillionrabbitry.com": "2024-12-10",
      "axieinfinity.assessalign.com": "2026-01-02",
      "axieinfinity.assessintel.com": "2026-01-02",
      "axieinfinity.certifyedge360.com": "2026-01-02",
      "axieinfinity.hirelytics360.com": "2026-01-02",
      "axionara.com": "2026-01-02",
      "ayr.dropfile.online": "2024-10-09",
      "ayrshire360.com": "2026-01-02",
      "azure-defender.cloud": "2023-05-10",
      "azure-drive.com": "2021-06-09",
      "azure-protect.cloud": "2023-01-04",
      "azure-protect.online": "2022-09-15",
      "azure-protection.cloud": "2022-09-23",
      "azure-protection.online": "2023-01-04",
      "azure.auto-protection.cloud": "2023-01-04",
      "azure.auto-protection.services": "2023-01-04",
      "azure.auto-secure.cloud": "2023-01-04",
      "azure.doc-protection.cloud": "2023-01-04",
      "azure.doc-protection.online": "2023-01-04",
      "azure.docs-protection.cloud": "2023-10-11",
      "azure.docs-protection.online": "2023-10-11",
      "azure.docs-protection.top": "2023-10-11",
      "azure.docs-view.cloud": "2023-01-04",
      "azure.online-protection.cloud": "2023-01-04",
      "azure.protection-service.cloud": "2023-01-04",
      "azuredefender.online": "2023-05-10",
      "azuredeploypackages.net": "2026-01-02",
      "azureglobalaccelerator.com": "2026-01-02",
      "b.videotalks.site": "2024-11-15",
      "b.watashinonegai.ru": "2022-01-01",
      "ba5827bf4e00.privatepool.store": "2024-10-21",
      "bac.dropfile.online": "2024-10-09",
      "backed.docsend.site": "2024-10-09",
      "backed.general-meet.site": "2024-09-10",
      "backend.alwayswelcome.online": "2024-09-10",
      "backend.chrome-browser.cloud": "2024-10-09",
      "backend.docsend.site": "2024-10-09",
      "backend.drop-box.store": "2024-11-13",
      "backend.dropfile.cloud": "2024-10-09",
      "backend.dropfile.online": "2024-10-09",
      "backend.meeting-zone.online": "2024-09-10",
      "backend.pre-screen.net": "2026-02-10",
      "backup.coinbase-backup.com": "2026-06-09",
      "backupwizard.net": "2026-01-02",
      "baincapitalcrypto.zm-meeting.com": "2026-01-02",
      "ballroller.fun": "2026-01-02",
      "banner-counter.com": "2022-01-01",
      "bapi.evalsuit.com": "2026-02-09",
      "barjobslasvegas-2f0akudpg-superbwebsolutions-e260a2eb.vercel.app": "2026-02-20",
      "base-cei.pages.dev": "2026-01-02",
      "bbcnewsagency.com": "2022-10-19",
      "bbs.topigsnorsvin.com.ec": "2023-09-03",
      "bcvbert.naveicoipe.tech": "2022-03-31",
      "beastgoc.com": "2019-10-11",
      "beenos.biz": "2022-01-17",
      "beeztrend.com": "2023-10-18",
      "belgiumchickenroad.com": "2026-02-14",
      "bensaru.site": "2026-05-01",
      "bestonlinefilmstudio.org": "2024-05-28",
      "beta-reactjs-org-1c98ufhjb-fbopensource.vercel.app": "2026-02-20",
      "beta.preconnection.online": "2024-07-15",
      "betterevaluation.us": "2026-02-10",
      "beyondnextventures.us": "2023-01-04",
      "bico-news.blog": "2023-08-09",
      "bico.tokentracking.info": "2023-08-09",
      "big-typl.online": "2024-11-13",
      "bigrocks918.com": "2026-01-02",
      "binancestransfers.com": "2026-01-02",
      "binshtok-cowan-test-pwjs2ggdx.vercel.sh": "2026-02-20",
      "biomedsurgcial.com": "2026-01-02",
      "bitensor.xyz": "2026-07-08",
      "bitfinex.internal-meeting.online": "2023-11-29",
      "bitfinex.video-meet.online": "2023-11-29",
      "bitfiniex.org": "2018-09-13",
      "bitgesell.finance": "2026-05-17",
      "bitgo.talentelevate360.com": "2026-01-02",
      "bitmart.hiremodozone.com": "2026-01-02",
      "bitscrunch.co": "2023-10-26",
      "bitscrunch.ddns.net": "2023-10-31",
      "bitscrunch.deck.linkpc.net": "2023-10-26",
      "bitscrunch.im.linkpc.net": "2023-10-26",
      "bitscrunch.linkpc.net": "2023-09-30",
      "bitscrunch.myvnc.com": "2023-11-16",
      "bitscrunch.pd.linkpc.net": "2023-10-27",
      "bitscrunch.presentations.life": "2023-10-27",
      "bitscrunch.publicvm.com": "2023-09-30",
      "bitscrunch.serveirc.com": "2023-10-31",
      "bitscrunch.tech.linkpc.net": "2023-10-31",
      "bitscrunch.zapto.org": "2023-10-31",
      "bitscrunchtech.linkpc.net": "2023-10-31",
      "bitscrunnch.linkpc.net": "2023-09-30",
      "bitscrunnch.run.place": "2023-09-30",
      "bitsvertise.com": "2023-09-07",
      "bitzone.io": "2026-01-02",
      "biz-meeting.site": "2024-10-22",
      "biz-zoom.us": "2026-01-02",
      "bizmeet.online": "2026-01-02",
      "bizmeet.org": "2026-01-02",
      "bizmeet.pro": "2026-01-02",
      "bizmeeting.org": "2026-01-02",
      "bizmeeting.video": "2026-01-02",
      "bizsupport365.com": "2024-12-10",
      "bizzyclub.org": "2026-01-02",
      "blackleopard.myvnc.com": "2023-11-16",
      "blackleopard.world": "2023-07-03",
      "blackskydev.org": "2026-08-05",
      "blastapi.org": "2026-01-02",
      "blgbeach.com": "2023-09-07",
      "blo.dropfile.online": "2024-10-09",
      "block-digital.fit": "2026-01-02",
      "block-digital.online": "2026-01-02",
      "block-digital.site": "2026-01-02",
      "block-digital.store": "2026-01-02",
      "blockassess.com": "2026-01-02",
      "blockchain-assess.com": "2024-12-28",
      "blockchain-checkup.com": "2025-01-07",
      "blockchain-newtech.com": "2023-10-10",
      "blockchain-talent-search.com": "2025-01-28",
      "blockchainjobassessment.com": "2026-01-02",
      "blockchainjobhub.com": "2026-01-02",
      "blockchainnews.vip": "2022-03-24",
      "blockchainrecruitment360.com": "2025-02-02",
      "blockchainworld.info": "2023-08-09",
      "blockfi-krollra.com": "2026-01-02",
      "blockfi.loans": "2023-05-10",
      "blocknovas.com": "2026-01-02",
      "blocknovas.talenthiringexpert.com": "2026-01-02",
      "blocknovasllc.com": "2026-01-02",
      "blockprices.io": "2026-01-02",
      "blocktechtalent.com": "2026-03-19",
      "blockterralab.com": "2026-05-05",
      "blocktestingto.com": "2023-11-25",
      "blog.br0vvnn.io": "2021-01-26",
      "blog.evalonboard.com": "2026-01-02",
      "bloombergnewsagency.com": "2022-10-20",
      "bloomcloud.org": "2022-01-17",
      "bloxholder.com": "2022-12-03",
      "bluecow.com": "2021-04-01",
      "bluemoonresearch.org": "2020-06-07",
      "blurbshop.com": "2023-01-26",
      "blxrbn.com": "2026-05-01",
      "bmanal.com": "2022-02-08",
      "boa.azuredefender.online": "2023-05-10",
      "boa.job-description.online": "2023-05-10",
      "boa.jobdescription.online": "2023-05-10",
      "bobshields.com": "2024-12-10",
      "bodyshoppechiropractic.com": "2019-03-18",
      "bofhintl.com": "2026-01-02",
      "bon.dropfile.online": "2024-10-09",
      "bonusdali.com": "2026-01-02",
      "boofparadise.com": "2026-01-02",
      "book-download.shop": "2023-10-13",
      "book.tomming.us": "2023-10-17",
      "boolnetwork.xyz": "2026-01-02",
      "bootcamp-coders.cnm.edu": "2021-04-27",
      "bot-protection-3bhbcw8wm.vercel.sh": "2026-02-20",
      "bot.dropfile.online": "2024-10-09",
      "botsc.autoupdate.xyz": "2023-11-29",
      "box-docsend.cloud": "2023-08-09",
      "box-docsend.online": "2023-08-09",
      "bqersape.dropfile.online": "2024-10-09",
      "brantwork.vercel.app": "2026-01-23",
      "breezyhr.us": "2026-02-25",
      "brianrep.com": "2023-09-15",
      "brightlaunch-app615.vercel.app": "2026-02-28",
      "brightlaunch-ext742.vercel.app": "2026-02-28",
      "bs-production.up.railway.app": "2026-01-02",
      "bsc-dash.us": "2026-01-02",
      "btcblender.live": "2026-01-02",
      "btfns.co": "2026-05-27",
      "bu-zoom.us": "2026-01-02",
      "buckfast-zucht.de": "2020-01-08",
      "bugnol.com": "2026-06-09",
      "buiweggajhqwj.naveicoipg.online": "2022-04-05",
      "bujey.store": "2026-01-02",
      "business-zoom.us": "2026-01-02",
      "businessgoogledoc.com": "2026-01-02",
      "businesshire.cv": "2026-01-02",
      "businesshire.top": "2026-01-02",
      "businessmeet.xyz": "2026-01-02",
      "bybit-assessment.com": "2026-01-02",
      "caesarx.trade": "2026-05-01",
      "caladangroup.xyz": "2024-09-21",
      "calendly.live": "2026-01-02",
      "callapp.us": "2026-01-02",
      "callsdk.online": "2026-07-07",
      "callservice.us": "2025-02-04",
      "calystiabusiness.com": "2026-01-02",
      "camallupdate.cloud": "2026-01-02",
      "camdriver.pro": "2026-02-09",
      "camdriverhelp.club": "2026-01-02",
      "camdriverhub.cloud": "2026-01-02",
      "camdrivers.cloud": "2026-01-02",
      "camdriverstore.cloud": "2026-01-02",
      "camdriversupport.com": "2026-01-02",
      "camera-drive.cloud": "2024-12-29",
      "camera-drive.org": "2025-01-13",
      "cameradriver.pro": "2026-07-07",
      "cameradriverupdates.com": "2026-07-06",
      "cameradriverx.cloud": "2026-01-02",
      "cammio.org": "2026-02-14",
      "camtechdrivers.com": "2026-01-02",
      "camtuneup.online": "2026-01-02",
      "candidateinsightinfo.com": "2026-01-02",
      "candidatescope.com": "2026-01-02",
      "candidatesnap.com": "2026-01-02",
      "canditech.co": "2026-07-21",
      "canditech.ink": "2026-07-21",
      "canditech.net": "2026-07-21",
      "canditech.online": "2026-07-21",
      "canditech.org": "2026-07-21",
      "canditech.us": "2026-07-21",
      "canditech.xyz": "2026-07-21",
      "candy-pdf.com": "2025-02-11",
      "canyonzcc.com": "2022-02-08",
      "capitalviabtc.com": "2026-01-02",
      "capitalviabtc.comhollow-jordan-narrow.on-fleek.app": "2026-01-02",
      "capmarketreport.com": "2022-11-18",
      "carandcclasic.com": "2026-01-02",
      "career-8hp.pages.dev": "2026-01-02",
      "careerboard.video": "2026-01-02",
      "careerinterview360.com": "2025-01-28",
      "careerpredictto.space": "2026-06-09",
      "careerpulsynk.xyz": "2026-06-09",
      "careerquestion.com": "2026-01-02",
      "careerscreeners.com": "2026-01-02",
      "careertrixauvex.ink": "2026-06-09",
      "carllamb4judge.com": "2026-01-02",
      "carrerlilla.com": "2026-01-02",
      "carrervision.com": "2026-01-02",
      "casteisland.sky-meeting.com": "2024-10-22",
      "casteisland.team-meeting.net": "2024-10-22",
      "castleisland.sky-meeting.com": "2024-11-14",
      "catalog-editorial-qdoii4smx-clg.vercel.app": "2026-02-20",
      "ccsnbao.com": "2020-06-23",
      "cctxtools.com": "2026-07-07",
      "ccuk.edu.ng": "2026-02-10",
      "ccwaterfall.com": "2024-05-28",
      "cdn-static-icons.vercel.app": "2026-07-20",
      "cdn-static-server.vercel.app": "2026-01-02",
      "cdn.clubinfo.io": "2026-01-02",
      "cdn.clublogos.io": "2026-01-02",
      "cdn.documentworkspace.io": "2022-07-20",
      "cdn.jqueryversion.net": "2026-01-02",
      "cdn.leaguehub.net": "2026-01-02",
      "cdn.logoeye.net": "2026-01-02",
      "cdn.logosports.net": "2026-01-02",
      "cdn.luckyguys.cloud": "2026-04-30",
      "cdn.onlinedocview.biz": "2022-03-29",
      "cdn.soccerlab.io": "2026-01-02",
      "cdn.wordonline.cloud": "2022-08-09",
      "cdpll-couk.top": "2026-01-02",
      "cecomtp3.naveicoipg.online": "2022-04-06",
      "ceinbase.com": "2024-09-17",
      "ceionbase.com": "2024-09-18",
      "celasllc.com": "2019-04-26",
      "centoservices.cz": "2026-06-19",
      "ceronet.work": "2026-06-09",
      "ceronetwork.org": "2026-06-09",
      "certifyedge360.com": "2026-01-02",
      "cestlaviewellnessretreat.com": "2024-08-05",
      "cex.apply-camera.com": "2026-01-02",
      "cgbrandh.short.gy": "2026-04-23",
      "chainanalyser.com": "2026-01-02",
      "chainfun365.com": "2020-01-08",
      "chaingrown.com": "2023-12-08",
      "chainlink-api-v3.cloud": "2026-01-02",
      "chainlink-api-v3.com": "2026-01-02",
      "chainnews-star.com": "2022-03-24",
      "changelog.rest": "2026-05-01",
      "chaoslabs.abilityscan360.com": "2026-01-02",
      "chaoslabs.motionassess.com": "2026-01-02",
      "chaoslabs.professionalsnapshot.com": "2026-01-02",
      "chat-services.online": "2023-10-13",
      "chat.blocknovas.com": "2026-01-02",
      "chat.luckyguys.cloud": "2026-04-30",
      "check.luckyguys.cloud": "2026-04-30",
      "checkdevinc.com": "2023-07-19",
      "checknewversion.com": "2025-02-16",
      "chemistryworld.us": "2021-03-26",
      "chickenbaloonsgame.com": "2026-02-14",
      "chickenfrroad.com": "2026-02-14",
      "chickenroad.chickenbaloonsgame.com": "2026-02-14",
      "chickenroad.chickenkitchengame.org": "2026-02-14",
      "chickenroad.eggfactorygame.es": "2026-02-14",
      "chickenroad.greatchickenescape.com": "2026-02-14",
      "chickenroad.happychickenmrs.com": "2026-02-14",
      "chickenroad.playskatepark.com": "2026-02-14",
      "chickenroad.plushtoytumama.com": "2026-02-14",
      "chickenroad.toadegged.com": "2026-02-14",
      "chickenroadbike.com": "2026-02-14",
      "chickenroadblast.com": "2026-02-14",
      "chickenroadcase.com": "2026-02-14",
      "chickenroadde.org": "2026-02-14",
      "chickenroadjump.org": "2026-02-14",
      "chickenroadjumping.com": "2026-02-14",
      "chickenroadpixel.com": "2026-02-14",
      "chickenroadrecipe.com": "2026-02-14",
      "chickenroadrocky.com": "2026-02-14",
      "chickenroadshow.com": "2026-02-14",
      "chickenroadsquad.com": "2026-02-14",
      "chickenroadstack.com": "2026-02-14",
      "chickenroadventures.com": "2026-02-14",
      "chinesekungfu.org": "2023-09-03",
      "chipmixer.live": "2026-01-02",
      "chrome-browser.cloud": "2024-10-09",
      "chvsvr.short.gy": "2026-04-23",
      "cicoinbase.com": "2024-09-18",
      "cienbase.com": "2024-09-18",
      "cincopa.org": "2026-02-09",
      "circle.talentmonitoringtool.com": "2026-01-02",
      "cisco-webex.online": "2023-10-31",
      "citce-group.com": "2026-01-02",
      "civ.team-meeting.net": "2024-11-13",
      "clarionhpdu.top": "2022-01-01",
      "cleverbiz.us": "2026-02-09",
      "cleverstack-app998.vercel.app": "2026-02-28",
      "cleverstack-ext301.vercel.app": "2026-02-28",
      "clients.socket.luckyguys.cloud": "2026-04-30",
      "clob-polymarket.com": "2026-05-01",
      "clob.health": "2026-05-01",
      "cloud-sheet.net": "2020-12-30",
      "cloud-storage.world": "2024-08-21",
      "cloud.bdcc.bio": "2023-10-17",
      "cloud.beenos.biz": "2022-04-19",
      "cloud.beyondnextventures.us": "2023-01-04",
      "cloud.cryptyk.info": "2023-05-10",
      "cloud.daiwa.ventures": "2023-03-09",
      "cloud.doc-shared.linkpc.net": "2023-11-02",
      "cloud.jbic.us": "2022-09-16",
      "cloud.medipoint.mccprod.site": "2026-06-19",
      "cloud.mizuhogroup.uk": "2023-01-04",
      "cloud.mufg.tokyo": "2022-09-16",
      "cloud.optvers.net": "2020-12-30",
      "cloud.prosec.ink": "2022-12-20",
      "cloud.smbcgroup.uk": "2023-01-04",
      "cloudflare-prevention.vercel.app": "2026-06-29",
      "cloudflare1.vercel.app": "2026-06-11",
      "cloudflarefirewall.vercel.app": "2026-04-14",
      "cloudflareinsights.vercel.app": "2026-04-14",
      "cloudflaresecurity.vercel.app": "2026-04-14",
      "cloudfly.org": "2023-01-26",
      "cloudharbor-app239.vercel.app": "2026-02-28",
      "cloudharbor-ext664.vercel.app": "2026-02-28",
      "cloudmgmt.org": "2022-01-07",
      "cloudplus.one": "2021-12-08",
      "cloudprotect.us.org": "2022-12-20",
      "cloudscare.xyz": "2022-03-29",
      "cloudshare.jumpshare.vip": "2021-03-22",
      "cloudstore.business": "2024-08-21",
      "cltpk.doomdns.org": "2022-01-01",
      "clubinfo.io": "2026-01-02",
      "clublogos.io": "2026-01-02",
      "cms.docsend.store": "2026-06-19",
      "cnbc.crypto-ecosystem.world": "2023-08-09",
      "co.intneral-document-he-gr-me.run.place": "2023-10-26",
      "coachzenblog.biz": "2026-03-18",
      "coalink.support": "2026-07-07",
      "cobinase.com": "2024-09-18",
      "cobinbase.com": "2024-09-18",
      "coca-cola.bond": "2024-07-24",
      "codebiogblog.com": "2021-01-26",
      "codepointlab.com": "2026-04-24",
      "codepool.cloud": "2026-02-12",
      "codevexillium.org": "2021-01-26",
      "codeviewer-fawn.vercel.app": "2026-01-23",
      "codeviewer-three.vercel.app": "2026-01-23",
      "coinbalse.com": "2024-09-18",
      "coinbase-backup.com": "2026-06-09",
      "coinbase-walet.biz": "2026-01-02",
      "coinbase-walet.me": "2026-01-02",
      "coinbase.abilityscan360.com": "2026-01-02",
      "coinbase.expublic.linkpc.net": "2023-05-10",
      "coinbase.motionassess.com": "2026-01-02",
      "coinbase.onchainhiringtool.com": "2026-01-02",
      "coinbase.professionalsnapshot.com": "2026-01-02",
      "coinbase.talentelevate360.com": "2026-01-02",
      "coinbase.talenthiringtool.com": "2026-01-02",
      "coinbase.talentmonitoringtool.com": "2026-01-02",
      "coinbase.talentscreeningtool.com": "2026-01-02",
      "coinbigex.com": "2021-03-26",
      "coinblase.com": "2024-09-17",
      "coinbrase.com": "2024-09-17",
      "coingecko.bond": "2023-10-20",
      "coingotrade.com": "2020-06-03",
      "coinhar.io": "2026-01-02",
      "coinhouse360.com": "2026-01-02",
      "coinibrase.com": "2024-09-18",
      "coininbase.com": "2024-09-18",
      "coinlenddefi.com": "2026-01-02",
      "coinlendefi.com": "2026-01-02",
      "coinmaketcape.com": "2018-09-13",
      "coinme.hiring-one.com": "2026-02-09",
      "coinoen.org": "2018-09-13",
      "coinpricehub.io": "2026-01-02",
      "col-link.linkpc.net": "2023-10-27",
      "comma3.biz-meeting.site": "2024-11-14",
      "comma3.videotalks.online": "2024-11-15",
      "commoncome.online": "2024-01-04",
      "commoncome.site": "2024-01-04",
      "communicationhub.us": "2026-01-02",
      "companydetail.online": "2023-12-05",
      "compassidea.org": "2026-01-02",
      "competency-core.com": "2026-01-02",
      "complexassess.com": "2025-01-07",
      "complexassessment.com": "2025-01-10",
      "concrecapital.com": "2022-08-17",
      "conf-2025-fcwpato0v.vercel.sh": "2026-02-20",
      "conference-go.online": "2024-11-25",
      "conferenceauth.coffeebrain.co": "2026-01-02",
      "connectptogether.ink": "2026-06-09",
      "consensys.willoassessment.com": "2024-12-28",
      "consulturbo.com": "2026-01-02",
      "consulturbo.pages.dev": "2026-01-02",
      "contactpredicttogether.ink": "2026-06-09",
      "contactpulsynk.ink": "2026-06-09",
      "contacttrixauvex.ink": "2026-06-09",
      "contentverge.com": "2024-12-10",
      "continue-meeting.site": "2024-02-07",
      "contract.waventic.com": "2026-01-02",
      "contradecapital.com": "2022-09-30",
      "control-plane-default-ehybkouwd.vercel.sh": "2026-02-20",
      "controller.rightwidth.dev": "2026-07-18",
      "coop-shop-next-jld7wvrxk-co-op-food-customer-experience.vercel.app": "2026-02-20",
      "coop-shop-next-philwolstenholme-co-op-food-customer-experience.vercel.app": "2026-02-20",
      "cooporatestock.com": "2022-08-19",
      "copia.vin": "2026-02-14",
      "copilot-ai.whisdev.org": "2026-05-01",
      "copper-fv73l6e9m.vercel.sh": "2026-02-20",
      "corebiz.fun": "2026-01-02",
      "corecheckmailsrv.com": "2020-12-30",
      "coredeal2.vercel.app": "2026-02-25",
      "coreladao.com": "2026-01-02",
      "coreviewer.vercel.app": "2026-01-23",
      "corjus.top": "2026-03-16",
      "coslyintra.online": "2026-06-09",
      "cosmoplanets.net": "2026-02-25",
      "coto.live": "2023-05-10",
      "cotrixauvex.ink": "2026-06-09",
      "coupang-marketing.rest": "2024-07-24",
      "coupang-network.pics": "2023-09-30",
      "coupang-networks.pics": "2023-11-01",
      "coupang-sales.rest": "2024-07-24",
      "coz.dropfile.online": "2024-10-09",
      "cpanel.wtalents.us": "2024-12-29",
      "cpromoter.com": "2026-01-02",
      "cr-zoom.us": "2026-01-02",
      "crabbedly.club": "2019-10-22",
      "craptioerne.com": "2022-01-01",
      "crawl-analysis-git-main.vercel.sh": "2026-02-20",
      "crawled-sitemap-git-main.vercel.sh": "2026-02-20",
      "craypot.live": "2019-10-22",
      "cro.dropfile.online": "2024-10-09",
      "crosstheages.eskillence.com": "2026-01-02",
      "crosstheages.hirehatch360.com": "2026-01-02",
      "crosstheages.hirelytics360.com": "2026-01-02",
      "crosstheages.skillence360.com": "2026-01-02",
      "crosstheages.talentelevate360.com": "2026-01-02",
      "crostox.com": "2026-01-02",
      "crownx-academy.com": "2026-03-16",
      "crtypk.run.place": "2023-10-17",
      "cryptais.com": "2022-04-19",
      "crypto-assess.com": "2025-01-15",
      "crypto-assessment.com": "2024-12-28",
      "crypto-briefings.com": "2026-01-02",
      "crypto-ecosystem.world": "2023-08-09",
      "crypto.blockchainworld.info": "2023-08-09",
      "crypto.hondchain.com": "2023-07-03",
      "cryptocopedia.com": "2024-12-29",
      "cryptofundsresearch.com": "2023-12-05",
      "cryptomn.vercel.app": "2026-01-02",
      "cryptopriceoffer.com": "2024-06-14",
      "cryptowave.capital": "2023-09-06",
      "cryptowave.internal-meeting.online": "2023-11-29",
      "cryptowave.video-meet.online": "2023-11-29",
      "cryptyk.cloud": "2023-05-10",
      "cryptyk.ddns.net": "2023-05-10",
      "cryptyk.hopto.org": "2023-05-10",
      "cryptyk.info": "2023-05-10",
      "cryptyk.sytes.net": "2023-05-10",
      "cryptyk.webredirect.org": "2023-05-10",
      "cryptykhost.work.gd": "2023-10-17",
      "ctmnews.kr": "2023-03-05",
      "ctrac.online": "2021-01-27",
      "culyrax.us": "2026-06-09",
      "curiofirenze.com": "2019-10-26",
      "curiosity-works-opschudding.vercel.app": "2026-02-20",
      "customizetions.com": "2026-01-02",
      "cv-8zz57gksb-simons-projects-486531f7.vercel.app": "2026-02-20",
      "cwwpxpxuswo7b6tr.onion": "2021-04-12",
      "cyberpanel78354.hostkey.in": "2026-04-24",
      "cyptian.com": "2020-01-08",
      "cyptoconnections.com": "2026-01-02",
      "czinfo.club": "2019-10-23",
      "d.diragame.com": "2022-01-13",
      "d.watashinonegai.ru": "2022-01-01",
      "d1.skyboxdrive.cloud": "2023-11-29",
      "d12rlkj8v5mwse.cloudfront.net": "2024-12-29",
      "d1yzmjg018adwf.cloudfront.net": "2024-12-29",
      "d20zx0lguyxj2p.cloudfront.net": "2024-12-29",
      "d3o9p0hkd7eul5.cloudfront.net": "2024-12-29",
      "d4yp8bphj3.naveicoiph.online": "2022-04-11",
      "dabacof.com": "2026-01-02",
      "dafom.dev": "2022-04-19",
      "dag.dropfile.online": "2024-10-09",
      "dailynewsagent.com": "2023-01-26",
      "daiwa.azure-defender.cloud": "2023-05-10",
      "daiwa.ventures": "2023-03-09",
      "dal-shared-22.hostwindsdns.com": "2024-12-29",
      "dal-shared-25.hostwindsdns.com": "2024-12-29",
      "dal-shared-37.hostwindsdns.com": "2024-12-29",
      "dalbinews.co.kr": "2023-03-05",
      "daniel-ayala.netlify.app": "2024-09-24",
      "data-kappa.vercel.app": "2026-04-23",
      "database.retrots.net": "2022-01-01",
      "datacentre.center": "2022-02-08",
      "datasecure-service.vercel.app": "2026-06-11",
      "datasend.linkpc.net": "2023-09-25",
      "dataxo.net": "2026-02-09",
      "davhub88.vercel.app": "2026-04-23",
      "dawiteewnetu-uxgr-ig97x97wa-dawite-ewnetus-projects.vercel.app": "2026-02-20",
      "dawiteewnetu-uxgr-l5fvt75j7-dawite-ewnetus-projects.vercel.app": "2026-02-20",
      "day.dropfile.online": "2024-10-09",
      "dbgsymbol.com": "2023-09-07",
      "dc-aeea9bdbc87b.dropfile.online": "2024-10-09",
      "dc-ba6f51b553e0.olidhealth.com": "2022-11-11",
      "de.ztec.store": "2024-08-01",
      "deadfellaz.candidatescope.com": "2026-01-02",
      "decentralizeddataexchangeinferencelayer.com": "2026-03-11",
      "decentscrippts.com": "2025-01-23",
      "deck.linkpc.net": "2023-10-26",
      "deep-ai-guard.store": "2026-06-09",
      "deepdriverupdate.online": "2026-01-02",
      "deepmindschematic.com": "2026-01-02",
      "default-configuration-sandy.vercel.app": "2026-04-23",
      "default-configuration.vercel.app": "2026-04-03",
      "defi.smart-contracts.blog": "2023-05-10",
      "defianceanalytics.abilityscan360.com": "2026-01-02",
      "defianceanalytics.easyhiringtool.com": "2026-01-02",
      "defitankzone.com": "2024-05-28",
      "deltaemis.com": "2019-10-04",
      "demo.alwayswelcome.online": "2024-09-10",
      "demo.chrome-browser.cloud": "2024-10-09",
      "demo.docsend.site": "2024-10-09",
      "demo.docsend.store": "2024-10-09",
      "demo.drop-box.store": "2024-11-13",
      "demo.dropfile.online": "2024-10-09",
      "demo.luckyguys.site": "2026-04-22",
      "demo.techsaeein.com": "2026-01-02",
      "deng-labs-6ts0pz3vm.vercel.sh": "2026-02-20",
      "deoft.com": "2026-03-22",
      "derek-site-2026-6g03r9taz-derek-martins-projects.vercel.app": "2026-02-20",
      "desarrollolab.com": "2026-07-29",
      "designautocad.org": "2022-02-05",
      "detankwar.com": "2024-05-28",
      "detankzone.com": "2024-10-28",
      "dev.alwayswelcome.online": "2024-09-10",
      "dev.caesarx.trade": "2026-05-01",
      "dev.chrome-browser.cloud": "2024-10-09",
      "dev.copia.vin": "2026-02-14",
      "dev.docsend.site": "2024-10-09",
      "dev.docsend.store": "2024-10-09",
      "dev.dropfile.online": "2024-10-09",
      "dev.general-meet.site": "2024-09-10",
      "dev.jmttrading.org": "2019-10-15",
      "dev.meeting-zone.online": "2024-09-10",
      "dev.microcravate.com": "2019-03-26",
      "dev.sslsharecloud.net": "2021-05-27",
      "devchallengehq.com": "2026-01-02",
      "development-server.aduresi.com": "2026-01-02",
      "devguardmap.org": "2021-11-12",
      "devicefixer.online": "2026-01-02",
      "devicelinkintel.com": "2026-05-27",
      "devprocloud.com": "2021-07-10",
      "dezertir.com": "2026-06-09",
      "dg.novaplayer.online": "2026-06-19",
      "diamondhilllaw.com": "2026-01-02",
      "digiboxes.us": "2022-09-26",
      "digipairx.com": "2026-01-02",
      "digital-skill-assessment.com": "2026-07-20",
      "digitalcurencygroup.co": "2020-12-30",
      "digitalguarder.com": "2021-10-11",
      "digitaltalent.review": "2026-01-02",
      "digitaltalentassess.com": "2026-01-02",
      "digitpotalent.com": "2025-01-10",
      "digitptalent.com": "2025-01-13",
      "dip.dropfile.online": "2024-10-09",
      "diragame.com": "2021-04-11",
      "diregame.live": "2022-03-29",
      "disneycareers.net": "2022-03-24",
      "distscrippts.com": "2025-01-10",
      "dldoc.net": "2024-11-27",
      "dliklone.online": "2023-08-25",
      "dmarc.fsdriveshare.org": "2022-01-07",
      "dmarc.onlineshares.cloud": "2022-11-19",
      "doc-protection.cloud": "2023-01-04",
      "doc-send.cloud": "2023-05-10",
      "doc-send.com": "2023-05-10",
      "doc-send.online": "2023-12-05",
      "doc-share.cloud": "2023-02-08",
      "doc-shared.linkpc.net": "2023-11-02",
      "doc.cooporatestock.com": "2022-08-19",
      "doc.documentshare.info": "2022-08-09",
      "doc.filesaves.cloud": "2022-02-15",
      "doc.global-link.run.place": "2023-10-26",
      "doc.gsheetshare.org": "2021-03-04",
      "docs-git-fix-issue-330-driveclub.vercel.app": "2026-02-20",
      "docs-payload-dgwy6heek.vercel.sh": "2026-02-20",
      "docs-protection.cloud": "2023-10-11",
      "docs-protection.online": "2023-10-11",
      "docs-protection.top": "2023-10-11",
      "docs-send.com": "2023-05-10",
      "docs-send.online": "2023-08-09",
      "docs-view.cloud": "2023-01-04",
      "docs.azure-protection.cloud": "2022-09-23",
      "docs.cooporatestock.com": "2022-08-19",
      "docs.drivegoogle.info": "2022-08-20",
      "docs.dsharefile.tech": "2020-09-04",
      "docs.gdriveshare.top": "2021-03-12",
      "docs.gsheetpage.com": "2022-02-15",
      "docs.mktrending.com": "2022-08-05",
      "docs.panteracapital.ventures": "2023-08-09",
      "docs.smbc-vc.com": "2023-10-11",
      "docs.tptf.cloud": "2023-01-04",
      "docsend-host.cloud": "2023-08-09",
      "docsend.apple.linkpc.net": "2023-07-03",
      "docsend.apple.work.gd": "2023-07-03",
      "docsend.camdvr.org": "2023-07-03",
      "docsend.linkpc.net": "2023-07-03",
      "docsend.online": "2024-07-16",
      "docsend.publicvm.com": "2023-07-03",
      "docsend.site": "2024-07-16",
      "docsend.store": "2024-07-16",
      "docsend.theworkpc.com": "2023-07-03",
      "docsenddata.linkpc.net": "2023-09-25",
      "docsendinfo.linkpc.net": "2023-09-25",
      "docshared.col-link.linkpc.net": "2023-10-27",
      "document-content.online": "2026-01-02",
      "document.antcapital.us": "2021-03-23",
      "document.coto.live": "2023-05-10",
      "document.shared-link.line.pm": "2023-10-31",
      "document.sharedrive.ink": "2023-05-10",
      "documentprotect.live": "2021-03-21",
      "documentprotect.pro": "2021-03-21",
      "documentshare.info": "2022-08-09",
      "documentworkspace.io": "2022-07-20",
      "docuprivacy.com": "2022-09-28",
      "docusend.coto.live": "2023-05-10",
      "docusign.agency": "2022-01-27",
      "docview.ink": "2026-06-19",
      "domatisc.ink": "2026-06-09",
      "donmuzzi.site": "2026-01-02",
      "doodles.careerquestion.com": "2026-01-02",
      "doodles.carrervision.com": "2026-01-02",
      "doodles.hirequestion.com": "2026-01-02",
      "doodles.interviews360.com": "2026-01-02",
      "doodles.skillquestion.com": "2026-01-02",
      "doodles.skillquestions.com": "2026-01-02",
      "doodles.workquestion.com": "2026-01-02",
      "down.1230578.com": "2020-06-26",
      "down.mykings.pw": "2022-01-01",
      "down.privatework.buzz": "2020-12-30",
      "download.azure-drive.com": "2021-06-09",
      "download.factrina.com": "2026-02-10",
      "download.getevalor.com": "2026-02-10",
      "download.inspach.com": "2026-02-09",
      "download.kooverly.org": "2026-02-10",
      "download.prontoquiz.org": "2026-02-10",
      "downloadcenter.website": "2026-01-02",
      "doxxela.ink": "2026-06-09",
      "dpkgrepo.com": "2026-01-02",
      "dprk-it.pages.dev": "2026-01-02",
      "dps.shconstmarket.com": "2022-07-30",
      "dragonfly.cloudstore.business": "2024-11-14",
      "dragonfly.virtual-collab.online": "2024-08-21",
      "draper.online-meeting.xyz": "2023-08-09",
      "drive-access.site": "2024-02-07",
      "drive-release.cloud": "2025-01-17",
      "drive.chrome-browser.cloud": "2024-10-09",
      "drive.cloudplus.one": "2021-12-08",
      "drivegoogle.info": "2022-08-20",
      "drivercamhub.cloud": "2026-01-02",
      "drivercams.cloud": "2026-01-02",
      "drivercamsupport.com": "2026-01-02",
      "driverhubpro.net": "2026-06-15",
      "driverpool.online": "2026-01-02",
      "driverservices.store": "2026-01-02",
      "driversnap.cloud": "2026-01-02",
      "driversofthub.online": "2026-01-02",
      "driverstream.cloud": "2026-01-02",
      "drivertools.org": "2026-01-02",
      "drivetools.xyz": "2022-10-21",
      "drivfixer.online": "2026-01-02",
      "drivhost.store": "2026-01-02",
      "drop-box.cloud": "2023-05-10",
      "drop-box.info": "2024-11-13",
      "drop-box.store": "2024-11-13",
      "drop.skyboxdrive.cloud": "2023-11-29",
      "drop.trailads.net": "2021-03-12",
      "dropbox-docsend.cloud": "2023-08-09",
      "dropbox-docsend.online": "2023-08-09",
      "dropbx-doc.online": "2023-12-05",
      "dropfile.cloud": "2024-07-16",
      "dropfile.online": "2024-07-16",
      "drupdate.club": "2019-07-10",
      "drvfixer.online": "2026-01-02",
      "dsharefile.tech": "2021-03-12",
      "dshellelink.gcloud-share.com": "2021-03-03",
      "dsx-app.com": "2022-12-01",
      "dtdgwgfvr.naveicoiph.online": "2022-04-11",
      "dubai.network.cloud.doc-shared.linkpc.net": "2023-11-02",
      "dubbedfinally.link": "2022-01-01",
      "dun.audiocheck.store": "2023-11-29",
      "dun.auditprovidre.online": "2023-11-29",
      "dun.wndlwndmfe.xyz": "2024-11-13",
      "dunamu.jp-zoom.com": "2026-01-02",
      "dynamic.expublic.linkpc.net": "2023-05-10",
      "eager-shockley.144-172-108-248.plesk.page": "2026-06-09",
      "eastvalex-peak.com": "2026-03-16",
      "easydriver.cloud": "2026-01-02",
      "easyhiringtool.com": "2026-01-02",
      "easyinterview360.com": "2025-01-14",
      "easyvps.net": "2026-01-02",
      "easywalletconnect.com": "2026-01-02",
      "eboardcareer.com": "2026-01-02",
      "eboardcareer.pages.dev": "2026-01-02",
      "ecareerflare.com": "2026-02-10",
      "ecareerflare.pages.dev": "2026-02-10",
      "ecareerscan.com": "2026-01-02",
      "echelonfnd.io": "2026-01-02",
      "eclairdomain.com": "2026-01-02",
      "ecombox.store": "2019-03-18",
      "ecordillos.com": "2023-09-07",
      "ecosystem.openfort.video": "2026-01-02",
      "edfeiyql.naveicoipg.online": "2022-04-05",
      "edge-runtime-git-main.vercel.sh": "2026-02-20",
      "edit.onlinedocview.biz": "2022-03-29",
      "edit.wpsonline.co": "2022-08-31",
      "editorsettings.vercel.app": "2026-01-23",
      "edividy.pro": "2026-01-02",
      "eduflex-eu.org": "2026-06-19",
      "effectiveengineeringleader.com": "2026-01-02",
      "ehireflex.com": "2026-01-02",
      "ehireflix.com": "2026-01-02",
      "ehiremeasure.com": "2026-02-09",
      "einei.line.pm": "2023-12-01",
      "electoralvictory.site": "2026-01-02",
      "element-3.bestleas.ru": "2026-04-24",
      "elemize.us": "2026-02-09",
      "eli.dropfile.online": "2024-10-09",
      "elitedrivva-app.dabacof.com": "2026-01-02",
      "elitehireaxis360.com": "2026-01-02",
      "eliteshire.com": "2026-01-02",
      "elitetalent360.com": "2026-01-02",
      "elitewholetalent.com": "2025-02-05",
      "elm.dropfile.online": "2024-10-09",
      "elsavora.us": "2026-06-09",
      "elwoodasset.xyz": "2021-07-10",
      "email.alwayswait.online": "2023-11-29",
      "email.dropfile.online": "2024-10-09",
      "email.instant-patch.online": "2024-05-08",
      "emeetings.zoominvites.com": "2026-01-02",
      "employ-check.com": "2026-07-21",
      "empowerpharmacy.space": "2026-06-09",
      "emv1.alwayswelcome.online": "2024-09-10",
      "emv1.chrome-browser.cloud": "2024-10-09",
      "emv1.dropfile.cloud": "2024-10-09",
      "emv1.dropfile.online": "2024-10-09",
      "emv1.general-meeting.team": "2024-05-08",
      "emv1.group-meet.online": "2024-09-10",
      "emv1.group-meet.site": "2024-09-10",
      "emv1.group-meeting.pro": "2024-05-08",
      "emv1.group-meeting.team": "2023-12-12",
      "emv1.meetingverse.app": "2023-11-29",
      "emv1.preconnection.online": "2024-05-08",
      "emv1.private-meet.online": "2024-05-08",
      "emv1.team-meet.xyz": "2023-12-12",
      "emv1.ubi-safemeeting.live": "2023-11-29",
      "emv1.videotalks.online": "2024-11-15",
      "en-zoom.us": "2026-01-02",
      "en.stocksindex.org": "2026-01-02",
      "en.stocksitem.org": "2026-01-02",
      "en.stockslab.org": "2026-01-02",
      "en.wfinance.org": "2026-01-02",
      "encorpost.com": "2022-03-16",
      "endesway.life": "2026-01-02",
      "energydonate.com": "2026-02-17",
      "enimvzud.mouradvps8hostwin.online": "2023-10-17",
      "enrollcrux.com": "2026-01-02",
      "entergenix.com": "2026-02-09",
      "eoinbase.com": "2024-09-18",
      "eoinlslsf.naveicoipg.online": "2022-04-05",
      "eon.dropfile.online": "2024-10-09",
      "eosszzc.hateoo.space": "2024-11-13",
      "equisphire.com": "2026-02-10",
      "equisphirep.com": "2026-01-02",
      "er-zoom.us": "2026-01-02",
      "esilet.com": "2022-04-19",
      "eskillence.com": "2026-01-02",
      "eskillfolio.com": "2026-01-02",
      "eskillforge.com": "2026-01-02",
      "eskillion.com": "2026-02-09",
      "eskillmetric.com": "2026-01-02",
      "eskillora.com": "2026-01-02",
      "eskillpilot.com": "2026-01-02",
      "eskillprof.com": "2026-01-02",
      "eskillprov.com": "2026-01-02",
      "essendantdock.online": "2024-11-26",
      "ethereum.blastapi.org": "2026-01-02",
      "ethzone.io": "2026-01-02",
      "etoffcoinbase.com": "2024-12-10",
      "etoro.careerquestion.com": "2026-01-02",
      "evalassesso.com": "2026-01-02",
      "evalcrew.com": "2026-02-09",
      "evalium-expertise1.pages.dev": "2026-02-10",
      "evalium-expertise360.com": "2026-02-10",
      "evalium-expertises.us": "2026-02-10",
      "evaliuminsights.com": "2026-02-16",
      "evalixhub.com": "2026-01-02",
      "evalonboard.com": "2026-01-02",
      "evalsuit.com": "2026-02-09",
      "evalswift.com": "2026-01-02",
      "evaluateiq.com": "2026-01-02",
      "evaluateproficiency.com": "2026-02-09",
      "evaluino.com": "2026-01-02",
      "evaluza.com": "2026-01-02",
      "evalvideo.com": "2026-01-02",
      "evalvidz.com": "2026-01-02",
      "everydaynodechecker-39143n.vercel.app": "2026-07-22",
      "ewha-ac.ml": "2021-05-30",
      "examples-basic-web.vercel.sh": "2026-02-20",
      "exbonus.mrbasic.com": "2017-04-12",
      "exceptions.coinbase.expublic.linkpc.net": "2023-05-10",
      "exceptions.expublic.linkpc.net": "2023-05-10",
      "exchange.dropfile.online": "2024-10-09",
      "exodus.linkpc.net": "2023-09-30",
      "expert-mode-1c2u0v83b-chainlinklabs.vercel.app": "2026-02-20",
      "expert-mode-1ruzfeq6x-chainlinklabs.vercel.app": "2026-02-20",
      "expert-mode-iebahb8mh-chainlinklabs.vercel.app": "2026-02-20",
      "expert-mode-ifa37strm-chainlinklabs.vercel.app": "2026-02-20",
      "expert-mode-ilj8udtti-chainlinklabs.vercel.app": "2026-02-20",
      "expert-mode-j12s18yqd-chainlinklabs.vercel.app": "2026-02-20",
      "expert-mode-kpwcznf9q-chainlinklabs.vercel.app": "2026-02-20",
      "expert-mode-n0lcsjlju-chainlinklabs.vercel.app": "2026-02-20",
      "expert-mode-omc4wsgd7-chainlinklabs.vercel.app": "2026-02-20",
      "expert-mode-otcucejsn-chainlinklabs.vercel.app": "2026-02-20",
      "expert-mode-retiqr6xk-chainlinklabs.vercel.app": "2026-02-20",
      "expert-mode-rr4zcmoka-chainlinklabs.vercel.app": "2026-02-20",
      "expertssavingai.com": "2026-01-02",
      "express--vpn.com": "2025-02-11",
      "expublic.linkpc.net": "2023-05-10",
      "ext-checkedin.vercel.app": "2026-04-23",
      "ext.luckyguys.cloud": "2026-04-30",
      "extrazoom.us": "2026-01-02",
      "facial.anomgaming.online": "2026-01-02",
      "factrina.com": "2026-02-10",
      "falcancoin.io": "2019-10-05",
      "fashdefi.store": "2026-01-02",
      "fast-video-recording.com": "2026-01-02",
      "fasttet.com": "2024-01-25",
      "fastwise.org": "2026-02-10",
      "faulttolerantdigitalengine.com": "2026-04-28",
      "fax-cover.com": "2026-06-09",
      "fclouddown.co": "2022-07-20",
      "febintllc.com": "2026-01-02",
      "felixpools.vercel.app": "2026-04-03",
      "fenbushi.general-meeting.team": "2024-05-08",
      "fenbushi.private-meet.online": "2024-04-30",
      "fenbushi.private-meet.team": "2024-05-08",
      "fenbushi.regular-meeting.team": "2024-05-07",
      "fetchtalent360.com": "2026-01-02",
      "fhewkhwjehwekjfhwehfwe.com": "2022-01-01",
      "fidelitydigitalsassets.com": "2020-12-30",
      "figuermarkets.com": "2026-07-06",
      "file-secure-sharing.com": "2026-02-09",
      "file.cestlaviewellnessretreat.com": "2024-08-05",
      "file.fclouddown.co": "2022-07-20",
      "file.fsdriveshare.org": "2022-01-07",
      "file.luckyguys.cloud": "2026-04-30",
      "file.rightwidth.dev": "2026-07-18",
      "filehost.network": "2021-03-12",
      "filehosting.store": "2026-02-09",
      "files-archive.online": "2023-10-13",
      "files.cestlaviewellnessretreat.com": "2024-08-05",
      "files.hirog.io": "2024-07-20",
      "filesaves.cloud": "2022-01-01",
      "filesspace.xyz": "2023-01-17",
      "final.hiringtalent.pro": "2024-12-28",
      "financecap.io": "2026-01-02",
      "financialtimes365.com": "2022-03-24",
      "find-dreamjob.com": "2022-03-24",
      "findhelptalent360.com": "2026-01-02",
      "finnt.evalonboard.com": "2026-01-02",
      "finorabsns.com": "2026-03-16",
      "finovec.co.ke": "2026-01-02",
      "fireblocks-assessment.com": "2026-01-02",
      "fireblocks.vip": "2022-03-24",
      "fireblockshireflow.com": "2026-01-02",
      "fireblockshiring.com": "2026-01-02",
      "fireblocksinsight.com": "2026-01-02",
      "firexch.com": "2026-01-02",
      "fitnessdirector.net": "2020-06-07",
      "fivebit.io": "2026-01-02",
      "fivefingerz.dev": "2026-05-01",
      "fix-driver.online": "2026-01-02",
      "fix-drivers.online": "2026-01-02",
      "fix.measureaptitudes.com": "2026-02-17",
      "fix.soft-dev.online": "2026-01-02",
      "fixdiskpro.online": "2026-01-02",
      "flag-git-main.vercel.sh": "2026-02-20",
      "floriventures.linkpc.net": "2023-07-03",
      "floriventures.publicvm.com": "2023-07-03",
      "floriventuresend.linkpc.net": "2023-10-17",
      "floriventuresfund.com": "2023-07-03",
      "flow.dropfile.online": "2024-10-09",
      "fmi-link.info": "2024-11-27",
      "fmose.com": "2020-06-23",
      "fob.dropfile.online": "2024-10-09",
      "focuscamere.com": "2020-07-09",
      "fog.dropfile.online": "2024-10-09",
      "forest.groundwolf.sbs": "2023-07-03",
      "forservercon.run.place": "2023-10-17",
      "foundationcap.regular-meet.team": "2024-09-10",
      "foxiebed.com": "2022-03-21",
      "framework.careerboard.video": "2026-01-02",
      "frameworkvc.icareerc.com": "2026-01-02",
      "frameworkvc.ixcareers.com": "2026-01-02",
      "frameworkvc.ixscreen.com": "2026-01-02",
      "france24.live": "2023-11-28",
      "free-loader.org": "2026-01-02",
      "freeconference.io": "2024-09-06",
      "freenet-zhilly.org": "2024-05-28",
      "front-bzi.pages.dev": "2026-02-12",
      "frontend-5e7.pages.dev": "2026-02-10",
      "frontend-dev-bnp.pages.dev": "2026-01-02",
      "frontend-eu1.pages.dev": "2026-01-02",
      "frontend-staging-egw.pages.dev": "2026-01-02",
      "frontend-us1.pages.dev": "2026-01-02",
      "fronterixbusiness.com": "2026-01-02",
      "fs.digiboxes.us": "2022-09-26",
      "fsdriveshare.org": "2022-01-01",
      "ftp.anchoragehireflow.com": "2026-01-02",
      "ftp.ccuk.edu.ng": "2026-02-10",
      "ftp.dataxo.net": "2026-02-09",
      "ftp.dropfile.online": "2024-10-09",
      "ftp.kaltura.studio": "2026-02-09",
      "ftp.skillview360.com": "2026-01-02",
      "ftp.talentevaluate.com": "2026-01-02",
      "ftp.teams-meets.com": "2026-06-19",
      "ftutech.store": "2026-01-02",
      "ftxstock.com": "2026-01-02",
      "fudcitydelivers.com": "2020-06-02",
      "fundcandidates.com": "2024-12-28",
      "funnyboy0719.fun": "2026-01-02",
      "fusionlayer-app463.vercel.app": "2026-02-28",
      "fusionlayer-ext807.vercel.app": "2026-02-28",
      "fw.docsend.online": "2024-10-09",
      "fwpoyktt.naveicoipg.online": "2022-04-05",
      "gamesmasterbb.com": "2026-01-02",
      "gappeo.us": "2026-02-09",
      "gatexpiring.com": "2022-03-24",
      "gatuga-api.cpromoter.com": "2026-01-02",
      "gbclabs.com": "2022-03-24",
      "gbflatinamerica.com": "2021-04-27",
      "gbmaudiologininstructions.esdinfra.com": "2026-01-02",
      "gcloud-share.com": "2021-03-03",
      "gcp.webzoom.video": "2026-01-02",
      "gdoc.wordonline.cloud": "2022-08-09",
      "gdocshare.com": "2020-12-16",
      "gdocshare.one": "2022-11-19",
      "gdriveupload.info": "2020-02-21",
      "gdrvup.xyz": "2020-02-07",
      "geist-docs-n03iy9wgb.vercel.sh": "2026-02-20",
      "geist-storybook-kbjruqxe3.vercel.sh": "2026-02-20",
      "geist-storybook-nyf9kazrs.vercel.sh": "2026-02-20",
      "gemini.crypto-assessment.com": "2024-12-28",
      "gemini.willoassess.com": "2024-12-28",
      "gemini.willohiring.com": "2024-12-28",
      "gemini.willohiringtalent.org": "2024-12-29",
      "geminiskill.willoassessment.com": "2024-12-28",
      "gen.dropfile.online": "2024-10-09",
      "gendoraduragonkgp126.com": "2022-09-07",
      "general-meet.online": "2024-07-16",
      "general-meet.site": "2024-07-16",
      "general-meet.team": "2024-07-16",
      "general-meeting.team": "2024-05-08",
      "geocollab.wegrowup.us": "2026-01-02",
      "georgeservice77.vercel.app": "2026-04-03",
      "getapilatency.onrender.com": "2026-02-20",
      "getcoinprice.info": "2026-01-02",
      "getdonald.xyz": "2026-01-02",
      "getevalor.com": "2026-02-10",
      "gethirednow.org": "2025-01-15",
      "gethiring360.com": "2026-01-02",
      "getpngdata.vercel.app": "2026-02-20",
      "getstockprice.com": "2026-01-02",
      "getstockprice.info": "2026-01-02",
      "gfinanzen.net": "2022-01-25",
      "gglab-poker.netlify.app": "2026-05-26",
      "ghostraper.top": "2026-05-01",
      "giantblock.org": "2022-03-24",
      "git-hub.me": "2023-07-19",
      "git.luckyguys.cloud": "2026-04-30",
      "git.luckyguys.site": "2026-04-22",
      "gitcheck-commit.vercel.app": "2026-05-21",
      "githelper.store": "2026-06-24",
      "githero-dev7uf163-gimenetes-projects.vercel.app": "2026-02-20",
      "github.expublic.linkpc.net": "2023-05-10",
      "gkins2p3i.naveicoiph.online": "2022-04-11",
      "gladneyocivpsdedinvme4.com": "2026-01-02",
      "glitchmedic.com": "2026-01-02",
      "global-job.org": "2024-11-21",
      "global-link.run.place": "2023-10-26",
      "globalelitehire.com": "2026-01-02",
      "globalskillconnect360.com": "2026-01-02",
      "globiscapital.co": "2023-01-25",
      "globiscapitals.com": "2026-01-02",
      "gmaildrive.site": "2020-02-07",
      "gnxcepro.com": "2024-12-10",
      "go.oncehub.co": "2026-01-02",
      "goglestorage.com": "2020-12-30",
      "goingladies.com": "2026-01-02",
      "goldllama4.sakura.ne.jp": "2021-04-27",
      "good.commoncome.site": "2024-01-04",
      "google-clouds.com": "2020-12-18",
      "google.coinbase.expublic.linkpc.net": "2023-05-10",
      "google.diragame.com": "2022-01-13",
      "googleauth.pro": "2020-02-07",
      "googledocpage.com": "2021-05-11",
      "googledriver.info": "2020-02-07",
      "googleproduct.org": "2020-12-30",
      "googlesheet.info": "2022-07-22",
      "googlesheetpage.org": "2022-01-01",
      "googleupload.info": "2020-02-07",
      "googlezauthtoken.vercel.app": "2026-02-20",
      "gorodmechty.ddns.net": "2026-06-19",
      "gossipsnare.com": "2026-01-02",
      "gowelknx.naveicoipf.online": "2022-04-06",
      "gp-core.com": "2019-10-08",
      "gp-main.com": "2019-10-08",
      "grace-ayodele.workers.dev": "2026-03-02",
      "grainituae.com": "2026-01-02",
      "greendottb.com": "2026-01-02",
      "greendtb.com": "2026-01-02",
      "greenhouselc.com": "2024-07-20",
      "greennovadigital.com": "2026-01-02",
      "greenroad.top": "2024-11-27",
      "greenservice.tech": "2026-01-02",
      "greenways.shop": "2024-11-27",
      "groundwolf.sbs": "2023-07-03",
      "group-meet.online": "2024-07-16",
      "group-meet.site": "2024-07-16",
      "group-meet.team": "2024-07-16",
      "group-meeting.online": "2023-11-24",
      "group-meeting.pro": "2024-05-08",
      "group-meeting.team": "2023-11-24",
      "group.evalaskatours.com": "2023-11-02",
      "group.link-net.publicvm.com": "2023-10-26",
      "group.superstatefund.co": "2026-01-02",
      "growzy.tech": "2026-01-02",
      "gsheetpage.com": "2022-02-15",
      "gsheetshare.org": "2021-03-04",
      "gsoftcompany.com": "2026-01-02",
      "gsuiteshare.com": "2020-12-30",
      "guildsmartchainpulse.com": "2026-05-27",
      "gumi-cryptos.group-meeting.online": "2023-11-29",
      "gumi-cryptos.group-meeting.team": "2023-11-29",
      "gumi-cryptos.loan": "2023-05-10",
      "gumi-cryptos.team-meet.online": "2023-11-29",
      "gumi-cryptos.team-meeting.xyz": "2023-11-29",
      "gumi-cryptos.video-meet.team": "2023-11-29",
      "gumicryptos.com": "2023-05-10",
      "gumlet.us": "2026-02-09",
      "gurucooldown.short.gy": "2026-04-23",
      "gwmspacegpt.com": "2024-12-10",
      "h34fdfbm.store": "2024-11-26",
      "hack-vc.video-meets.site": "2024-11-05",
      "hack-vc.video-meets.xyz": "2024-11-05",
      "hahaios.com": "2026-06-09",
      "haifeizhang.com": "2024-12-10",
      "hanagroup.live": "2026-01-02",
      "hanagroup.video": "2024-11-11",
      "happy.nanoace.co.kr": "2022-04-18",
      "happychickenmrs.com": "2026-02-14",
      "hare.1drvmicrosoft.com": "2022-08-17",
      "harqen.us": "2026-02-09",
      "hartmanmcapital.com": "2026-01-02",
      "hashkey.group-meeting.online": "2023-11-29",
      "hashkey.group-meeting.team": "2023-11-29",
      "hashkey.internal-meeting.online": "2023-11-29",
      "hashkey.online-meet.team": "2024-05-08",
      "hashkey.online-meet.xyz": "2024-05-08",
      "hashkey.online-meeting.team": "2023-11-29",
      "hashkey.online-meeting.xyz": "2023-09-07",
      "hashkey.team-meet.online": "2023-11-29",
      "hashkey.team-meeting.pro": "2023-12-04",
      "hashkey.team-meeting.xyz": "2023-11-29",
      "hashkey.video-meet.online": "2023-11-29",
      "hashkey.video-meet.team": "2023-11-29",
      "hashkey.video-meeting.team": "2023-11-29",
      "hateoo.space": "2024-11-13",
      "help-optus.com": "2022-01-01",
      "help.group-meeting.online": "2023-11-29",
      "help.mappo-on.life": "2021-04-30",
      "help.navreplya.live": "2022-04-11",
      "help.octo-manage.net": "2021-04-30",
      "help.team-meet.online": "2023-11-29",
      "help.video-meet.team": "2023-11-29",
      "help.video-meeting.team": "2023-11-29",
      "helpdeskassistance.org": "2025-01-10",
      "hentaikawaiiuwu.com": "2026-02-25",
      "heritage-netwk.com": "2026-03-16",
      "heritagetbk.com": "2026-01-02",
      "highmatch.cloud": "2026-03-12",
      "highmatch.pro": "2026-03-08",
      "hillokay.com": "2022-03-17",
      "hirebest.cv": "2026-01-02",
      "hirefeedbacker.com": "2026-01-02",
      "hirefiix.pro": "2026-01-02",
      "hireflix.pro": "2026-01-02",
      "hireflix360.com": "2026-01-02",
      "hirehatch360.com": "2026-01-02",
      "hirelytics360.com": "2026-01-02",
      "hiremodozone.com": "2026-01-02",
      "hiremployee.com": "2026-01-02",
      "hireone.top": "2026-01-02",
      "hireproflix.online": "2026-01-02",
      "hireqora.com": "2026-01-02",
      "hirequestion.com": "2026-01-02",
      "hireskillhub.com": "2026-01-02",
      "hiresyncer.us": "2026-01-02",
      "hiretestzone.com": "2026-01-02",
      "hireviavideo.com": "2026-01-02",
      "hirevision360.com": "2026-01-02",
      "hiring-intellipro.com": "2026-07-07",
      "hiring-interview.com": "2025-01-10",
      "hiring-one.com": "2026-02-09",
      "hiring-you.com": "2026-02-09",
      "hiring.crostox.com": "2026-01-02",
      "hiring.waventic.com": "2026-01-02",
      "hiring.willoassessment.com": "2024-12-28",
      "hiringinterview.org": "2024-12-28",
      "hiringinterview360.com": "2026-01-02",
      "hiringtalent.pro": "2024-12-28",
      "hiringtestpro.com": "2026-01-02",
      "hirog.io": "2024-07-20",
      "hirvexo.com": "2026-02-17",
      "hk05web.us": "2026-01-02",
      "hohoho.rightwidth.dev": "2026-07-18",
      "holi.intervu-talent.pro": "2026-01-02",
      "hollow-jordan-narrow.on-fleek.app": "2026-01-02",
      "home-continue.online": "2024-02-07",
      "home-proceed.online": "2024-02-07",
      "homemaxair.pro": "2026-03-16",
      "hondchain.com": "2023-07-03",
      "honehsn.com": "2024-07-31",
      "hopanatech.com": "2024-11-21",
      "hopehobo.com": "2026-02-25",
      "hostings.webredirect.org": "2023-05-10",
      "hotstreamx.stream": "2026-01-02",
      "http-qjhndbrw.roomconnect.online": "2024-07-15",
      "https-qjhndbrw.roomconnect.online": "2024-07-15",
      "huanying.remoteproweb.cfd": "2023-10-05",
      "huguotechltd.com": "2024-11-21",
      "huhuhu.rightwidth.dev": "2026-07-18",
      "human-check.com": "2026-02-24",
      "humingbot.io": "2022-03-24",
      "huweisge.dliklone.online": "2023-08-25",
      "hvdaconversions.com": "2026-06-09",
      "hwsrv-1033810.hostwindsdns.com": "2023-05-10",
      "hwsrv-1091010.hostwindsdns.com": "2025-02-16",
      "hwsrv-1093408.hostwindsdns.com": "2023-11-29",
      "hwsrv-1275416.hostwindsdns.com": "2026-01-02",
      "hyperchaincapital.online": "2023-05-10",
      "hyperdevpipline.org": "2026-06-09",
      "hyphen-connect.com": "2024-12-29",
      "hysf6-baaaa-aaaag-algfa-cai.icp0.io": "2026-01-02",
      "hytrycnc.naveicoipg.online": "2022-04-06",
      "iao.dropfile.online": "2024-10-09",
      "iba.dropfile.online": "2024-10-09",
      "icareerc.com": "2026-01-02",
      "ice.dropfile.online": "2024-10-09",
      "ich.dropfile.online": "2024-10-09",
      "icimp.swarkul.com": "2023-10-18",
      "id37093.com": "2026-06-09",
      "ido-epargne.com": "2026-01-02",
      "ignite.bizmeeting.org": "2026-01-02",
      "ignite.bizmeeting.video": "2026-01-02",
      "ignite.onlinemeet.pro": "2026-01-02",
      "ihsgpnsj.meetingverse.app": "2023-11-29",
      "illycafe.my": "2026-02-24",
      "illycoffee.my": "2026-02-24",
      "imap.dropfile.online": "2024-10-09",
      "imap1.dropfile.online": "2024-10-09",
      "imoda.site": "2025-01-06",
      "indaddy.xyz": "2023-10-31",
      "indagator.club": "2019-10-22",
      "indeedus.org": "2022-03-24",
      "inditechlab.com": "2024-11-21",
      "indobit.io": "2026-01-02",
      "industryinfostructure.com": "2022-02-08",
      "info-job.org": "2026-02-10",
      "info.floriventuresfund.com": "2023-07-03",
      "info.racondog.shop": "2023-07-03",
      "infuy.us": "2026-01-02",
      "innerteams.us": "2026-01-02",
      "innoenergy.info": "2021-03-26",
      "innovateinc.fun": "2026-01-02",
      "insighboard.com": "2026-02-09",
      "insight-hire.com": "2026-01-02",
      "insight-interview.com": "2025-02-14",
      "insighthire360.com": "2026-01-02",
      "insightquestion.com": "2025-02-09",
      "insights.online-meets.pro": "2024-11-25",
      "insomnianwin.site": "2026-01-02",
      "inspach.com": "2026-02-09",
      "inst.fetchtalent360.com": "2026-01-02",
      "inst.shconstmarket.com": "2022-07-30",
      "instant-patch.online": "2024-05-08",
      "instant-preview-site-9w675nmgg.vercel.sh": "2026-02-20",
      "intelcloudinsights.com": "2026-05-27",
      "inter.quickskill-review.com": "2026-01-02",
      "inter.vid-crypto-assess.com": "2026-01-02",
      "internal-engineering-documentation-site-mrj1hhs06.vercel.sh": "2026-02-20",
      "internal-meet.online": "2024-07-16",
      "internal-meet.team": "2024-07-16",
      "internal-meet.xyz": "2024-07-16",
      "internal-meeting.cyou": "2024-11-25",
      "internal-meeting.online": "2023-09-06",
      "internal-meeting.site": "2024-11-13",
      "internal-server.nextera.capital": "2023-05-10",
      "internal.bounceme.net": "2023-11-02",
      "internal.daiwa.ventures": "2023-05-10",
      "internal.group.link-net.publicvm.com": "2023-10-26",
      "internal.usncet.org": "2023-05-10",
      "internalpdfviewer.ddns.net": "2023-10-31",
      "interview-talent.com": "2025-01-10",
      "interview.private-meeting.online": "2023-08-09",
      "interviewhub.org": "2025-01-10",
      "interviewnest.org": "2024-12-28",
      "interviews360.com": "2026-01-02",
      "interviewskillmaster.com": "2026-01-02",
      "intervu-talent.pro": "2025-01-07",
      "intervwolf.com": "2026-01-02",
      "interzoom.us": "2026-01-02",
      "intneral-document-he-gr-me.run.place": "2023-10-26",
      "intro-crypto-assess.com": "2025-01-07",
      "intro.quickskill-review.com": "2026-01-02",
      "intro.vid-crypto-assess.com": "2026-01-02",
      "introon.com": "2026-01-02",
      "investbooking.de": "2021-01-26",
      "invesuccess.com": "2020-01-08",
      "invoicez.xyz": "2024-11-05",
      "ip-api-check-nine.vercel.app": "2026-06-23",
      "ip-api-server.vercel.app": "2026-01-02",
      "ip-api-test.vercel.app": "2026-02-20",
      "ip-check-api.vercel.app": "2026-01-02",
      "ip-check-notification-03.vercel.app": "2026-02-25",
      "ip-check-notification-firebase.vercel.app": "2026-02-25",
      "ip-check-notification-firebase03.vercel.app": "2026-02-25",
      "ip-check-notification-rkb.vercel.app": "2026-02-25",
      "ip-check-server.vercel.app": "2026-01-02",
      "ip-check-wh.vercel.app": "2026-02-25",
      "ip-checking-notification-firebase111.vercel.app": "2026-02-25",
      "ip-checking-notification-kgm.vercel.app": "2026-02-25",
      "ipcheck.cloud": "2024-08-30",
      "ipfs-url-validator.vercel.app": "2026-05-01",
      "iploglab.store": "2026-07-28",
      "ipservice.kro.kr": "2023-09-03",
      "ipv6.srv755058.hstgr.cloud": "2026-01-02",
      "ismartrium.com": "2023-09-07",
      "isvalid-region.vercel.app": "2026-01-23",
      "isvalid-regions.vercel.app": "2026-01-23",
      "it.zvc.capital": "2022-04-19",
      "itaddnet.com": "2018-09-13",
      "ixcareer-video.pages.dev": "2026-01-02",
      "ixcareer.com": "2026-01-02",
      "ixcareer.video": "2026-01-02",
      "ixcareers.com": "2026-01-02",
      "ixscreen.com": "2026-01-02",
      "j-ic.co.intneral-document-he-gr-me.run.place": "2023-10-26",
      "j-rl.com": "2026-01-02",
      "jaicvc.com": "2023-07-03",
      "jamesbillion.com": "2026-02-21",
      "jameslack.vercel.app": "2026-04-03",
      "jbic.us": "2022-09-16",
      "jbmnqpwp.naveicoipg.online": "2022-04-05",
      "jdkgradle.com": "2024-03-02",
      "jenn.shop": "2026-02-25",
      "jerryfox-platform.vercel.app": "2026-01-23",
      "jk.theworldofluck.site": "2026-06-19",
      "jmttrading.org": "2020-01-08",
      "job-career-portal.com": "2026-01-02",
      "job-description.online": "2023-05-10",
      "jobdescription.linkpc.net": "2023-09-30",
      "jobdescription.online": "2023-05-10",
      "jobecam.org": "2026-02-10",
      "jobecam.us": "2026-02-10",
      "jobinterview360.com": "2025-01-15",
      "jobinterviewguide.org": "2025-01-10",
      "jobinterviews360.com": "2026-01-02",
      "jobintro.linkpc.net": "2023-10-17",
      "joblitic.com": "2026-01-02",
      "jobskillmatch360.com": "2026-01-02",
      "join-room.meeting-online.site": "2024-02-07",
      "joinustoday.online": "2026-01-02",
      "jom.diregame.live": "2022-03-29",
      "josehub88.vercel.app": "2026-02-25",
      "jp-zoom.com": "2026-01-02",
      "jquery-release.com": "2026-01-02",
      "jquerycloud.io": "2026-01-02",
      "jqueryversion.net": "2026-01-02",
      "jrodacooker.dev": "2026-05-01",
      "json-project-hazel.vercel.app": "2026-01-02",
      "jumping-mechellen.com": "2026-01-02",
      "jumpshare.online": "2026-03-12",
      "juneprint.com": "2022-04-18",
      "jungfrau.co.kr": "2022-04-18",
      "justbuiltprojects.com.au": "2026-01-02",
      "jvnquetbon.naveicoipg.online": "2022-04-05",
      "jwt-alpha-woad.vercel.app": "2026-02-20",
      "jz-aws.info": "2024-12-29",
      "jzus0ve6iq-staging.onrocket.site": "2026-02-23",
      "kaltura.studio": "2026-02-09",
      "kashaccn4.naveicoiph.online": "2022-04-15",
      "kb102531x.vercel.app": "2026-01-13",
      "kdzdm1rq.naveicoipg.online": "2022-04-06",
      "keenest.org": "2026-02-10",
      "keondigital.com": "2026-01-02",
      "kerajaanmoshi.xyz": "2026-08-03",
      "key.sharedrive.ink": "2022-12-02",
      "kfcjn.com": "2023-03-05",
      "kingstar.publicvm.com": "2023-10-01",
      "kingsvc.cc": "2020-04-27",
      "kirschneigroup.com": "2026-01-02",
      "kit-haus.net": "2026-02-25",
      "kkvps.buzz": "2023-11-29",
      "knightsbridge-dex.vercel.app": "2026-01-02",
      "knockri.us": "2026-07-06",
      "koliinfotech.company": "2026-01-02",
      "koover.org": "2026-02-19",
      "kooverly.org": "2026-02-10",
      "kourosh.uefa-meeting.com": "2026-01-02",
      "kraken.group-meeting.online": "2023-11-29",
      "kraken.group-meeting.team": "2023-11-29",
      "kraken.livehiringpro.com": "2026-01-02",
      "kraken.team-meet.online": "2023-11-29",
      "kraken.video-meeting.team": "2023-11-29",
      "krakenfolio.com": "2021-01-26",
      "krakenhire.com": "2026-01-02",
      "krakenmeetings.com": "2026-01-02",
      "kryptoneer.com": "2026-01-02",
      "ksrtcaudiologininstructions.esdinfra.com": "2026-01-02",
      "ksrtceccsgbmaudiologininstructions.esdinfra.com": "2026-01-02",
      "kuadyhfnejh.meeting-hub.online": "2024-10-09",
      "kupaywallet.com": "2020-06-03",
      "kygfkdum.naveicoipg.online": "2022-04-05",
      "l1tog1iv.naveicoipg.online": "2022-04-07",
      "l3vywd.easypanel.host": "2026-07-22",
      "lab99.sbs": "2026-06-09",
      "lackservice.short.gy": "2026-04-23",
      "lad.dropfile.online": "2024-10-09",
      "lam.dropfile.online": "2024-10-09",
      "latamics.org": "2026-01-02",
      "lavaandstone.com": "2020-06-23",
      "lbmwbnbieo.naveicoipg.online": "2022-04-05",
      "ld-digitaal.com": "2024-06-08",
      "ldb.rightwidth.dev": "2026-07-18",
      "leaguehub.net": "2026-01-02",
      "leavetecs.online": "2024-11-26",
      "ledgemail.net": "2025-01-20",
      "ledgep.net": "2025-01-20",
      "ledgernowone.com": "2026-03-16",
      "lei.dropfile.online": "2024-10-09",
      "lenvny.com": "2026-01-02",
      "letsmeetnow.site": "2024-05-07",
      "levelframeblog.com": "2021-02-17",
      "levinpros.com": "2026-01-02",
      "lianxinxiao.com": "2025-01-02",
      "license.cloudplus.one": "2022-02-15",
      "lido.web05zoom.us": "2026-01-02",
      "lif0.top": "2022-01-01",
      "lightingmart.co.kr": "2023-03-05",
      "lightkingstar.com": "2023-07-03",
      "limesurvey.us": "2026-01-02",
      "limitlesstechltd.com": "2026-01-02",
      "limmatcampus.com": "2026-03-16",
      "link-net.publicvm.com": "2023-10-26",
      "linkedinservice.us": "2026-01-02",
      "links.ceinbase.com": "2024-09-17",
      "linkundlink.de": "2022-02-08",
      "litslink.online": "2026-01-02",
      "live-meeting.world": "2024-07-16",
      "live.bankdost.in": "2026-01-02",
      "live.econceptual.com": "2026-01-02",
      "livehirehub.com": "2026-01-02",
      "livehirepro.com": "2026-01-02",
      "livehiringhub.com": "2026-01-02",
      "livehiringpro.com": "2026-01-02",
      "liveonedrvshare.xyz": "2020-02-07",
      "livesnotnumbers.org": "2026-01-02",
      "livetalentpro.com": "2026-01-02",
      "liwoeson.online-meet.team": "2024-05-08",
      "liymgdc-aeea9bdbc87b.dropfile.online": "2024-10-09",
      "liz.dropfile.online": "2024-10-09",
      "lkpiedozd.naveicoiph.online": "2022-04-11",
      "llm.docsend.online": "2024-10-09",
      "llmtraininginference.xyz": "2026-05-07",
      "lm-career.com": "2022-01-18",
      "lmaxtrd.com": "2026-01-02",
      "loading-coinbase.com": "2024-09-17",
      "location-request-api.short.gy": "2026-03-13",
      "log-server-lovat.vercel.app": "2026-01-02",
      "log-writter.vercel.app": "2026-01-02",
      "log.pricesheet.ink": "2026-05-01",
      "logger.clob.health": "2026-05-01",
      "logicfield-app681.vercel.app": "2026-02-28",
      "logicfield-ext432.vercel.app": "2026-02-28",
      "login.ceinbase.com": "2024-09-17",
      "login.ceionbase.com": "2024-09-18",
      "login.cicoinbase.com": "2024-09-18",
      "login.cobinase.com": "2024-09-18",
      "login.cobinbase.com": "2024-09-18",
      "login.coinbalse.com": "2024-09-18",
      "login.coinblase.com": "2024-09-17",
      "login.coinbrase.com": "2024-09-17",
      "login.coinibrase.com": "2024-09-18",
      "login.coininbase.com": "2024-09-18",
      "login.docsend.online": "2024-10-09",
      "logkit-tau.vercel.app": "2026-08-05",
      "logn.navermanagecorp.site": "2022-04-11",
      "logn.noreplya.website": "2022-04-11",
      "logoeye.net": "2026-01-02",
      "logosports.net": "2026-01-02",
      "logs-bin.com": "2026-05-17",
      "long.waitingfor.cfd": "2024-06-08",
      "longhash.general-meet.site": "2024-09-10",
      "longhash.video-meets.online": "2024-09-10",
      "loopsoft.tech": "2026-01-02",
      "lostdungeon.openfort.xyz": "2026-01-02",
      "lrakkiqr.team-meeting.pro": "2023-12-04",
      "luc.uefa-meeting.com": "2026-01-02",
      "lucas-gaming.com": "2026-01-02",
      "luckyguys.cloud": "2026-04-30",
      "luckyguys.site": "2026-04-22",
      "lunoxbet77--yes.site": "2026-01-02",
      "lunoxbet77rain.baby": "2026-01-02",
      "lunoxbet77rain.online": "2026-01-02",
      "lunoxbet77rain.store": "2026-01-02",
      "lunoxbet77speed.site": "2026-01-02",
      "luosongs.shop": "2024-12-10",
      "m-omeets.online": "2024-11-27",
      "m-teams.live": "2024-11-27",
      "m.contradecapital.com": "2022-09-30",
      "m.docsend.online": "2024-10-09",
      "m.dropfile.online": "2024-10-09",
      "m.energydonate.com": "2026-02-17",
      "m21gk.wiremockapi.cloud": "2026-01-02",
      "macamhelp.online": "2026-01-02",
      "magmow.sourljsourhs.cfd": "2023-08-25",
      "mail-roundcube.site": "2023-10-13",
      "mail.aes-secure.net": "2026-05-27",
      "mail.anifintech.xyz": "2026-01-02",
      "mail.archblock.careerscreeners.com": "2026-01-02",
      "mail.big-typl.online": "2024-11-13",
      "mail.careerscreeners.com": "2026-01-02",
      "mail.ccuk.edu.ng": "2026-02-10",
      "mail.crypto-assess.com": "2025-01-15",
      "mail.digitpotalent.com": "2025-01-10",
      "mail.dropfile.online": "2024-10-09",
      "mail.eoinbase.com": "2024-09-18",
      "mail.gethirednow.org": "2025-01-15",
      "mail.gladneyocivpsdedinvme4.com": "2026-01-02",
      "mail.hireviavideo.com": "2026-01-02",
      "mail.interviewhub.org": "2025-01-10",
      "mail.kooverly.org": "2026-02-10",
      "mail.massmedia24.com": "2026-01-02",
      "mail.naveradmina.tech": "2022-04-11",
      "mail.navercomf.link": "2022-04-11",
      "mail.newson-6.com": "2026-05-27",
      "mail.privymeet.com": "2023-12-04",
      "mail.reuniao21.admescolassistema.com": "2026-06-09",
      "mail.support-ledger.net": "2025-01-20",
      "mail.tesolraria6.admescolassystemf.com": "2026-05-26",
      "mail.testforhire.com": "2026-01-02",
      "mail.usengineergroup.com": "2022-04-30",
      "mail.vyrabank.com": "2026-05-26",
      "mail.web021zoom.us": "2026-01-02",
      "mail.willomexcvip.us": "2024-12-29",
      "mail.wtalents.us": "2024-12-29",
      "mail1.dropfile.online": "2024-10-09",
      "mail1.fuchuangonline.com": "2024-09-10",
      "mail2.dropfile.online": "2024-10-09",
      "mailcontactteam.online": "2022-04-11",
      "mailcustomerservice.site": "2022-04-11",
      "mailer.dropfile.online": "2024-10-09",
      "mailgate.dropfile.online": "2024-10-09",
      "mailgw.dropfile.online": "2024-10-09",
      "mailhelp.online": "2022-04-11",
      "mailhost.dropfile.online": "2024-10-09",
      "mailin.dropfile.online": "2024-10-09",
      "mailmanagecorp.online": "2022-04-11",
      "mailout.dropfile.online": "2024-10-09",
      "mailpredicttogether.ink": "2026-06-09",
      "mailpulsynk.xyz": "2026-06-09",
      "mailsecurity.email": "2022-04-11",
      "mailserver.dropfile.online": "2024-10-09",
      "mailservicecorp.online": "2022-04-11",
      "mailserviceteam.email": "2022-04-11",
      "mailtrixauvex.ink": "2026-06-09",
      "mailx.dropfile.online": "2024-10-09",
      "main-8i4.pages.dev": "2026-03-02",
      "main-aptitudespro.pages.dev": "2026-02-10",
      "main-az8.pages.dev": "2026-02-10",
      "main.socket.luckyguys.cloud": "2026-04-30",
      "malicanbur.pro": "2026-03-16",
      "manage.luckyguys.cloud": "2026-04-30",
      "manchestercity.work.gd": "2023-12-08",
      "mante.li": "2022-02-08",
      "mantis-gewa.technisat-digital.de": "2022-02-15",
      "mantis.linkundlink.de": "2021-11-04",
      "mappo-on.life": "2021-05-06",
      "mariamchurch.com": "2022-04-18",
      "market.contradecapital.com": "2022-09-30",
      "markethubuk.com": "2026-02-24",
      "marketplace-neut52jgl.vercel.sh": "2026-02-20",
      "marketplacepcai.com": "2024-12-10",
      "markettrendingcenter.com": "2022-01-21",
      "massmedia24.com": "2026-01-02",
      "mat-techcore.org": "2026-01-02",
      "materialindia.in": "2019-10-30",
      "matias.uefa-meeting.com": "2026-01-02",
      "matrix-3.bestleas.ru": "2026-04-24",
      "matrixane.com": "2024-05-28",
      "mavenradar.com": "2026-01-02",
      "maverick-njkr6h6me-sohybes-projects.vercel.app": "2026-02-20",
      "maxbookpro.com": "2026-03-16",
      "mayonestore.online": "2026-01-02",
      "mbafleet.com": "2023-10-18",
      "mccprod.site": "2026-06-19",
      "mclearoptical.com": "2023-11-02",
      "mclland.com": "2021-03-26",
      "mdown.showprice.xyz": "2021-03-12",
      "me-c0h.pages.dev": "2026-02-27",
      "measureaptitudes.com": "2026-02-17",
      "medcialbiotop.com": "2026-01-02",
      "mediajourney.digital": "2026-01-02",
      "mediaprime.team": "2026-01-02",
      "medincahub.com": "2026-02-14",
      "meet-client.online": "2024-11-13",
      "meet-safe.online": "2024-07-15",
      "meet.caladangroup.xyz": "2024-09-21",
      "meet.capitalviabtc.com": "2026-01-02",
      "meet.capitalviabtc.comhollow-jordan-narrow.on-fleek.app": "2026-01-02",
      "meet.cryptowave.capital": "2023-11-29",
      "meet.globiscapital.co": "2026-01-02",
      "meet.globiscapitals.com": "2026-01-02",
      "meet.hanagroup.video": "2024-11-11",
      "meet.mythicaigames.foundation": "2026-01-02",
      "meet.mythicalgames.foundation": "2026-01-02",
      "meet.openfort-team.xyz": "2026-01-02",
      "meet.picwe-team.com": "2026-01-02",
      "meet.re7.network": "2026-01-02",
      "meet.rwa-team.video": "2026-01-02",
      "meet.ryzelabs.net": "2024-08-21",
      "meet.selinicapital.online": "2024-09-21",
      "meet.selinicapital.xyz": "2024-09-21",
      "meet.str8fire-team.network": "2026-01-02",
      "meet.superstatefund.co": "2026-01-02",
      "meet.synternetlab.com": "2026-01-02",
      "meet.twosigma-vc.com": "2026-01-02",
      "meet.ubi-safemeeting.online": "2023-09-07",
      "meetcentralhub.online": "2023-11-29",
      "meeting-central.online": "2024-07-16",
      "meeting-hub.online": "2024-07-16",
      "meeting-online.site": "2023-11-28",
      "meeting-pro.online": "2024-07-16",
      "meeting-zone.online": "2024-09-10",
      "meeting-zoom-witcam-tests-meet-id-5u83-82f3-8h39-83h9-d9e3.pages.dev": "2026-01-02",
      "meeting-zoom-witcam-tests-meet-id-5u83-82f3-8h39-83h9-n9e3.pages.dev": "2026-01-02",
      "meeting.document-content.online": "2026-01-02",
      "meeting.sellinicapital.com": "2024-09-21",
      "meeting.work.gd": "2023-10-11",
      "meetingjoin.us": "2026-01-02",
      "meetingverse.app": "2023-11-29",
      "meetingzoom.org": "2025-02-11",
      "meetup-zone.online": "2024-07-15",
      "meetwithhealthyh2o.com": "2026-01-02",
      "memecoinmania.net": "2026-01-02",
      "memo.ccuk.edu.ng": "2026-02-10",
      "menchro.pro": "2026-03-22",
      "merreo.org": "2026-01-02",
      "message.luckyguys.cloud": "2026-04-30",
      "metaschool.video-meets.online": "2024-09-10",
      "metric-analytics.vercel.app": "2026-02-20",
      "metrics-dashboard-7lgdhdfot-peter1.vercel.app": "2026-02-20",
      "mettl.app": "2026-07-21",
      "mettl.us": "2026-07-21",
      "mettl.xyz": "2026-07-21",
      "mhf8huuo.naveicoipe.tech": "2022-03-31",
      "microshare.cloud": "2022-12-12",
      "microsoft.customizetions.com": "2026-01-02",
      "micrsofts.tech": "2023-12-12",
      "migadyn.info": "2026-06-09",
      "mindfulbiz.link": "2026-03-16",
      "mingeloem.com": "2024-03-19",
      "mircosoftclouddocment.com": "2026-01-02",
      "mirotalk.net": "2024-07-16",
      "mizuhogroup.uk": "2023-01-04",
      "mktrending.com": "2022-08-05",
      "mlischagori.pro": "2026-02-10",
      "mo-events.online": "2024-11-27",
      "modelatelier.club": "2026-03-21",
      "momentumspace.top": "2024-12-10",
      "momls4ii.naveicoipa.tech": "2022-03-30",
      "momls4ii.naveicoipc.tech": "2022-03-29",
      "monade.online": "2026-06-09",
      "monobyte-code.vercel.app": "2026-02-25",
      "mopquanta.pro": "2026-03-16",
      "motionassess.com": "2026-01-02",
      "mouradvps43hostwin.online": "2024-11-13",
      "mouradvps8hostwin.online": "2023-10-17",
      "movis-es.ignorelist.com": "2017-04-12",
      "moxtern.com": "2026-02-10",
      "ms.msteam.biz": "2022-09-28",
      "ms.onlineshares.cloud": "2022-09-21",
      "msdeliverycontent.com": "2026-05-27",
      "mse.theworkpc.com": "2021-03-12",
      "msftoffice.com": "2020-12-30",
      "msg.luckyguys.cloud": "2026-04-30",
      "msldkopw.naveicoipe.tech": "2022-03-31",
      "mssrv.kro.kr": "2024-03-21",
      "msteam.biz": "2022-09-28",
      "mta-sts.meetingverse.app": "2023-11-29",
      "mta-sts.ubi-safemeeting.live": "2023-11-29",
      "mufg.tokyo": "2022-09-16",
      "mx.dropfile.online": "2024-10-09",
      "mx.hiring-you.com": "2026-02-09",
      "mx2.dropfile.online": "2024-10-09",
      "my-3d-portfolio-1o6x-j8oobuufq-hadi-arabis-projects.vercel.app": "2026-02-20",
      "my-3d-portfolio-598x-c8nb68kta-hadi-arabis-projects.vercel.app": "2026-02-20",
      "my-3d-portfolio-598x-git-main-hadi-arabis-projects.vercel.app": "2026-02-20",
      "my-c0m.pages.dev": "2026-02-15",
      "my-n8n-76.duckdns.org": "2026-01-02",
      "mydealoman.com": "2020-01-08",
      "myemail.works": "2020-12-30",
      "mygametoa.com": "2022-01-13",
      "mypatchauto.com": "2026-02-10",
      "mypatchfree.com": "2026-02-10",
      "myproject-f8d.pages.dev": "2026-02-10",
      "myqr-generator.com": "2025-02-11",
      "myself.hopto.org": "2023-12-08",
      "mythicaigames.foundation": "2026-01-02",
      "mythicalgames.foundation": "2026-01-02",
      "mythicalgames.hiremodozone.com": "2026-01-02",
      "mywalletsss.store": "2026-05-01",
      "mzweb3.bu-zoom.us": "2026-01-02",
      "mzweb3.er-zoom.us": "2026-01-02",
      "mzweb3.jp-zoom.com": "2026-01-02",
      "n34kr3z26f3jzp4ckmwuv5ipqyatumdxhgjgsmucc65jac56khdy5zqd.onion": "2026-01-02",
      "nadlan-dubai.com": "2026-01-02",
      "name.ownemail.me": "2021-03-12",
      "nansenpro.org": "2026-01-02",
      "natefi.org": "2026-01-02",
      "nav.cloudcentre.space": "2022-04-11",
      "nav.naveracom.link": "2022-04-11",
      "nav.naveradmin06.online": "2022-04-11",
      "nav.noreplyb.xyz": "2022-04-11",
      "nav.portalcorpteam.com": "2022-04-11",
      "navcopcenter.tech": "2022-04-11",
      "navcorpmanager.site": "2022-04-11",
      "naveeocorp.xyz": "2022-04-11",
      "naveicoipa.tech": "2022-03-29",
      "naveicoipc.tech": "2022-03-25",
      "naveicoipd.tech": "2022-03-29",
      "naveicoipe.tech": "2022-03-29",
      "naveicoipf.online": "2022-03-31",
      "naveicoipg.online": "2022-03-31",
      "naveicoiph.online": "2022-03-31",
      "navenida.live": "2022-04-11",
      "navenida.site": "2022-04-11",
      "navenidb.live": "2022-04-11",
      "navenidb.site": "2022-04-11",
      "navenidc.live": "2022-04-11",
      "navenidc.site": "2022-04-11",
      "navenidd.site": "2022-04-11",
      "navenide.site": "2022-04-11",
      "navenidf.site": "2022-04-11",
      "naveorseccorp.link": "2022-04-11",
      "naveracom.link": "2022-04-11",
      "naveradmin01.link": "2022-04-11",
      "naveranid.link": "2022-04-11",
      "naveranid.live": "2022-04-11",
      "naveranid.online": "2022-04-11",
      "naverbcom.link": "2022-04-11",
      "naverbnid.live": "2022-04-11",
      "naverbnid.online": "2022-04-11",
      "naverccom.link": "2022-04-11",
      "navercert.live": "2022-04-11",
      "navercert.online": "2022-04-11",
      "navercnid.link": "2022-04-11",
      "navercnid.online": "2022-04-11",
      "navercoa.store": "2022-04-11",
      "navercob.store": "2022-04-11",
      "navercoc.store": "2022-04-11",
      "navercod.store": "2022-04-11",
      "navercoe.store": "2022-04-11",
      "navercoma.link": "2022-04-11",
      "navercoma.online": "2022-04-11",
      "navercomb.link": "2022-04-11",
      "navercomb.online": "2022-04-11",
      "navercomb.tech": "2022-04-11",
      "navercomc.link": "2022-04-11",
      "navercomc.online": "2022-04-11",
      "navercomc.tech": "2022-04-11",
      "navercomd.link": "2022-04-11",
      "navercomd.online": "2022-04-11",
      "navercome.link": "2022-04-11",
      "navercome.online": "2022-04-11",
      "navercome.tech": "2022-04-11",
      "navercomf.link": "2022-04-11",
      "navercomf.online": "2022-04-11",
      "navercomg.link": "2022-04-11",
      "navercomh.link": "2022-04-11",
      "navercop.link": "2022-04-11",
      "navercop.online": "2022-04-11",
      "navercorp.email": "2022-04-11",
      "navercorp.live": "2022-04-11",
      "navercorpl.tech": "2022-04-11",
      "navercorpr.online": "2022-04-11",
      "navercorpservice.com": "2021-11-12",
      "navercorpteam.com": "2022-04-11",
      "navercscorp.com": "2022-04-11",
      "naverenid.online": "2022-04-11",
      "naverfnid.online": "2022-04-11",
      "navergnid.online": "2022-04-11",
      "naverhnid.online": "2022-04-11",
      "naverhost.live": "2022-04-11",
      "naverinid.com": "2022-04-11",
      "naverinid.online": "2022-04-11",
      "naverjnid.online": "2022-04-11",
      "naverk.myvnc.com": "2023-11-16",
      "naverlogn.live": "2022-04-11",
      "navermailcorp.com": "2022-04-11",
      "navermailmanage.com": "2022-04-11",
      "navermailservice.com": "2022-04-11",
      "navermailservice.online": "2022-04-11",
      "navermailteam.online": "2022-04-11",
      "navermanage.com": "2022-04-11",
      "navermanage.live": "2022-04-11",
      "navermanage.space": "2022-04-11",
      "navermanageteam.com": "2022-04-11",
      "navermcorp.com": "2022-04-11",
      "navernida.link": "2022-04-11",
      "navernida.online": "2022-04-11",
      "navernida.tech": "2022-04-11",
      "navernidb.link": "2022-04-11",
      "navernidb.online": "2022-04-11",
      "navernidb.tech": "2022-04-11",
      "navernidc.link": "2022-04-11",
      "navernidc.online": "2022-04-11",
      "navernidc.tech": "2022-04-11",
      "navernidd.live": "2022-04-11",
      "navernidd.online": "2022-04-11",
      "navernide.online": "2022-04-11",
      "navernidlog.live": "2022-04-11",
      "navernidmail.com": "2022-04-11",
      "naverorteam.link": "2022-04-11",
      "naverreda.xyz": "2022-04-11",
      "naverredc.xyz": "2022-04-11",
      "naverredd.xyz": "2022-04-11",
      "naverrede.xyz": "2022-04-11",
      "naverredirect.live": "2022-04-11",
      "naversecurityservice.online": "2022-04-11",
      "naversecurityteam.com": "2022-04-11",
      "naverservice.email": "2022-04-11",
      "naverservice.host": "2022-04-11",
      "naverservice.link": "2022-04-11",
      "naverserviceteam.com": "2022-04-11",
      "naverserviceteam.email": "2022-04-11",
      "naverteam.live": "2022-04-11",
      "naverteamcorp.live": "2022-04-11",
      "navigatorshub.com": "2026-05-01",
      "navreplya.live": "2022-04-11",
      "navreplya.online": "2022-04-11",
      "navreplyb.live": "2022-04-11",
      "navreplyd.live": "2022-04-11",
      "navreplye.live": "2022-04-11",
      "navreplyf.site": "2022-04-11",
      "navreplyg.site": "2022-04-11",
      "navreplyh.site": "2022-04-11",
      "navreplyi.site": "2022-04-11",
      "navreplyj.site": "2022-04-11",
      "navreplyk.site": "2022-04-11",
      "navteamcorp.link": "2022-04-11",
      "nd6u0.asia": "2024-12-10",
      "nemesistrade.work": "2026-06-09",
      "net.lightkingstar.com": "2023-07-03",
      "network.cloud.doc-shared.linkpc.net": "2023-11-02",
      "neugrenz.com": "2026-03-16",
      "neuraldock-app734.vercel.app": "2026-02-28",
      "neuraldock-ext126.vercel.app": "2026-02-28",
      "neuralnetworkdatalab.com": "2026-05-02",
      "new.hirvexo.com": "2026-02-17",
      "newcoming.cfd": "2023-09-11",
      "newfromjune.xyz": "2024-11-05",
      "newsbtctech.com": "2021-03-12",
      "newson-6.com": "2026-05-27",
      "next-master-pwg93975l-now-examples.vercel.app": "2026-02-20",
      "nextera.capital": "2023-05-10",
      "nextjs-conf-2024-jwokq4e6s.vercel.sh": "2026-02-20",
      "nextjs-stripe-template.vercel.sh": "2026-02-20",
      "ngc.private-meet.xyz": "2024-05-08",
      "ngc.regular-meet.site": "2024-09-10",
      "ngc.regular-meeting.site": "2024-05-10",
      "ngc.regular-meeting.team": "2024-05-07",
      "nhn-games.com": "2022-03-16",
      "nidbnaver.tech": "2022-04-11",
      "nidcnaver.tech": "2022-04-11",
      "niddnaver.tech": "2022-04-11",
      "nidnavera.online": "2022-04-11",
      "nidnavere.online": "2022-04-11",
      "nin.navercop.link": "2022-04-11",
      "nlog.noreplyb.space": "2022-04-11",
      "nomanstone.shop": "2023-07-03",
      "nor-health.xyz": "2023-10-31",
      "noreplya.xyz": "2022-04-11",
      "noreplyb.xyz": "2022-04-11",
      "notaiospuglisi.com": "2026-01-02",
      "notifypulsynk.ink": "2026-06-09",
      "novachainhub.com": "2026-05-29",
      "novaplayer.online": "2026-06-19",
      "now-examples-3ok9tvp04.zeit.sh": "2026-02-20",
      "now-examples-5onkajpkx.zeit.sh": "2026-02-20",
      "now-examples-6pn2lr1ir.zeit.sh": "2026-02-20",
      "now-examples-7v52p79xj.zeit.sh": "2026-02-20",
      "now-examples-7voymifaz.zeit.sh": "2026-02-20",
      "now-examples-7xu2100yl.zeit.sh": "2026-02-20",
      "now-examples-9zv8bcocf.zeit.sh": "2026-02-20",
      "now-examples-bd1jwqxdf.zeit.sh": "2026-02-20",
      "now-examples-crsku8zyd.zeit.sh": "2026-02-20",
      "now-examples-d8gbron9h.zeit.sh": "2026-02-20",
      "now-examples-dge5dpeg6.zeit.sh": "2026-02-20",
      "now-examples-dhev9x619.zeit.sh": "2026-02-20",
      "now-examples-enprlx5lm.zeit.sh": "2026-02-20",
      "now-examples-j447nc3bq.zeit.sh": "2026-02-20",
      "now-examples-nqk5yw2f2.zeit.sh": "2026-02-20",
      "now-examples-oiceysajh.zeit.sh": "2026-02-20",
      "now-examples-rnwbzp2r8.zeit.sh": "2026-02-20",
      "now-tgxhacluff.now.sh": "2026-02-20",
      "nowurisch.fit": "2026-06-09",
      "nredial.navermailteam.online": "2022-04-11",
      "ns.dropfile.online": "2024-10-09",
      "ns1.big-typl.online": "2024-11-13",
      "ns1.coponde.com": "2025-02-12",
      "ns1.dataxo.net": "2026-02-09",
      "ns1.dropfile.online": "2024-10-09",
      "ns1.salessgroupss.live": "2024-11-27",
      "ns2.bizsupport365.com": "2024-12-10",
      "ns2.contentverge.com": "2024-12-10",
      "ns2.dataxo.net": "2026-02-09",
      "ns2.dropfile.online": "2024-10-09",
      "ns2.salessgroupss.live": "2024-11-27",
      "ns2.videotalks.online": "2024-11-15",
      "nv-onlines.info": "2025-02-11",
      "nvidia-cloud.online": "2025-01-06",
      "nvidia-drive.cloud": "2025-01-06",
      "nvidia-release.cloud": "2025-01-06",
      "nvidia-release.org": "2024-12-28",
      "nvidia-release.us": "2024-12-29",
      "nvidiadriver.net": "2026-07-21",
      "nvidiasdk.fly.dev": "2026-01-02",
      "nvrcopa.link": "2022-04-11",
      "nvrcopb.link": "2022-04-11",
      "nvrcopc.link": "2022-04-11",
      "nvrcope.site": "2022-04-11",
      "nvrcopf.site": "2022-04-11",
      "nvricop.online": "2022-04-11",
      "nvrjcop.online": "2022-04-11",
      "nxlog.tech": "2026-06-09",
      "ny.silvergatehr.com": "2021-12-01",
      "nzssdm.com": "2019-03-26",
      "o1xyc6.easypanel.host": "2026-07-10",
      "octo-manage.net": "2021-05-06",
      "offerings.cloud": "2022-12-30",
      "office-theme.com": "2026-01-02",
      "office.microsoft.customizetions.com": "2026-01-02",
      "officezoom.us": "2026-01-02",
      "official.googleproduct.org": "2020-12-30",
      "ofo-home.top": "2026-01-02",
      "og-examples-4gnvoge9a.vercel.sh": "2026-02-20",
      "oidc-issuer-8pba9g3rc.vercel.sh": "2026-02-20",
      "oilycargo.com": "2022-12-03",
      "ok.preconnection.online": "2024-05-08",
      "okx.hiringinterview360.com": "2026-01-02",
      "okx.internal-meeting.online": "2023-11-29",
      "okx.talenthiring360.com": "2026-01-02",
      "okx.video-meet.online": "2023-11-29",
      "okx.video-meeting.team": "2023-11-29",
      "olaestudiocreativo.com": "2026-01-02",
      "olidhealth.com": "2022-11-11",
      "ollie.videotalks.online": "2024-11-15",
      "olsnvolqwe.naveicoipg.online": "2022-04-05",
      "on-global.xyz": "2023-10-26",
      "oncehub.co": "2026-01-02",
      "onchainassess.com": "2026-01-02",
      "onchainhiringtool.com": "2026-01-02",
      "onchainmodeltraining.com": "2026-03-23",
      "ondofinance.tech": "2026-06-09",
      "one.microshare.cloud": "2022-12-12",
      "onebalancelab.com": "2026-03-16",
      "onedocshare.com": "2022-01-01",
      "onedrive.azure-defender.cloud": "2023-05-10",
      "onehire.pro": "2026-01-02",
      "onelao.line.pm": "2023-12-01",
      "oneweb-host.com": "2023-01-26",
      "online-globaleurope.com": "2026-01-02",
      "online-meet.team": "2024-05-08",
      "online-meet.xyz": "2024-05-08",
      "online-meeting.co": "2024-05-08",
      "online-meeting.community": "2024-07-16",
      "online-meeting.pro": "2023-08-26",
      "online-meeting.site": "2023-10-13",
      "online-meeting.social": "2024-07-16",
      "online-meeting.team": "2023-11-07",
      "online-meeting.xyz": "2023-08-09",
      "online-meets.online": "2024-11-25",
      "online-meets.pro": "2024-11-25",
      "online-meets.site": "2024-11-05",
      "online-meets.xyz": "2024-11-05",
      "online-processing.online": "2023-11-28",
      "online-protection.cloud": "2023-01-04",
      "online-video-services.site": "2023-10-13",
      "online.advisornetic.com": "2026-02-10",
      "online.betterevaluation.us": "2026-02-10",
      "online.evalium-expertises.us": "2026-02-10",
      "online.prontoquiz.org": "2026-02-10",
      "online.rev-prot.org": "2026-02-10",
      "online.spiralboard.com": "2026-02-10",
      "online.stdheritb.com": "2026-01-02",
      "online.weboink.com": "2026-02-21",
      "online.zitlex.com": "2026-02-27",
      "onlinecloud.cloud": "2022-09-28",
      "onlinedoc.dev": "2022-01-01",
      "onlinedocview.biz": "2022-03-29",
      "onlinemeet.pro": "2026-01-02",
      "onlinesearchlic.com": "2026-01-02",
      "onlineshares.cloud": "2022-09-21",
      "onlinestockwatch.net": "2022-05-04",
      "onlynova.org": "2022-03-24",
      "onoplainai.ink": "2026-06-09",
      "onoplanoai.ink": "2026-06-09",
      "open-sc.xyz": "2023-09-25",
      "open-src.org": "2026-01-02",
      "open.googlesheetpage.org": "2022-03-11",
      "open.onlinecloud.cloud": "2022-09-28",
      "openfort-team.xyz": "2026-01-02",
      "openfort.businessmeet.xyz": "2026-01-02",
      "openfort.video": "2026-01-02",
      "openfort.xyz": "2026-01-02",
      "openmatrix-app882.vercel.app": "2026-02-28",
      "openmatrix-ext539.vercel.app": "2026-02-28",
      "openmodules.org": "2026-02-20",
      "opensend.linkpc.net": "2023-09-25",
      "opensend.online": "2023-09-25",
      "opsonew3org.sg": "2021-01-26",
      "optixauvex.us": "2026-06-09",
      "oracle-v1-beta.vercel.app": "2026-02-25",
      "orangecake.work.gd": "2023-10-11",
      "orbitstack-app318.vercel.app": "2026-02-28",
      "orbitstack-ext592.vercel.app": "2026-02-28",
      "origin.blackleopard.world": "2023-07-03",
      "ourhome.o-r.kr": "2024-03-21",
      "ovcloud.online": "2023-11-28",
      "ownemail.me": "2020-05-14",
      "oxdo.xyz": "2026-06-11",
      "palgong-cc.co.kr": "2019-10-04",
      "pancakeswap.studio": "2026-02-17",
      "panda.ourhome.o-r.kr": "2024-03-21",
      "panelcvedata.com": "2026-01-02",
      "pannel-get-data.us": "2024-02-07",
      "panteracapital.ventures": "2023-08-09",
      "papers0urce.com": "2020-07-06",
      "paradigm.hiremodozone.com": "2026-01-02",
      "parallaxdigital.online": "2023-05-10",
      "parallel.assesspro360.com": "2026-01-02",
      "parallel.eskillora.com": "2026-01-02",
      "parallel.eskillprov.com": "2026-01-02",
      "parallel.skillview360.com": "2026-01-02",
      "partner.hartmanmcapital.com": "2026-01-02",
      "partners.boolnetwork.xyz": "2026-01-02",
      "patch.levinpros.com": "2026-01-02",
      "patch.zynoracreative.com": "2026-01-02",
      "patchpal.pro": "2026-01-02",
      "pathsummitx.com": "2026-01-02",
      "pathsummitx.pages.dev": "2026-01-02",
      "paxos-apply.com": "2026-07-06",
      "paxos-video-interview.com": "2026-01-02",
      "paxos-video-interviews.com": "2026-02-09",
      "paxos-video-recording.com": "2026-02-09",
      "paxos-video-talk.com": "2026-01-02",
      "paxos.video-hiring.com": "2026-02-09",
      "paxosassessments.com": "2026-01-02",
      "paxosfuture.com": "2026-01-02",
      "paxosinterview.com": "2026-01-02",
      "paxosvideointerviewassesment.com": "2026-01-02",
      "pay.aihealthchains.com": "2026-04-24",
      "pay.resumegenie.us": "2026-01-02",
      "paycount.webbs-information.login.udaviemayas.com": "2024-11-13",
      "payload-beta-lemon.vercel.app": "2026-05-26",
      "payloadrpc.com": "2024-11-05",
      "pd.linkpc.net": "2023-10-27",
      "pdf-candy.com": "2025-02-11",
      "pdf.cisco-webex.online": "2023-10-31",
      "pdftool25.com": "2025-02-11",
      "pegasusco.net": "2019-10-23",
      "peninsulaparking-5ubyvdtqb-om-sanghvis-projects.vercel.app": "2026-02-20",
      "pepeartly-foundry.net": "2026-01-02",
      "pesncv.short.gy": "2026-04-23",
      "phantom-phantomwallet.us": "2026-01-02",
      "phantomwallet-us.us": "2026-01-02",
      "phubauto.space": "2026-01-02",
      "picktime.live": "2026-01-02",
      "picolink-jorisjgriffioen.vercel.app": "2026-02-20",
      "picwe-team.com": "2026-01-02",
      "pilotview.cloud": "2022-02-15",
      "pinkgoat.com": "2021-04-01",
      "pitisalot.site": "2026-01-02",
      "pkginstall.net": "2023-07-19",
      "playingwithcodex-git-codex-implement-en-954ce6-shnurps-projects.vercel.app": "2026-02-20",
      "playskatepark.com": "2026-02-14",
      "plexisco.com": "2026-01-02",
      "plugksa.com": "2026-02-23",
      "plushtoytumama.com": "2026-02-14",
      "pngconvert-p0kl4fodi-jhones-projects-f8ddbcbe.vercel.app": "2026-02-20",
      "pointdnt.com": "2024-05-28",
      "polblxpnl.space": "2026-05-01",
      "policyupdates.info": "2019-08-06",
      "polymarket-clob.com": "2026-05-01",
      "pop.dataxo.net": "2026-02-09",
      "pop.dropfile.online": "2024-10-09",
      "pop3.dropfile.online": "2024-10-09",
      "portal.ccuk.edu.ng": "2026-02-10",
      "portal.gfinanzen.net": "2022-01-25",
      "portalcorpteam.com": "2022-04-11",
      "portfolio-naylinmyats-projects.vercel.app": "2026-02-20",
      "post.dropfile.online": "2024-10-09",
      "postedviral.com": "2026-01-02",
      "postmaster.dropfile.online": "2024-10-09",
      "postprocesser.com": "2026-02-25",
      "poweem.com": "2026-02-10",
      "powerwize.org": "2026-02-10",
      "powerwize.pages.dev": "2026-02-10",
      "prajeshpatel.com": "2023-10-18",
      "pre-screen.net": "2026-02-10",
      "pre-screen.online": "2026-02-10",
      "pre-zoom.us": "2026-01-02",
      "precisioncoderss.com": "2026-01-02",
      "precommit.vercel.app": "2026-05-21",
      "preconnection.online": "2024-05-08",
      "predictcareertogether.space": "2026-06-09",
      "predicttocareer.space": "2026-06-09",
      "predicttogerecruit.store": "2026-06-09",
      "predicttogether.ink": "2026-06-09",
      "predicttogetherrecruit.store": "2026-06-09",
      "prehighiq.com": "2026-01-02",
      "prehireiq.com": "2026-01-02",
      "presentations.life": "2023-10-27",
      "presentonline.xyz": "2020-12-30",
      "previewaccess-doc.online": "2023-12-05",
      "price-oracle-v2.vercel.app": "2026-02-25",
      "pricesheet.ink": "2026-05-01",
      "primestacks.org": "2025-01-29",
      "primevector-app920.vercel.app": "2026-02-28",
      "primevector-ext483.vercel.app": "2026-02-28",
      "primez.online": "2023-11-25",
      "privacy.hopto.org": "2024-03-21",
      "privacysign.org": "2022-09-28",
      "private-kurier.com": "2020-01-08",
      "private-meet.online": "2024-04-30",
      "private-meet.team": "2024-05-08",
      "private-meet.xyz": "2024-05-08",
      "private-meeting.online": "2023-08-09",
      "private-meeting.site": "2024-11-13",
      "private-meeting.xyz": "2023-08-26",
      "privatemake.bounceme.net": "2023-09-03",
      "privatenetwork.online": "2023-05-10",
      "privatepool.store": "2024-10-21",
      "privatework.buzz": "2020-12-30",
      "privymeet.com": "2023-11-24",
      "process-log-update.vercel.app": "2026-01-02",
      "process-log.vercel.app": "2026-01-02",
      "product.onlinedoc.dev": "2022-01-01",
      "professionalsnapshot.com": "2026-01-02",
      "professiondesc.com": "2022-12-28",
      "proficiencycert.com": "2026-01-02",
      "proficientmint.com": "2026-01-02",
      "proficientmint.pages.dev": "2026-01-02",
      "prohirevideo.com": "2026-01-02",
      "pronoia-kkeeland-4878s-projects.vercel.app": "2026-02-20",
      "prontoquiz.org": "2026-02-10",
      "propertys-shop.com": "2022-10-12",
      "prosec.ink": "2022-12-20",
      "protect.antcapital.us": "2021-03-23",
      "protect.azure-drive.com": "2021-06-09",
      "protection-service.cloud": "2023-01-04",
      "protectli.online": "2023-10-17",
      "protectoffice.club": "2021-04-11",
      "provevidskillcheck.com": "2026-01-02",
      "provideodrivers.cloud": "2026-01-02",
      "publishapp.co": "2020-08-03",
      "pulsynk.org": "2026-06-09",
      "purewatertokyo.com": "2021-04-01",
      "purplebear.com": "2022-11-16",
      "pv5pnwlx.naveicoipg.online": "2022-04-06",
      "pypilibrary.com": "2026-01-02",
      "pypistorage.com": "2026-01-02",
      "pyra-docs-git-main.vercel.sh": "2026-02-20",
      "pyra-docs.vercel.sh": "2026-02-20",
      "qeiukdemo.docsend.store": "2024-10-09",
      "qogngnslel.naveicoipg.online": "2022-04-05",
      "qooqle.download": "2021-03-26",
      "quant-screen.com": "2026-02-10",
      "quantapath-app914.vercel.app": "2026-02-28",
      "quantapath-ext275.vercel.app": "2026-02-28",
      "quantumnodespro.com": "2026-01-02",
      "queryyard.com": "2026-01-02",
      "questionic.com": "2026-03-02",
      "questionnairehq.com": "2025-01-15",
      "quick-view.org": "2026-02-10",
      "quickassessio.com": "2026-01-02",
      "quickcamfix.online": "2026-01-02",
      "quickdriverupdate.online": "2026-01-02",
      "quickhire360.com": "2025-01-22",
      "quickhiretest.com": "2025-01-16",
      "quickinterview360.com": "2025-01-29",
      "quickproassess.com": "2026-01-02",
      "quickskill-review.com": "2026-01-02",
      "quickskillup.us": "2026-01-02",
      "quickvidintro.com": "2025-01-14",
      "quiz-nest.com": "2026-01-02",
      "quizpathway.com": "2026-01-02",
      "quizterview.com": "2026-01-02",
      "quonexa.com": "2024-12-10",
      "qwary.org": "2026-01-02",
      "r4liyq.easypanel.host": "2026-07-20",
      "rabbywallet-app.us": "2026-01-02",
      "racksuphde.xyz": "2024-11-27",
      "racondog.shop": "2023-07-03",
      "radarsync.pro": "2026-01-02",
      "rapiddrivers.cloud": "2026-01-02",
      "rapisigns.com": "2023-09-07",
      "rastreojerezexpress.com": "2026-01-02",
      "raxvatange.ink": "2026-06-09",
      "rbluckyguys.com": "2026-04-30",
      "rdweb.luckyguys.cloud": "2026-04-30",
      "re7.network": "2026-01-02",
      "readonlymemory.xyz": "2026-02-25",
      "real.unbelievableresult.store": "2023-10-05",
      "rebelthumb.net": "2022-12-03",
      "rec.vid-crypto-assess.com": "2026-01-02",
      "recent.bico-news.blog": "2023-09-07",
      "recroya.com": "2026-02-17",
      "recruit.vervoe.us": "2026-02-09",
      "recruitboard-base.pages.dev": "2026-01-02",
      "recruitboard.video": "2026-01-02",
      "recruiterlogon.company": "2026-06-09",
      "recruitptogether.xyz": "2026-06-09",
      "recruitvex.us": "2026-06-09",
      "red.naveradmin07.site": "2022-04-11",
      "red.nidnavere.online": "2022-04-11",
      "reddish-dawn.store": "2024-12-10",
      "redirect-smartwallet.com": "2025-02-12",
      "regioncheck.net": "2024-08-30",
      "regioncheck.xyz": "2026-01-23",
      "register-meeting.pages.dev": "2026-01-02",
      "regular-meet.online": "2024-07-16",
      "regular-meet.site": "2024-07-16",
      "regular-meet.team": "2024-07-16",
      "regular-meeting.online": "2024-05-10",
      "regular-meeting.pro": "2024-05-10",
      "regular-meeting.site": "2024-05-10",
      "regular-meeting.team": "2024-05-07",
      "regular-meeting.xyz": "2024-05-10",
      "relay.dropfile.online": "2024-10-09",
      "release-driver.online": "2026-01-02",
      "release-drivers.online": "2026-01-02",
      "releasedrive.live": "2026-01-02",
      "reliableservers.org": "2026-01-02",
      "remote.dropfile.online": "2024-10-09",
      "remoteproweb.cfd": "2023-09-11",
      "replaydreary.com": "2026-01-02",
      "repohost.online": "2024-08-30",
      "republic.biz-zoom.us": "2026-01-02",
      "republic.bu-zoom.us": "2026-01-02",
      "republic.cr-zoom.us": "2026-01-02",
      "republic.er-zoom.us": "2026-01-02",
      "republic.extrazoom.us": "2026-01-02",
      "republic.innerteams.us": "2026-01-02",
      "republic.officezoom.us": "2026-01-02",
      "republic.pre-zoom.us": "2026-01-02",
      "republic.usweb-zoom.us": "2026-01-02",
      "republic.web021zoom.us": "2026-01-02",
      "rest-icon-configure.vercel.app": "2026-07-20",
      "rest-icon-handler.store": "2026-06-16",
      "rest-icon-helper.store": "2026-07-20",
      "rest-icon-moduler.vercel.app": "2026-07-20",
      "rest-icon-provider.link": "2026-07-20",
      "rest-icon-provider.net": "2026-07-21",
      "resumegenie.us": "2026-01-02",
      "retailpackagingpartner.xyz": "2026-01-02",
      "retrots.net": "2022-01-01",
      "reuss-works.com": "2026-03-16",
      "rev-prot.org": "2026-02-10",
      "rewarded.fi": "2026-02-25",
      "rgedist.com": "2024-09-19",
      "ric-camid.re.kr": "2022-04-18",
      "riccardo.uefa-meeting.com": "2026-01-02",
      "rightwidth.dev": "2026-07-18",
      "ripple.quizterview.com": "2026-01-02",
      "ripple.speakure.com": "2026-01-02",
      "robinhood.eskillfolio.com": "2026-01-02",
      "robinhood.eskillpilot.com": "2026-01-02",
      "robinhood.eskillprof.com": "2026-01-02",
      "robinhood.evalvidz.com": "2026-01-02",
      "robinhood.interview.org": "2025-01-12",
      "robinhood.intervwolf.com": "2026-01-02",
      "robinhood.intro-crypto-assess.com": "2025-01-12",
      "robinhood.quickskill-review.com": "2026-01-02",
      "robonowlife.com": "2026-03-16",
      "rocket-resume.vercel.app": "2026-02-20",
      "roleassessor.com": "2026-01-02",
      "rolefit360.com": "2026-01-02",
      "rolematches.com": "2026-01-02",
      "rolevia.us": "2026-02-13",
      "rolltojoin.com": "2026-01-02",
      "ronaldo-nftprojects.shop": "2023-11-01",
      "room-connect.online": "2024-07-16",
      "room-meeting.xyz": "2024-11-26",
      "roomconnect.online": "2024-07-15",
      "rpc-amoy.polygon.technology": "2026-05-01",
      "rtupdates.net": "2024-11-27",
      "runningcloudx.com": "2025-02-16",
      "rustdesk.luckyguys.cloud": "2026-04-30",
      "rwa-team.video": "2026-01-02",
      "rwa.business-zoom.us": "2026-01-02",
      "rwa.businessmeet.xyz": "2026-01-02",
      "rxpz7z2yi8.naveicoiph.online": "2022-04-11",
      "ryze.privymeet.com": "2023-11-29",
      "ryzelabs.net": "2024-08-21",
      "ryzelabs.private-meeting.site": "2024-11-13",
      "saasbrief.vip": "2026-03-16",
      "sabrpartner.com": "2023-10-01",
      "sadborgroup.site": "2026-01-02",
      "safe-meeting.online": "2023-08-28",
      "safe-meeting.site": "2024-11-25",
      "safe.doc-share.cloud": "2023-02-08",
      "safefinanceltd.com": "2026-01-02",
      "safemeeting.online": "2023-11-07",
      "sakuramedia-git-cognito-sakura-media.vercel.app": "2026-02-20",
      "salessgroupss.live": "2024-11-27",
      "salmonrabbit.com": "2021-04-01",
      "salt1ending.com": "2022-09-16",
      "sammy.uefa-meeting.com": "2026-01-02",
      "sandwich-factory.buzz": "2024-12-10",
      "sap.misapor.ch": "2017-04-12",
      "sapia.us": "2026-07-21",
      "savannahpos.co.ke": "2026-06-28",
      "sbackservice.com": "2019-06-07",
      "scoret.net": "2026-02-09",
      "screenquestion.com": "2025-01-29",
      "screenquestions.com": "2026-01-02",
      "sctemarkets.com": "2020-06-02",
      "sdhsdfhsd.com": "2024-12-10",
      "sea-shared-10.hostwindsdns.com": "2024-12-29",
      "sec.naveralert.link": "2022-04-11",
      "secfilecert.com": "2025-02-11",
      "secure.azure-protect.cloud": "2023-01-04",
      "secure.azure-protection.cloud": "2022-09-23",
      "secure.azure-protection.online": "2023-01-04",
      "secure.dropfile.online": "2024-10-09",
      "secure.greendottb.com": "2026-01-02",
      "secure.greendtb.com": "2026-01-02",
      "secure.paycount.webbs-information.login.udaviemayas.com": "2024-11-13",
      "securemypc.xyz": "2026-06-19",
      "secureshares.online": "2020-02-07",
      "selfhonda.com": "2026-03-18",
      "selinicapital.online": "2024-09-21",
      "selinicapital.xyz": "2024-09-21",
      "sellinicapital.com": "2024-09-21",
      "server.dropfile.online": "2024-10-09",
      "server.pre-screen.net": "2026-02-10",
      "serversnoti.com": "2024-12-10",
      "sfdfsdf.icareerc.com": "2026-01-02",
      "share-meeting.online": "2023-10-13",
      "share.1drvmicrosoft.com": "2022-08-17",
      "share.bloomcloud.org": "2022-01-17",
      "share.cloudmgmt.org": "2022-01-07",
      "share.devprocloud.com": "2021-07-10",
      "share.fsdriveshare.org": "2022-01-07",
      "share.googlefiledrive.com": "2023-05-04",
      "share.onedrvfile.site": "2021-03-12",
      "share.prosec.ink": "2023-10-17",
      "share.stablemarket.org": "2022-01-07",
      "sharebusiness.xyz": "2021-07-10",
      "shared-link.line.pm": "2023-10-31",
      "shared.box-docsend.cloud": "2023-08-09",
      "shared.box-docsend.online": "2023-08-09",
      "shared.doc-send.cloud": "2023-05-10",
      "shared.drop-box.cloud": "2023-05-10",
      "shared.dropbox-docsend.cloud": "2023-08-09",
      "shared.dropbox-docsend.online": "2023-08-09",
      "sharefilesdocment.com": "2026-01-02",
      "sharemanage.elwoodasset.xyz": "2021-06-24",
      "sharesvr.net": "2020-12-30",
      "shconstmarket.com": "2022-07-30",
      "sheet.tresordocs.com": "2022-02-15",
      "shieldlabit.vip": "2026-03-16",
      "shimacapital.abilityscan360.com": "2026-01-02",
      "shimacapital.easyhiringtool.com": "2026-01-02",
      "ship-ai-2025-gguq0jdwo.vercel.sh": "2026-02-20",
      "shop.newsbtctech.com": "2020-09-04",
      "shopandtravelusa.com": "2022-02-08",
      "shopapppro.com": "2022-02-08",
      "shopapptech.com": "2022-02-08",
      "shopweblive.com": "2021-06-10",
      "shopwebstudio.com": "2023-01-26",
      "showmanroast.com": "2026-01-02",
      "shrill-breeze-e0f.grace-ayodele.workers.dev": "2026-03-02",
      "sicherdigitx.com": "2026-03-16",
      "sictradingc.com": "2026-02-24",
      "sightalent.org": "2026-02-09",
      "sightalent.pages.dev": "2026-02-10",
      "signalbase-app845.vercel.app": "2026-02-28",
      "signalbase-ext369.vercel.app": "2026-02-28",
      "signot.digital": "2026-03-16",
      "signum.group-meeting.pro": "2024-05-08",
      "signverydn.sharebusiness.xyz": "2021-07-10",
      "sihlquaiinst.com": "2026-03-16",
      "silencio.webzoom.video": "2026-01-02",
      "silserhafen.com": "2026-03-16",
      "silvergatehr.com": "2021-12-01",
      "silvermine.web05zoom.us": "2026-01-02",
      "silverrabbit.wegrowup.us": "2026-01-02",
      "singlelink.work.gd": "2023-10-17",
      "site-git-fix-issue-330-driveclub.vercel.app": "2026-02-20",
      "situsslotdepo10k.org": "2026-01-02",
      "skalelabs.as-zoom.us": "2026-01-02",
      "skalelabs.bu-zoom.us": "2026-01-02",
      "skalelabs.cr-zoom.us": "2026-01-02",
      "skalelabs.en-zoom.us": "2026-01-02",
      "skalelabs.mediaprime.team": "2026-01-02",
      "skalelabs.pre-zoom.us": "2026-01-02",
      "skalelabs.usweb-zoom.us": "2026-01-02",
      "skill-bridges.com": "2026-01-02",
      "skill-share.org": "2025-01-16",
      "skill.vidassessmentmaster.com": "2026-01-02",
      "skill.vidcruiterinterview.com": "2026-01-02",
      "skill.vidcruitermaster.com": "2026-01-02",
      "skillcheck.pro": "2026-01-02",
      "skillence360.com": "2026-01-02",
      "skillhiretrack.com": "2026-01-02",
      "skilllens360.com": "2026-01-02",
      "skillmasteryhub.org": "2025-02-06",
      "skillmasteryhub.us": "2026-01-02",
      "skillpilothq.com": "2026-01-02",
      "skillprooflab.com": "2026-01-02",
      "skillprops.com": "2026-01-02",
      "skillquestion.com": "2026-01-02",
      "skillquestions.com": "2026-01-02",
      "skillroar.com": "2026-01-02",
      "skillsquestions.com": "2026-01-02",
      "skillstandard360.com": "2026-01-02",
      "skilluplifestylehub.com": "2026-01-02",
      "skillview360.com": "2026-01-02",
      "skillvisions.com": "2026-01-02",
      "sktelecom.help": "2022-03-16",
      "sky-meeting.com": "2024-10-22",
      "skyboxdrive.cloud": "2023-11-29",
      "skypredict.org": "2026-01-02",
      "sloneek.us": "2026-01-02",
      "small-forest-2b0b.workers.dev": "2026-02-17",
      "smart-contracts.blog": "2023-05-10",
      "smartaudpor.com": "2021-07-24",
      "smartchecker.online": "2026-01-02",
      "smartdriverfix.cloud": "2026-01-02",
      "smartdriverfixer.com": "2026-01-02",
      "smartdrvupdate.online": "2026-01-02",
      "smarthiretop.online": "2025-02-03",
      "smartmanagerex.com": "2026-01-02",
      "smartonboardingportal.com": "2026-05-14",
      "smartscreenfilter.com": "2022-01-01",
      "smartvideoassess.com": "2026-01-02",
      "smartvideohire.com": "2026-01-02",
      "smartvirtual-assessment.com": "2026-01-02",
      "smartwalletfinder.com": "2026-01-02",
      "smbcgroup.uk": "2023-01-04",
      "smilekeepers.co": "2019-10-23",
      "smrtassess.com": "2026-01-02",
      "smtp.dropfile.online": "2024-10-09",
      "smtp1.dropfile.online": "2024-10-09",
      "smtp2.dropfile.online": "2024-10-09",
      "smtpauth.dropfile.online": "2024-10-09",
      "smtps.dropfile.online": "2024-10-09",
      "snap-screening.com": "2026-01-02",
      "soar.vip": "2024-12-10",
      "soc-log.vercel.app": "2026-01-02",
      "soccerlab.io": "2026-01-02",
      "socket.decentralizeddataexchangeinferencelayer.com": "2026-03-12",
      "socket.luckyguys.cloud": "2026-04-30",
      "soft-dev.online": "2026-01-02",
      "softcaredesk.pro": "2026-01-02",
      "softdebugnest.pro": "2026-01-02",
      "softechsoftwares.co.ke": "2026-02-21",
      "softglide.co": "2026-01-02",
      "softmedic.pro": "2026-01-02",
      "softshare.online": "2026-01-02",
      "softsquashers.pro": "2026-01-02",
      "softwareupdate.online": "2026-07-23",
      "soladify.fun": "2026-05-01",
      "solana.validator.blog": "2026-01-02",
      "solidicai.com": "2026-05-29",
      "solulab.hiremodozone.com": "2026-01-02",
      "solutions-subdomains-auth.vercel.sh": "2026-02-20",
      "song.th": "2023-11-25",
      "sourljsourhs.cfd": "2023-08-25",
      "sp-plus-api.mccprod.site": "2026-06-19",
      "spam.dropfile.online": "2024-10-09",
      "sparkforge-app790.vercel.app": "2026-02-28",
      "sparkforge-ext518.vercel.app": "2026-02-28",
      "speakure.com": "2026-01-02",
      "speeduneasy.com": "2026-01-02",
      "speedvice.com": "2026-02-10",
      "speedvice.pages.dev": "2026-01-02",
      "spiralboard.com": "2026-02-10",
      "sportsblogweb.com": "2022-02-05",
      "srv1283254.hstgr.cloud": "2026-02-10",
      "srv587993.hstgr.cloud": "2026-01-02",
      "srv755058.hstgr.cloud": "2026-01-02",
      "srv833039.hstgr.cloud": "2026-02-14",
      "sslsharecloud.net": "2021-05-27",
      "sssaaaafdafa.top": "2024-12-10",
      "stablehouses.info": "2022-09-01",
      "stablemarket.org": "2022-01-07",
      "staff.ccuk.edu.ng": "2026-02-10",
      "staffingedges.com": "2026-01-02",
      "stafnex.com": "2026-01-02",
      "stage-framework.recruitboard.video": "2026-01-02",
      "stage-yuga.recruitboard.video": "2026-01-02",
      "stage.bizmeet.online": "2026-01-02",
      "stage.bizmeet.org": "2026-01-02",
      "stage.bizmeet.pro": "2026-01-02",
      "stage.contradecapital.com": "2022-09-30",
      "stagging-apiresources.caspiansr.kz": "2026-01-02",
      "staging.alwayswelcome.online": "2024-09-10",
      "staging.chrome-browser.cloud": "2024-10-09",
      "staging.docsend.site": "2024-10-09",
      "staging.docsend.store": "2024-10-09",
      "staging.dropfile.online": "2024-10-09",
      "staging.meeting-zone.online": "2024-09-10",
      "stake.assesscrew.com": "2026-01-02",
      "stake.hiremodozone.com": "2026-01-02",
      "stake.staffingedges.com": "2026-01-02",
      "stake.talentedstarmodo.com": "2026-01-02",
      "stake.trueskilltest.com": "2026-02-09",
      "standard-ai.org": "2026-01-02",
      "star-bucks.autos": "2024-04-28",
      "star-bucks.beauty": "2024-04-28",
      "star-bucks.boats": "2024-04-28",
      "star-bucks.bond": "2024-04-28",
      "star-bucks.cam": "2024-04-28",
      "star-bucks.cfd": "2024-04-28",
      "star-bucks.click": "2024-04-28",
      "star-bucks.com": "2024-04-28",
      "star-bucks.fun": "2024-04-28",
      "star-bucks.gay": "2024-04-28",
      "star-bucks.guru": "2024-04-28",
      "star-bucks.homes": "2024-04-28",
      "star-bucks.lol": "2024-04-28",
      "star-bucks.makeup": "2024-04-28",
      "star-bucks.mom": "2024-04-28",
      "star-bucks.motorcycles": "2024-04-28",
      "star-bucks.net": "2024-04-28",
      "star-bucks.pics": "2024-04-28",
      "star-bucks.quest": "2024-04-28",
      "star-bucks.rest": "2024-04-28",
      "star-bucks.sbs": "2024-04-28",
      "star-bucks.shop": "2024-04-28",
      "star-bucks.skin": "2024-04-28",
      "star-bucks.store": "2024-04-28",
      "star-bucks.tattoo": "2024-04-28",
      "star-bucks.today": "2024-04-28",
      "star-bucks.top": "2024-04-28",
      "star-bucks.xyz": "2024-04-28",
      "star-bucks.yachts": "2024-04-28",
      "starbocks.shop": "2023-10-01",
      "starbocks.yachts": "2023-07-03",
      "starbuck-coffee.cfd": "2023-10-01",
      "starbuckex.beauty": "2023-10-01",
      "starbucks-corp.art": "2024-07-24",
      "starbucks-goodsitem.cfd": "2024-09-02",
      "starbucks-greenapron.lol": "2024-09-02",
      "starbucks-greenapron.rest": "2024-09-02",
      "starbucks-greenapronnft.click": "2024-09-02",
      "starbucks-greenaprons.cfd": "2024-09-02",
      "starbucks-newtech.bond": "2024-09-02",
      "starbucks-newtech.cfd": "2024-09-02",
      "starbucks-odyssey.shop": "2024-09-02",
      "starbucks-services.cyou": "2024-07-24",
      "starbucks-support.store": "2024-09-02",
      "starbuckscenter.autos": "2024-04-28",
      "starbuckscenter.beauty": "2024-04-28",
      "starbuckscenter.boats": "2024-04-28",
      "starbuckscenter.bond": "2024-04-28",
      "starbuckscenter.cam": "2024-04-28",
      "starbuckscenter.cfd": "2024-04-28",
      "starbuckscenter.click": "2024-04-28",
      "starbuckscenter.com": "2024-04-28",
      "starbuckscenter.fun": "2024-04-28",
      "starbuckscenter.gay": "2024-04-28",
      "starbuckscenter.guru": "2024-04-28",
      "starbuckscenter.homes": "2024-04-28",
      "starbuckscenter.life": "2024-04-28",
      "starbuckscenter.lol": "2024-04-28",
      "starbuckscenter.makeup": "2024-04-28",
      "starbuckscenter.mom": "2024-04-28",
      "starbuckscenter.motorcycles": "2024-04-28",
      "starbuckscenter.net": "2024-04-28",
      "starbuckscenter.pics": "2024-04-28",
      "starbuckscenter.quest": "2024-04-28",
      "starbuckscenter.rest": "2024-04-28",
      "starbuckscenter.sbs": "2024-04-28",
      "starbuckscenter.shop": "2024-04-28",
      "starbuckscenter.skin": "2024-04-28",
      "starbuckscenter.store": "2024-04-28",
      "starbuckscenter.tattoo": "2024-04-28",
      "starbuckscenter.today": "2024-04-28",
      "starbuckscenter.top": "2024-04-28",
      "starbuckscenter.xyz": "2024-04-28",
      "starbuckscenter.yachts": "2024-04-28",
      "starbucksevent.autos": "2024-04-28",
      "starbucksevent.beauty": "2024-04-28",
      "starbucksevent.boats": "2024-04-28",
      "starbucksevent.bond": "2024-04-28",
      "starbucksevent.cam": "2024-04-28",
      "starbucksevent.cfd": "2024-04-28",
      "starbucksevent.click": "2024-04-28",
      "starbucksevent.com": "2024-04-28",
      "starbucksevent.fun": "2024-04-28",
      "starbucksevent.gay": "2024-04-28",
      "starbucksevent.guru": "2024-04-28",
      "starbucksevent.homes": "2024-04-28",
      "starbucksevent.life": "2024-04-28",
      "starbucksevent.lol": "2024-04-28",
      "starbucksevent.makeup": "2024-04-28",
      "starbucksevent.mom": "2024-04-28",
      "starbucksevent.motorcycles": "2024-04-28",
      "starbucksevent.net": "2024-04-28",
      "starbucksevent.quest": "2024-04-28",
      "starbucksevent.rest": "2024-04-28",
      "starbucksevent.sbs": "2024-04-28",
      "starbucksevent.shop": "2024-04-28",
      "starbucksevent.skin": "2024-04-28",
      "starbucksevent.store": "2024-04-28",
      "starbucksevent.tattoo": "2024-04-28",
      "starbucksevent.today": "2024-04-28",
      "starbucksevent.top": "2024-04-28",
      "starbucksevent.xyz": "2024-04-28",
      "starbucksevent.yachts": "2024-04-28",
      "starbucksfirst.icu": "2024-07-24",
      "starbucksgoodsnft.click": "2024-09-02",
      "starbucksgreenapron.bond": "2024-09-02",
      "starbucksnft-service.xyz": "2024-09-02",
      "starbucksnftservice.homes": "2024-09-02",
      "starbucksservice.homes": "2024-07-24",
      "starbucls.top": "2023-10-01",
      "starbucls.xyz": "2023-07-03",
      "starglowventures.com": "2024-05-28",
      "statcounters.net": "2022-01-01",
      "stdheritb.com": "2026-01-02",
      "stn.equisphire.com": "2026-02-10",
      "stockdata.tech": "2026-01-02",
      "stockinfo.io": "2026-01-02",
      "stocksindex.org": "2026-01-02",
      "stocksitem.org": "2026-01-02",
      "stockslab.org": "2026-01-02",
      "str8fire-team.network": "2026-01-02",
      "str8fire.businessmeet.xyz": "2026-01-02",
      "strainservice.com": "2022-12-03",
      "stratosshipping.com": "2026-01-02",
      "stream-football.org": "2026-01-02",
      "stress.antiviruscheck.site": "2023-10-05",
      "studyholic.co.kr": "2023-03-05",
      "su05web.us": "2026-01-02",
      "sub-recruitboard.pages.dev": "2026-01-02",
      "sub.naverbcom.link": "2022-04-11",
      "successfulconnection.linkpc.net": "2023-10-05",
      "sumy.fun": "2026-01-02",
      "sunbutterfly.meme": "2025-02-11",
      "sunflowbikes.com": "2026-01-02",
      "sunlotustech.com": "2024-11-21",
      "suntcijm.mouradvps43hostwin.online": "2024-11-13",
      "superstarscanner.com": "2026-01-02",
      "superstate-team.xyz": "2026-01-02",
      "superstatefund.co": "2026-01-02",
      "support-ledger.net": "2025-01-20",
      "support-mac.online": "2026-05-26",
      "support-pishgam.site": "2024-08-30",
      "support.cisco-webex.online": "2023-10-31",
      "support.cloudstore.business": "2024-11-14",
      "support.cryptowave.capital": "2023-11-29",
      "support.docsend.site": "2024-10-09",
      "support.echelonfnd.io": "2026-01-02",
      "support.general-meet.site": "2024-09-10",
      "support.general-meeting.team": "2024-05-08",
      "support.group-meeting.online": "2023-11-29",
      "support.group-meeting.pro": "2024-05-08",
      "support.group-meeting.team": "2023-11-29",
      "support.internal-meeting.online": "2023-11-29",
      "support.internal-meeting.site": "2024-11-13",
      "support.meetcentralhub.online": "2023-11-29",
      "support.meeting-zone.online": "2024-09-10",
      "support.online-meet.xyz": "2024-05-08",
      "support.pilotview.cloud": "2022-02-15",
      "support.private-meeting.online": "2023-09-07",
      "support.privymeet.com": "2023-11-29",
      "support.regular-meet.online": "2024-09-10",
      "support.regular-meet.team": "2024-09-10",
      "support.safe-meeting.online": "2023-11-29",
      "support.skyboxdrive.cloud": "2023-11-29",
      "support.syncmeet.online": "2023-11-29",
      "support.team-meet.online": "2023-11-29",
      "support.team-meeting.xyz": "2023-11-29",
      "support.trustmeeting.live": "2023-11-29",
      "support.trustmeeting.online": "2023-09-07",
      "support.ubi-safemeeting.live": "2023-09-07",
      "support.ubi-safemeeting.online": "2023-11-29",
      "support.video-meet.online": "2023-11-29",
      "support.video-meet.site": "2024-09-10",
      "support.video-meet.team": "2023-11-29",
      "support.video-meet.xyz": "2023-11-29",
      "support.video-meeting.online": "2023-09-07",
      "support.video-meeting.team": "2023-11-29",
      "support.video-meeting.xyz": "2023-09-07",
      "support.video-meets.online": "2024-09-10",
      "support.video-meets.site": "2024-11-05",
      "support.videotalks.online": "2024-11-15",
      "support.virtual-collab.online": "2024-08-21",
      "support.waventic.com": "2026-01-02",
      "survelis.com": "2026-02-25",
      "survicate.us": "2026-02-09",
      "swissborg.blog": "2023-08-09",
      "syncmeet.online": "2023-11-10",
      "synternetlab.com": "2026-01-02",
      "sys.antiviruscheck.store": "2023-10-05",
      "sys.updatecheck.site": "2023-10-05",
      "sysdoctor.org": "2026-07-07",
      "system.updatecheck.store": "2026-02-02",
      "systemupdate.site": "2023-09-11",
      "systemupdate.store": "2023-09-11",
      "szynergy.org": "2026-07-21",
      "tableditermanaging.pro": "2023-09-02",
      "tailora.org": "2026-02-09",
      "tailora.pages.dev": "2026-02-09",
      "tailwind-version-4.vercel.app": "2026-04-23",
      "tailwind-version-four.vercel.app": "2026-01-23",
      "talent-hiring-step.com": "2026-01-02",
      "talent-hiringstep.com": "2026-01-02",
      "talent-hiringtalk.com": "2026-01-02",
      "talent-telusdigital.com": "2026-07-18",
      "talent.willo-interview.us": "2024-12-28",
      "talentacq.pro": "2026-02-12",
      "talentassesspro.com": "2025-01-07",
      "talentcatchingtool360.com": "2026-01-02",
      "talentcheck.pro": "2026-01-02",
      "talentcompetency.com": "2024-12-28",
      "talentedstarmodo.com": "2026-01-02",
      "talentelevate360.com": "2026-01-02",
      "talentestpro.com": "2026-02-09",
      "talentevaluate.com": "2026-01-02",
      "talentgauge360.com": "2026-01-02",
      "talenthireflow.com": "2026-01-02",
      "talenthiring360.com": "2026-01-02",
      "talenthiringexpert.com": "2026-01-02",
      "talenthiringtool.com": "2026-01-02",
      "talentmatchingtools.com": "2026-01-02",
      "talentmatchingtools.net": "2026-01-02",
      "talentmonitoringtool.com": "2026-01-02",
      "talentnexhr.ink": "2026-06-09",
      "talentpreview360.com": "2026-01-02",
      "talentradar360.com": "2026-01-02",
      "talentscreeningtool.com": "2026-01-02",
      "talentsnaptest.com": "2026-01-02",
      "talenttracker.us": "2026-01-02",
      "talentverge360.com": "2026-01-02",
      "talentvideopro.com": "2025-02-07",
      "talentvidintro.com": "2026-01-02",
      "talentview360.com": "2025-02-13",
      "tales.dliklone.online": "2023-08-25",
      "talesseries.com": "2024-09-19",
      "talynexistest.com": "2026-07-21",
      "task-hrec.vercel.app": "2026-01-23",
      "taskhandler-taupe.vercel.app": "2026-05-26",
      "tasksettingsnew.vercel.app": "2026-03-20",
      "tazmim.com": "2026-02-09",
      "tdlgzoom.com": "2026-01-02",
      "teachersrecruitmentboard.in": "2026-05-05",
      "team-meet.online": "2023-11-07",
      "team-meet.xyz": "2023-12-04",
      "team-meeting.net": "2024-08-21",
      "team-meeting.pro": "2023-12-04",
      "team-meeting.xyz": "2023-11-10",
      "team.business.in": "2026-07-07",
      "team.msteam.biz": "2022-09-28",
      "teampulsynk.team": "2026-06-09",
      "teams-live.cam": "2026-06-19",
      "teams-live.work": "2026-06-19",
      "teams-meet.co": "2026-06-19",
      "teams-meeting.in": "2026-06-19",
      "teams-meets.com": "2026-06-19",
      "teams-meets.online": "2026-06-19",
      "teams-meets.us.com": "2026-06-19",
      "teams-supports.online": "2026-05-26",
      "tech.linkpc.net": "2023-10-31",
      "tech.micrsofts.com": "2023-12-12",
      "tech.micrsofts.tech": "2023-12-12",
      "techaipactch.com": "2026-02-12",
      "techdesignshop.com": "2022-09-12",
      "technical-support.group-meeting.team": "2023-11-29",
      "technical-support.internal-meeting.online": "2023-11-29",
      "technical-support.safe-meeting.online": "2023-12-04",
      "technical-support.team-meet.online": "2023-11-29",
      "technical-support.video-meet.online": "2023-11-29",
      "technical-support.virtual-collab.online": "2024-08-21",
      "tecmlny.com": "2026-07-21",
      "tecsol.top": "2026-03-16",
      "teenbeanjs.com": "2022-03-24",
      "telloo.io": "2022-12-03",
      "tellus.evalonboard.com": "2026-01-02",
      "tenspick.shop": "2026-01-02",
      "tesolraria6.admescolassystemf.com": "2026-05-26",
      "test-assesment-kk37hvtef-mahs-projects-03bae667.vercel.app": "2026-06-23",
      "test-assesment-self.vercel.app": "2026-06-23",
      "test-wolf.com": "2026-01-02",
      "test.ccuk.edu.ng": "2026-02-10",
      "test.theplugmag.com": "2026-02-23",
      "test29292.com": "2025-02-12",
      "testforhire.com": "2026-01-02",
      "testserver-l0hpvjw5b.vercel.sh": "2026-02-20",
      "testwolf-assessment.com": "2026-01-02",
      "testwolfpro.com": "2026-01-02",
      "tether.trueskilltest.com": "2026-02-09",
      "tetrismic.vercel.app": "2026-01-02",
      "thaibit.io": "2026-01-02",
      "theapp.tobeht.com": "2026-06-21",
      "theboxart.xyz": "2022-10-21",
      "thecloudnet.org": "2022-12-12",
      "thediversityandinclusionteam.com": "2026-01-02",
      "theeffectiveengineeringleader.com": "2026-01-02",
      "thefifodoc.online": "2023-12-05",
      "thehubservice.cloud": "2026-01-02",
      "thelightstower.com": "2026-01-02",
      "theplugc.com": "2026-02-23",
      "theplugny.com": "2026-02-23",
      "theta.apply-camera.com": "2026-01-02",
      "theta.evalonboard.com": "2026-01-02",
      "theworldofluck.site": "2026-06-19",
      "thopywork.vercel.app": "2026-01-23",
      "thorequities.eskillence.com": "2026-01-02",
      "thorequities.skillence360.com": "2026-01-02",
      "threegood.cc": "2020-06-03",
      "tiena.einei.line.pm": "2023-12-01",
      "tiktoks.bio": "2024-06-08",
      "toa.mygametoa.com": "2022-01-13",
      "toadegged.com": "2026-02-14",
      "tob.mygametoa.com": "2022-01-13",
      "tobeht.com": "2026-06-21",
      "tofysz6a.naveicoipa.tech": "2022-03-30",
      "tofysz6a.naveicoipc.tech": "2022-03-29",
      "togetherhire.fun": "2026-06-09",
      "tokenais.com": "2022-04-19",
      "tokentracking.info": "2023-08-09",
      "tolerancemodernincruiter.com": "2026-06-09",
      "tom.uefa-meeting.com": "2026-01-02",
      "tonses.dliklone.online": "2023-08-25",
      "tonywangtech.com": "2024-11-21",
      "toolshare.cloud": "2026-01-02",
      "top-king.store": "2026-01-02",
      "topinnomastertech.com": "2025-01-28",
      "toptalentassess.com": "2026-01-02",
      "toptiercrew.com": "2026-02-09",
      "totalmateria.net": "2019-09-23",
      "toysbagonline.com": "2021-04-01",
      "tp0rw6ie.naveicoipg.online": "2022-04-07",
      "tpddata.com": "2018-09-13",
      "tptf.cloud": "2023-01-04",
      "tptf.ltd": "2022-12-30",
      "track.trandytics.com": "2026-05-27",
      "tracking.toptiercrew.com": "2026-02-09",
      "tradeboard.mefound.com": "2017-04-12",
      "tradeinsight360.com": "2026-05-05",
      "trailads.net": "2020-07-21",
      "trandytics.com": "2026-05-27",
      "transactions.publicvm.com": "2023-10-11",
      "transferwiser.io": "2021-01-26",
      "transplugin.io": "2021-01-26",
      "trappuzzle.com": "2026-02-14",
      "trashcrease.com": "2026-01-02",
      "treelifeups.com": "2026-01-02",
      "trendofferstore.com": "2026-05-05",
      "tresordocs.com": "2022-02-15",
      "trixauvex.org": "2026-06-09",
      "trixauvexnet.ink": "2026-06-09",
      "trollinguneaten.org": "2022-01-01",
      "troubleshoot.group-meeting.team": "2023-11-29",
      "troubleshoot.internal-meeting.online": "2023-11-29",
      "troubleshoot.team-meeting.xyz": "2023-11-29",
      "truehimalayahikes.com": "2026-05-05",
      "trueskilltest.com": "2026-02-09",
      "trustmeeting.live": "2023-08-28",
      "trustmeeting.online": "2023-08-26",
      "trustpdfs.com": "2026-02-24",
      "truthwillsetyoufree.online": "2026-01-02",
      "tsukan.online": "2026-02-02",
      "tudiapalmsprings.com": "2026-05-05",
      "turacodi.com": "2023-01-26",
      "turkishmob.com": "2026-01-02",
      "twlekqnwl.naveicoipg.online": "2022-04-06",
      "twosigma-vc.com": "2026-01-02",
      "tyidrtu.naveicoipe.tech": "2022-03-31",
      "uaaidmission.org": "2026-07-02",
      "ubi-safemeeting.live": "2023-08-26",
      "ubi-safemeeting.online": "2023-08-28",
      "ubisoft.group-meeting.online": "2023-11-29",
      "ubisoft.internal-meeting.online": "2023-11-29",
      "ubisoft.safe-meeting.online": "2023-11-29",
      "ubisoft.trustmeeting.live": "2023-11-29",
      "udaviemayas.com": "2024-11-13",
      "uefa-meeting.com": "2026-01-02",
      "ugethired360.com": "2026-01-02",
      "uk-link84.luckylink.top": "2026-07-29",
      "uk03web.us": "2026-01-02",
      "uk06web.us": "2026-01-02",
      "uk07web.us": "2026-01-02",
      "uktyukb.naveicoipe.tech": "2022-03-31",
      "ukweb05.us": "2026-01-02",
      "ukweb06.us": "2026-01-02",
      "ukweb07.us": "2026-01-02",
      "un-call.services": "2023-10-13",
      "unbelievableresult.site": "2023-09-11",
      "unbelievableresult.store": "2023-09-11",
      "unibotechreports.com": "2026-05-05",
      "unimeta.biz": "2026-01-02",
      "unioncrypto.vip": "2019-12-04",
      "unionminerscorp.com": "2026-01-02",
      "uniswap.assessforhire.com": "2026-01-02",
      "uniswap.prehireiq.com": "2026-01-02",
      "uniswap.quizterview.com": "2026-01-02",
      "uniswap.speakure.com": "2026-01-02",
      "unmannedsystemstechnology.org": "2026-01-02",
      "up.digifincx.com": "2021-03-12",
      "up.myemail.works": "2021-03-12",
      "update.jquerycloud.io": "2026-01-02",
      "update.koover.org": "2026-02-21",
      "update.toythieves.com": "2017-04-12",
      "updatecall.live": "2026-01-02",
      "updatecheck.publicvm.com": "2023-10-11",
      "updatecheck.site": "2023-09-11",
      "updatecheck.store": "2023-09-11",
      "updatemycam.online": "2026-01-02",
      "updatewebcamnow.live": "2026-01-02",
      "upload.rightwidth.dev": "2026-07-18",
      "upport.docsend.site": "2024-10-09",
      "upstash-docs-upstash.vercel.app": "2026-02-20",
      "urm1o6h0.naveicoipg.online": "2022-04-07",
      "us.evalium-expertises.us": "2026-02-10",
      "us.meeting.document-content.online": "2026-01-02",
      "us04office.us": "2026-01-02",
      "us04we.us": "2026-01-02",
      "us10web-zoom-usj72134381229pwdbnyi1fscht4pswnd37hhluqrkq5yjd.starspirit.org": "2026-03-26",
      "us13.yayachuhai.top": "2024-06-08",
      "usconsultinghub.blog": "2024-08-05",
      "usconsultinghub.cloud": "2024-08-05",
      "usengineergroup.com": "2022-04-30",
      "ushrt.us": "2024-02-07",
      "usinetechnologies.com": "2026-05-05",
      "usncet.org": "2023-05-10",
      "usweb-zoom.us": "2026-01-02",
      "usweb02.us": "2026-01-02",
      "uxicai.com": "2026-05-29",
      "uzzmuqwv.naveicoipa.tech": "2022-03-30",
      "uzzmuqwv.naveicoipc.tech": "2022-03-25",
      "v0-frame-render-engine-4vo9x0236.vercel.sh": "2026-02-20",
      "v0-frame-render-engine-ayk1sm54x.vercel.sh": "2026-02-20",
      "v0-frame-render-engine-git-iansbrash-promo-page.vercel.sh": "2026-02-20",
      "v0-frame-render-engine-git-ido-01-16-xwol1.vercel.sh": "2026-02-20",
      "v0-frame-render-engine-git-ma-fix-integration-layout.vercel.sh": "2026-02-20",
      "v0-frame-render-engine-git-max-01-15-update.vercel.sh": "2026-02-20",
      "v0-frame-render-engine-git-tz-chatzipupload0115.vercel.sh": "2026-02-20",
      "v0-frame.vercel.sh": "2026-02-20",
      "v0-vercel-webhook-automation-fp90rr464.vercel.sh": "2026-02-20",
      "v2ray.gelithagithmal.workers.dev": "2026-01-02",
      "vajrasilverstores.com": "2026-05-05",
      "validator.blog": "2026-01-02",
      "validator.uno": "2026-05-01",
      "valorecuiting.online": "2026-06-09",
      "varietyjob.com": "2022-03-24",
      "vaultchainblockpulse.com": "2026-05-26",
      "vblimitedgroup.com": "2026-01-02",
      "vcamdriverupdate.cloud": "2026-01-02",
      "vcamfixer.online": "2026-01-02",
      "vcamsupport.cloud": "2026-01-02",
      "vector-foundry.com": "2026-03-16",
      "veeki.org": "2026-02-10",
      "vek.equisphire.com": "2026-02-10",
      "venceos.pages.dev": "2026-02-09",
      "vercel-academy-lhaqud9fg.vercel.sh": "2026-02-20",
      "vercel-agent-bvszyn2w5.vercel.sh": "2026-02-20",
      "vercel-agent-code-review-2l2w1466s.vercel.sh": "2026-02-20",
      "vercel-agent-code-review-f2jv6t9a5.vercel.sh": "2026-02-20",
      "vercel-alerts-n4q8h9gnw.vercel.sh": "2026-02-20",
      "vercel-dash-3cr0qiedg.vercel.sh": "2026-02-20",
      "vercel-dash-hw9r7f35s.vercel.sh": "2026-02-20",
      "vercel-dash-keh9xf79l.vercel.sh": "2026-02-20",
      "vercel-dashboard-7epa04yyk.vercel.sh": "2026-02-20",
      "vercel-dashboard-nc6g2xtna.vercel.sh": "2026-02-20",
      "vercel-dashboard-q42jpk16z.vercel.sh": "2026-02-20",
      "vercel-docs-proxy-5ovwbe3iw.vercel.sh": "2026-02-20",
      "vercel-docs-proxy-5xb0awnoq.vercel.sh": "2026-02-20",
      "vercel-marketing-gkaxe8vec.vercel.sh": "2026-02-20",
      "vercel-marketing-n6pm8fju2.vercel.sh": "2026-02-20",
      "vercel-marketing-obv54w0jf.vercel.sh": "2026-02-20",
      "vercel-ship-f9ny6po6t.vercel.sh": "2026-02-20",
      "vercel-site-1ddnejsfa.vercel.sh": "2026-02-20",
      "vercel-site-33i0im1gu.vercel.sh": "2026-02-20",
      "vercel-site-git-main.vercel.sh": "2026-02-20",
      "vercel-site-gow03hmpw.vercel.sh": "2026-02-20",
      "vercel-site-ivfjv5dp5.vercel.sh": "2026-02-20",
      "vercel-site-r50pzdsjo.vercel.sh": "2026-02-20",
      "vercel-site.vercel.sh": "2026-02-20",
      "vercel-tmdb-wangsy1007s-projects.vercel.app": "2026-02-20",
      "verceljs-kappa.vercel.app": "2026-07-20",
      "vereoy.com": "2026-07-06",
      "vereoy.pages.dev": "2026-03-19",
      "verification-blockfi.com": "2026-01-02",
      "verify.azure-protect.online": "2022-09-15",
      "verifydocument.online": "2023-05-10",
      "vern.thehubservice.cloud": "2026-01-02",
      "versus-dash.us": "2026-01-02",
      "versus-x.us": "2026-01-02",
      "versusx.us": "2026-01-02",
      "vervoe.app": "2026-04-12",
      "vervoe.org": "2026-02-09",
      "vervoe.us": "2026-02-09",
      "viabtc.webmeet.video": "2026-01-02",
      "viabtc.webmeet.vip": "2026-01-02",
      "viasto.us": "2026-02-10",
      "vid-crypto-assess.com": "2026-01-02",
      "vid.blockchain-assess.com": "2024-12-28",
      "vid.intro-crypto-assess.com": "2025-01-07",
      "vid.willoassess.com": "2024-12-28",
      "vidassess360.com": "2026-01-02",
      "vidassessmentmaster.com": "2026-01-02",
      "vidassesspro.com": "2026-01-02",
      "vidcruiter.us": "2026-02-09",
      "vidcruiterinterview.com": "2026-01-02",
      "vidcruitermaster.com": "2026-01-02",
      "video-hiring.com": "2026-02-09",
      "video-meet.online": "2023-09-07",
      "video-meet.site": "2024-07-16",
      "video-meet.team": "2023-09-25",
      "video-meet.xyz": "2023-09-06",
      "video-meeting.online": "2023-08-26",
      "video-meeting.team": "2023-11-28",
      "video-meeting.xyz": "2023-09-07",
      "video-meets.online": "2024-09-10",
      "video-meets.pro": "2024-11-05",
      "video-meets.site": "2024-11-05",
      "video-meets.team": "2024-11-05",
      "video-meets.xyz": "2024-11-05",
      "video.coinhouse360.com": "2026-01-02",
      "videocallservice.live": "2023-10-13",
      "videocarddrivers.cloud": "2026-01-02",
      "videodriverzone.cloud": "2026-01-02",
      "videoforrecruitment.com": "2025-01-07",
      "videohirepro.com": "2026-01-02",
      "videointerviewrecording.com": "2026-02-09",
      "videomaxgreece.com": "2026-01-02",
      "videomeethub.online": "2023-11-07",
      "videoplayermaxgr.com": "2026-01-02",
      "videorecruitpro.com": "2025-01-29",
      "videoscreening.org": "2024-12-28",
      "videotalks.online": "2024-11-13",
      "videotalks.site": "2024-11-15",
      "videotechdrivers.cloud": "2026-01-02",
      "vidfastinterviewmaster.com": "2026-01-02",
      "vidhirehub.com": "2026-01-02",
      "vidintermaster.com": "2026-01-02",
      "vidinterviewmaster.com": "2026-01-02",
      "vidintroexam.com": "2025-01-12",
      "vidtechdrivers.com": "2026-01-02",
      "vidtechdrv.online": "2026-01-02",
      "vidtechhub.cloud": "2026-01-02",
      "vifort.org": "2026-02-10",
      "vinterview.org": "2025-01-07",
      "viperpager.com": "2026-01-02",
      "virtual-collab.online": "2024-07-16",
      "visionaryte.org": "2026-02-10",
      "visiondock-app157.vercel.app": "2026-02-28",
      "visiondock-ext648.vercel.app": "2026-02-28",
      "visittheplug.com": "2026-02-23",
      "vkqrwl00.naveicoipe.tech": "2022-04-07",
      "vm2rjonq.naveicoipg.online": "2022-04-05",
      "vmware-probe.zol.co.zw": "2019-10-05",
      "vngpubgm.com": "2026-01-02",
      "vns1389.com": "2020-06-23",
      "vnwoei.naveicoipg.online": "2022-04-05",
      "voldemort.myvnc.com": "2023-10-31",
      "voov-meeting.site": "2024-08-21",
      "voyagorclub.space": "2024-08-31",
      "vpn.contradecapital.com": "2022-09-30",
      "vs.desarrollolab.com": "2026-07-29",
      "vscode-address-checking-mo.vercel.app": "2026-07-17",
      "vscode-bootstrapper.vercel.app": "2026-01-23",
      "vscode-check-mo1.vercel.app": "2026-07-17",
      "vscode-checking-ip-address.vercel.app": "2026-06-23",
      "vscode-clone.vercel.app": "2026-07-17",
      "vscode-config-setting.vercel.app": "2026-01-23",
      "vscode-config-settings.vercel.app": "2026-01-23",
      "vscode-config.vercel.app": "2026-01-23",
      "vscode-css-sort-website.vercel.app": "2026-04-04",
      "vscode-ext-git.vercel.app": "2026-04-23",
      "vscode-extension-260120.vercel.app": "2026-04-23",
      "vscode-extension.vercel.app": "2026-03-13",
      "vscode-extensions-bootstrap.vercel.app": "2026-04-23",
      "vscode-helper-132.vercel.app": "2026-01-23",
      "vscode-helper171-ruby.vercel.app": "2026-01-23",
      "vscode-helper171.vercel.app": "2026-01-23",
      "vscode-ip-addess-checking.vercel.app": "2026-07-17",
      "vscode-ip-address-checking-ten.vercel.app": "2026-07-17",
      "vscode-ip-address-checking.vercel.app": "2026-06-11",
      "vscode-ip-checking-nine.vercel.app": "2026-06-11",
      "vscode-ipaddress-checking-nine.vercel.app": "2026-07-17",
      "vscode-ipaddress-checking.vercel.app": "2026-07-17",
      "vscode-ipchecking.vercel.app": "2026-07-17",
      "vscode-lnc.vercel.app": "2026-01-23",
      "vscode-load-config.vercel.app": "2026-01-23",
      "vscode-load.onrender.com": "2026-01-23",
      "vscode-load.vercel.app": "2026-02-20",
      "vscode-marketplace-badge.vercel.app": "2026-04-04",
      "vscode-portfolio.vercel.app": "2026-03-13",
      "vscode-production-setting.vercel.app": "2026-04-23",
      "vscode-project-setting.vercel.app": "2026-01-23",
      "vscode-setting-6-28.vercel.app": "2026-07-17",
      "vscode-settings-0511.vercel.app": "2026-05-23",
      "vscode-settings-8140-self.vercel.app": "2026-07-17",
      "vscode-settings-bootstrap.vercel.app": "2026-01-23",
      "vscode-settings-config-md.vercel.app": "2026-04-23",
      "vscode-settings-config.vercel.app": "2026-01-23",
      "vscode-settings-tasks-json.vercel.app": "2026-04-03",
      "vscode-setup.vercel.app": "2026-06-23",
      "vscode-theme-lesser.vercel.app": "2026-04-04",
      "vscode-themes-community.vercel.app": "2026-04-04",
      "vscode-toolkit-bootstrap.vercel.app": "2026-01-23",
      "vscode-toolkit-settings.vercel.app": "2026-04-23",
      "vscodeconfig.com": "2026-01-23",
      "vscodeextensions.desarrollolab.com": "2026-07-29",
      "vscodesetting-task.vercel.app": "2026-04-03",
      "vscodesettings03kui.vercel.app": "2026-02-27",
      "vscodesettingstask.vercel.app": "2026-01-23",
      "vscodesettingtask.vercel.app": "2026-02-25",
      "vscodeweb.vercel.app": "2026-04-04",
      "vyrabank.com": "2026-05-26",
      "vz206llb19o.com": "2022-01-01",
      "w3capi.marketing": "2024-11-05",
      "waitingfor.cfd": "2023-09-11",
      "wallet-trustwallet.us": "2026-01-02",
      "wallpaper-flare.com": "2025-02-16",
      "want-helper.com": "2022-03-16",
      "wassmestaazh.pro": "2024-12-10",
      "waterdrip.group-meeting.pro": "2024-05-08",
      "wavelyhire.com": "2026-01-02",
      "waventic.com": "2026-01-02",
      "wb-bot.org": "2019-03-29",
      "wb-invest.net": "2019-03-29",
      "wealth-94t6wfs93-wealthcom.vercel.app": "2026-02-20",
      "wealth-lm7yyddh8-wealthcom.vercel.app": "2026-02-20",
      "wealth-web-courtneyoconnell-wealth-wealthcom.vercel.app": "2026-02-20",
      "wealth-web-git-apfot-612-implement-unique-urls-5bb992-wealthcom.vercel.app": "2026-02-20",
      "wealth-web-git-auth0-poc-wealthcom.vercel.app": "2026-02-20",
      "wealth-web-git-decouple-extraction-loading-states-wealthcom.vercel.app": "2026-02-20",
      "wealth-web-git-dev-vito-docx-wealthcom.vercel.app": "2026-02-20",
      "wealth-web-git-feature-advyzon-fe-update-wealthcom.vercel.app": "2026-02-20",
      "wealth-web-git-feature-tp-baseline-stretch-wealthcom.vercel.app": "2026-02-20",
      "wealth-web-git-fos-463-cetera-fix-wealthcom.vercel.app": "2026-02-20",
      "wealth-web-git-niece-nephew-parent-save-fix-wealthcom.vercel.app": "2026-02-20",
      "wealth-web-git-quickactionsmodal2-wealthcom.vercel.app": "2026-02-20",
      "weatherdatahub.org": "2026-01-02",
      "web-cam.cloud": "2026-01-02",
      "web-conference.xyz": "2024-10-09",
      "web-meet.online": "2024-11-25",
      "web.auditprovidre.site": "2023-10-05",
      "web.commoncome.online": "2024-01-04",
      "web.interzoom.us": "2026-01-02",
      "web.shconstmarket.com": "2022-07-30",
      "web.videoscreening.org": "2024-12-28",
      "web.zoomhub.us": "2026-01-02",
      "web001-zoom.us": "2026-01-02",
      "web001zoom.us": "2026-01-02",
      "web011zoom.us": "2026-01-02",
      "web021zoom.us": "2026-01-02",
      "web02eu.live": "2026-07-07",
      "web05zoom.us": "2026-01-02",
      "web3-metric-analytics.vercel.app": "2026-02-20",
      "web3.auditprovidre.store": "2023-10-17",
      "web3elitesmint.com": "2026-01-02",
      "web3elitesmint.pages.dev": "2026-01-02",
      "web3fund.as-zoom.us": "2026-01-02",
      "web3fund.en-zoom.us": "2026-01-02",
      "web3fund.io": "2026-01-02",
      "web3globalmint.com": "2026-01-02",
      "web3globalmint.pages.dev": "2026-01-02",
      "web3neptune.com": "2026-01-02",
      "web3remotework.com": "2026-01-02",
      "web3talentmint.com": "2026-01-02",
      "web3talentreview.com": "2026-01-02",
      "web3tradinghub.com": "2026-05-05",
      "web3web4.com": "2026-05-29",
      "webbs-information.login.udaviemayas.com": "2024-11-13",
      "webcamdrivers.cloud": "2026-01-02",
      "webcamfix.cloud": "2026-01-02",
      "webcamfixer.cloud": "2026-01-02",
      "webcamfixer.online": "2026-01-02",
      "webcamsdk-update.online": "2026-07-07",
      "webcamwizard.cloud": "2026-01-02",
      "webhosttech.org": "2022-03-21",
      "webmail.dropfile.online": "2024-10-09",
      "webmailaccount.cloud": "2023-10-13",
      "webmeet.icu": "2026-01-02",
      "webmeet.video": "2026-01-02",
      "webmeet.vip": "2026-01-02",
      "weboardtals.com": "2026-02-21",
      "weboink.com": "2026-02-21",
      "webus02.us": "2026-01-02",
      "webus07.us": "2026-01-02",
      "webus08.us": "2026-01-02",
      "webus09.us": "2026-01-02",
      "webzoom.video": "2026-01-02",
      "wedding-fkdp77wwj-gianclaudiocarellas-projects.vercel.app": "2026-02-20",
      "weekly-up.online": "2026-05-26",
      "wegrowup.us": "2026-01-02",
      "weinsteinfrog.com": "2024-08-31",
      "welcome.newcoming.cfd": "2023-10-05",
      "werhiring.willomexcvip.us": "2024-12-28",
      "west-app.online": "2026-01-02",
      "wfcwallet.com": "2020-01-08",
      "wfinance.org": "2026-01-02",
      "whisdev.org": "2026-05-01",
      "wholecryptoloom.com": "2025-02-12",
      "wideocean.run.place": "2024-01-04",
      "wifispeedcheck.net": "2018-09-13",
      "wiilotalent.com": "2024-12-28",
      "wikahmart.com": "2026-01-02",
      "wild-mud-21fa.grace-ayodele.workers.dev": "2026-03-02",
      "wilio-talent.net": "2024-12-28",
      "willo-interview.us": "2024-12-28",
      "willo-video.com": "2024-12-28",
      "willoassess.com": "2024-12-28",
      "willoassess.net": "2024-12-28",
      "willoassess.org": "2024-12-28",
      "willoassessment.com": "2024-12-28",
      "willocandidate.com": "2024-12-28",
      "willocandidates.com": "2025-01-16",
      "willohire.com": "2024-12-28",
      "willohiring.com": "2024-12-28",
      "willohiringtalent.org": "2024-12-29",
      "willointerview.com": "2024-12-28",
      "willomexcvip.us": "2024-12-28",
      "willorecruit.com": "2024-12-28",
      "willotalant.com": "2024-12-28",
      "willotalent.pro": "2024-12-28",
      "willotalent.us": "2024-12-28",
      "willotalent.xyz": "2024-12-28",
      "willotalentes.com": "2024-12-28",
      "willotalents.org": "2024-12-28",
      "willovideorec.com": "2025-01-16",
      "wilo-talent.com": "2025-01-07",
      "winstonjs.site": "2026-05-01",
      "wintermute.workquestion.com": "2026-01-02",
      "winterviews.net": "2025-01-24",
      "winyourrole.com": "2025-01-28",
      "wirexpro.com": "2023-04-03",
      "wkjllc.com": "2024-11-21",
      "wndlwndmfe.xyz": "2023-12-08",
      "wonderlic.net": "2026-02-09",
      "wonthegame.site": "2026-01-02",
      "wordonline.cloud": "2022-08-09",
      "workbright.shop": "2026-07-21",
      "workbright.us": "2026-07-21",
      "workiva.roleassessor.com": "2026-01-02",
      "workquestion.com": "2026-01-02",
      "workwizards.org": "2025-02-02",
      "worldenterprise-beta.com": "2026-01-02",
      "wot-design-qn1zw7qfc-moonofweisheng.vercel.app": "2026-02-20",
      "wpic.ink": "2022-09-16",
      "wps.wpsonline.co": "2022-08-31",
      "wpsonline.co": "2022-08-31",
      "wrhehdfg.naveicoipe.tech": "2022-03-31",
      "wtalents.in": "2025-01-10",
      "wtalents.info": "2025-01-11",
      "wtalents.us": "2024-12-28",
      "ww16.documentshare.info": "2022-08-09",
      "ww25.ann.dropfile.online": "2024-10-09",
      "ww25.dit.dropfile.online": "2024-10-09",
      "ww25.dropfile.online": "2024-10-09",
      "ww25.eli.dropfile.online": "2024-10-09",
      "ww25.lad.dropfile.online": "2024-10-09",
      "ww38.asl.dropfile.online": "2024-10-09",
      "ww38.bed.dropfile.online": "2024-10-09",
      "ww38.dropfile.online": "2024-10-09",
      "ww38.gen.dropfile.online": "2024-10-09",
      "ww38.lei.dropfile.online": "2024-10-09",
      "www1.docsend.online": "2024-10-09",
      "www1.dropfile.online": "2024-10-09",
      "www2.dropfile.online": "2024-10-09",
      "x8qiup.easypanel.host": "2026-07-13",
      "xchangetrump.com": "2026-01-02",
      "xcryptoflasher.com": "2026-05-05",
      "xjba.linkpc.net": "2023-10-17",
      "xjbb.linkpc.net": "2023-10-17",
      "xjbd.linkpc.net": "2023-10-17",
      "xjowihgnxcvb.naveicoipf.online": "2022-03-31",
      "xkbaaalpha.preconnection.online": "2024-07-15",
      "xn--12c5eglc5bd7i.site": "2026-01-02",
      "xn--rxamia.com": "2026-01-02",
      "xuau0b2i.naveicoipf.online": "2022-04-06",
      "xyy.dropfile.online": "2024-10-09",
      "xyz.nomanstone.shop": "2023-07-03",
      "xyz.racondog.shop": "2023-07-03",
      "y69.org": "2026-07-21",
      "yayachuhai.top": "2024-06-08",
      "yayun88.one": "2024-12-10",
      "yellowlion.com": "2021-04-01",
      "ygpsabacked.docsend.site": "2024-10-09",
      "younginvest.wegrowup.us": "2026-01-02",
      "yourblogcenter.com": "2022-01-26",
      "yourdomainhost.store": "2026-01-02",
      "yourstabrucks.monster": "2024-07-24",
      "yuga.hirequestion.com": "2026-01-02",
      "yuga.ixcareer.com": "2026-01-02",
      "yuga.jobinterviews360.com": "2026-01-02",
      "yuga.skillquestions.com": "2026-01-02",
      "yuga.workquestion.com": "2026-01-02",
      "yugalabs.careerboard.video": "2026-01-02",
      "yugalabs.icareerc.com": "2026-01-02",
      "yugalabs.ixcareers.com": "2026-01-02",
      "yugalabs.ixscreen.com": "2026-01-02",
      "z8048w4.caspiansr.kz": "2026-01-02",
      "zach.uefa-meeting.com": "2026-01-02",
      "zavnia.us": "2026-07-21",
      "zawajonly.com": "2023-10-18",
      "zedplug.com": "2026-02-23",
      "zenithflow-app877.vercel.app": "2026-02-28",
      "zenithflow-ext156.vercel.app": "2026-02-28",
      "zenspiretech.com": "2026-01-02",
      "ziggeo.tech": "2026-07-21",
      "zincnetwork.tk": "2026-01-02",
      "ziprecruiters.org": "2022-03-24",
      "zitlex.com": "2026-02-27",
      "zkservice.cloud": "2024-12-27",
      "zksync-blog-git-adding-to-prividium-the-tm-matter-labs-651a8986.vercel.app": "2026-02-20",
      "zksync-enterprise-df1wkzlnd-matter-labs-651a8986.vercel.app": "2026-02-20",
      "zksync-enterprise-pxn6m30gh-matter-labs-651a8986.vercel.app": "2026-02-20",
      "zm-meeting.com": "2026-01-02",
      "zmwebsdk.com": "2026-01-02",
      "zone-api-navy.vercel.app": "2026-02-20",
      "zonelitho.com": "2026-07-07",
      "zoom-client.xyz": "2026-01-02",
      "zoom-meeting-web-static.eventx.com.cn": "2026-01-02",
      "zoom-sdk.us": "2026-01-02",
      "zoom-support.online": "2026-05-26",
      "zoom.2vanx.com": "2026-01-02",
      "zoom.app-center.download": "2026-01-02",
      "zoom.callapp.us": "2026-01-02",
      "zoom.callservice.us": "2025-02-04",
      "zoom.communicationhub.us": "2026-01-02",
      "zoom.downloadcenter.website": "2026-01-02",
      "zoom.eventx.io": "2026-01-02",
      "zoom.eventxtra.com": "2026-01-02",
      "zoom.hanagroup.live": "2026-01-02",
      "zoom.hk05web.us": "2026-01-02",
      "zoom.personifyio.com": "2026-01-02",
      "zoom.petersen.ai": "2026-01-02",
      "zoom.qa.retrocubedev.com": "2026-01-02",
      "zoom.su05web.us": "2026-01-02",
      "zoom.uk03web.us": "2026-01-02",
      "zoom.uk06web.us": "2026-01-02",
      "zoom.uk07web.us": "2026-01-02",
      "zoom.ukweb05.us": "2026-01-02",
      "zoom.ukweb06.us": "2026-01-02",
      "zoom.ukweb07.us": "2026-01-02",
      "zoom.us04office.us": "2026-01-02",
      "zoom.us04we.us": "2026-01-02",
      "zoom.usweb02.us": "2026-01-02",
      "zoom.vervoe.us": "2026-02-09",
      "zoom.webus02.us": "2026-01-02",
      "zoom.webus07.us": "2026-01-02",
      "zoom.webus08.us": "2026-01-02",
      "zoom.webus09.us": "2026-01-02",
      "zoomapp.downloadcenter.website": "2026-01-02",
      "zoomfiledrop.pages.dev": "2026-01-02",
      "zoomhub.us": "2026-01-02",
      "zoominvites.com": "2026-01-02",
      "zoommeetspace.com": "2026-01-02",
      "zoommetting.dev.retrocubedevs.com": "2026-01-02",
      "zoomsdk.us": "2026-01-02",
      "zoomtomeet.pposbc.org": "2026-01-02",
      "zoomwebapi.com": "2026-01-02",
      "zoomworkspace.us.meeting.document-content.online": "2026-01-02",
      "zoomzipdrop.pages.dev": "2026-01-02",
      "zooom.in": "2026-01-02",
      "zooom.pages.dev": "2026-01-02",
      "zooommeeting.pages.dev": "2026-01-02",
      "zora.quickproassess.com": "2026-01-02",
      "zora.rolefit360.com": "2026-01-02",
      "ztec.store": "2024-08-01",
      "zvc.capital": "2022-04-19",
      "zvc1ijau.naveicoipa.tech": "2022-03-30",
      "zvc1ijau.naveicoipc.tech": "2022-03-29",
      "zynoracreative.com": "2026-01-02",
      "zypras.com": "2026-02-24"
    },
    "ipv4": {
      "100.51.175.254:8080": "2026-03-18",
      "103.106.67.63:1244": "2026-02-28",
      "103.106.67.63:1245": "2026-02-28",
      "103.106.67.63:1247": "2026-02-28",
      "103.205.179.4:8080": "2020-02-07",
      "103.231.75.101:8888": "2026-01-02",
      "103.35.188.48:3000": "2026-07-02",
      "103.35.188.48:5000": "2026-07-02",
      "103.35.189.107:3000": "2026-01-02",
      "103.35.189.107:4000": "2026-01-02",
      "103.65.230.100:1244": "2026-01-12",
      "104.168.136.24:8080": "2024-01-04",
      "104.168.151.116:443": "2026-04-01",
      "104.168.151.34:8080": "2023-11-29",
      "104.168.157.45:3389": "2024-11-13",
      "104.168.157.45:443": "2024-11-13",
      "104.168.165.165:3389": "2024-11-13",
      "104.168.165.165:443": "2024-11-13",
      "104.168.165.173:3389": "2024-11-13",
      "104.168.165.173:443": "2024-11-13",
      "104.168.165.203:3389": "2024-11-13",
      "104.168.165.203:443": "2024-11-13",
      "104.168.172.20:8080": "2024-01-04",
      "104.168.198.145:443": "2026-04-01",
      "104.168.203.159:3389": "2024-11-13",
      "104.168.203.159:443": "2024-11-13",
      "104.192.42.117:3000": "2026-03-05",
      "104.194.133.88:1224": "2026-01-02",
      "104.194.133.88:1245": "2026-01-02",
      "104.194.153.144:8085": "2026-06-24",
      "104.194.153.144:8086": "2026-06-24",
      "104.194.153.144:8087": "2026-06-24",
      "104.217.163.61:443": "2020-08-31",
      "104.232.71.7:443": "2020-07-23",
      "107.172.197.175:443": "2019-12-17",
      "107.175.172.129:443": "2020-08-31",
      "107.189.16.122:1224": "2026-01-02",
      "107.189.16.122:1245": "2026-01-02",
      "107.189.16.176:1224": "2026-01-02",
      "107.189.16.176:1245": "2026-01-02",
      "107.189.20.152:1224": "2026-01-02",
      "107.189.20.152:1245": "2026-01-02",
      "107.189.22.20:8085": "2026-04-14",
      "107.189.22.20:8086": "2026-04-14",
      "107.189.22.20:8087": "2026-04-14",
      "107.189.24.80:1224": "2026-01-02",
      "107.189.24.80:1245": "2026-01-02",
      "107.189.25.109:1224": "2026-01-02",
      "107.189.25.109:1245": "2026-01-02",
      "107.6.12.135:443": "2020-03-05",
      "108.170.31.81:443": "2020-07-23",
      "108.181.185.2:23": "2024-12-25",
      "108.181.185.2:443": "2024-12-25",
      "108.181.185.2:5001": "2024-12-25",
      "109.205.195.98:3000": "2026-02-10",
      "109.248.144.136:8443": "2022-04-30",
      "109.248.144.155:8080": "2022-04-30",
      "109.248.144.155:8443": "2022-04-30",
      "109.248.150.13:443": "2023-05-19",
      "109.248.150.147:8585": "2023-11-25",
      "11.23.33.44:8050": "2023-01-17",
      "111.90.146.105:443": "2020-07-23",
      "111.90.148.132:443": "2020-07-23",
      "112.175.92.57:443": "2019-04-15",
      "113.114.117.122:23397": "2019-04-15",
      "116.202.208.125:8086": "2026-04-02",
      "116.202.208.125:8087": "2026-04-02",
      "116.202.208.125:8089": "2026-04-02",
      "116.202.208.125:8181": "2026-04-02",
      "116.202.208.125:8443": "2026-04-02",
      "116.202.208.125:8888": "2026-04-02",
      "116.202.208.125:9999": "2026-04-02",
      "118.123.54.71:9999": "2026-01-02",
      "119.18.230.253:443": "2019-10-25",
      "119.6.121.143:9999": "2026-01-02",
      "119.6.56.194:9999": "2026-01-02",
      "123.21.4.30:3000": "2024-10-10",
      "125.65.88.195:9999": "2026-01-02",
      "125.67.171.158:9999": "2026-01-02",
      "128.200.115.228:52884": "2019-04-15",
      "13.126.148.192:3000": "2024-10-10",
      "13.76.169.115:3000": "2024-10-10",
      "135.181.123.177:8080": "2026-01-02",
      "135.181.123.177:8081": "2026-01-02",
      "135.181.123.177:9000": "2026-01-02",
      "135.181.123.177:9001": "2026-01-02",
      "136.243.22.62:1224": "2026-05-29",
      "137.139.135.151:64694": "2019-04-15",
      "137.184.15.189:22": "2022-09-29",
      "138.201.125.58:1224": "2026-04-22",
      "138.201.125.58:1245": "2026-04-22",
      "138.201.128.169:1224": "2026-05-29",
      "138.201.140.23:4553": "2026-07-02",
      "138.201.199.46:1224": "2025-01-22",
      "138.201.220.225:1224": "2026-07-22",
      "138.201.220.225:1245": "2026-07-22",
      "138.201.223.115:4801": "2026-04-04",
      "138.201.248.205:49498": "2026-03-23",
      "138.201.248.205:49499": "2026-03-23",
      "138.201.50.5:5961": "2026-01-02",
      "138.226.220.187:1244": "2026-04-30",
      "139.60.162.62:3000": "2026-07-02",
      "139.60.162.62:5000": "2026-07-02",
      "139.60.163.206:4000": "2026-01-02",
      "14.37.47.13:1244": "2026-01-22",
      "14.37.47.13:1245": "2026-01-22",
      "141.94.148.35:1224": "2026-08-06",
      "141.94.148.37:1224": "2026-08-07",
      "141.94.148.37:3333": "2026-08-07",
      "141.94.148.39:1224": "2026-08-07",
      "141.94.148.39:3333": "2026-08-07",
      "142.11.209.109:443": "2026-04-01",
      "142.11.210.175:3000": "2024-10-10",
      "143.198.48.95:22": "2024-07-26",
      "143.198.48.95:443": "2024-07-26",
      "144.172.100.124:1224": "2026-01-02",
      "144.172.100.124:1245": "2026-01-02",
      "144.172.100.142:1224": "2026-01-02",
      "144.172.100.142:1245": "2026-01-02",
      "144.172.101.45:1224": "2026-01-02",
      "144.172.101.45:1245": "2026-01-02",
      "144.172.102.148:1224": "2026-01-02",
      "144.172.102.148:1245": "2026-01-02",
      "144.172.102.21:1224": "2026-01-02",
      "144.172.102.21:1245": "2026-01-02",
      "144.172.103.97:1224": "2026-01-02",
      "144.172.103.97:1245": "2026-01-02",
      "144.172.104.10:1224": "2026-01-02",
      "144.172.104.10:1245": "2026-01-02",
      "144.172.104.113:1224": "2026-01-02",
      "144.172.104.113:1245": "2026-01-02",
      "144.172.104.117:5918": "2026-01-02",
      "144.172.104.196:7431": "2026-07-02",
      "144.172.104.196:7436": "2026-07-02",
      "144.172.105.122:8085": "2026-01-07",
      "144.172.105.122:8086": "2026-01-07",
      "144.172.105.122:8087": "2026-01-07",
      "144.172.105.189:1224": "2026-01-02",
      "144.172.105.189:1245": "2026-01-02",
      "144.172.105.235:1224": "2026-01-02",
      "144.172.105.235:1245": "2026-01-02",
      "144.172.106.133:1224": "2026-01-02",
      "144.172.106.133:1245": "2026-01-02",
      "144.172.106.7:1224": "2026-01-02",
      "144.172.106.7:1245": "2026-01-02",
      "144.172.108.225:2000": "2026-06-09",
      "144.172.108.225:8443": "2026-06-09",
      "144.172.108.236:2000": "2026-07-17",
      "144.172.108.236:3000": "2026-07-17",
      "144.172.108.236:5918": "2026-07-17",
      "144.172.108.248:8443": "2026-06-09",
      "144.172.109.155:1224": "2026-01-02",
      "144.172.109.98:1224": "2026-01-02",
      "144.172.109.98:1245": "2026-01-02",
      "144.172.110.132:8085": "2026-04-14",
      "144.172.110.132:8086": "2026-04-14",
      "144.172.110.132:8087": "2026-04-14",
      "144.172.110.228:8085": "2026-04-14",
      "144.172.110.228:8086": "2026-04-14",
      "144.172.110.228:8087": "2026-04-14",
      "144.172.110.53:3000": "2026-07-07",
      "144.172.110.96:8085": "2026-04-14",
      "144.172.110.96:8086": "2026-04-14",
      "144.172.110.96:8087": "2026-04-14",
      "144.172.112.106:1224": "2026-01-02",
      "144.172.112.106:1245": "2026-01-02",
      "144.172.112.213:443": "2026-06-09",
      "144.172.112.214:3000": "2026-07-02",
      "144.172.112.214:5000": "2026-07-02",
      "144.172.114.238:8085": "2026-01-02",
      "144.172.114.238:8086": "2026-01-02",
      "144.172.114.238:8087": "2026-01-02",
      "144.172.115.177:8443": "2026-06-09",
      "144.172.115.189:8080": "2026-02-09",
      "144.172.116.80:8085": "2026-01-23",
      "144.172.116.80:8086": "2026-01-23",
      "144.172.116.80:8087": "2026-01-23",
      "144.172.74.120:3389": "2026-01-02",
      "144.172.86.27:1224": "2026-01-02",
      "144.172.86.27:1245": "2026-01-02",
      "144.172.87.27:1224": "2026-01-02",
      "144.172.89.183:443": "2026-06-09",
      "144.172.89.198:21": "2026-05-18",
      "144.172.89.198:3000": "2026-05-18",
      "144.172.93.169:8085": "2026-04-14",
      "144.172.93.169:8086": "2026-04-14",
      "144.172.93.169:8087": "2026-04-14",
      "144.172.93.253:8085": "2026-04-14",
      "144.172.93.253:8086": "2026-04-14",
      "144.172.93.253:8087": "2026-04-14",
      "144.172.93.88:8080": "2026-02-25",
      "144.172.93.88:8088": "2026-02-25",
      "144.172.94.226:5961": "2026-01-02",
      "144.172.94.226:5974": "2026-01-02",
      "144.172.95.226:1224": "2026-01-02",
      "144.172.95.226:1245": "2026-01-02",
      "144.172.96.35:3000": "2026-01-02",
      "144.172.96.35:8000": "2026-01-02",
      "144.172.96.35:8080": "2026-01-02",
      "144.172.96.80:1224": "2026-01-02",
      "144.172.96.80:1245": "2026-01-02",
      "144.172.97.7:1224": "2026-01-02",
      "144.172.97.7:1245": "2026-01-02",
      "144.172.99.248:8085": "2026-04-14",
      "144.172.99.248:8086": "2026-04-14",
      "144.172.99.248:8087": "2026-04-14",
      "144.172.99.81:8085": "2026-04-14",
      "144.172.99.81:8086": "2026-04-14",
      "144.172.99.81:8087": "2026-04-14",
      "144.208.127.165:3000": "2026-07-06",
      "145.59.1.45:1244": "2026-02-14",
      "146.103.99.12:8080": "2026-03-18",
      "146.70.253.107:1224": "2026-01-02",
      "146.70.253.107:1245": "2026-01-02",
      "146.70.41.188:1224": "2026-01-02",
      "146.70.41.188:1245": "2026-01-02",
      "147.124.197.138:1244": "2024-11-12",
      "147.124.197.149:1244": "2024-11-12",
      "147.124.202.163:1243": "2026-02-14",
      "147.124.202.182:1224": "2026-05-08",
      "147.124.202.194:1244": "2026-02-02",
      "147.124.202.194:3000": "2026-02-02",
      "147.124.202.206:1244": "2026-04-24",
      "147.124.202.208:3000": "2026-02-25",
      "147.124.202.210:1244": "2026-07-02",
      "147.124.202.213:1244": "2026-07-02",
      "147.124.202.225:1244": "2026-01-02",
      "147.124.202.225:3000": "2026-04-10",
      "147.124.211.143:1224": "2026-06-01",
      "147.124.211.201:1224": "2026-04-17",
      "147.124.212.125:1244": "2024-12-23",
      "147.124.212.146:1244": "2024-05-10",
      "147.124.212.178:1224": "2026-06-01",
      "147.124.212.180:1224": "2026-06-01",
      "147.124.212.207:1224": "2026-06-01",
      "147.124.212.234:1244": "2026-02-12",
      "147.124.212.89:1244": "2024-04-24",
      "147.124.213.11:1244": "2024-05-10",
      "147.124.213.19:1244": "2026-01-02",
      "147.124.213.232:1244": "2026-01-02",
      "147.124.213.29:1244": "2024-05-10",
      "147.124.214.129:1244": "2024-04-24",
      "147.124.214.131:1244": "2024-04-24",
      "147.124.214.235:1244": "2026-02-25",
      "147.124.214.237:1244": "2024-04-23",
      "147.124.215.131:1244": "2026-02-14",
      "147.124.216.103:1224": "2026-07-09",
      "147.124.217.204:1224": "2026-07-09",
      "147.93.40.224:3000": "2026-01-02",
      "147.93.90.228:8090": "2026-05-02",
      "148.251.11.208:9498": "2026-04-28",
      "149.28.137.173:7001": "2024-10-10",
      "149.28.139.62:8080": "2026-01-02",
      "149.40.62.82:3000": "2024-10-10",
      "151.106.2.139:8080": "2022-09-07",
      "151.106.2.139:8443": "2022-09-07",
      "151.243.101.229:8080": "2026-01-02",
      "151.80.205.187:1224": "2026-07-09",
      "151.80.76.64:1224": "2026-08-07",
      "151.80.76.64:3333": "2026-08-07",
      "152.89.61.240:443": "2026-01-02",
      "152.89.61.96:443": "2026-01-02",
      "154.216.177.215:8080": "2026-01-02",
      "154.58.204.15:8080": "2026-01-02",
      "154.62.226.22:8080": "2026-01-02",
      "154.91.0.196:443": "2026-04-23",
      "157.250.195.237:3000": "2026-02-25",
      "157.250.202.237:3000": "2026-02-25",
      "158.62.198.177:8080": "2026-01-02",
      "159.100.250.231:80": "2020-03-05",
      "159.100.250.231:8080": "2020-02-14",
      "159.93.36.174:8444": "2024-10-10",
      "159.93.36.84:8444": "2024-10-10",
      "160.20.147.253:8443": "2020-06-10",
      "162.0.239.85:3000": "2026-07-20",
      "162.120.17.8:3000": "2026-07-02",
      "162.120.17.8:5000": "2026-07-02",
      "163.245.194.216:3000": "2026-02-25",
      "163.245.219.19:443": "2026-04-22",
      "165.140.85.105:1244": "2026-01-22",
      "165.140.85.106:1243": "2026-01-02",
      "165.140.85.106:1244": "2026-01-02",
      "165.140.85.106:1245": "2026-01-02",
      "165.140.85.106:1248": "2026-01-02",
      "165.140.85.106:3389": "2026-01-02",
      "165.140.86.154:1244": "2026-01-02",
      "165.140.86.160:1244": "2026-01-02",
      "165.140.86.181:1244": "2026-01-22",
      "165.140.86.181:1245": "2026-01-22",
      "165.140.86.183:1245": "2026-04-30",
      "165.140.86.183:2246": "2026-04-30",
      "165.140.86.227:1244": "2024-11-12",
      "166.88.132.114:8000": "2024-08-01",
      "166.88.134.62:10000": "2026-06-24",
      "166.88.134.62:2000": "2026-06-24",
      "166.88.134.62:443": "2026-06-24",
      "166.88.134.82:27107": "2026-07-21",
      "166.88.4.2:27017": "2026-07-21",
      "166.88.4.2:443": "2026-07-21",
      "166.88.54.158:27107": "2026-06-12",
      "166.88.54.158:443": "2026-06-12",
      "166.88.54.158:8888": "2026-06-12",
      "167.114.215.75:1224": "2026-07-09",
      "167.88.168.152:1224": "2024-10-22",
      "167.88.39.141:5000": "2026-01-02",
      "167.88.39.55:3000": "2026-01-02",
      "167.88.39.55:4000": "2026-01-02",
      "167.88.63.91:8080": "2026-03-18",
      "170.205.31.203:3000": "2026-05-10",
      "171.22.127.221:5000": "2026-01-02",
      "171.22.127.221:8000": "2026-01-02",
      "172.81.132.41:443": "2020-07-23",
      "172.86.105.40:5918": "2026-02-03",
      "172.86.113.115:1244": "2026-01-02",
      "172.86.113.115:1245": "2026-01-02",
      "172.86.113.18:1224": "2026-01-02",
      "172.86.113.18:1245": "2026-01-02",
      "172.86.114.170:4000": "2026-01-02",
      "172.86.114.170:5000": "2026-01-02",
      "172.86.114.31:3000": "2026-01-02",
      "172.86.116.178:3000": "2026-01-23",
      "172.86.116.178:5918": "2026-01-02",
      "172.86.116.178:5976": "2026-01-02",
      "172.86.116.90:1224": "2026-01-02",
      "172.86.116.90:1245": "2026-01-02",
      "172.86.123.35:1244": "2024-05-10",
      "172.86.123.55:1224": "2026-01-02",
      "172.86.123.55:1245": "2026-01-02",
      "172.86.64.67:4181": "2026-01-02",
      "172.86.64.67:4186": "2026-01-02",
      "172.86.64.67:4187": "2026-01-02",
      "172.86.64.67:4188": "2026-01-02",
      "172.86.73.198:1224": "2026-01-02",
      "172.86.73.198:1245": "2026-01-02",
      "172.86.80.145:1224": "2026-01-02",
      "172.86.84.38:1224": "2026-01-02",
      "172.86.84.38:1245": "2026-01-02",
      "172.86.88.188:1418": "2026-01-02",
      "172.86.88.188:1476": "2026-01-02",
      "172.86.89.10:4382": "2026-01-02",
      "172.86.93.139:3000": "2026-01-02",
      "172.86.97.80:1224": "2024-05-10",
      "172.86.98.240:1224": "2024-05-30",
      "172.93.184.62:443": "2020-07-23",
      "172.93.201.219:443": "2019-12-17",
      "172.93.201.253:22": "2022-09-29",
      "173.211.106.101:1244": "2026-01-02",
      "173.211.106.101:1245": "2024-05-10",
      "173.211.106.164:1244": "2026-02-14",
      "173.211.40.14:8080": "2026-03-16",
      "173.211.40.24:8080": "2026-03-16",
      "173.211.40.28:8080": "2026-03-16",
      "173.211.46.22:8080": "2026-03-16",
      "173.211.46.37:8080": "2026-02-09",
      "173.211.70.210:8080": "2026-01-02",
      "173.211.70.246:8080": "2026-01-02",
      "174.138.188.80:3000": "2026-02-25",
      "176.222.52.155:1244": "2026-04-30",
      "176.222.52.77:1244": "2026-01-22",
      "176.222.52.77:1245": "2026-01-22",
      "176.31.205.16:1244": "2026-03-09",
      "176.9.174.137:1224": "2026-06-01",
      "181.39.135.126:7443": "2019-04-15",
      "182.136.120.52:9999": "2026-01-02",
      "182.136.123.102:9999": "2026-01-02",
      "185.142.236.226": "2018-08-23",
      "185.142.239.173": "2018-08-23",
      "185.153.182.241:1224": "2025-01-16",
      "185.153.182.251:1224": "2026-01-02",
      "185.153.182.251:1245": "2026-01-02",
      "185.163.125.196:3000": "2026-03-05",
      "185.163.125.196:5000": "2026-03-05",
      "185.164.111.104:3000": "2026-01-02",
      "185.177.127.27:8080": "2026-03-18",
      "185.204.54.232:1244": "2026-04-30",
      "185.208.158.203:5555": "2024-08-05",
      "185.208.158.203:8080": "2024-08-05",
      "185.208.158.204:443": "2021-06-19",
      "185.213.22.215:8080": "2026-03-18",
      "185.228.83.32:443": "2019-10-13",
      "185.235.241.208:1224": "2024-10-10",
      "185.235.241.208:1244": "2024-08-22",
      "185.29.8.108:8585": "2023-11-25",
      "185.53.46.38:1244": "2026-01-02",
      "185.53.46.38:3000": "2026-01-02",
      "185.53.46.38:3389": "2026-01-02",
      "185.62.58.207:443": "2020-05-06",
      "185.92.220.208:5000": "2026-02-20",
      "185.92.220.208:5173": "2026-02-20",
      "185.92.220.208:8080": "2026-02-20",
      "186.169.2.237:65292": "2019-04-15",
      "188.165.37.168:80": "2020-03-05",
      "188.40.64.61:5000": "2026-07-18",
      "188.40.64.61:7777": "2026-07-18",
      "188.43.33.250:3389": "2026-01-02",
      "188.43.33.250:5000": "2026-01-02",
      "188.43.33.250:8080": "2026-01-02",
      "188.43.33.251:12323": "2026-01-02",
      "188.43.33.251:12324": "2026-01-02",
      "188.43.33.251:5000": "2026-01-02",
      "188.43.33.251:8000": "2026-01-02",
      "188.43.33.251:8080": "2026-01-02",
      "192.119.116.231:443": "2026-04-01",
      "192.169.250.185:443": "2020-05-11",
      "192.210.213.178:443": "2019-12-17",
      "192.210.239.122:443": "2020-07-23",
      "192.236.146.20:443": "2026-04-01",
      "192.236.146.22:443": "2026-04-01",
      "192.236.176.164:443": "2026-04-01",
      "192.236.233.162:443": "2026-04-01",
      "192.236.233.165:443": "2026-04-01",
      "192.236.236.100:443": "2026-04-01",
      "192.99.204.154:1224": "2026-07-09",
      "193.56.28.103:88": "2020-03-05",
      "193.56.28.251:443": "2021-06-19",
      "194.45.8.41:443": "2019-07-10",
      "195.154.173.4:3000": "2024-10-10",
      "195.201.104.53:21": "2026-05-18",
      "195.201.104.53:6931": "2026-04-23",
      "195.201.104.53:6936": "2026-04-23",
      "195.201.104.53:6939": "2026-04-23",
      "195.201.194.107:3000": "2026-05-20",
      "195.201.194.107:8000": "2026-05-20",
      "195.201.194.107:801": "2026-05-25",
      "195.201.194.107:8010": "2026-05-01",
      "195.201.194.107:9000": "2026-05-20",
      "195.250.29.94:1337": "2025-01-29",
      "195.250.29.94:3001": "2025-01-29",
      "195.26.248.212:7000": "2026-07-18",
      "195.26.248.212:8081": "2026-07-18",
      "195.26.248.212:8443": "2026-07-18",
      "195.35.23.88:8080": "2026-05-14",
      "195.35.23.88:8081": "2026-05-14",
      "195.35.23.88:8443": "2026-05-14",
      "196.38.48.121": "2018-08-23",
      "197.211.212.59:7443": "2019-04-15",
      "198.105.127.210:443": "2026-04-23",
      "198.135.49.65:1224": "2026-06-29",
      "198.135.50.70:1224": "2026-05-11",
      "198.135.51.233:1224": "2026-06-26",
      "198.135.55.119:1224": "2026-05-08",
      "198.135.55.67:1224": "2026-05-01",
      "198.180.198.6:443": "2019-12-17",
      "201.77.179.66:8082": "2023-12-12",
      "202.155.11.141:3000": "2026-05-06",
      "202.163.147.124:1248": "2026-02-14",
      "203.161.52.90:3000": "2026-01-02",
      "203.161.52.90:4000": "2026-01-02",
      "203.161.52.90:8090": "2026-01-02",
      "206.206.127.135:8080": "2026-01-22",
      "206.206.127.80:8080": "2026-01-22",
      "207.189.164.137:1244": "2026-01-02",
      "207.254.22.248:8800": "2026-01-02",
      "208.84.100.22:3000": "2026-05-10",
      "209.182.224.49:443": "2026-06-09",
      "209.90.234.34:443": "2019-12-17",
      "21.252.107.198:23164": "2019-04-15",
      "210.202.40.35:443": "2020-03-05",
      "212.81.47.217:8080": "2026-01-02",
      "214.75.112.56:1224": "2026-01-02",
      "214.75.112.56:1244": "2026-01-02",
      "214.75.112.56:1245": "2026-01-02",
      "216.126.224.168:7101": "2026-07-02",
      "216.126.224.168:7106": "2026-07-02",
      "216.126.224.220:5976": "2026-04-27",
      "216.126.225.104:3000": "2026-07-02",
      "216.126.225.104:5000": "2026-07-02",
      "216.126.225.243:8085": "2026-06-09",
      "216.126.225.243:8086": "2026-06-09",
      "216.126.225.243:8087": "2026-06-09",
      "216.126.225.67:443": "2026-06-09",
      "216.126.227.239:21": "2026-05-18",
      "216.126.229.166:1224": "2026-01-02",
      "216.126.229.166:1245": "2026-01-02",
      "216.126.236.244:4801": "2026-06-29",
      "216.126.236.244:4806": "2026-06-29",
      "216.126.236.244:4808": "2026-06-29",
      "216.126.236.244:4809": "2026-06-29",
      "216.126.236.64:3000": "2026-07-18",
      "216.126.236.64:7777": "2026-07-18",
      "216.126.236.64:8888": "2026-07-18",
      "216.126.237.200:8443": "2026-06-09",
      "216.126.237.71:4801": "2026-04-04",
      "216.126.237.71:4806": "2026-04-04",
      "216.126.237.71:4809": "2026-04-04",
      "216.126.237.71:4891": "2026-07-02",
      "216.126.237.71:4892": "2026-07-02",
      "216.126.237.71:4893": "2026-07-02",
      "216.126.237.71:4894": "2026-07-02",
      "216.126.237.71:4895": "2026-07-02",
      "216.126.237.71:4896": "2026-07-02",
      "216.126.237.71:4897": "2026-07-02",
      "216.126.237.71:4898": "2026-07-02",
      "216.126.237.71:4899": "2026-04-04",
      "216.158.225.144:3000": "2026-04-22",
      "216.158.225.144:443": "2026-04-22",
      "216.158.225.144:8000": "2026-04-22",
      "216.173.115.200:1244": "2025-01-12",
      "216.244.71.233:443": "2020-07-23",
      "216.250.248.160:1224": "2026-04-24",
      "216.250.248.160:8888": "2026-04-24",
      "216.250.248.200:1224": "2026-03-28",
      "216.250.249.176:1224": "2026-03-28",
      "216.250.249.179:1224": "2026-06-26",
      "216.250.251.187:1224": "2026-06-26",
      "216.250.251.211:1244": "2026-01-09",
      "216.250.251.87:1244": "2026-01-13",
      "216.250.251.87:1245": "2026-01-13",
      "216.250.251.87:1247": "2026-02-03",
      "216.250.251.87:1249": "2026-01-13",
      "216.250.251.87:3389": "2026-01-13",
      "216.250.252.103:1244": "2026-03-18",
      "216.250.252.163:1244": "2026-02-14",
      "216.250.252.245:1224": "2026-06-29",
      "216.74.123.191:22": "2024-12-29",
      "216.74.123.191:3001": "2024-12-29",
      "216.74.123.191:8080": "2024-12-29",
      "217.148.142.113:1224": "2026-01-02",
      "217.148.142.113:1245": "2026-01-02",
      "217.15.168.86:3000": "2026-01-02",
      "217.69.0.159:10000": "2026-03-17",
      "217.69.0.159:5000": "2026-03-17",
      "217.69.0.159:8080": "2026-03-17",
      "217.69.11.60:5000": "2026-03-17",
      "217.69.11.60:8080": "2026-03-17",
      "217.69.11.99:5000": "2026-03-17",
      "217.69.3.152:10000": "2026-03-19",
      "218.255.24.226:443": "2019-10-25",
      "23.106.253.194:1244": "2024-09-06",
      "23.106.253.209:1244": "2024-10-10",
      "23.106.253.215:1244": "2024-10-10",
      "23.106.253.221:1224": "2024-10-03",
      "23.106.253.221:1244": "2024-10-10",
      "23.106.253.242:1244": "2024-10-10",
      "23.106.70.154:1244": "2024-10-10",
      "23.137.105.75:5000": "2026-06-09",
      "23.137.105.75:5173": "2026-06-09",
      "23.227.196.116:443": "2019-12-17",
      "23.227.199.53:443": "2019-12-17",
      "23.227.199.69:443": "2020-07-23",
      "23.227.202.244:1224": "2026-01-02",
      "23.227.202.244:1245": "2026-01-02",
      "23.227.202.51:1224": "2026-01-02",
      "23.227.202.51:1245": "2026-01-02",
      "23.227.202.52:1224": "2026-01-02",
      "23.227.202.52:1245": "2026-01-02",
      "23.227.203.18:1224": "2026-01-02",
      "23.227.203.18:1245": "2026-01-02",
      "23.227.203.192:1224": "2026-01-02",
      "23.227.203.192:1245": "2026-01-02",
      "23.227.203.204:1224": "2026-01-02",
      "23.227.203.204:1245": "2026-01-02",
      "23.254.119.12:443": "2019-12-17",
      "23.254.128.114:443": "2026-04-01",
      "23.254.164.50:443": "2026-04-01",
      "23.254.244.242:3000": "2024-07-24",
      "23.254.244.248:3389": "2024-11-13",
      "23.254.244.248:443": "2024-11-13",
      "23.254.247.32:3389": "2024-11-13",
      "23.254.247.32:443": "2024-11-13",
      "23.254.247.53:3389": "2024-11-13",
      "23.254.247.53:443": "2024-11-13",
      "23.27.120.142:27017": "2026-07-21",
      "23.27.120.142:443": "2026-07-21",
      "23.27.13.43:27017": "2026-07-29",
      "23.27.13.43:443": "2026-07-29",
      "23.27.13.43:8888": "2026-07-29",
      "23.27.177.183:443": "2026-01-02",
      "23.27.20.143:27017": "2026-07-21",
      "23.27.20.143:443": "2026-07-21",
      "23.27.20.187:27107": "2026-07-29",
      "23.27.20.187:443": "2026-07-29",
      "23.27.20.187:8888": "2026-07-29",
      "23.27.202.27:27017": "2026-07-21",
      "23.27.202.27:443": "2026-07-21",
      "23.81.246.179:443": "2019-12-17",
      "26.165.218.44:2248": "2019-04-15",
      "27.102.118.204:6099": "2023-11-25",
      "27.102.128.152:8098": "2023-11-25",
      "3.125.137.101:8080": "2026-03-18",
      "31.207.47.71:3000": "2026-07-02",
      "31.207.47.71:5000": "2026-07-02",
      "31.220.48.106:3000": "2026-01-02",
      "31.220.62.190:3000": "2026-01-02",
      "31.222.250.65:1244": "2026-07-22",
      "31.222.250.65:15152": "2026-07-22",
      "31.57.243.190:8080": "2026-01-02",
      "31.57.243.29:8080": "2026-01-02",
      "31.57.243.55:8080": "2026-01-22",
      "31.57.35.114:8080": "2026-03-18",
      "31.97.211.52:3000": "2026-01-02",
      "31.97.218.133:6168": "2026-01-02",
      "35.188.212.32:3000": "2024-10-10",
      "35.219.62.75:3001": "2024-10-10",
      "37.221.126.117:3011": "2026-01-02",
      "37.221.126.117:4000": "2026-01-02",
      "37.221.126.117:5000": "2025-01-02",
      "37.48.102.17:1224": "2026-06-01",
      "37.72.168.228:443": "2020-08-31",
      "37.72.175.179:443": "2019-12-17",
      "38.134.148.218:8080": "2026-01-02",
      "38.146.28.177:8080": "2026-01-22",
      "38.92.47.118:1244": "2026-01-22",
      "38.92.47.151:1244": "2024-11-12",
      "38.92.47.152:1244": "2026-01-02",
      "38.92.47.155:1244": "2026-01-22",
      "38.92.47.157:1244": "2026-07-02",
      "38.92.47.165:1244": "2026-04-30",
      "38.92.47.167:3000": "2026-04-14",
      "38.92.47.175:1244": "2026-07-02",
      "38.92.47.85:1244": "2024-11-12",
      "38.92.47.91:1244": "2024-11-12",
      "41.208.185.235:443": "2026-01-02",
      "44.238.74.84:22": "2022-09-29",
      "44.238.74.84:5900": "2022-09-29",
      "45.128.52.14:1224": "2024-12-27",
      "45.137.213.30:1224": "2024-10-10",
      "45.140.147.208:53421": "2024-08-22",
      "45.140.147.208:53422": "2024-08-22",
      "45.140.167.218:1224": "2026-07-02",
      "45.249.90.214:27017": "2026-07-21",
      "45.32.150.97:5000": "2026-03-17",
      "45.43.11.199:1244": "2026-01-13",
      "45.43.11.199:1249": "2026-01-13",
      "45.43.11.199:3389": "2026-01-13",
      "45.43.11.200:1244": "2026-02-14",
      "45.43.11.201:1244": "2024-11-12",
      "45.43.11.211:1224": "2026-05-08",
      "45.43.11.214:1224": "2026-06-01",
      "45.43.11.248:1244": "2026-02-14",
      "45.59.160.166:1244": "2026-03-09",
      "45.59.160.199:1244": "2026-03-18",
      "45.59.160.200:1244": "2026-03-20",
      "45.59.160.210:1244": "2026-03-18",
      "45.59.160.211:1244": "2026-03-19",
      "45.59.160.215:1244": "2026-03-30",
      "45.59.160.215:3000": "2026-07-02",
      "45.59.163.198:1244": "2026-07-02",
      "45.59.163.23:1244": "2026-01-02",
      "45.59.163.50:1244": "2026-04-30",
      "45.59.163.55:1244": "2025-02-10",
      "45.59.163.56:1244": "2025-01-29",
      "45.61.128.110:1224": "2026-01-02",
      "45.61.128.110:1245": "2026-01-02",
      "45.61.128.61:1224": "2026-01-02",
      "45.61.128.61:1245": "2026-01-02",
      "45.61.131.218:1245": "2024-05-10",
      "45.61.133.110:1224": "2026-01-02",
      "45.61.133.110:1245": "2026-01-02",
      "45.61.135.4:1224": "2026-01-02",
      "45.61.135.4:1245": "2026-01-02",
      "45.61.149.222:1224": "2026-01-02",
      "45.61.149.222:1245": "2026-01-02",
      "45.61.150.30:1224": "2026-01-02",
      "45.61.150.30:1245": "2026-01-02",
      "45.61.150.31:1224": "2026-01-02",
      "45.61.150.31:1245": "2026-01-02",
      "45.61.150.67:1224": "2026-01-02",
      "45.61.150.67:1245": "2026-01-02",
      "45.61.151.71:1244": "2026-01-02",
      "45.61.151.71:1245": "2026-01-02",
      "45.61.160.28:1224": "2026-01-02",
      "45.61.160.28:1245": "2026-01-02",
      "45.61.161.146:3000": "2026-05-01",
      "45.61.161.146:4000": "2026-05-01",
      "45.61.161.146:5000": "2026-05-01",
      "45.61.161.146:5173": "2026-05-01",
      "45.61.165.45:1224": "2026-01-02",
      "45.61.165.45:1245": "2026-01-02",
      "45.61.169.99:3000": "2024-10-10",
      "45.76.154.181:3000": "2024-10-10",
      "45.8.146.93:443": "2026-01-02",
      "45.8.22.144:3000": "2026-05-01",
      "45.8.22.144:8080": "2026-05-01",
      "45.8.22.52:3000": "2026-05-01",
      "45.8.22.52:8000": "2026-05-01",
      "45.8.22.52:9000": "2026-05-01",
      "45.81.243.71:8080": "2026-03-18",
      "45.83.140.55:1244": "2026-03-05",
      "45.95.186.237:8000": "2026-06-15",
      "46.17.98.55:1244": "2026-04-30",
      "47.206.4.145:59067": "2019-04-15",
      "5.135.5.48:1244": "2025-01-29",
      "5.253.43.122:1224": "2024-12-27",
      "5.253.43.122:5346": "2024-12-28",
      "51.178.11.177:1224": "2026-07-09",
      "51.178.11.181:1224": "2026-07-09",
      "51.255.9.164:1224": "2026-08-07",
      "51.255.9.164:3333": "2026-08-07",
      "51.77.65.154:443": "2020-05-11",
      "51.79.124.171:1224": "2026-08-06",
      "52.187.130.188:3000": "2024-10-10",
      "52.202.193.124:443": "2021-06-30",
      "52.58.193.70:8080": "2026-03-18",
      "54.146.239.83:8080": "2026-01-02",
      "54.39.43.114:1224": "2026-08-06",
      "54.39.43.117:1224": "2026-07-09",
      "54.39.43.119:1224": "2026-08-07",
      "54.39.43.119:3333": "2026-08-07",
      "61.139.89.11:9999": "2026-01-02",
      "63.176.219.134:8080": "2026-01-22",
      "64.188.19.117:443": "2019-12-17",
      "65.108.27.116:3000": "2026-07-10",
      "66.154.102.91:9090": "2022-06-02",
      "66.235.168.136:3000": "2026-02-25",
      "66.235.168.155:1244": "2026-04-30",
      "66.235.168.158:1224": "2026-06-01",
      "66.235.168.17:1244": "2026-01-22",
      "66.235.168.17:1245": "2026-01-22",
      "66.235.168.232:1244": "2024-11-12",
      "66.235.168.233:1244": "2026-04-13",
      "66.235.168.238:1244": "2024-12-12",
      "66.235.168.238:22411": "2026-02-03",
      "66.235.168.238:22413": "2026-02-03",
      "66.235.168.245:1244": "2026-04-30",
      "66.235.175.109:1244": "2024-12-23",
      "66.235.175.117:1244": "2026-01-02",
      "66.235.175.83:1244": "2026-04-30",
      "66.235.175.96:1244": "2026-07-21",
      "66.235.175.96:3000": "2026-07-21",
      "66.235.28.238:1244": "2026-02-14",
      "66.235.28.238:1249": "2026-02-14",
      "66.235.63.55:1244": "2026-01-13",
      "66.235.63.55:1249": "2026-01-13",
      "66.235.63.55:3389": "2026-01-13",
      "66.248.205.172:3000": "2026-07-02",
      "66.248.205.172:5000": "2026-07-02",
      "66.248.205.172:8000": "2026-07-02",
      "66.45.225.94:1244": "2026-08-05",
      "66.45.225.94:1245": "2026-08-05",
      "66.45.225.94:1246": "2026-08-05",
      "66.85.157.67:8050": "2022-10-21",
      "67.203.7.163:1244": "2024-07-23",
      "67.203.7.171:1244": "2024-04-24",
      "67.203.7.200:1244": "2024-12-23",
      "67.203.7.205:1244": "2025-02-10",
      "67.203.7.209:1244": "2024-12-23",
      "67.203.7.245:1244": "2024-04-24",
      "67.203.7.245:21": "2024-05-10",
      "67.207.166.173:1224": "2026-03-18",
      "67.43.239.146:443": "2020-05-06",
      "68.168.123.86:443": "2020-07-23",
      "69.197.164.135:1224": "2026-06-26",
      "69.197.164.135:1245": "2026-06-26",
      "69.43.130.141:3000": "2024-10-22",
      "69.43.130.153:3000": "2024-10-22",
      "70.224.36.194:59681": "2019-04-15",
      "72.5.42.93:8080": "2026-01-02",
      "72.60.117.70:3000": "2026-01-02",
      "72.60.173.32:3000": "2026-01-02",
      "72.60.174.178:3000": "2026-01-02",
      "72.60.77.221:3000": "2026-05-27",
      "72.60.77.221:4000": "2026-05-27",
      "72.60.77.221:8080": "2026-05-27",
      "72.61.123.154:3000": "2026-05-26",
      "72.61.123.154:5173": "2026-05-26",
      "72.61.123.154:8000": "2026-05-26",
      "72.61.123.154:9000": "2026-05-26",
      "74.119.194.129:3000": "2025-02-17",
      "74.119.194.129:3001": "2025-02-17",
      "74.119.194.205:3000": "2026-01-02",
      "74.119.194.205:4000": "2026-01-02",
      "74.121.190.121:443": "2019-12-17",
      "74.121.190.140:8443": "2020-03-13",
      "77.37.37.81:1244": "2024-08-01",
      "77.37.37.81:8000": "2024-08-01",
      "77.37.74.86:6168": "2026-01-02",
      "77.42.1.210:1224": "2026-03-09",
      "77.42.1.210:1245": "2026-03-09",
      "77.42.1.210:7777": "2026-03-09",
      "78.142.218.26:1244": "2026-04-30",
      "80.209.243.85:4000": "2026-01-02",
      "80.209.243.85:5000": "2026-01-02",
      "80.82.64.91": "2018-08-23",
      "81.94.192.147:443": "2019-04-15",
      "83.168.68.219:27017": "2026-04-23",
      "84.38.129.21:2222": "2024-03-21",
      "84.38.129.21:5443": "2024-03-21",
      "84.38.132.67:9479": "2023-11-25",
      "84.49.242.125:17770": "2019-04-15",
      "86.104.72.247:443": "2026-01-02",
      "86.104.74.169:27017": "2026-01-02",
      "86.104.74.51:1224": "2024-11-25",
      "86.106.85.234:4558": "2026-02-03",
      "87.236.177.9:3000": "2026-02-02",
      "88.119.169.226:5000": "2026-01-02",
      "88.204.166.59:8080": "2020-04-04",
      "88.218.0.78:1224": "2026-01-02",
      "88.218.0.78:1245": "2026-01-02",
      "88.218.0.78:2243": "2026-01-02",
      "88.99.212.230:3000": "2026-03-07",
      "88.99.241.111:1224": "2026-03-18",
      "91.198.66.112:3000": "2026-01-02",
      "91.198.66.158:3000": "2026-01-02",
      "91.222.173.110:443": "2026-01-02",
      "91.222.173.138:443": "2026-01-02",
      "91.222.173.168:443": "2026-01-02",
      "91.90.121.87:443": "2026-07-18",
      "91.92.120.135:3000": "2024-05-10",
      "91.92.248.50:445": "2024-03-24",
      "93.88.74.112:1244": "2026-01-02",
      "94.131.9.32:1224": "2025-01-22",
      "94.131.97.195:1224": "2026-01-02",
      "94.131.97.195:1245": "2026-01-02",
      "94.177.123.138:8088": "2020-03-05",
      "94.232.247.192:1224": "2025-01-22",
      "95.164.17.24:1224": "2024-07-15",
      "95.164.17.24:2249": "2024-10-21",
      "95.164.17.24:5346": "2024-12-28",
      "95.164.45.239:3000": "2025-02-17",
      "95.164.45.239:3001": "2025-02-17",
      "95.164.7.171:1244": "2024-10-21",
      "95.164.7.171:2249": "2024-10-21",
      "95.164.7.171:445": "2024-10-21",
      "95.169.180.140:8080": "2026-01-02",
      "95.169.180.146:3389": "2025-02-14",
      "95.169.180.146:4444": "2025-02-14",
      "95.169.180.146:8080": "2025-02-14",
      "95.169.180.198:8080": "2026-02-09",
      "95.179.135.133:1244": "2025-01-12",
      "95.179.135.133:1245": "2025-01-29",
      "95.216.118.146:3000": "2026-07-28",
      "95.216.37.186:3000": "2026-07-02",
      "95.216.37.186:5000": "2026-07-02",
      "95.216.64.240:1224": "2026-07-06",
      "95.216.64.240:1245": "2026-07-06",
      "95.216.92.207:4000": "2026-07-21",
      "95.216.92.207:7777": "2026-07-21",
      "95.216.92.207:8080": "2026-07-21",
      "97.90.44.200:37120": "2019-04-15"
    },
    "url": {
      "028xmz.com/include/common.php": "2019-04-26",
      "168wangpi.com/include/charset.php": "2019-04-26",
      "33cow.com/include/control.php": "2019-04-26",
      "3cuartos.com/wp-content/plugins/music-press-pro/templates/global/update.php": "2020-11-14",
      "3x-tv.com/plugins/editors/about.php": "2019-07-22",
      "51up.com/ace/main.asp": "2019-04-26",
      "530hr.com/data/common.php": "2019-04-26",
      "97nb.net/include/arc.sglistview.php": "2019-04-26",
      "Engpro.xyz/images/detail.php": "2020-11-14",
      "acanicjquery.com/slides/style.php": "2020-12-15",
      "addfriend.kr/board/userfiles/temp/index.html": "2025-01-27",
      "aditijindal.com/wp-content/gallery/services/globalcareers/12849/jobs/gallery.php": "2021-12-27",
      "admforte.com.br/wp-content/plugins/top.php": "2020-12-11",
      "admin.esangedu.kr/XPaySample/submit.php": "2023-10-28",
      "admin.shcpa.co.kr/_asapro2/formmail/lib.php": "2020-12-15",
      "advertapp.me/user/invite.php": "2020-11-14",
      "aeon-petro.com/wcms/plugins/addition_contents/cfg.png": "2023-11-15",
      "aeon-petro.com/wcms/plugins/addition_contents/user64.png": "2023-11-15",
      "afuocolento.it/wp-admin/network/server_test.php": "2020-04-27",
      "afuocolento.it/wp-includes/process.php": "2020-11-14",
      "akramportal.org/delv/public/voice/voice.php": "2021-04-29",
      "akramportal.org/public/voice/voice.php": "2021-01-26",
      "allamwith.com/home/mobile/list.php": "2021-06-16",
      "alnagm-press.com/wp-content/plugins/cloudflare/list.php": "2019-08-31",
      "americanhotboats.com/forums/core/cache/index.php": "2021-02-25",
      "amytanathorn.com/wp-admin/includes/about.php": "2019-07-19",
      "anca-aste.it/uploads/form/02E319AF73A33547343B71D5CB1064BC.dotm": "2020-12-15",
      "anca-aste.it/uploads/form/boeing_spe_leos_logo.jpg": "2020-06-26",
      "anca-aste.it/uploads/form/boeing_spectrolab_logo.jpg": "2020-05-27",
      "ando.co.kr/service/s_top.asp": "2019-04-26",
      "anisweb.org/layout/site/style/preview.jsp": "2020-12-15",
      "anlway.com/include/arc.search.class.php": "2019-04-26",
      "annafalkenau.com/awstats/data/upload.php": "2020-12-04",
      "ansetech.co.kr/smarteditor/common.asp": "2019-04-26",
      "anvil.org.ph/list/images/index.php": "2026-01-26",
      "anyoneforum.cc/forum/list.php": "2020-11-14",
      "ap8898.com/include/arc.search.class.php": "2019-04-26",
      "apars-surgery.org/bbs/bbs_files/board_blog/write.php": "2021-04-27",
      "apars-surgery.org/bbs/bbs_files/board_photo/menu.php": "2020-12-15",
      "api.npoint.io/1f901a22daea7694face": "2026-01-02",
      "api.npoint.io/96979650f5739bcbaebb": "2026-01-02",
      "api.npoint.io/e5a5e32cdf9bfe7d2386": "2026-01-02",
      "api.shw.kr/login_admin/member/login_fail.php": "2023-10-28",
      "apshenyihl.com/include/arc.speclist.class.php": "2019-04-26",
      "aquaprographix.com/patterns/Map/maps.php": "2022-10-06",
      "arar-musique.fr/wp-content/plugins/music-press-pro/includes/admin/upgrade.php": "2020-11-14",
      "arumdaunresort.com/admin/html/user/contact.asp": "2020-12-15",
      "astedams.it/include/inc-elenco-offerter.asp": "2020-05-05",
      "astedams.it/photos/image/image.asp": "2020-12-15",
      "astedams.it/uploads/frame/61.dotm": "2020-05-07",
      "astedams.it/uploads/template/17.dotm": "2020-05-05",
      "au-pair.org/admin/Newspaper.asp": "2021-02-25",
      "au-pair.org/admin/login.asp": "2021-02-25",
      "audiopodcasts.co/verify.php": "2020-06-10",
      "automercado.co.cr/empleo/css/main.jsp": "2020-09-29",
      "bandarpowder.com/public/assets/buttons/bootstrap.php": "2026-01-26",
      "bandarpowder.com/public/assets/img/cfg.png": "2023-11-15",
      "bandarpowder.com/public/assets/img/user64.png": "2023-11-15",
      "barsaji.com.mx/src/recaptcha/index.php": "2023-09-29",
      "baseballcharlemagnelegardeur.com/wp-content/languages/common.php": "2019-03-26",
      "bcdm.or.kr/board/type3_D/edit.asp": "2023-08-20",
      "blastedlevels.com/levels4SqR8/measure.asp": "2023-10-28",
      "bluecreekrobotics.com/wp-includes/common.php": "2019-03-26",
      "bluedragon.com/login": "2022-07-05",
      "bluekostec.com/eng/community/write.asp": "2026-01-02",
      "bn-cosmo.com/customer/board_replay.asp": "2022-04-01",
      "bogorcenter.com/wp-content/themes/index2.php": "2019-03-26",
      "bokkeriejesj.nl/wp-content/plugins/music-press-pro/upload.php": "2020-11-14",
      "bug.restoroad.com/admin/view_status.php": "2023-09-29",
      "builsf.com/inc/left.php": "2026-01-02",
      "bytecortex.com.br/eletronicos/digital.jsp": "2020-12-23",
      "byucksanpaint.com/community/com_gon_open.asp": "2019-07-10",
      "byucksanpaint.com/main/main4.asp": "2019-07-16",
      "cabba-cacao.com/wp-content/themes/integral/about.php": "2019-07-22",
      "calculactcal.org/wp-content/themes/twentysixteen/body.php": "2020-11-14",
      "calculadoras.mx/themes/pack/pilot.php": "2020-12-15",
      "cats.runtimerec.com/db/dbconn.php": "2022-11-25",
      "chanbang.co.kr/board/check.asp": "2019-07-15",
      "chanbang.co.kr/family/check.asp": "2019-07-15",
      "chanbang.co.kr/gonggu/upload.asp": "2019-07-15",
      "chiark.greenend.org.uk/~sgtatham/putty/": "2023-10-11",
      "client.livesistemas.com/Live/posto/system.jsp": "2020-12-23",
      "cloudarray.com/images/logo/videos/cache.jsp": "2021-02-25",
      "codevexillium.org/image/download/download.asp": "2021-01-26",
      "codibest.com/data/geditor/main_1.php": "2021-04-27",
      "colasprint.com/_vti_log/upload.asp": "2021-01-26",
      "colasprint.com/about/about.asp": "2022-03-24",
      "cometnet.biz/framework/common/common.asp": "2020-12-23",
      "commodore.com.tr/mobiquo/appExtt/notdefteri/writenote.php": "2021-01-26",
      "commune-fraita.ma/wp-content/plugins/wp-contact/contact.php": "2023-11-15",
      "conkorea.com/cshop/banner/list.php": "2021-06-16",
      "copansrl.it/wp-admin/user/invite.php": "2020-11-14",
      "coralsunmarine.com/wp-content/themes/flatsome/inc/functions/function-hand.php": "2026-01-26",
      "coupontreezero.com/include/bottom.asp": "2023-08-20",
      "cowp.or.kr/html/board/main.asp": "2020-11-17",
      "creaideck.com/update/darwin64.bin": "2021-01-15",
      "crm.vncgroup.com/cats/scripts/sphinxview.php": "2022-07-05",
      "ctevt.org.np/ctevt/public/frontend/review.php": "2021-04-27",
      "curiofirenze.com/include/inc-site.asp": "2020-09-29",
      "cyberub.com/board/icon/template/template_ro.php": "2019-09-23",
      "daehang.com/member/logout.asp": "2023-08-20",
      "dafnefonseca.com/wp-content/themes/top.php": "2020-12-11",
      "ddjm.co.kr/bbs/icon/skin/skin.php": "2021-04-21",
      "dellarocca.net/it/content/img/img.asp": "2021-02-25",
      "depts.washington.edu/dswkshp/wordpress/wp-content/themes/twentyfifteen/inc/io/": "2020-05-26",
      "dev.microcravate.com/wp-includes/common.php": "2019-03-26",
      "dev.whatsyourcrunch.com/wp-includes/common.php": "2019-03-26",
      "difa.or.kr/common/asp/inc_Comn.asp": "2019-06-25",
      "digitaldowns.us/artman/exec/upload.php": "2021-02-25",
      "dimer-group.com/wp-content/plugins/ckeditor-for-wordpress/ckeditor/plugins/image/download.php": "2020-11-14",
      "ditijindal.com/wp-content/gallery/services/globalcareers/12849/jobs/gallery.php": "2021-11-22",
      "djasw.or.kr/sub/popup/images/upfiles.asp": "2021-02-25",
      "docentfx.com/wp-admin/includes/upload.php": "2021-02-25",
      "dodoi.cc/photos/preview.php": "2020-11-14",
      "dorusio.com/dorusio_update.php": "2021-02-17",
      "dream.bluit.gethompy.com/mobile/skin/board/gallery/index.skin.php": "2026-01-02",
      "drei-schneeballen.de/wp-content/plugins/nextgen-gallery/view.php": "2020-12-11",
      "dronerc.it/forum/uploads/index.php": "2021-01-26",
      "dronerc.it/shop_testbr/Adapter/Adapter_Config.php": "2021-01-26",
      "dronerc.it/shop_testbr/Core/upload.php": "2021-01-26",
      "dronerc.it/shop_testbr/localization/dir_photoes/image.php": "2021-03-11",
      "dronerc.it/shop_testbr/localization/dir_photoes/logo.php": "2021-03-11",
      "dronerc.it/shop_testbr/upload/upload.php": "2021-01-26",
      "droof.kr/Board/htmlEdit/PopupWin/Editor.asp": "2023-10-28",
      "easyview.kr/board/mb_admin.php": "2023-01-13",
      "ec2-15-207-207-64.ap-south-1.compute.amazonaws.com/resource/main/rawmail.php": "2023-08-24",
      "ecolerubanvert.com/wp-content/plugins/image-intense/know.php": "2020-11-14",
      "ecudecode.mx/redsocial/wp-content/themes/buddyx/inc/Customizer/usercomp.php": "2026-01-26",
      "edenenc.co.kr/Report/RptMyReport.asp": "2019-06-25",
      "edujikim.com/intro/blue/insert.asp": "2021-01-26",
      "edujikim.com/intro/blue/view.asp": "2021-02-25",
      "edujikim.com/pay/sample/INIstart.asp": "2021-02-25",
      "edujikim.com/pay_sample/INIstart.asp": "2022-04-01",
      "edujikim.com/smarteditor/img/upload.asp": "2021-02-25",
      "eflow.co.kr/member_image/about.php": "2023-05-17",
      "egreenland.co.kr/cheditor2/example/newpost.asp": "2019-07-15",
      "elite4print.com/admin/order/batchPdfs.asp": "2020-05-11",
      "elite4print.com/support/support.asp": "2022-11-25",
      "elshaik.com/wp-content/plugins/elementor/core/editor/editor-ui.php": "2024-02-15",
      "elsouq.org/aramex/left.php": "2019-08-31",
      "emilypress.com/CMWorking/Static/service/center.asp": "2020-12-15",
      "emsystec.com/include/inc.asp": "2022-04-01",
      "encontrosmaracatu.com.br/wp-content/plugins/music-press-pro/templates/global/topmenu.php": "2020-11-14",
      "enterpriseheroes.com.ng/wp-includes/common.php": "2019-03-26",
      "erickeleo.com.br/wp-content/plugins/music-press-pro/go.php": "2020-11-14",
      "erpmas.co.kr/Member/franchise_modify.asp": "2020-11-17",
      "eventum.cwsdev3.bi.com/wp-includes/common.php": "2019-03-26",
      "fabianiarte.com/newsletter/arte/view.asp": "2021-01-26",
      "fabianiarte.com/pdf/thumbs/thumb.asp": "2020-12-15",
      "fabianiarte.com/uploads/imgup/21it-23792.jpg": "2020-09-07",
      "fabioluciani.com/ae/include/constant.asp": "2021-01-26",
      "fabioluciani.com/es/include/include.asp": "2021-01-26",
      "fidesarte.it/thumb/multibox/style/common.asp": "2020-12-15",
      "financialtimes365.com/user/finance.asp": "2022-03-24",
      "firstalliance.church/wp-content/plugins/music-press/templates/404.php": "2020-11-14",
      "forecareer.com/gdcareer/officetemplate-20nab.asp": "2021-04-27",
      "fored.or.kr/home/board/view.php": "2020-11-17",
      "forum.iron-maiden.ru/core/cache/index.php": "2021-02-25",
      "forum.snowreport.gr/cache/template/upload.php": "2021-02-25",
      "franksweeklycall.com/wp-includes/html-api/class-wp-html-user.php": "2024-02-14",
      "fredrikarnell.com/marocko2014/index.php": "2021-02-25",
      "freeforum.co/forum/list.php": "2020-11-14",
      "friendmc.com/upload/board/asp20062107.asp": "2023-10-28",
      "friendship.me/users/register.php": "2020-11-14",
      "funny-pictures.picphotos.net/saint-louis-senior-photos-senior-pictures-seniors-st-louis-st-louis/upload.php": "2020-12-11",
      "galaterrace.com/wp-content/themes/hello-elementor/includes/functions.php": "2026-01-26",
      "gaonwell.com/data/base/mail/login.asp": "2022-04-19",
      "gatexpiring.com/gate/index.asp": "2022-03-24",
      "gbflatinamerica.com/file/filelist.php": "2021-04-27",
      "geeks-board.com/blog/wp-content/uploads/2017/cache.php": "2021-02-25",
      "genieaccount.com/images/common/common.asp": "2020-12-15",
      "gestao.simtelecomrs.com.br/sac/digital/client.jsp": "2020-08-31",
      "gncaf.or.kr/cafe/cafe_board.asp": "2020-11-17",
      "gongim.com/board/ajax_Write.asp": "2020-12-23",
      "gongsilbox.com/board/bbs.asp": "2023-08-20",
      "gongsinet.kr/comm/comm_gongsi.asp": "2020-11-17",
      "gonnelli.it/uploads/catalogo/thumbs/thumb.asp": "2021-02-25",
      "goodfriend.pro/projects/list.php": "2020-11-14",
      "goodproject.xyz/projects/list.php": "2020-11-14",
      "goojoo.net/board/banner01.asp": "2020-11-17",
      "gozdeelektronik.net/wp-content/themes/0111/": "2021-10-08",
      "grandgolf.co.kr/html/facilities/facilities_01_06.asp": "2021-07-08",
      "greenvideo.nl/wp-content/themes/top.php": "2020-12-11",
      "gyro3d.com/common/faq.asp": "2022-04-01",
      "gyro3d.com/mypage/faq.asp": "2022-04-01",
      "h-cube.co.kr/main/image/gellery/gallery.asp": "2022-04-19",
      "haciendadeclarevot.com/wp-content/top.php": "2020-12-11",
      "haciendasacchich.com/wp-content/plugins/photo-gallery/admin/views/404.php": "2020-12-04",
      "hanbook.co.kr/partnershop/hanmail_ep.asp": "2019-06-25",
      "hankooktop.com/ko/company/info.asp": "2023-10-28",
      "hanlasangjo.com/editor/pages/page.asp": "2023-10-28",
      "hansolhope.or.kr/welfare/notice/view.jsp": "2020-12-15",
      "happinesscc.com/mobile/include/func.asp": "2023-10-28",
      "healthpro.or.kr/upload/naver_editor/subview/view.inc": "2023-10-28",
      "hellofriend.pro/users/register.php": "2020-11-14",
      "heromessi.com/wp-public/career/car_add.php": "2019-09-30",
      "hicar.kalo.kr/data/rental/Coupon/include/inc.asp": "2023-10-28",
      "hirokawaunso.co.jp/wordpress/wp-includes/ID3/module.audio.mp4.php": "2021-01-26",
      "hirokawaunso.co.jp/wordpress/wp-includes/review.php": "2020-12-15",
      "hivekorea.com/jdboard/member/list.php": "2021-06-16",
      "hmedical.co.kr/include/edit.php": "2023-08-20",
      "hospitality-partners.co.jp/works/performance/consumer.php": "2021-04-29",
      "hpc.kau.ac.kr/error2.php": "2021-01-23",
      "hpc.kau.ac.kr/rolling_banner/tmp4c5ae3.p3a": "2021-01-23",
      "hrgp.asselsolutions.com/wp-includes/common.php": "2019-03-26",
      "hsbutton.co.kr/bbs/bbs_write.asp": "2020-11-17",
      "hspje.com/menu6/teacher_qna.asp": "2023-10-28",
      "hstudymall.co.kr/easypay/web/bottom.asp": "2020-11-17",
      "htns.com/eng/skin/member/basic/skin.php": "2026-01-02",
      "http://103.179.142.171": "2023-12-08",
      "http://103.225.168.159/admin/verify.php": "2019-03-27",
      "http://103.35.190.170": "2026-01-02",
      "http://103.53.176.145:8080/ServiceDeskPlus/products.do": "2019-07-15",
      "http://104.243.41.127": "2026-07-06",
      "http://108.181.185.2": "2024-12-25",
      "http://109.248.144.155": "2022-04-30",
      "http://109.248.150.13": "2022-06-25",
      "http://111.68.126.155:8080/ServiceDeskPlus/products.do": "2019-07-15",
      "http://121.146.68.233/fileserver/temp/platform.asp": "2021-04-27",
      "http://121.254.224.218/angkor.ylw.common.fileserviceserver/web/document/netframework.asp": "2021-04-27",
      "http://125.206.177.152/old/viewer.php": "2020-12-15",
      "http://135.181.123.177": "2026-01-02",
      "http://135.181.242.24": "2026-01-02",
      "http://137.117.57.244:8080/ServiceDeskPlus/products.do": "2019-07-15",
      "http://137.74.114.227/theveniaux/webliotheque/public/css/main.php": "2020-12-15",
      "http://138.201.50.5": "2026-01-02",
      "http://141.98.168.79": "2026-01-02",
      "http://143.198.48.95": "2024-07-26",
      "http://144.172.100.204": "2026-06-29",
      "http://144.172.101.178": "2026-06-29",
      "http://144.172.103.75": "2026-06-29",
      "http://144.172.105.92": "2026-06-29",
      "http://144.172.110.72": "2026-06-29",
      "http://144.172.112.106": "2026-01-02",
      "http://144.172.112.50": "2026-01-02",
      "http://144.172.114.159": "2026-06-29",
      "http://144.172.114.56": "2026-06-29",
      "http://144.172.115.235": "2026-06-29",
      "http://144.172.116.19": "2026-06-29",
      "http://144.172.116.67": "2026-06-29",
      "http://144.172.117.86": "2026-06-29",
      "http://144.172.89.183": "2026-06-09",
      "http://144.172.89.227": "2026-06-29",
      "http://144.172.91.252": "2026-06-29",
      "http://144.172.93.69": "2026-06-29",
      "http://144.172.94.226": "2026-01-02",
      "http://144.172.95.14": "2026-06-29",
      "http://144.172.96.35": "2026-01-02",
      "http://144.172.97.203": "2026-06-29",
      "http://144.172.97.67": "2026-06-29",
      "http://144.172.98.156": "2026-06-29",
      "http://144.172.98.170": "2026-06-29",
      "http://144.172.98.23": "2025-02-18",
      "http://144.217.86.88": "2026-01-02",
      "http://144.76.201.229": "2026-01-02",
      "http://145.232.235.222": "2022-08-10",
      "http://146.4.21.94": "2023-08-24",
      "http://146.70.253.10": "2026-01-02",
      "http://147.189.172.105": "2026-07-02",
      "http://15.235.33.14": "2022-04-15",
      "http://151.106.2.139": "2022-09-07",
      "http://152.89.247.236": "2021-12-01",
      "http://152.89.61.240": "2026-01-02",
      "http://152.89.61.96": "2026-01-02",
      "http://153.75.91.138": "2026-06-29",
      "http://154.91.0.196": "2026-06-24",
      "http://155.94.208.209": "2023-12-12",
      "http://155.94.210.11": "2022-04-30",
      "http://156.236.76.9": "2023-12-08",
      "http://156.245.16.55/admin/admin.asp": "2021-02-25",
      "http://158.69.57.135": "2019-09-23",
      "http://159.100.18.177": "2026-01-02",
      "http://163.245.219.19": "2026-04-22",
      "http://166.88.134.62": "2026-06-24",
      "http://166.88.54.158": "2026-06-12",
      "http://172.86.109.49": "2026-01-02",
      "http://172.86.113.12": "2026-01-02",
      "http://172.86.114.141": "2025-02-12",
      "http://172.86.116.178": "2026-01-02",
      "http://172.86.64.67": "2026-01-02",
      "http://172.86.70.173": "2025-02-12",
      "http://172.86.73.46": "2026-01-02",
      "http://172.86.88.188": "2026-01-02",
      "http://173.249.5.112": "2024-01-22",
      "http://178.128.253.67/tbl_add.php": "2019-07-10",
      "http://185.231.205.75": "2025-02-12",
      "http://185.29.8.53": "2023-12-12",
      "http://191.96.31.38": "2026-01-02",
      "http://193.56.28.251": "2022-09-07",
      "http://193.56.28.32": "2022-04-30",
      "http://195.201.104.22": "2026-04-28",
      "http://195.201.104.4": "2026-04-28",
      "http://195.201.104.41": "2026-04-28",
      "http://195.201.104.53": "2026-04-27",
      "http://195.201.53.165": "2026-04-28",
      "http://195.250.29.94": "2025-01-29",
      "http://198.105.127.210": "2026-06-24",
      "http://206.71.148.38": "2026-06-03",
      "http://209.182.224.49": "2026-06-09",
      "http://213.180.180.154": "2022-07-07",
      "http://216.107.137.53": "2026-01-02",
      "http://216.126.224.195": "2026-06-29",
      "http://216.126.225.83": "2026-07-02",
      "http://216.126.225.84": "2026-06-29",
      "http://216.126.227.161": "2026-06-29",
      "http://216.126.227.187": "2026-06-29",
      "http://216.126.229.172": "2026-06-29",
      "http://216.126.236.138": "2026-06-29",
      "http://216.126.236.244": "2026-06-29",
      "http://216.126.237.112": "2026-06-29",
      "http://216.126.237.200": "2026-06-09",
      "http://216.126.237.86": "2026-06-29",
      "http://216.158.225.144": "2026-04-22",
      "http://217.69.0.159": "2026-03-17",
      "http://217.69.11.60": "2026-03-17",
      "http://217.69.11.99": "2026-03-17",
      "http://217.69.3.152": "2026-03-19",
      "http://23.127.202.249": "2026-01-02",
      "http://23.227.202.242": "2026-01-02",
      "http://23.254.164.156": "2026-01-02",
      "http://23.254.164.232": "2026-01-02",
      "http://23.254.204.184": "2026-01-02",
      "http://23.27.13.43": "2026-07-29",
      "http://23.27.177.183": "2026-01-02",
      "http://23.27.20.187": "2026-07-29",
      "http://27.102.113.93": "2023-12-12",
      "http://3.89.226.234": "2023-05-17",
      "http://37.238.135.70/img/anan.jpg": "2019-03-15",
      "http://38.110.228.112": "2026-01-02",
      "http://40.121.90.194": "2023-05-17",
      "http://41.208.185.235": "2026-01-02",
      "http://45.12.134.206": "2026-01-02",
      "http://45.140.147.208": "2024-08-22",
      "http://45.159.248.110": "2026-01-02",
      "http://45.32.150.97": "2026-03-17",
      "http://45.42.40.200": "2026-01-02",
      "http://45.42.40.208": "2026-01-02",
      "http://45.57.245.17": "2022-04-30",
      "http://45.61.136.204": "2021-05-11",
      "http://45.61.148.153": "2025-01-03",
      "http://45.76.160.53": "2026-01-02",
      "http://45.76.44.240": "2026-03-17",
      "http://45.8.146.93": "2026-01-02",
      "http://45.84.226.239": "2026-01-02",
      "http://45.89.53.54": "2026-01-02",
      "http://45.95.186.237": "2026-06-15",
      "http://47.91.56.21/verify.php": "2019-03-27",
      "http://5.175.184.52": "2026-07-07",
      "http://5.230.251.49": "2026-01-02",
      "http://5.230.252.157": "2026-01-02",
      "http://5.230.44.79": "2026-01-02",
      "http://52.202.193.124": "2022-09-07",
      "http://52.79.92.249/bbs/bbs_post.asp": "2022-07-31",
      "http://62.33.223.164": "2026-07-03",
      "http://64.188.27.73": "2022-09-07",
      "http://66.154.102.91": "2022-09-07",
      "http://69.10.53.86": "2026-01-02",
      "http://74.119.194.244": "2026-01-02",
      "http://84.201.189.216": "2020-11-16",
      "http://86.104.72.247": "2026-01-02",
      "http://91.206.178.125": "2023-09-22",
      "http://91.222.173.110": "2026-01-02",
      "http://91.222.173.138": "2026-01-02",
      "http://91.222.173.168": "2026-01-02",
      "http://91.92.120.132": "2025-01-31",
      "http://91.92.248.50": "2024-03-24",
      "http://92.222.106.229": "2019-09-23",
      "http://95.179.235.55": "2021-07-10",
      "http://95.216.46.218": "2026-01-02",
      "humingbot.io/cdn/js.asp": "2022-03-24",
      "hurricanepub.com/include/include.php": "2022-11-25",
      "ics-kr.com/video/player.php": "2024-11-21",
      "ictm.or.kr/UPLOAD_file/board/free/edit/index.php": "2023-10-28",
      "ikrea.or.kr/main/main_board.asp": "2020-11-17",
      "ilhak.co.kr/images/data/upload.asp": "2020-12-03",
      "ilovesvc.com/HomePage1/Inquiry/privacy.asp": "2022-04-01",
      "img.kindermom.co.kr/frameart/print/footer.mov": "2019-06-25",
      "index-consulting.jp/eng/news/index.php": "2020-12-15",
      "indoweb.org/love/data/common/common.php": "2020-12-15",
      "infocop.me/products/list.php": "2020-11-14",
      "inovecommerce.com.br/public/pdf/view.php": "2021-01-26",
      "insideforum.me/forum/list.php": "2020-11-14",
      "iski.silogica.net/events/serial.jsp": "2020-12-23",
      "ja-fc.or.jp/shop/shopping.php": "2021-01-26",
      "jinjinpig.co.kr/Anyboard/skin/board.php": "2021-04-15",
      "jkmusic.co.kr/shop/data/theme/": "2023-07-20",
      "jsonkeeper.com/b/7EBZP": "2026-04-27",
      "jsonkeeper.com/b/YY8VI": "2026-04-04",
      "juliesoskin.com/includes/common/list.php": "2019-10-24",
      "justholdfast.com/doodle/wp-content/plugins/top.php": "2020-12-11",
      "juvillage.co.kr/img/upload.asp": "2021-02-25",
      "k-kiosk.com/bbs/notice_write.asp": "2020-12-23",
      "kadsm.org/skin/board/basic/write_comment_skin.php": "2026-01-02",
      "kannadagrahakarakoota.org/forums/admincp/upload.php": "2021-02-25",
      "kapata-arkeologi.kemdikbud.go.id/pages/payment/payment.php": "2023-09-29",
      "karin-store.com/recaptcha.php": "2022-07-07",
      "kartacnictvi.cz/wp-content/plugins/ckeditor-for-wordpress/ckeditor/plugins/image/upload.php": "2020-11-14",
      "katawaku.jp/bbs/data/theme/profile2.php": "2019-10-30",
      "kazitradebd.com/wp-content/themes/hello-elementor/includes/customizer/customizer-hand.php": "2026-01-26",
      "kbcwainwrightchallenge.org.uk/connections/dbconn.asp": "2021-02-25",
      "kdone.co.kr/Utils/EmailUtil.asp": "2021-07-08",
      "kenpa.org/yokohama/main.php": "2021-01-26",
      "kerstpakketten.horesca-meppel.nl/wp-content/plugins/woocommerce/lib.php": "2023-09-29",
      "keyang.co.kr/pub/editor/wa_path.asp": "2019-07-16",
      "kgsa1015.co.kr/upload/member/member.asp": "2019-07-15",
      "khmcpharm.com/Lib/Modules/HtmlEditor/Util/read.cer": "2023-10-28",
      "kingsvc.cc/index.php": "2020-11-14",
      "kittimasszazs.hu/images/virag.php": "2023-09-29",
      "kne.co.kr/upload/Customer/BBS.asp": "2020-12-23",
      "kscmfs.or.kr/member/handle/log_proc.php": "2023-10-28",
      "ksmarathon.com/admin/excel2.asp": "2023-08-20",
      "kstr.radiology.or.kr/upload/schedule/29431_1687715624.inc": "2023-10-28",
      "ktri.or.kr/upload/mail/upload.asp": "2020-12-03",
      "kwwa.org/DR6001/FN6006LS.asp": "2021-02-25",
      "kwwa.org/popup/160307/popup_160308.asp": "2021-02-25",
      "lastedforcast.com/list.php": "2020-06-10",
      "lavaandstone.com/wp-content/plugins/fusion-core/about.php": "2019-07-19",
      "leadsblue.com/wp-content/wp-utility/index.php": "2022-11-06",
      "leemble.com/5mai-lyon/public/webconf.php": "2021-01-26",
      "little-pet.com/web/board/skin/default/read.php": "2023-10-28",
      "locknlockmall.com/common/popup_left.asp": "2020-12-23",
      "loneeaglerecords.com/wp-content/uploads/2020/01/images.tgz.001": "2022-01-28",
      "loonsaloon.com/wp-content/plugins/revslider/hello.php": "2021-01-26",
      "luxmodelagency.com/wp-incluses/random_compat/zeus/wongs/wongs.php": "2021-04-15",
      "lwac.com/wp-content/plugins/gallery-plugin/includes/demo-data/images/music/photo.php": "2020-11-14",
      "lyzeum.com/board/bbs/bbs_read.asp": "2021-02-25",
      "lyzeum.com/images/board/upload.asp": "2021-02-25",
      "lyzeum.com/popup/popup.asp": "2020-12-15",
      "magazineschool.co.kr/includes/lm9.asp": "2026-06-03",
      "mail.clicktocareers.com/dev_clicktocareers/public/mailview.php": "2021-01-26",
      "mail.clicktocareers.com/public/jobapplications/jdviewer.php": "2021-04-29",
      "mail.namusoft.kr/jsp/user/eam/board.jsp": "2021-04-15",
      "mail.neocyon.com/jsp/user/sms/sms_recv.jsp": "2021-06-20",
      "mail.sisnet.co.kr/jsp/user/sms/sms_recv.jsp": "2021-06-16",
      "mainbiz.or.kr/SmartEditor2/photo_uploader/popup/edit.asp": "2023-10-28",
      "mainbiz.or.kr/include/common.asp": "2023-10-28",
      "manhotline.or.kr/data/member/search.php": "2024-11-21",
      "mannpublicwhseltd.com/cservice.asp": "2020-12-15",
      "mantis.jancom.pl/bluemantis/image/addon/addin.php": "2023-11-25",
      "mantis.westlinks.net/api/soap/mc_enum.php": "2022-07-05",
      "marmarademo.com/include/extend.php": "2019-04-26",
      "martiancartel.com/forum/customavatars/avatars.php": "2021-02-25",
      "materialindia.in/wp/wp-main/gallery/profile2.php": "2021-02-18",
      "materic.or.kr/files/board/equip/equip_ok.asp": "2023-08-20",
      "materic.or.kr/include/main/main_top.asp": "2022-04-19",
      "materic.or.kr/include/main/main_top.xn--asp": "2022-04-19",
      "matteoragazzini.it/wp-content/uploads/2017/06/category.php": "2020-04-27",
      "mbrainingevents.com/wp-admin/network/server_test.php": "2020-04-27",
      "mdim.in.ua/core/cache/index.php": "2021-02-25",
      "mediostresbarbas.com.ar/php_scrip/banahosting/index.php": "2026-01-26",
      "medric.or.kr/Controls/Board/certificate.cer": "2023-10-28",
      "mge.sn/themes/classic/modules/ps_rssfeed/feed.zip": "2023-11-15",
      "mge.sn/themes/classic/modules/ps_rssfeed/feedmd.zip": "2023-11-15",
      "mileage.krb.co.kr/common/db_conf.asp": "2019-04-26",
      "mk.bital.com.br/sac/Formule/Manager.jsp": "2020-08-31",
      "mnmathleague.com/ckeditor/adapters/index.php": "2026-01-02",
      "mnmathleague.org/ckeditor/adapters/index.php": "2026-01-26",
      "mocki.io/v1/32f16c80-602a-4c80-80af-32a9b8220a6b": "2026-01-02",
      "mokawafm.com/wp-content/plugins/ckeditor-for-wordpress/ckeditor/plugins/image/dialog.php": "2020-05-27",
      "moonge.cc/wp-content/plugins/google-sitemap-generator/sitemap-builder-embed.php": "2020-11-14",
      "mudeungsan.or.kr/gbbs/bbs/template/g_botton.php": "2023-01-13",
      "muijae.com/daumeditor/pages/template/": "2023-10-28",
      "muijae.com/daumeditor/pages/template/simple.asp": "2023-10-28",
      "muijae.com/daumeditor/pages/template/template.asp": "2023-10-28",
      "muzeyyengroup.com/wp-content/help.php": "2020-12-17",
      "myungokhun.co.kr/_proc/member/member_bk.asp": "2021-04-27",
      "namchoncc.co.kr/include/?ind=": "2022-04-19",
      "namchuncheon.co.kr/admin/BookAppl/Search_left.asp": "2021-07-08",
      "namchuncheon.co.kr/html/notice/list.asp": "2022-07-15",
      "ne-ba.org/files/gallery/img/img.asp": "2020-06-10",
      "ne-ba.org/files/news/thumbs/thumbs.asp": "2020-09-29",
      "necaled.com/modules/applet/list.php": "2019-10-24",
      "neohr.co.kr/bbs/data/notice/notice.php": "2023-01-13",
      "new-q-cells.com/upload/newsletter/cn/frame.php": "2023-10-28",
      "newbusantour.co.kr/gallery/left.asp": "2022-04-01",
      "newidealupvc.com:443/img/prettyPhoto/jquery.max.php": "2021-02-25",
      "nextlevelliving.pro/wp-content/uploads/js_composer/images/8c206b81-f5b1-4242-84d3-237ce728ff35.php": "2020-07-26",
      "nonstopexpress.com/community/include/index.asp": "2023-10-28",
      "notebooksell.kr/mall/m_schema.php": "2023-07-19",
      "nrfm.lk/wp-includes/simplepie/content.php": "2023-09-29",
      "od.lk/d/MzBfMjA1Njc0ODdf/pubmaterial.dotm": "2020-05-11",
      "okkids.kr/html/program/display/?re=": "2022-04-19",
      "oldlinewoodwork.com/wp-content/themes/zubin/inc/index.php": "2026-01-26",
      "olidhealth.com/wp-includes/php-compat/compat.php": "2022-11-25",
      "ougreen.com/zone": "2022-07-05",
      "paghera.com/content/view/thumb/info.asp": "2020-12-15",
      "paghera.com/include/inc-main-default-news.asp": "2020-06-09",
      "partnerls.pl/wp-content/themes/public/index.php": "2026-01-26",
      "paulkaren.com/synthpop/main.asp": "2019-04-26",
      "pcdesk.co.kr/Freeboard/mn_board.asp": "2020-11-17",
      "pediatrics.or.kr/PubReader/build_css.php": "2023-10-28",
      "pennontraders.com/assets/slides/view.jsp": "2020-12-15",
      "pgak.net/service/engine/release.asp": "2020-11-17",
      "phukien2a.net/images/images.zip.000": "2020-10-01",
      "pierregems.com/wp-content/themes/woodmart/inc/configs/js-hand.php": "2026-01-26",
      "pms.nninc.co.kr/app/content/board/inc_list.asp": "2023-10-28",
      "polyboatowners.com/2010/images/BOTM/upload.php": "2021-02-25",
      "polyboatowners.com/css/index.php": "2021-02-25",
      "prestigein-am.jp/akita/wp-includes/wp-rss1.php": "2020-12-15",
      "projectcell.niv.co.in/non_scientific/service.php": "2023-05-17",
      "propro.jp/wp-content/documents/docsmgmt.php": "2021-04-27",
      "prototypetrains.com:443/forums/core/cache/index.php": "2021-02-25",
      "publishapp.co/update/check.php": "2020-11-14",
      "puskesmas-terminal.com/wp-content/help.php": "2020-12-17",
      "pvacek.cz/wp-content/plugins/akismet/control/en/en.jpg": "2022-03-21",
      "quecue.kr/okproj/ex_join.asp": "2020-11-17",
      "qwerty.creativehonduras.com/wp-includes/class-wp-redirect.php": "2020-12-11",
      "radiographers.org/aboutus/aboutus.php": "2023-09-29",
      "raiestatesandbuilders.com/admin/installer/installer/index.php": "2021-02-25",
      "recruitment.raystechserv.com/lib/artichow/BarPlotDashboard.object.php": "2022-11-25",
      "rhythm86.com/wp-content/themes/twentysixteen/about.php": "2019-07-22",
      "rodaxsankyokorea.com/upload/favicon/favicon.asp": "2019-07-15",
      "roit.co.kr/xyz/adminer/edit_fail_decoded.asp": "2022-04-01",
      "roit.co.kr/xyz/mainpage/view.asp": "2021-02-25",
      "rowdensurname.org/slideshow/slides/show.asp": "2023-08-24",
      "royalsevres.com/bbs/bbs_img/btn_list.psd": "2026-01-02",
      "royalsevres.com/javascript/activex_patch.hwp": "2026-01-02",
      "rsdf.kr/wp-content/uploads/2024/01/index.php": "2026-01-02",
      "sac.najatelecom.com.br/sac/Dados/ntlm.jsp": "2020-12-23",
      "sac.onecenter.com.br/sac/masks/wfr_masks.jsp": "2020-08-31",
      "safemotors.co.kr/daumeditor/pages/template/template.asp": "2023-10-28",
      "sales.alitho.com/wp-content/themes/sketch/about.php": "2019-07-19",
      "samwoosystem.co.kr/board/list/write.asp": "2023-10-28",
      "sanatoliacare.com/include/index.asp": "2021-02-25",
      "sanlorenzoyacht.com/newsl/include/inc-map.asp": "2020-09-29",
      "sanlorenzoyacht.com/newsl/uploads/docs/": "2021-03-26",
      "sanlorenzoyacht.com/newsl/uploads/docs/43.dotm": "2020-05-11",
      "scertodisha.nic.in/wp-content/plugins/photo-gallery/admin/controllers/Photo.php": "2020-12-04",
      "scgestor.com.br/wp-content/themes/vantage/inc/template-headers.php": "2026-01-26",
      "scimpex.com/admin/assets/backup/requisition/requisition.php": "2021-01-26",
      "semiconductboard.com/xcror": "2022-07-05",
      "sensationalsecrets.com/js/left.php": "2019-07-09",
      "seoulanesthesia.or.kr/mail/mail_211230.html": "2023-10-28",
      "seouldementia.or.kr/_manage/inc/bbs/jiyeuk1_ok.asp": "2023-10-28",
      "shahrtdc.com/wp-content/plugins/top.php": "2020-12-11",
      "shcpump.com/admin/form/skin/formBasic/style.php": "2026-01-02",
      "shieldonline.co.za/sitemap.asp": "2019-04-26",
      "shikshakibaat.com/classes/detail.jsp": "2020-12-15",
      "shinwonbook.co.kr/basket/pay/open.asp": "2021-02-25",
      "shinwonbook.co.kr/board/editor/upload.asp": "2021-02-25",
      "shipshorejob.com/ckeditor/samples/samples.php": "2022-07-05",
      "shoppingbagsdirect.com/media/images/?ui=": "2022-04-19",
      "sideforum.cc/forum/list.php": "2020-11-14",
      "sinae.or.kr/sub01/index.asp": "2023-08-20",
      "sinokor-eng.com/sub/sub01_09.asp": "2019-07-15",
      "siriuskorea.co.kr/mall/community/bbs_read.asp": "2023-10-28",
      "sistema.celllab.com.br/webrun/Navbar/auth.jsp": "2020-12-23",
      "sixbitsmedia.com/wp-content/uploads/wp-logs/category.php": "2020-05-27",
      "snum.or.kr/skin_img/skin.php": "2021-04-19",
      "sofa.rs/wp-admin/network/server_test.php": "2020-04-27",
      "sofa.rs/wp-content/themes/twentynineteen/sass/layout/h1.jpg": "2020-04-27",
      "softapp.co.kr/sub/cscenter/privacy.asp": "2022-04-01",
      "sora.bz/xoops_root_path/templates_c/login.php": "2023-05-17",
      "sora.bz/xoops_root_path/uploads/information/about.php": "2023-05-17",
      "spaincaramoon.com/realestate/wp-content/plugins/gravityforms/forward.php": "2026-01-26",
      "ssoc.cl/wp-content/plugins/webmention/libraries/emoji-detector/src/Detector.php": "2024-02-15",
      "stracarrara.org/images/img.asp": "2022-10-06",
      "stracarrara.org/public/photos/image/image.asp": "2022-07-15",
      "stracarrara.org/public/photos/image/image.xn--asp": "2022-07-15",
      "streamf.ru/wp-content/index2.php": "2019-03-26",
      "style1.co.kr/main/view.asp": "2020-11-17",
      "sunlin.org/info/style?title=": "2022-09-27",
      "support.medicalinthecloud.com/TechCenter/include/slide.asp": "2020-12-15",
      "swedishmassageamsterdam.nl/wp-content/themes/top.php": "2019-08-31",
      "swt-keystonevalve.com/data/editor/index.php": "2023-10-28",
      "syadplus.com/search/search_00.asp": "2022-04-01",
      "tag-cloud-photo.freeware.filetransit.com/login.php": "2020-12-11",
      "tangowithcolette.com/pages/common.php": "2019-03-26",
      "teamspit.pro/adverts/follow.php": "2020-11-14",
      "tecnojournals.com/general": "2022-07-05",
      "tecnojournals.com/prest": "2022-07-05",
      "teenbeanjs.com/cloud/javascript.asp": "2022-03-24",
      "teslacontrols.ir/wp-includes/images/detail31.jpg": "2020-04-27",
      "teslacontrols.ir/wp-includes/images/detail32.jpg": "2020-04-27",
      "the.earth.li/~sgtatham/putty/0.80/w64/": "2024-03-24",
      "theblackout.fr/wp-content/plugins/music-press-pro/music-pro.php": "2020-11-14",
      "theforceawakenstoys.com/vBulletin/core/cache/upload.php": "2021-02-25",
      "thek-portal.com/eng/career/index.asp": "2026-01-02",
      "theorigin.co.kr:443/admin/management/index.php": "2023-10-28",
      "thestreetsmartsalesman.com/wp-content/uploads/wp-logs/category.php": "2020-06-23",
      "thetalkingcanvas.com/jobs/en-gb/jobs/9/details.php": "2021-11-20",
      "thetalkingcanvas.com/thetalking/globalcareers/us/5/careers/jobinfo.php": "2022-10-06",
      "thevagabondsatchel.com/wp-content/uploads/2019/09/public.avi": "2019-10-24",
      "threegood.cc/api/manage/customers": "2020-11-14",
      "tiramisu.it/wp-content/plugins/wp-comment-form.php": "2020-11-14",
      "torgirf.ru/loginhome.css": "2021-03-09",
      "totalmateria.net/wp/profile2.php": "2021-02-18",
      "towingoperations.com/chat/chat.php": "2019-03-26",
      "tpddata.com/skins/skin-6.thm": "2019-04-26",
      "tpddata.com/skins/skin-8.thm": "2019-04-26",
      "trainingpharmacist.co.uk/bootstrap/bootstrap.php": "2026-01-26",
      "transplugin.io/upload/upload.asp": "2021-01-26",
      "tronslog.com/public/appstore.php": "2021-01-26",
      "trophylab.com/design/trophy/product/lmages/logo.png": "2021-01-27",
      "trophylab.com/notice/images/renewal/upload.asp": "2021-01-26",
      "turnscor.com/ACT/images/slide/view.jsp": "2020-12-15",
      "turnscor.com/wp-includes/contacts.php": "2022-11-25",
      "turnscor.com/wp-includes/feedback.php": "2022-10-06",
      "ucware.net/skins/PHPMailer-master/index.php": "2023-10-28",
      "unsunozo.org/include/notes/notes.asp": "2020-08-12",
      "upload.childu.co.kr/include/OnlyOne1.asp": "2019-07-16",
      "urbankizomba.se/wp-content/plugins/photo-gallery/filemanager/upload.php": "2020-12-11",
      "vadtalmandir.org/admin/ckeditor/plugins/icontact/about.php": "2023-11-15",
      "valentinsblog.de/wp-admin/includes/list.php": "2019-10-24",
      "varietyjob.com/sitemap/sitemap.asp": "2022-03-24",
      "vega.mh-tec.jp/.well-known/gallery/siteview.php": "2021-04-29",
      "vega.mh-tec.jp/.well-known/index.php": "2020-12-15",
      "vietjetairkorea.com/INFO/info.asp": "2023-10-28",
      "vinhsake.com/wp-content/uploads/index2.php": "2019-03-26",
      "vnfmal2022.com/niabbs5/upload/gongji/index.php": "2023-10-28",
      "warevalley.com/en/common/include/page_tab.asp": "2023-10-28",
      "warevalley.com/support/orange_open.asp": "2020-12-03",
      "waterdoblog.com/uploads/index.asp": "2021-02-25",
      "worldfoodstory.co.uk/wp-includes/register.php": "2020-11-14",
      "worldspia.kr/upload_images/inc/LOG.PHP": "2021-01-27",
      "wowpress.co.kr/customer/refuse_05.asp": "2020-11-17",
      "yakufreshperu.com/facturacion/public/css/main.php": "2020-12-15",
      "yoohannet.kr/min/tmp/process/proc.php": "2023-10-28",
      "yoshinorihirano.net/wp-includes/feed-xml.php": "2022-07-07",
      "youdermoscopy.org/media/fly.avi": "2019-08-27",
      "youdermoscopy.org/media/fly312.avi": "2019-08-27",
      "zeandf.com/wp-content/help.php": "2020-12-17",
      "zeduzeventos.busqueabuse.com/wpadmin/js/widgets/sub/wids.php": "2023-11-25",
      "zndance.com/shop/post.asp": "2020-11-17"
    },
    "url_path": {
      "/.well-known/pki-validation/go/akgo.php": "2026-02-25",
      "/.well-known/pki-validation/go/boing": "2026-02-25",
      "/018ueCdS/": "2022-03-29",
      "/018ueCdS/018ueCdS32.acm": "2022-03-29",
      "/018ueCdS32.acm": "2022-03-29",
      "/0lvNAK1t/": "2022-03-29",
      "/0lvNAK1t/0lvNAK1t32.acm": "2022-03-29",
      "/0lvNAK1t32.acm": "2022-03-29",
      "/1uFnvppj/": "2022-03-25",
      "/1uFnvppj/1uFnvppj32.acm": "2022-03-25",
      "/1uFnvppj/1uFnvppj64.acm": "2022-03-25",
      "/1uFnvppj32.acm": "2022-03-25",
      "/1uFnvppj64.acm": "2022-03-25",
      "/5Ek9724mz8oncul8Zx7E7CVDCdBNxuFFUO6pLk/": "2021-12-01",
      "/C0sHwcGMH2/": "2022-03-11",
      "/DAhkMrMq7/": "2026-01-13",
      "/DmJMFYpwLPP3ygS/": "2022-08-09",
      "/Jy5S7hSx0K/": "2023-12-09",
      "/KcyRbGDJKRZoaLq8lHh8/": "2022-03-11",
      "/KcyRbGDJKRZoaLq8lHh8/C0sHwcGMH2/": "2022-03-11",
      "/N3RFYU07": "2024-09-06",
      "/OJITWH2WFx/": "2023-12-09",
      "/Of56cYsfVV8/": "2023-12-09",
      "/Of56cYsfVV8/OJITWH2WFx/Jy5S7hSx0K/fP7saoiPBc/": "2023-12-09",
      "/QWERTYU890T12HML": "2026-01-02",
      "/Z7vD3kT0Q5a9N1bW8LxYc4E2rF6pJHsUm_gettext": "2026-03-23",
      "/Z7vD3kT0Q5a9N1bW8LxYc4E2rF6pJHsUm_upload": "2026-03-23",
      "/_manage/inc/bbs/jiyeuk1_ok.asp": "2023-10-28",
      "/aaa000/support.php": "2022-07-07",
      "/adc/empOQO": "2024-12-25",
      "/adm_bord/login_new_check.php": "2022-09-07",
      "/angkor.ylw.common.fileserviceserver/web/document/netframework.asp": "2021-04-27",
      "/apikey/QWERTYU890T12HML": "2026-01-02",
      "/asdfghjkl": "2023-11-08",
      "/bro/ZU1RIOk9": "2025-01-29",
      "/bro/ZU1WJVq1": "2025-01-29",
      "/bro/ahNjWa2": "2026-01-02",
      "/bro/gbNsNg6": "2024-12-23",
      "/bro/ugDtMe1": "2025-01-29",
      "/brow/N3RFYU07": "2024-09-06",
      "/cam-v-ri69.fix": "2026-01-02",
      "/client/marstech1": "2025-02-17",
      "/data/geditor/main_1.php": "2021-04-27",
      "/daumeditor/pages/template/": "2023-10-28",
      "/daumeditor/pages/template/simple.asp": "2023-10-28",
      "/daumeditor/pages/template/template.asp": "2023-10-28",
      "/dnquery.phpinteger": "2023-09-15",
      "/editor/session/aaa000/support.php": "2022-07-07",
      "/fP7saoiPBc/": "2023-12-09",
      "/fileserver/temp/platform.asp": "2021-04-27",
      "/gallery/profile2.php": "2019-10-30",
      "/gbNsNg6": "2024-12-23",
      "/grepmonux.php": "2019-10-11",
      "/inc/bbs/jiyeuk1_ok.asp": "2023-10-28",
      "/j/marstech1": "2025-02-17",
      "/jsp/user/sms/sms_recv.jsp": "2021-06-20",
      "/ktBaRVjQMhMhzjExBFN9HHONH5W0zuR6qEVaYWfxCaxn2AFeYac9Ai0MDY8GFqgs_gettext": "2026-04-28",
      "/ktBaRVjQMhMhzjExBFN9HHONH5W0zuR6qEVaYWfxCaxn2AFeYac9Ai0MDY8GFqgs_upload": "2026-04-28",
      "/levels4SqR8/measure.asp": "2023-10-28",
      "/logs/officetemplate.php": "2021-11-04",
      "/mac-v-ri69.fixer": "2026-01-02",
      "/mall/community/bbs_read.asp": "2023-10-28",
      "/marstech1": "2025-02-17",
      "/michalcaladanxyz/": "2026-02-06",
      "/michalcaladanxyz/caladanecomvp": "2026-02-06",
      "/niabbs5/upload/gongji/": "2023-10-28",
      "/niabbs5/upload/gongji/index.php": "2023-10-28",
      "/paQbmQO0YPKDRyPi7CqrbTV": "2026-04-30",
      "/payl/ZU1RIOk9": "2025-01-29",
      "/payl/ZU1WJVq1": "2025-01-29",
      "/payl/ahNjWa2": "2026-01-02",
      "/payl/gbNsNg6": "2024-12-23",
      "/payl/ugDtMe1": "2025-01-29",
      "/payload/99/81": "2026-01-02",
      "/payload/99/root": "2026-01-16",
      "/payload/N3RFYU07": "2024-09-06",
      "/payload/empOQO": "2024-12-25",
      "/qwertyuiop": "2023-11-08",
      "/qwertyuiop/asdfghjkl": "2023-11-08",
      "/random_compat/zeus/wongs/wongs.php": "2021-04-15",
      "/realtekwin.update": "2026-02-09",
      "/tbl_add.php": "2019-03-15",
      "/theme/profile2.php": "2019-10-30",
      "/update_coingotrade.php": "2022-01-28",
      "/video-questions/create/531fbaedf67046d6904478f15d3e7142": "2025-01-12",
      "/well-known/pki-validation/go/akgo.php": "2026-02-25",
      "/well-known/pki-validation/go/boing": "2026-02-25",
      "/wp-admin/network/server_test.php": "2020-04-27",
      "/wp/profile2.php": "2019-10-30",
      "/zeus/wongs/wongs.php": "2021-04-15"
    }
  },
  "first_seen_precision": {
    "domain": {
      "0927.vercel.app": "at-or-before",
      "0xraiseup.com": "at-or-before",
      "118274-zoomid.com": "at-or-before",
      "1215.vercel.app": "at-or-before",
      "172-86-114-170.dal.priv.octovpn.net": "at-or-before",
      "360scanner.store": "at-or-before",
      "360share.pro": "at-or-before",
      "abilityscan360.com": "at-or-before",
      "acoustickoala.com": "at-or-before",
      "acroadovw.com": "at-or-before",
      "admin.echelonfnd.io": "at-or-before",
      "aduresi.com": "at-or-before",
      "advisorflux.com": "at-or-before",
      "advisorflux.pages.dev": "at-or-before",
      "advisoryfit.com": "at-or-before",
      "advisoryfit.pages.dev": "at-or-before",
      "advisorygrid.com": "at-or-before",
      "ae-zoom.us": "at-or-before",
      "ae-zooom-hegne-meetingsfromf6758s.pages.dev": "at-or-before",
      "aes-secure.net": "at-or-before",
      "africamall.chat": "at-or-before",
      "agora.assessintel.com": "at-or-before",
      "ai.coinhouse360.com": "at-or-before",
      "aiagentnow.online": "at-or-before",
      "alchemy-api-v3.cloud": "at-or-before",
      "alchemy.motionassess.com": "at-or-before",
      "alchemy.onchainhiringtool.com": "at-or-before",
      "alchemy.talentscreeningtool.com": "at-or-before",
      "alejandro.uefa-meeting.com": "at-or-before",
      "alpcoin.anomgaming.online": "at-or-before",
      "anchoragedigitalhireflow.com": "at-or-before",
      "anchoragehireflow.com": "at-or-before",
      "anchoragehiring.com": "at-or-before",
      "angeloper.com": "at-or-before",
      "angeloperonline.online": "at-or-before",
      "anglerstatic.com": "at-or-before",
      "anifintech.xyz": "at-or-before",
      "anomgaming.online": "at-or-before",
      "answerpanel.org": "at-or-before",
      "answerpart.com": "at-or-before",
      "answerpart.pages.dev": "at-or-before",
      "api-zoom.com": "at-or-before",
      "api.africamall.chat": "at-or-before",
      "api.auto-fixer.online": "at-or-before",
      "api.autocamfixer.online": "at-or-before",
      "api.autodriverfix.online": "at-or-before",
      "api.autofixer.online": "at-or-before",
      "api.bitzone.io": "at-or-before",
      "api.camallupdate.cloud": "at-or-before",
      "api.camdriverhelp.club": "at-or-before",
      "api.camdriverhub.cloud": "at-or-before",
      "api.camdrivers.cloud": "at-or-before",
      "api.camdriverstore.cloud": "at-or-before",
      "api.camdriversupport.com": "at-or-before",
      "api.cameradriverx.cloud": "at-or-before",
      "api.camtechdrivers.com": "at-or-before",
      "api.camtuneup.online": "at-or-before",
      "api.coinhar.io": "at-or-before",
      "api.coinpricehub.io": "at-or-before",
      "api.crm.koliinfotech.company": "at-or-before",
      "api.deepdriverupdate.online": "at-or-before",
      "api.devicefixer.online": "at-or-before",
      "api.digipairx.com": "at-or-before",
      "api.drivercamhub.cloud": "at-or-before",
      "api.drivercams.cloud": "at-or-before",
      "api.drivercamsupport.com": "at-or-before",
      "api.driversnap.cloud": "at-or-before",
      "api.driversofthub.online": "at-or-before",
      "api.driverstream.cloud": "at-or-before",
      "api.drivfixer.online": "at-or-before",
      "api.drivhost.store": "at-or-before",
      "api.drvfixer.online": "at-or-before",
      "api.ethzone.io": "at-or-before",
      "api.financecap.io": "at-or-before",
      "api.fivebit.io": "at-or-before",
      "api.fix-drivers.online": "at-or-before",
      "api.fixdiskpro.online": "at-or-before",
      "api.growzy.tech": "at-or-before",
      "api.introon.com": "at-or-before",
      "api.ixcareer.video": "at-or-before",
      "api.jquery-release.com": "at-or-before",
      "api.macamhelp.online": "at-or-before",
      "api.olaestudiocreativo.com": "at-or-before",
      "api.onchainassess.com": "at-or-before",
      "api.provideodrivers.cloud": "at-or-before",
      "api.quickcamfix.online": "at-or-before",
      "api.quickdriverupdate.online": "at-or-before",
      "api.rapiddrivers.cloud": "at-or-before",
      "api.release-driver.online": "at-or-before",
      "api.release-drivers.online": "at-or-before",
      "api.releasedrive.live": "at-or-before",
      "api.retailpackagingpartner.xyz": "at-or-before",
      "api.skilllens360.com": "at-or-before",
      "api.smartchecker.online": "at-or-before",
      "api.smartdriverfix.cloud": "at-or-before",
      "api.smartdriverfixer.com": "at-or-before",
      "api.smartdrvupdate.online": "at-or-before",
      "api.snap-screening.com": "at-or-before",
      "api.softshare.online": "at-or-before",
      "api.stockdata.tech": "at-or-before",
      "api.stockinfo.io": "at-or-before",
      "api.thaibit.io": "at-or-before",
      "api.unimeta.biz": "at-or-before",
      "api.updatecall.live": "at-or-before",
      "api.updatemycam.online": "at-or-before",
      "api.updatewebcamnow.live": "at-or-before",
      "api.vblimitedgroup.com": "at-or-before",
      "api.vcamdriverupdate.cloud": "at-or-before",
      "api.vcamfixer.online": "at-or-before",
      "api.vcamsupport.cloud": "at-or-before",
      "api.videocarddrivers.cloud": "at-or-before",
      "api.videodriverzone.cloud": "at-or-before",
      "api.videotechdrivers.cloud": "at-or-before",
      "api.vidtechdrivers.com": "at-or-before",
      "api.vidtechdrv.online": "at-or-before",
      "api.vidtechhub.cloud": "at-or-before",
      "api.web-cam.cloud": "at-or-before",
      "api.webcamdrivers.cloud": "at-or-before",
      "api.webcamfix.cloud": "at-or-before",
      "api.webcamfixer.cloud": "at-or-before",
      "api.webcamfixer.online": "at-or-before",
      "api.webcamwizard.cloud": "at-or-before",
      "api.wikahmart.com": "at-or-before",
      "api.yourdomainhost.store": "at-or-before",
      "api.zoom-sdk.us": "at-or-before",
      "api.zoomsdk.us": "at-or-before",
      "api.zynoracreative.com": "at-or-before",
      "app-center.download": "at-or-before",
      "app-solaxy.world": "at-or-before",
      "app-zoom.website": "at-or-before",
      "app.answerpart.com": "at-or-before",
      "app.axionara.com": "at-or-before",
      "app.carrerlilla.com": "at-or-before",
      "app.coinhouse360.com": "at-or-before",
      "app.compassidea.org": "at-or-before",
      "app.eboardcareer.com": "at-or-before",
      "app.evalixhub.com": "at-or-before",
      "app.evaluino.com": "at-or-before",
      "app.evaluza.com": "at-or-before",
      "app.expertssavingai.com": "at-or-before",
      "app.ixcareer.video": "at-or-before",
      "app.lenvny.com": "at-or-before",
      "app.limesurvey.us": "at-or-before",
      "app.merreo.org": "at-or-before",
      "app.proficiencycert.com": "at-or-before",
      "app.qwary.org": "at-or-before",
      "app.sloneek.us": "at-or-before",
      "app.vid-crypto-assess.com": "at-or-before",
      "app.zynoracreative.com": "at-or-before",
      "apply-blocknovas.site": "at-or-before",
      "apply-camera.com": "at-or-before",
      "apply.blocknovas.com": "at-or-before",
      "apply.blocknovasllc.com": "at-or-before",
      "apply.echelonfnd.io": "at-or-before",
      "apply.waventic.com": "at-or-before",
      "applylens.com": "at-or-before",
      "arcashop.org": "at-or-before",
      "archblock.candidatescope.com": "at-or-before",
      "archblock.careerscreeners.com": "at-or-before",
      "archblock.quickproassess.com": "at-or-before",
      "archblock.rolefit360.com": "at-or-before",
      "as-zoom.us": "at-or-before",
      "ascendrix.us": "at-or-before",
      "assessalign.com": "at-or-before",
      "assessbay.com": "at-or-before",
      "assesscrew.com": "at-or-before",
      "assessdome.com": "at-or-before",
      "assessforhire.com": "at-or-before",
      "assessintel.com": "at-or-before",
      "assessiohq.com": "at-or-before",
      "assessmentbay.com": "at-or-before",
      "assesspro360.com": "at-or-before",
      "assesstoday.com": "at-or-before",
      "assesstrack.com": "at-or-before",
      "assureeval.com": "at-or-before",
      "attisscmo.com": "at-or-before",
      "authnsecuresystems.com": "at-or-before",
      "auto-ai.online": "at-or-before",
      "auto-fixer.online": "at-or-before",
      "auto-patch.tech": "at-or-before",
      "autocamfixer.online": "at-or-before",
      "autodriverfix.online": "at-or-before",
      "autofixer.online": "at-or-before",
      "avalabs-digital.online": "at-or-before",
      "avalabs-digital.space": "at-or-before",
      "avalabs-digital.store": "at-or-before",
      "avalabs-hiring.online": "at-or-before",
      "avalabs-hiring.site": "at-or-before",
      "avalabs-hiring.space": "at-or-before",
      "avalabs-hiring.store": "at-or-before",
      "avalabs-hiring.world": "at-or-before",
      "avalabs-io.online": "at-or-before",
      "avalabs-io.space": "at-or-before",
      "avalabs-io.store": "at-or-before",
      "avalabs-network.live": "at-or-before",
      "avalabs-network.online": "at-or-before",
      "avalabs-network.space": "at-or-before",
      "avalabs-org.online": "at-or-before",
      "avalabs-talent.online": "at-or-before",
      "avalabs-talent.site": "at-or-before",
      "avalabs-talent.space": "at-or-before",
      "avalabs-talent.store": "at-or-before",
      "avalabs-tech.online": "at-or-before",
      "avalabs-tech.space": "at-or-before",
      "avalabs-tech.store": "at-or-before",
      "aveva.roleassessor.com": "at-or-before",
      "axieinfinity.assessalign.com": "at-or-before",
      "axieinfinity.assessintel.com": "at-or-before",
      "axieinfinity.certifyedge360.com": "at-or-before",
      "axieinfinity.hirelytics360.com": "at-or-before",
      "axionara.com": "at-or-before",
      "ayrshire360.com": "at-or-before",
      "azuredeploypackages.net": "at-or-before",
      "azureglobalaccelerator.com": "at-or-before",
      "backupwizard.net": "at-or-before",
      "baincapitalcrypto.zm-meeting.com": "at-or-before",
      "ballroller.fun": "at-or-before",
      "base-cei.pages.dev": "at-or-before",
      "bigrocks918.com": "at-or-before",
      "binancestransfers.com": "at-or-before",
      "biomedsurgcial.com": "at-or-before",
      "bitgo.talentelevate360.com": "at-or-before",
      "bitmart.hiremodozone.com": "at-or-before",
      "bitzone.io": "at-or-before",
      "biz-zoom.us": "at-or-before",
      "bizmeet.online": "at-or-before",
      "bizmeet.org": "at-or-before",
      "bizmeet.pro": "at-or-before",
      "bizmeeting.org": "at-or-before",
      "bizmeeting.video": "at-or-before",
      "bizzyclub.org": "at-or-before",
      "blastapi.org": "at-or-before",
      "block-digital.fit": "at-or-before",
      "block-digital.online": "at-or-before",
      "block-digital.site": "at-or-before",
      "block-digital.store": "at-or-before",
      "blockassess.com": "at-or-before",
      "blockchainjobassessment.com": "at-or-before",
      "blockchainjobhub.com": "at-or-before",
      "blockfi-krollra.com": "at-or-before",
      "blocknovas.com": "at-or-before",
      "blocknovas.talenthiringexpert.com": "at-or-before",
      "blocknovasllc.com": "at-or-before",
      "blockprices.io": "at-or-before",
      "blog.evalonboard.com": "at-or-before",
      "bofhintl.com": "at-or-before",
      "bonusdali.com": "at-or-before",
      "boofparadise.com": "at-or-before",
      "boolnetwork.xyz": "at-or-before",
      "bs-production.up.railway.app": "at-or-before",
      "bsc-dash.us": "at-or-before",
      "btcblender.live": "at-or-before",
      "bu-zoom.us": "at-or-before",
      "bujey.store": "at-or-before",
      "business-zoom.us": "at-or-before",
      "businessgoogledoc.com": "at-or-before",
      "businesshire.cv": "at-or-before",
      "businesshire.top": "at-or-before",
      "businessmeet.xyz": "at-or-before",
      "bybit-assessment.com": "at-or-before",
      "calendly.live": "at-or-before",
      "callapp.us": "at-or-before",
      "calystiabusiness.com": "at-or-before",
      "camallupdate.cloud": "at-or-before",
      "camdriverhelp.club": "at-or-before",
      "camdriverhub.cloud": "at-or-before",
      "camdrivers.cloud": "at-or-before",
      "camdriverstore.cloud": "at-or-before",
      "camdriversupport.com": "at-or-before",
      "cameradriverx.cloud": "at-or-before",
      "camtechdrivers.com": "at-or-before",
      "camtuneup.online": "at-or-before",
      "candidateinsightinfo.com": "at-or-before",
      "candidatescope.com": "at-or-before",
      "candidatesnap.com": "at-or-before",
      "capitalviabtc.com": "at-or-before",
      "capitalviabtc.comhollow-jordan-narrow.on-fleek.app": "at-or-before",
      "carandcclasic.com": "at-or-before",
      "career-8hp.pages.dev": "at-or-before",
      "careerboard.video": "at-or-before",
      "careerquestion.com": "at-or-before",
      "careerscreeners.com": "at-or-before",
      "carllamb4judge.com": "at-or-before",
      "carrerlilla.com": "at-or-before",
      "carrervision.com": "at-or-before",
      "cdn-static-server.vercel.app": "at-or-before",
      "cdn.clubinfo.io": "at-or-before",
      "cdn.clublogos.io": "at-or-before",
      "cdn.jqueryversion.net": "at-or-before",
      "cdn.leaguehub.net": "at-or-before",
      "cdn.logoeye.net": "at-or-before",
      "cdn.logosports.net": "at-or-before",
      "cdn.soccerlab.io": "at-or-before",
      "cdpll-couk.top": "at-or-before",
      "certifyedge360.com": "at-or-before",
      "cex.apply-camera.com": "at-or-before",
      "chainanalyser.com": "at-or-before",
      "chainlink-api-v3.cloud": "at-or-before",
      "chainlink-api-v3.com": "at-or-before",
      "chaoslabs.abilityscan360.com": "at-or-before",
      "chaoslabs.motionassess.com": "at-or-before",
      "chaoslabs.professionalsnapshot.com": "at-or-before",
      "chat.blocknovas.com": "at-or-before",
      "chipmixer.live": "at-or-before",
      "circle.talentmonitoringtool.com": "at-or-before",
      "citce-group.com": "at-or-before",
      "clubinfo.io": "at-or-before",
      "clublogos.io": "at-or-before",
      "coinbase-walet.biz": "at-or-before",
      "coinbase-walet.me": "at-or-before",
      "coinbase.abilityscan360.com": "at-or-before",
      "coinbase.motionassess.com": "at-or-before",
      "coinbase.onchainhiringtool.com": "at-or-before",
      "coinbase.professionalsnapshot.com": "at-or-before",
      "coinbase.talentelevate360.com": "at-or-before",
      "coinbase.talenthiringtool.com": "at-or-before",
      "coinbase.talentmonitoringtool.com": "at-or-before",
      "coinbase.talentscreeningtool.com": "at-or-before",
      "coinhar.io": "at-or-before",
      "coinhouse360.com": "at-or-before",
      "coinlenddefi.com": "at-or-before",
      "coinlendefi.com": "at-or-before",
      "coinpricehub.io": "at-or-before",
      "communicationhub.us": "at-or-before",
      "compassidea.org": "at-or-before",
      "competency-core.com": "at-or-before",
      "conferenceauth.coffeebrain.co": "at-or-before",
      "consulturbo.com": "at-or-before",
      "consulturbo.pages.dev": "at-or-before",
      "contract.waventic.com": "at-or-before",
      "corebiz.fun": "at-or-before",
      "coreladao.com": "at-or-before",
      "cpromoter.com": "at-or-before",
      "cr-zoom.us": "at-or-before",
      "crosstheages.eskillence.com": "at-or-before",
      "crosstheages.hirehatch360.com": "at-or-before",
      "crosstheages.hirelytics360.com": "at-or-before",
      "crosstheages.skillence360.com": "at-or-before",
      "crosstheages.talentelevate360.com": "at-or-before",
      "crostox.com": "at-or-before",
      "crypto-briefings.com": "at-or-before",
      "cryptomn.vercel.app": "at-or-before",
      "customizetions.com": "at-or-before",
      "cyptoconnections.com": "at-or-before",
      "dabacof.com": "at-or-before",
      "deadfellaz.candidatescope.com": "at-or-before",
      "deepdriverupdate.online": "at-or-before",
      "deepmindschematic.com": "at-or-before",
      "defianceanalytics.abilityscan360.com": "at-or-before",
      "defianceanalytics.easyhiringtool.com": "at-or-before",
      "demo.techsaeein.com": "at-or-before",
      "devchallengehq.com": "at-or-before",
      "development-server.aduresi.com": "at-or-before",
      "devicefixer.online": "at-or-before",
      "diamondhilllaw.com": "at-or-before",
      "digipairx.com": "at-or-before",
      "digitaltalent.review": "at-or-before",
      "digitaltalentassess.com": "at-or-before",
      "document-content.online": "at-or-before",
      "donmuzzi.site": "at-or-before",
      "doodles.careerquestion.com": "at-or-before",
      "doodles.carrervision.com": "at-or-before",
      "doodles.hirequestion.com": "at-or-before",
      "doodles.interviews360.com": "at-or-before",
      "doodles.skillquestion.com": "at-or-before",
      "doodles.skillquestions.com": "at-or-before",
      "doodles.workquestion.com": "at-or-before",
      "downloadcenter.website": "at-or-before",
      "dpkgrepo.com": "at-or-before",
      "dprk-it.pages.dev": "at-or-before",
      "drivercamhub.cloud": "at-or-before",
      "drivercams.cloud": "at-or-before",
      "drivercamsupport.com": "at-or-before",
      "driverpool.online": "at-or-before",
      "driverservices.store": "at-or-before",
      "driversnap.cloud": "at-or-before",
      "driversofthub.online": "at-or-before",
      "driverstream.cloud": "at-or-before",
      "drivertools.org": "at-or-before",
      "drivfixer.online": "at-or-before",
      "drivhost.store": "at-or-before",
      "drvfixer.online": "at-or-before",
      "dunamu.jp-zoom.com": "at-or-before",
      "easydriver.cloud": "at-or-before",
      "easyhiringtool.com": "at-or-before",
      "easyvps.net": "at-or-before",
      "easywalletconnect.com": "at-or-before",
      "eboardcareer.com": "at-or-before",
      "eboardcareer.pages.dev": "at-or-before",
      "ecareerscan.com": "at-or-before",
      "echelonfnd.io": "at-or-before",
      "eclairdomain.com": "at-or-before",
      "ecosystem.openfort.video": "at-or-before",
      "edividy.pro": "at-or-before",
      "effectiveengineeringleader.com": "at-or-before",
      "ehireflex.com": "at-or-before",
      "ehireflix.com": "at-or-before",
      "electoralvictory.site": "at-or-before",
      "elitedrivva-app.dabacof.com": "at-or-before",
      "elitehireaxis360.com": "at-or-before",
      "eliteshire.com": "at-or-before",
      "elitetalent360.com": "at-or-before",
      "emeetings.zoominvites.com": "at-or-before",
      "en-zoom.us": "at-or-before",
      "en.stocksindex.org": "at-or-before",
      "en.stocksitem.org": "at-or-before",
      "en.stockslab.org": "at-or-before",
      "en.wfinance.org": "at-or-before",
      "endesway.life": "at-or-before",
      "enrollcrux.com": "at-or-before",
      "equisphirep.com": "at-or-before",
      "er-zoom.us": "at-or-before",
      "eskillence.com": "at-or-before",
      "eskillfolio.com": "at-or-before",
      "eskillforge.com": "at-or-before",
      "eskillmetric.com": "at-or-before",
      "eskillora.com": "at-or-before",
      "eskillpilot.com": "at-or-before",
      "eskillprof.com": "at-or-before",
      "eskillprov.com": "at-or-before",
      "ethereum.blastapi.org": "at-or-before",
      "ethzone.io": "at-or-before",
      "etoro.careerquestion.com": "at-or-before",
      "evalassesso.com": "at-or-before",
      "evalixhub.com": "at-or-before",
      "evalonboard.com": "at-or-before",
      "evalswift.com": "at-or-before",
      "evaluateiq.com": "at-or-before",
      "evaluino.com": "at-or-before",
      "evaluza.com": "at-or-before",
      "evalvideo.com": "at-or-before",
      "evalvidz.com": "at-or-before",
      "expertssavingai.com": "at-or-before",
      "extrazoom.us": "at-or-before",
      "facial.anomgaming.online": "at-or-before",
      "fashdefi.store": "at-or-before",
      "fast-video-recording.com": "at-or-before",
      "febintllc.com": "at-or-before",
      "fetchtalent360.com": "at-or-before",
      "financecap.io": "at-or-before",
      "findhelptalent360.com": "at-or-before",
      "finnt.evalonboard.com": "at-or-before",
      "finovec.co.ke": "at-or-before",
      "fireblocks-assessment.com": "at-or-before",
      "fireblockshireflow.com": "at-or-before",
      "fireblockshiring.com": "at-or-before",
      "fireblocksinsight.com": "at-or-before",
      "firexch.com": "at-or-before",
      "fivebit.io": "at-or-before",
      "fix-driver.online": "at-or-before",
      "fix-drivers.online": "at-or-before",
      "fix.soft-dev.online": "at-or-before",
      "fixdiskpro.online": "at-or-before",
      "framework.careerboard.video": "at-or-before",
      "frameworkvc.icareerc.com": "at-or-before",
      "frameworkvc.ixcareers.com": "at-or-before",
      "frameworkvc.ixscreen.com": "at-or-before",
      "free-loader.org": "at-or-before",
      "frontend-dev-bnp.pages.dev": "at-or-before",
      "frontend-eu1.pages.dev": "at-or-before",
      "frontend-staging-egw.pages.dev": "at-or-before",
      "frontend-us1.pages.dev": "at-or-before",
      "fronterixbusiness.com": "at-or-before",
      "ftp.anchoragehireflow.com": "at-or-before",
      "ftp.skillview360.com": "at-or-before",
      "ftp.talentevaluate.com": "at-or-before",
      "ftutech.store": "at-or-before",
      "ftxstock.com": "at-or-before",
      "funnyboy0719.fun": "at-or-before",
      "gamesmasterbb.com": "at-or-before",
      "gatuga-api.cpromoter.com": "at-or-before",
      "gbmaudiologininstructions.esdinfra.com": "at-or-before",
      "gcp.webzoom.video": "at-or-before",
      "geocollab.wegrowup.us": "at-or-before",
      "getcoinprice.info": "at-or-before",
      "getdonald.xyz": "at-or-before",
      "gethiring360.com": "at-or-before",
      "getstockprice.com": "at-or-before",
      "getstockprice.info": "at-or-before",
      "gladneyocivpsdedinvme4.com": "at-or-before",
      "glitchmedic.com": "at-or-before",
      "globalelitehire.com": "at-or-before",
      "globalskillconnect360.com": "at-or-before",
      "globiscapitals.com": "at-or-before",
      "go.oncehub.co": "at-or-before",
      "goingladies.com": "at-or-before",
      "gossipsnare.com": "at-or-before",
      "grainituae.com": "at-or-before",
      "greendottb.com": "at-or-before",
      "greendtb.com": "at-or-before",
      "greennovadigital.com": "at-or-before",
      "greenservice.tech": "at-or-before",
      "group.superstatefund.co": "at-or-before",
      "growzy.tech": "at-or-before",
      "gsoftcompany.com": "at-or-before",
      "hanagroup.live": "at-or-before",
      "hartmanmcapital.com": "at-or-before",
      "heritagetbk.com": "at-or-before",
      "hirebest.cv": "at-or-before",
      "hirefeedbacker.com": "at-or-before",
      "hirefiix.pro": "at-or-before",
      "hireflix.pro": "at-or-before",
      "hireflix360.com": "at-or-before",
      "hirehatch360.com": "at-or-before",
      "hirelytics360.com": "at-or-before",
      "hiremodozone.com": "at-or-before",
      "hiremployee.com": "at-or-before",
      "hireone.top": "at-or-before",
      "hireproflix.online": "at-or-before",
      "hireqora.com": "at-or-before",
      "hirequestion.com": "at-or-before",
      "hireskillhub.com": "at-or-before",
      "hiresyncer.us": "at-or-before",
      "hiretestzone.com": "at-or-before",
      "hireviavideo.com": "at-or-before",
      "hirevision360.com": "at-or-before",
      "hiring.crostox.com": "at-or-before",
      "hiring.waventic.com": "at-or-before",
      "hiringinterview360.com": "at-or-before",
      "hiringtestpro.com": "at-or-before",
      "hk05web.us": "at-or-before",
      "holi.intervu-talent.pro": "at-or-before",
      "hollow-jordan-narrow.on-fleek.app": "at-or-before",
      "hotstreamx.stream": "at-or-before",
      "hwsrv-1275416.hostwindsdns.com": "at-or-before",
      "hysf6-baaaa-aaaag-algfa-cai.icp0.io": "at-or-before",
      "icareerc.com": "at-or-before",
      "ido-epargne.com": "at-or-before",
      "ignite.bizmeeting.org": "at-or-before",
      "ignite.bizmeeting.video": "at-or-before",
      "ignite.onlinemeet.pro": "at-or-before",
      "indobit.io": "at-or-before",
      "infuy.us": "at-or-before",
      "innerteams.us": "at-or-before",
      "innovateinc.fun": "at-or-before",
      "insight-hire.com": "at-or-before",
      "insighthire360.com": "at-or-before",
      "insomnianwin.site": "at-or-before",
      "inst.fetchtalent360.com": "at-or-before",
      "inter.quickskill-review.com": "at-or-before",
      "inter.vid-crypto-assess.com": "at-or-before",
      "interviews360.com": "at-or-before",
      "interviewskillmaster.com": "at-or-before",
      "intervwolf.com": "at-or-before",
      "interzoom.us": "at-or-before",
      "intro.quickskill-review.com": "at-or-before",
      "intro.vid-crypto-assess.com": "at-or-before",
      "introon.com": "at-or-before",
      "ip-api-server.vercel.app": "at-or-before",
      "ip-check-api.vercel.app": "at-or-before",
      "ip-check-server.vercel.app": "at-or-before",
      "ipv6.srv755058.hstgr.cloud": "at-or-before",
      "ixcareer-video.pages.dev": "at-or-before",
      "ixcareer.com": "at-or-before",
      "ixcareer.video": "at-or-before",
      "ixcareers.com": "at-or-before",
      "ixscreen.com": "at-or-before",
      "j-rl.com": "at-or-before",
      "job-career-portal.com": "at-or-before",
      "jobinterviews360.com": "at-or-before",
      "joblitic.com": "at-or-before",
      "jobskillmatch360.com": "at-or-before",
      "joinustoday.online": "at-or-before",
      "jp-zoom.com": "at-or-before",
      "jquery-release.com": "at-or-before",
      "jquerycloud.io": "at-or-before",
      "jqueryversion.net": "at-or-before",
      "json-project-hazel.vercel.app": "at-or-before",
      "jumping-mechellen.com": "at-or-before",
      "justbuiltprojects.com.au": "at-or-before",
      "keondigital.com": "at-or-before",
      "kirschneigroup.com": "at-or-before",
      "knightsbridge-dex.vercel.app": "at-or-before",
      "koliinfotech.company": "at-or-before",
      "kourosh.uefa-meeting.com": "at-or-before",
      "kraken.livehiringpro.com": "at-or-before",
      "krakenhire.com": "at-or-before",
      "krakenmeetings.com": "at-or-before",
      "kryptoneer.com": "at-or-before",
      "ksrtcaudiologininstructions.esdinfra.com": "at-or-before",
      "ksrtceccsgbmaudiologininstructions.esdinfra.com": "at-or-before",
      "latamics.org": "at-or-before",
      "leaguehub.net": "at-or-before",
      "lenvny.com": "at-or-before",
      "levinpros.com": "at-or-before",
      "lido.web05zoom.us": "at-or-before",
      "limesurvey.us": "at-or-before",
      "limitlesstechltd.com": "at-or-before",
      "linkedinservice.us": "at-or-before",
      "litslink.online": "at-or-before",
      "live.bankdost.in": "at-or-before",
      "live.econceptual.com": "at-or-before",
      "livehirehub.com": "at-or-before",
      "livehirepro.com": "at-or-before",
      "livehiringhub.com": "at-or-before",
      "livehiringpro.com": "at-or-before",
      "livesnotnumbers.org": "at-or-before",
      "livetalentpro.com": "at-or-before",
      "lmaxtrd.com": "at-or-before",
      "log-server-lovat.vercel.app": "at-or-before",
      "log-writter.vercel.app": "at-or-before",
      "logoeye.net": "at-or-before",
      "logosports.net": "at-or-before",
      "loopsoft.tech": "at-or-before",
      "lostdungeon.openfort.xyz": "at-or-before",
      "luc.uefa-meeting.com": "at-or-before",
      "lucas-gaming.com": "at-or-before",
      "lunoxbet77--yes.site": "at-or-before",
      "lunoxbet77rain.baby": "at-or-before",
      "lunoxbet77rain.online": "at-or-before",
      "lunoxbet77rain.store": "at-or-before",
      "lunoxbet77speed.site": "at-or-before",
      "m21gk.wiremockapi.cloud": "at-or-before",
      "macamhelp.online": "at-or-before",
      "mail.anifintech.xyz": "at-or-before",
      "mail.archblock.careerscreeners.com": "at-or-before",
      "mail.careerscreeners.com": "at-or-before",
      "mail.gladneyocivpsdedinvme4.com": "at-or-before",
      "mail.hireviavideo.com": "at-or-before",
      "mail.massmedia24.com": "at-or-before",
      "mail.testforhire.com": "at-or-before",
      "mail.web021zoom.us": "at-or-before",
      "massmedia24.com": "at-or-before",
      "mat-techcore.org": "at-or-before",
      "matias.uefa-meeting.com": "at-or-before",
      "mavenradar.com": "at-or-before",
      "mayonestore.online": "at-or-before",
      "medcialbiotop.com": "at-or-before",
      "mediajourney.digital": "at-or-before",
      "mediaprime.team": "at-or-before",
      "meet.capitalviabtc.com": "at-or-before",
      "meet.capitalviabtc.comhollow-jordan-narrow.on-fleek.app": "at-or-before",
      "meet.globiscapital.co": "at-or-before",
      "meet.globiscapitals.com": "at-or-before",
      "meet.mythicaigames.foundation": "at-or-before",
      "meet.mythicalgames.foundation": "at-or-before",
      "meet.openfort-team.xyz": "at-or-before",
      "meet.picwe-team.com": "at-or-before",
      "meet.re7.network": "at-or-before",
      "meet.rwa-team.video": "at-or-before",
      "meet.str8fire-team.network": "at-or-before",
      "meet.superstatefund.co": "at-or-before",
      "meet.synternetlab.com": "at-or-before",
      "meet.twosigma-vc.com": "at-or-before",
      "meeting-zoom-witcam-tests-meet-id-5u83-82f3-8h39-83h9-d9e3.pages.dev": "at-or-before",
      "meeting-zoom-witcam-tests-meet-id-5u83-82f3-8h39-83h9-n9e3.pages.dev": "at-or-before",
      "meeting.document-content.online": "at-or-before",
      "meetingjoin.us": "at-or-before",
      "meetwithhealthyh2o.com": "at-or-before",
      "memecoinmania.net": "at-or-before",
      "merreo.org": "at-or-before",
      "microsoft.customizetions.com": "at-or-before",
      "mircosoftclouddocment.com": "at-or-before",
      "motionassess.com": "at-or-before",
      "my-n8n-76.duckdns.org": "at-or-before",
      "mythicaigames.foundation": "at-or-before",
      "mythicalgames.foundation": "at-or-before",
      "mythicalgames.hiremodozone.com": "at-or-before",
      "mzweb3.bu-zoom.us": "at-or-before",
      "mzweb3.er-zoom.us": "at-or-before",
      "mzweb3.jp-zoom.com": "at-or-before",
      "n34kr3z26f3jzp4ckmwuv5ipqyatumdxhgjgsmucc65jac56khdy5zqd.onion": "at-or-before",
      "nadlan-dubai.com": "at-or-before",
      "nansenpro.org": "at-or-before",
      "natefi.org": "at-or-before",
      "notaiospuglisi.com": "at-or-before",
      "nvidiasdk.fly.dev": "at-or-before",
      "office-theme.com": "at-or-before",
      "office.microsoft.customizetions.com": "at-or-before",
      "officezoom.us": "at-or-before",
      "ofo-home.top": "at-or-before",
      "okx.hiringinterview360.com": "at-or-before",
      "okx.talenthiring360.com": "at-or-before",
      "olaestudiocreativo.com": "at-or-before",
      "oncehub.co": "at-or-before",
      "onchainassess.com": "at-or-before",
      "onchainhiringtool.com": "at-or-before",
      "onehire.pro": "at-or-before",
      "online-globaleurope.com": "at-or-before",
      "online.stdheritb.com": "at-or-before",
      "onlinemeet.pro": "at-or-before",
      "onlinesearchlic.com": "at-or-before",
      "open-src.org": "at-or-before",
      "openfort-team.xyz": "at-or-before",
      "openfort.businessmeet.xyz": "at-or-before",
      "openfort.video": "at-or-before",
      "openfort.xyz": "at-or-before",
      "panelcvedata.com": "at-or-before",
      "paradigm.hiremodozone.com": "at-or-before",
      "parallel.assesspro360.com": "at-or-before",
      "parallel.eskillora.com": "at-or-before",
      "parallel.eskillprov.com": "at-or-before",
      "parallel.skillview360.com": "at-or-before",
      "partner.hartmanmcapital.com": "at-or-before",
      "partners.boolnetwork.xyz": "at-or-before",
      "patch.levinpros.com": "at-or-before",
      "patch.zynoracreative.com": "at-or-before",
      "patchpal.pro": "at-or-before",
      "pathsummitx.com": "at-or-before",
      "pathsummitx.pages.dev": "at-or-before",
      "paxos-video-interview.com": "at-or-before",
      "paxos-video-talk.com": "at-or-before",
      "paxosassessments.com": "at-or-before",
      "paxosfuture.com": "at-or-before",
      "paxosinterview.com": "at-or-before",
      "paxosvideointerviewassesment.com": "at-or-before",
      "pay.resumegenie.us": "at-or-before",
      "pepeartly-foundry.net": "at-or-before",
      "phantom-phantomwallet.us": "at-or-before",
      "phantomwallet-us.us": "at-or-before",
      "phubauto.space": "at-or-before",
      "picktime.live": "at-or-before",
      "picwe-team.com": "at-or-before",
      "pitisalot.site": "at-or-before",
      "plexisco.com": "at-or-before",
      "postedviral.com": "at-or-before",
      "pre-zoom.us": "at-or-before",
      "precisioncoderss.com": "at-or-before",
      "prehighiq.com": "at-or-before",
      "prehireiq.com": "at-or-before",
      "process-log-update.vercel.app": "at-or-before",
      "process-log.vercel.app": "at-or-before",
      "professionalsnapshot.com": "at-or-before",
      "proficiencycert.com": "at-or-before",
      "proficientmint.com": "at-or-before",
      "proficientmint.pages.dev": "at-or-before",
      "prohirevideo.com": "at-or-before",
      "provevidskillcheck.com": "at-or-before",
      "provideodrivers.cloud": "at-or-before",
      "pypilibrary.com": "at-or-before",
      "pypistorage.com": "at-or-before",
      "quantumnodespro.com": "at-or-before",
      "queryyard.com": "at-or-before",
      "quickassessio.com": "at-or-before",
      "quickcamfix.online": "at-or-before",
      "quickdriverupdate.online": "at-or-before",
      "quickproassess.com": "at-or-before",
      "quickskill-review.com": "at-or-before",
      "quickskillup.us": "at-or-before",
      "quiz-nest.com": "at-or-before",
      "quizpathway.com": "at-or-before",
      "quizterview.com": "at-or-before",
      "qwary.org": "at-or-before",
      "rabbywallet-app.us": "at-or-before",
      "radarsync.pro": "at-or-before",
      "rapiddrivers.cloud": "at-or-before",
      "rastreojerezexpress.com": "at-or-before",
      "re7.network": "at-or-before",
      "rec.vid-crypto-assess.com": "at-or-before",
      "recruitboard-base.pages.dev": "at-or-before",
      "recruitboard.video": "at-or-before",
      "register-meeting.pages.dev": "at-or-before",
      "release-driver.online": "at-or-before",
      "release-drivers.online": "at-or-before",
      "releasedrive.live": "at-or-before",
      "reliableservers.org": "at-or-before",
      "replaydreary.com": "at-or-before",
      "republic.biz-zoom.us": "at-or-before",
      "republic.bu-zoom.us": "at-or-before",
      "republic.cr-zoom.us": "at-or-before",
      "republic.er-zoom.us": "at-or-before",
      "republic.extrazoom.us": "at-or-before",
      "republic.innerteams.us": "at-or-before",
      "republic.officezoom.us": "at-or-before",
      "republic.pre-zoom.us": "at-or-before",
      "republic.usweb-zoom.us": "at-or-before",
      "republic.web021zoom.us": "at-or-before",
      "resumegenie.us": "at-or-before",
      "retailpackagingpartner.xyz": "at-or-before",
      "riccardo.uefa-meeting.com": "at-or-before",
      "ripple.quizterview.com": "at-or-before",
      "ripple.speakure.com": "at-or-before",
      "robinhood.eskillfolio.com": "at-or-before",
      "robinhood.eskillpilot.com": "at-or-before",
      "robinhood.eskillprof.com": "at-or-before",
      "robinhood.evalvidz.com": "at-or-before",
      "robinhood.intervwolf.com": "at-or-before",
      "robinhood.quickskill-review.com": "at-or-before",
      "roleassessor.com": "at-or-before",
      "rolefit360.com": "at-or-before",
      "rolematches.com": "at-or-before",
      "rolltojoin.com": "at-or-before",
      "rwa-team.video": "at-or-before",
      "rwa.business-zoom.us": "at-or-before",
      "rwa.businessmeet.xyz": "at-or-before",
      "sadborgroup.site": "at-or-before",
      "safefinanceltd.com": "at-or-before",
      "sammy.uefa-meeting.com": "at-or-before",
      "screenquestions.com": "at-or-before",
      "secure.greendottb.com": "at-or-before",
      "secure.greendtb.com": "at-or-before",
      "sfdfsdf.icareerc.com": "at-or-before",
      "sharefilesdocment.com": "at-or-before",
      "shimacapital.abilityscan360.com": "at-or-before",
      "shimacapital.easyhiringtool.com": "at-or-before",
      "showmanroast.com": "at-or-before",
      "silencio.webzoom.video": "at-or-before",
      "silvermine.web05zoom.us": "at-or-before",
      "silverrabbit.wegrowup.us": "at-or-before",
      "situsslotdepo10k.org": "at-or-before",
      "skalelabs.as-zoom.us": "at-or-before",
      "skalelabs.bu-zoom.us": "at-or-before",
      "skalelabs.cr-zoom.us": "at-or-before",
      "skalelabs.en-zoom.us": "at-or-before",
      "skalelabs.mediaprime.team": "at-or-before",
      "skalelabs.pre-zoom.us": "at-or-before",
      "skalelabs.usweb-zoom.us": "at-or-before",
      "skill-bridges.com": "at-or-before",
      "skill.vidassessmentmaster.com": "at-or-before",
      "skill.vidcruiterinterview.com": "at-or-before",
      "skill.vidcruitermaster.com": "at-or-before",
      "skillcheck.pro": "at-or-before",
      "skillence360.com": "at-or-before",
      "skillhiretrack.com": "at-or-before",
      "skilllens360.com": "at-or-before",
      "skillmasteryhub.us": "at-or-before",
      "skillpilothq.com": "at-or-before",
      "skillprooflab.com": "at-or-before",
      "skillprops.com": "at-or-before",
      "skillquestion.com": "at-or-before",
      "skillquestions.com": "at-or-before",
      "skillroar.com": "at-or-before",
      "skillsquestions.com": "at-or-before",
      "skillstandard360.com": "at-or-before",
      "skilluplifestylehub.com": "at-or-before",
      "skillview360.com": "at-or-before",
      "skillvisions.com": "at-or-before",
      "skypredict.org": "at-or-before",
      "sloneek.us": "at-or-before",
      "smartchecker.online": "at-or-before",
      "smartdriverfix.cloud": "at-or-before",
      "smartdriverfixer.com": "at-or-before",
      "smartdrvupdate.online": "at-or-before",
      "smartmanagerex.com": "at-or-before",
      "smartvideoassess.com": "at-or-before",
      "smartvideohire.com": "at-or-before",
      "smartvirtual-assessment.com": "at-or-before",
      "smartwalletfinder.com": "at-or-before",
      "smrtassess.com": "at-or-before",
      "snap-screening.com": "at-or-before",
      "soc-log.vercel.app": "at-or-before",
      "soccerlab.io": "at-or-before",
      "soft-dev.online": "at-or-before",
      "softcaredesk.pro": "at-or-before",
      "softdebugnest.pro": "at-or-before",
      "softglide.co": "at-or-before",
      "softmedic.pro": "at-or-before",
      "softshare.online": "at-or-before",
      "softsquashers.pro": "at-or-before",
      "solana.validator.blog": "at-or-before",
      "solulab.hiremodozone.com": "at-or-before",
      "speakure.com": "at-or-before",
      "speeduneasy.com": "at-or-before",
      "speedvice.pages.dev": "at-or-before",
      "srv587993.hstgr.cloud": "at-or-before",
      "srv755058.hstgr.cloud": "at-or-before",
      "staffingedges.com": "at-or-before",
      "stafnex.com": "at-or-before",
      "stage-framework.recruitboard.video": "at-or-before",
      "stage-yuga.recruitboard.video": "at-or-before",
      "stage.bizmeet.online": "at-or-before",
      "stage.bizmeet.org": "at-or-before",
      "stage.bizmeet.pro": "at-or-before",
      "stagging-apiresources.caspiansr.kz": "at-or-before",
      "stake.assesscrew.com": "at-or-before",
      "stake.hiremodozone.com": "at-or-before",
      "stake.staffingedges.com": "at-or-before",
      "stake.talentedstarmodo.com": "at-or-before",
      "standard-ai.org": "at-or-before",
      "stdheritb.com": "at-or-before",
      "stockdata.tech": "at-or-before",
      "stockinfo.io": "at-or-before",
      "stocksindex.org": "at-or-before",
      "stocksitem.org": "at-or-before",
      "stockslab.org": "at-or-before",
      "str8fire-team.network": "at-or-before",
      "str8fire.businessmeet.xyz": "at-or-before",
      "stratosshipping.com": "at-or-before",
      "stream-football.org": "at-or-before",
      "su05web.us": "at-or-before",
      "sub-recruitboard.pages.dev": "at-or-before",
      "sumy.fun": "at-or-before",
      "sunflowbikes.com": "at-or-before",
      "superstarscanner.com": "at-or-before",
      "superstate-team.xyz": "at-or-before",
      "superstatefund.co": "at-or-before",
      "support.echelonfnd.io": "at-or-before",
      "support.waventic.com": "at-or-before",
      "synternetlab.com": "at-or-before",
      "talent-hiring-step.com": "at-or-before",
      "talent-hiringstep.com": "at-or-before",
      "talent-hiringtalk.com": "at-or-before",
      "talentcatchingtool360.com": "at-or-before",
      "talentcheck.pro": "at-or-before",
      "talentedstarmodo.com": "at-or-before",
      "talentelevate360.com": "at-or-before",
      "talentevaluate.com": "at-or-before",
      "talentgauge360.com": "at-or-before",
      "talenthireflow.com": "at-or-before",
      "talenthiring360.com": "at-or-before",
      "talenthiringexpert.com": "at-or-before",
      "talenthiringtool.com": "at-or-before",
      "talentmatchingtools.com": "at-or-before",
      "talentmatchingtools.net": "at-or-before",
      "talentmonitoringtool.com": "at-or-before",
      "talentpreview360.com": "at-or-before",
      "talentradar360.com": "at-or-before",
      "talentscreeningtool.com": "at-or-before",
      "talentsnaptest.com": "at-or-before",
      "talenttracker.us": "at-or-before",
      "talentverge360.com": "at-or-before",
      "talentvidintro.com": "at-or-before",
      "tdlgzoom.com": "at-or-before",
      "tellus.evalonboard.com": "at-or-before",
      "tenspick.shop": "at-or-before",
      "test-wolf.com": "at-or-before",
      "testforhire.com": "at-or-before",
      "testwolf-assessment.com": "at-or-before",
      "testwolfpro.com": "at-or-before",
      "tetrismic.vercel.app": "at-or-before",
      "thaibit.io": "at-or-before",
      "thediversityandinclusionteam.com": "at-or-before",
      "theeffectiveengineeringleader.com": "at-or-before",
      "thehubservice.cloud": "at-or-before",
      "thelightstower.com": "at-or-before",
      "theta.apply-camera.com": "at-or-before",
      "theta.evalonboard.com": "at-or-before",
      "thorequities.eskillence.com": "at-or-before",
      "thorequities.skillence360.com": "at-or-before",
      "tom.uefa-meeting.com": "at-or-before",
      "toolshare.cloud": "at-or-before",
      "top-king.store": "at-or-before",
      "toptalentassess.com": "at-or-before",
      "trashcrease.com": "at-or-before",
      "treelifeups.com": "at-or-before",
      "truthwillsetyoufree.online": "at-or-before",
      "turkishmob.com": "at-or-before",
      "twosigma-vc.com": "at-or-before",
      "uefa-meeting.com": "at-or-before",
      "ugethired360.com": "at-or-before",
      "uk03web.us": "at-or-before",
      "uk06web.us": "at-or-before",
      "uk07web.us": "at-or-before",
      "ukweb05.us": "at-or-before",
      "ukweb06.us": "at-or-before",
      "ukweb07.us": "at-or-before",
      "unimeta.biz": "at-or-before",
      "unionminerscorp.com": "at-or-before",
      "uniswap.assessforhire.com": "at-or-before",
      "uniswap.prehireiq.com": "at-or-before",
      "uniswap.quizterview.com": "at-or-before",
      "uniswap.speakure.com": "at-or-before",
      "unmannedsystemstechnology.org": "at-or-before",
      "update.jquerycloud.io": "at-or-before",
      "updatecall.live": "at-or-before",
      "updatemycam.online": "at-or-before",
      "updatewebcamnow.live": "at-or-before",
      "us.meeting.document-content.online": "at-or-before",
      "us04office.us": "at-or-before",
      "us04we.us": "at-or-before",
      "usweb-zoom.us": "at-or-before",
      "usweb02.us": "at-or-before",
      "v2ray.gelithagithmal.workers.dev": "at-or-before",
      "validator.blog": "at-or-before",
      "vblimitedgroup.com": "at-or-before",
      "vcamdriverupdate.cloud": "at-or-before",
      "vcamfixer.online": "at-or-before",
      "vcamsupport.cloud": "at-or-before",
      "verification-blockfi.com": "at-or-before",
      "vern.thehubservice.cloud": "at-or-before",
      "versus-dash.us": "at-or-before",
      "versus-x.us": "at-or-before",
      "versusx.us": "at-or-before",
      "viabtc.webmeet.video": "at-or-before",
      "viabtc.webmeet.vip": "at-or-before",
      "vid-crypto-assess.com": "at-or-before",
      "vidassess360.com": "at-or-before",
      "vidassessmentmaster.com": "at-or-before",
      "vidassesspro.com": "at-or-before",
      "vidcruiterinterview.com": "at-or-before",
      "vidcruitermaster.com": "at-or-before",
      "video.coinhouse360.com": "at-or-before",
      "videocarddrivers.cloud": "at-or-before",
      "videodriverzone.cloud": "at-or-before",
      "videohirepro.com": "at-or-before",
      "videomaxgreece.com": "at-or-before",
      "videoplayermaxgr.com": "at-or-before",
      "videotechdrivers.cloud": "at-or-before",
      "vidfastinterviewmaster.com": "at-or-before",
      "vidhirehub.com": "at-or-before",
      "vidintermaster.com": "at-or-before",
      "vidinterviewmaster.com": "at-or-before",
      "vidtechdrivers.com": "at-or-before",
      "vidtechdrv.online": "at-or-before",
      "vidtechhub.cloud": "at-or-before",
      "viperpager.com": "at-or-before",
      "vngpubgm.com": "at-or-before",
      "wallet-trustwallet.us": "at-or-before",
      "wavelyhire.com": "at-or-before",
      "waventic.com": "at-or-before",
      "weatherdatahub.org": "at-or-before",
      "web-cam.cloud": "at-or-before",
      "web.interzoom.us": "at-or-before",
      "web.zoomhub.us": "at-or-before",
      "web001-zoom.us": "at-or-before",
      "web001zoom.us": "at-or-before",
      "web011zoom.us": "at-or-before",
      "web021zoom.us": "at-or-before",
      "web05zoom.us": "at-or-before",
      "web3elitesmint.com": "at-or-before",
      "web3elitesmint.pages.dev": "at-or-before",
      "web3fund.as-zoom.us": "at-or-before",
      "web3fund.en-zoom.us": "at-or-before",
      "web3fund.io": "at-or-before",
      "web3globalmint.com": "at-or-before",
      "web3globalmint.pages.dev": "at-or-before",
      "web3neptune.com": "at-or-before",
      "web3remotework.com": "at-or-before",
      "web3talentmint.com": "at-or-before",
      "web3talentreview.com": "at-or-before",
      "webcamdrivers.cloud": "at-or-before",
      "webcamfix.cloud": "at-or-before",
      "webcamfixer.cloud": "at-or-before",
      "webcamfixer.online": "at-or-before",
      "webcamwizard.cloud": "at-or-before",
      "webmeet.icu": "at-or-before",
      "webmeet.video": "at-or-before",
      "webmeet.vip": "at-or-before",
      "webus02.us": "at-or-before",
      "webus07.us": "at-or-before",
      "webus08.us": "at-or-before",
      "webus09.us": "at-or-before",
      "webzoom.video": "at-or-before",
      "wegrowup.us": "at-or-before",
      "west-app.online": "at-or-before",
      "wfinance.org": "at-or-before",
      "wikahmart.com": "at-or-before",
      "wintermute.workquestion.com": "at-or-before",
      "wonthegame.site": "at-or-before",
      "workiva.roleassessor.com": "at-or-before",
      "workquestion.com": "at-or-before",
      "worldenterprise-beta.com": "at-or-before",
      "xchangetrump.com": "at-or-before",
      "xn--12c5eglc5bd7i.site": "at-or-before",
      "xn--rxamia.com": "at-or-before",
      "younginvest.wegrowup.us": "at-or-before",
      "yourdomainhost.store": "at-or-before",
      "yuga.hirequestion.com": "at-or-before",
      "yuga.ixcareer.com": "at-or-before",
      "yuga.jobinterviews360.com": "at-or-before",
      "yuga.skillquestions.com": "at-or-before",
      "yuga.workquestion.com": "at-or-before",
      "yugalabs.careerboard.video": "at-or-before",
      "yugalabs.icareerc.com": "at-or-before",
      "yugalabs.ixcareers.com": "at-or-before",
      "yugalabs.ixscreen.com": "at-or-before",
      "z8048w4.caspiansr.kz": "at-or-before",
      "zach.uefa-meeting.com": "at-or-before",
      "zenspiretech.com": "at-or-before",
      "zincnetwork.tk": "at-or-before",
      "zm-meeting.com": "at-or-before",
      "zmwebsdk.com": "at-or-before",
      "zoom-client.xyz": "at-or-before",
      "zoom-meeting-web-static.eventx.com.cn": "at-or-before",
      "zoom-sdk.us": "at-or-before",
      "zoom.2vanx.com": "at-or-before",
      "zoom.app-center.download": "at-or-before",
      "zoom.callapp.us": "at-or-before",
      "zoom.communicationhub.us": "at-or-before",
      "zoom.downloadcenter.website": "at-or-before",
      "zoom.eventx.io": "at-or-before",
      "zoom.eventxtra.com": "at-or-before",
      "zoom.hanagroup.live": "at-or-before",
      "zoom.hk05web.us": "at-or-before",
      "zoom.personifyio.com": "at-or-before",
      "zoom.petersen.ai": "at-or-before",
      "zoom.qa.retrocubedev.com": "at-or-before",
      "zoom.su05web.us": "at-or-before",
      "zoom.uk03web.us": "at-or-before",
      "zoom.uk06web.us": "at-or-before",
      "zoom.uk07web.us": "at-or-before",
      "zoom.ukweb05.us": "at-or-before",
      "zoom.ukweb06.us": "at-or-before",
      "zoom.ukweb07.us": "at-or-before",
      "zoom.us04office.us": "at-or-before",
      "zoom.us04we.us": "at-or-before",
      "zoom.usweb02.us": "at-or-before",
      "zoom.webus02.us": "at-or-before",
      "zoom.webus07.us": "at-or-before",
      "zoom.webus08.us": "at-or-before",
      "zoom.webus09.us": "at-or-before",
      "zoomapp.downloadcenter.website": "at-or-before",
      "zoomfiledrop.pages.dev": "at-or-before",
      "zoomhub.us": "at-or-before",
      "zoominvites.com": "at-or-before",
      "zoommeetspace.com": "at-or-before",
      "zoommetting.dev.retrocubedevs.com": "at-or-before",
      "zoomsdk.us": "at-or-before",
      "zoomtomeet.pposbc.org": "at-or-before",
      "zoomwebapi.com": "at-or-before",
      "zoomworkspace.us.meeting.document-content.online": "at-or-before",
      "zoomzipdrop.pages.dev": "at-or-before",
      "zooom.in": "at-or-before",
      "zooom.pages.dev": "at-or-before",
      "zooommeeting.pages.dev": "at-or-before",
      "zora.quickproassess.com": "at-or-before",
      "zora.rolefit360.com": "at-or-before",
      "zynoracreative.com": "at-or-before"
    },
    "ipv4": {
      "103.231.75.101:8888": "at-or-before",
      "103.35.189.107:3000": "at-or-before",
      "103.35.189.107:4000": "at-or-before",
      "104.194.133.88:1224": "at-or-before",
      "104.194.133.88:1245": "at-or-before",
      "107.189.16.122:1224": "at-or-before",
      "107.189.16.122:1245": "at-or-before",
      "107.189.16.176:1224": "at-or-before",
      "107.189.16.176:1245": "at-or-before",
      "107.189.20.152:1224": "at-or-before",
      "107.189.20.152:1245": "at-or-before",
      "107.189.24.80:1224": "at-or-before",
      "107.189.24.80:1245": "at-or-before",
      "107.189.25.109:1224": "at-or-before",
      "107.189.25.109:1245": "at-or-before",
      "118.123.54.71:9999": "at-or-before",
      "119.6.121.143:9999": "at-or-before",
      "119.6.56.194:9999": "at-or-before",
      "125.65.88.195:9999": "at-or-before",
      "125.67.171.158:9999": "at-or-before",
      "135.181.123.177:8080": "at-or-before",
      "135.181.123.177:8081": "at-or-before",
      "135.181.123.177:9000": "at-or-before",
      "135.181.123.177:9001": "at-or-before",
      "138.201.50.5:5961": "at-or-before",
      "139.60.163.206:4000": "at-or-before",
      "144.172.100.124:1224": "at-or-before",
      "144.172.100.124:1245": "at-or-before",
      "144.172.100.142:1224": "at-or-before",
      "144.172.100.142:1245": "at-or-before",
      "144.172.101.45:1224": "at-or-before",
      "144.172.101.45:1245": "at-or-before",
      "144.172.102.148:1224": "at-or-before",
      "144.172.102.148:1245": "at-or-before",
      "144.172.102.21:1224": "at-or-before",
      "144.172.102.21:1245": "at-or-before",
      "144.172.103.97:1224": "at-or-before",
      "144.172.103.97:1245": "at-or-before",
      "144.172.104.10:1224": "at-or-before",
      "144.172.104.10:1245": "at-or-before",
      "144.172.104.113:1224": "at-or-before",
      "144.172.104.113:1245": "at-or-before",
      "144.172.104.117:5918": "at-or-before",
      "144.172.105.189:1224": "at-or-before",
      "144.172.105.189:1245": "at-or-before",
      "144.172.105.235:1224": "at-or-before",
      "144.172.105.235:1245": "at-or-before",
      "144.172.106.133:1224": "at-or-before",
      "144.172.106.133:1245": "at-or-before",
      "144.172.106.7:1224": "at-or-before",
      "144.172.106.7:1245": "at-or-before",
      "144.172.109.155:1224": "at-or-before",
      "144.172.109.98:1224": "at-or-before",
      "144.172.109.98:1245": "at-or-before",
      "144.172.112.106:1224": "at-or-before",
      "144.172.112.106:1245": "at-or-before",
      "144.172.114.238:8085": "at-or-before",
      "144.172.114.238:8086": "at-or-before",
      "144.172.114.238:8087": "at-or-before",
      "144.172.74.120:3389": "at-or-before",
      "144.172.86.27:1224": "at-or-before",
      "144.172.86.27:1245": "at-or-before",
      "144.172.87.27:1224": "at-or-before",
      "144.172.94.226:5961": "at-or-before",
      "144.172.94.226:5974": "at-or-before",
      "144.172.95.226:1224": "at-or-before",
      "144.172.95.226:1245": "at-or-before",
      "144.172.96.35:3000": "at-or-before",
      "144.172.96.35:8000": "at-or-before",
      "144.172.96.35:8080": "at-or-before",
      "144.172.96.80:1224": "at-or-before",
      "144.172.96.80:1245": "at-or-before",
      "144.172.97.7:1224": "at-or-before",
      "144.172.97.7:1245": "at-or-before",
      "146.70.253.107:1224": "at-or-before",
      "146.70.253.107:1245": "at-or-before",
      "146.70.41.188:1224": "at-or-before",
      "146.70.41.188:1245": "at-or-before",
      "147.124.202.225:1244": "at-or-before",
      "147.124.213.19:1244": "at-or-before",
      "147.124.213.232:1244": "at-or-before",
      "147.93.40.224:3000": "at-or-before",
      "149.28.139.62:8080": "at-or-before",
      "151.243.101.229:8080": "at-or-before",
      "152.89.61.240:443": "at-or-before",
      "152.89.61.96:443": "at-or-before",
      "154.216.177.215:8080": "at-or-before",
      "154.58.204.15:8080": "at-or-before",
      "154.62.226.22:8080": "at-or-before",
      "158.62.198.177:8080": "at-or-before",
      "165.140.85.106:1243": "at-or-before",
      "165.140.85.106:1244": "at-or-before",
      "165.140.85.106:1245": "at-or-before",
      "165.140.85.106:1248": "at-or-before",
      "165.140.85.106:3389": "at-or-before",
      "165.140.86.154:1244": "at-or-before",
      "165.140.86.160:1244": "at-or-before",
      "167.88.39.141:5000": "at-or-before",
      "167.88.39.55:3000": "at-or-before",
      "167.88.39.55:4000": "at-or-before",
      "171.22.127.221:5000": "at-or-before",
      "171.22.127.221:8000": "at-or-before",
      "172.86.113.115:1244": "at-or-before",
      "172.86.113.115:1245": "at-or-before",
      "172.86.113.18:1224": "at-or-before",
      "172.86.113.18:1245": "at-or-before",
      "172.86.114.170:4000": "at-or-before",
      "172.86.114.170:5000": "at-or-before",
      "172.86.114.31:3000": "at-or-before",
      "172.86.116.178:5918": "at-or-before",
      "172.86.116.178:5976": "at-or-before",
      "172.86.116.90:1224": "at-or-before",
      "172.86.116.90:1245": "at-or-before",
      "172.86.123.55:1224": "at-or-before",
      "172.86.123.55:1245": "at-or-before",
      "172.86.64.67:4181": "at-or-before",
      "172.86.64.67:4186": "at-or-before",
      "172.86.64.67:4187": "at-or-before",
      "172.86.64.67:4188": "at-or-before",
      "172.86.73.198:1224": "at-or-before",
      "172.86.73.198:1245": "at-or-before",
      "172.86.80.145:1224": "at-or-before",
      "172.86.84.38:1224": "at-or-before",
      "172.86.84.38:1245": "at-or-before",
      "172.86.88.188:1418": "at-or-before",
      "172.86.88.188:1476": "at-or-before",
      "172.86.89.10:4382": "at-or-before",
      "172.86.93.139:3000": "at-or-before",
      "173.211.106.101:1244": "at-or-before",
      "173.211.70.210:8080": "at-or-before",
      "173.211.70.246:8080": "at-or-before",
      "182.136.120.52:9999": "at-or-before",
      "182.136.123.102:9999": "at-or-before",
      "185.153.182.251:1224": "at-or-before",
      "185.153.182.251:1245": "at-or-before",
      "185.164.111.104:3000": "at-or-before",
      "185.53.46.38:1244": "at-or-before",
      "185.53.46.38:3000": "at-or-before",
      "185.53.46.38:3389": "at-or-before",
      "188.43.33.250:3389": "at-or-before",
      "188.43.33.250:5000": "at-or-before",
      "188.43.33.250:8080": "at-or-before",
      "188.43.33.251:12323": "at-or-before",
      "188.43.33.251:12324": "at-or-before",
      "188.43.33.251:5000": "at-or-before",
      "188.43.33.251:8000": "at-or-before",
      "188.43.33.251:8080": "at-or-before",
      "203.161.52.90:3000": "at-or-before",
      "203.161.52.90:4000": "at-or-before",
      "203.161.52.90:8090": "at-or-before",
      "207.189.164.137:1244": "at-or-before",
      "207.254.22.248:8800": "at-or-before",
      "212.81.47.217:8080": "at-or-before",
      "214.75.112.56:1224": "at-or-before",
      "214.75.112.56:1244": "at-or-before",
      "214.75.112.56:1245": "at-or-before",
      "216.126.229.166:1224": "at-or-before",
      "216.126.229.166:1245": "at-or-before",
      "217.148.142.113:1224": "at-or-before",
      "217.148.142.113:1245": "at-or-before",
      "217.15.168.86:3000": "at-or-before",
      "23.227.202.244:1224": "at-or-before",
      "23.227.202.244:1245": "at-or-before",
      "23.227.202.51:1224": "at-or-before",
      "23.227.202.51:1245": "at-or-before",
      "23.227.202.52:1224": "at-or-before",
      "23.227.202.52:1245": "at-or-before",
      "23.227.203.18:1224": "at-or-before",
      "23.227.203.18:1245": "at-or-before",
      "23.227.203.192:1224": "at-or-before",
      "23.227.203.192:1245": "at-or-before",
      "23.227.203.204:1224": "at-or-before",
      "23.227.203.204:1245": "at-or-before",
      "23.27.177.183:443": "at-or-before",
      "31.220.48.106:3000": "at-or-before",
      "31.220.62.190:3000": "at-or-before",
      "31.57.243.190:8080": "at-or-before",
      "31.57.243.29:8080": "at-or-before",
      "31.97.211.52:3000": "at-or-before",
      "31.97.218.133:6168": "at-or-before",
      "37.221.126.117:3011": "at-or-before",
      "37.221.126.117:4000": "at-or-before",
      "38.134.148.218:8080": "at-or-before",
      "38.92.47.152:1244": "at-or-before",
      "41.208.185.235:443": "at-or-before",
      "45.59.163.23:1244": "at-or-before",
      "45.61.128.110:1224": "at-or-before",
      "45.61.128.110:1245": "at-or-before",
      "45.61.128.61:1224": "at-or-before",
      "45.61.128.61:1245": "at-or-before",
      "45.61.133.110:1224": "at-or-before",
      "45.61.133.110:1245": "at-or-before",
      "45.61.135.4:1224": "at-or-before",
      "45.61.135.4:1245": "at-or-before",
      "45.61.149.222:1224": "at-or-before",
      "45.61.149.222:1245": "at-or-before",
      "45.61.150.30:1224": "at-or-before",
      "45.61.150.30:1245": "at-or-before",
      "45.61.150.31:1224": "at-or-before",
      "45.61.150.31:1245": "at-or-before",
      "45.61.150.67:1224": "at-or-before",
      "45.61.150.67:1245": "at-or-before",
      "45.61.151.71:1244": "at-or-before",
      "45.61.151.71:1245": "at-or-before",
      "45.61.160.28:1224": "at-or-before",
      "45.61.160.28:1245": "at-or-before",
      "45.61.165.45:1224": "at-or-before",
      "45.61.165.45:1245": "at-or-before",
      "45.8.146.93:443": "at-or-before",
      "54.146.239.83:8080": "at-or-before",
      "61.139.89.11:9999": "at-or-before",
      "66.235.175.117:1244": "at-or-before",
      "72.5.42.93:8080": "at-or-before",
      "72.60.117.70:3000": "at-or-before",
      "72.60.173.32:3000": "at-or-before",
      "72.60.174.178:3000": "at-or-before",
      "74.119.194.205:3000": "at-or-before",
      "74.119.194.205:4000": "at-or-before",
      "77.37.74.86:6168": "at-or-before",
      "80.209.243.85:4000": "at-or-before",
      "80.209.243.85:5000": "at-or-before",
      "86.104.72.247:443": "at-or-before",
      "86.104.74.169:27017": "at-or-before",
      "88.119.169.226:5000": "at-or-before",
      "88.218.0.78:1224": "at-or-before",
      "88.218.0.78:1245": "at-or-before",
      "88.218.0.78:2243": "at-or-before",
      "91.198.66.112:3000": "at-or-before",
      "91.198.66.158:3000": "at-or-before",
      "91.222.173.110:443": "at-or-before",
      "91.222.173.138:443": "at-or-before",
      "91.222.173.168:443": "at-or-before",
      "93.88.74.112:1244": "at-or-before",
      "94.131.97.195:1224": "at-or-before",
      "94.131.97.195:1245": "at-or-before",
      "95.169.180.140:8080": "at-or-before"
    },
    "url": {
      "api.npoint.io/1f901a22daea7694face": "at-or-before",
      "api.npoint.io/96979650f5739bcbaebb": "at-or-before",
      "api.npoint.io/e5a5e32cdf9bfe7d2386": "at-or-before",
      "bluekostec.com/eng/community/write.asp": "at-or-before",
      "builsf.com/inc/left.php": "at-or-before",
      "dream.bluit.gethompy.com/mobile/skin/board/gallery/index.skin.php": "at-or-before",
      "htns.com/eng/skin/member/basic/skin.php": "at-or-before",
      "http://103.35.190.170": "at-or-before",
      "http://135.181.123.177": "at-or-before",
      "http://135.181.242.24": "at-or-before",
      "http://138.201.50.5": "at-or-before",
      "http://141.98.168.79": "at-or-before",
      "http://144.172.112.106": "at-or-before",
      "http://144.172.112.50": "at-or-before",
      "http://144.172.94.226": "at-or-before",
      "http://144.172.96.35": "at-or-before",
      "http://144.217.86.88": "at-or-before",
      "http://144.76.201.229": "at-or-before",
      "http://146.70.253.10": "at-or-before",
      "http://152.89.61.240": "at-or-before",
      "http://152.89.61.96": "at-or-before",
      "http://159.100.18.177": "at-or-before",
      "http://172.86.109.49": "at-or-before",
      "http://172.86.113.12": "at-or-before",
      "http://172.86.116.178": "at-or-before",
      "http://172.86.64.67": "at-or-before",
      "http://172.86.73.46": "at-or-before",
      "http://172.86.88.188": "at-or-before",
      "http://191.96.31.38": "at-or-before",
      "http://216.107.137.53": "at-or-before",
      "http://23.127.202.249": "at-or-before",
      "http://23.227.202.242": "at-or-before",
      "http://23.254.164.156": "at-or-before",
      "http://23.254.164.232": "at-or-before",
      "http://23.254.204.184": "at-or-before",
      "http://23.27.177.183": "at-or-before",
      "http://38.110.228.112": "at-or-before",
      "http://41.208.185.235": "at-or-before",
      "http://45.12.134.206": "at-or-before",
      "http://45.159.248.110": "at-or-before",
      "http://45.42.40.200": "at-or-before",
      "http://45.42.40.208": "at-or-before",
      "http://45.76.160.53": "at-or-before",
      "http://45.8.146.93": "at-or-before",
      "http://45.84.226.239": "at-or-before",
      "http://45.89.53.54": "at-or-before",
      "http://5.230.251.49": "at-or-before",
      "http://5.230.252.157": "at-or-before",
      "http://5.230.44.79": "at-or-before",
      "http://69.10.53.86": "at-or-before",
      "http://74.119.194.244": "at-or-before",
      "http://86.104.72.247": "at-or-before",
      "http://91.222.173.110": "at-or-before",
      "http://91.222.173.138": "at-or-before",
      "http://91.222.173.168": "at-or-before",
      "http://95.216.46.218": "at-or-before",
      "kadsm.org/skin/board/basic/write_comment_skin.php": "at-or-before",
      "mnmathleague.com/ckeditor/adapters/index.php": "at-or-before",
      "mocki.io/v1/32f16c80-602a-4c80-80af-32a9b8220a6b": "at-or-before",
      "royalsevres.com/bbs/bbs_img/btn_list.psd": "at-or-before",
      "royalsevres.com/javascript/activex_patch.hwp": "at-or-before",
      "rsdf.kr/wp-content/uploads/2024/01/index.php": "at-or-before",
      "shcpump.com/admin/form/skin/formBasic/style.php": "at-or-before",
      "thek-portal.com/eng/career/index.asp": "at-or-before"
    },
    "url_path": {
      "/QWERTYU890T12HML": "at-or-before",
      "/apikey/QWERTYU890T12HML": "at-or-before",
      "/bro/ahNjWa2": "at-or-before",
      "/cam-v-ri69.fix": "at-or-before",
      "/mac-v-ri69.fixer": "at-or-before",
      "/payl/ahNjWa2": "at-or-before",
      "/payload/99/81": "at-or-before"
    }
  },
  "first_seen_range": {
    "earliest": "2017-04-12",
    "latest": "2026-08-07"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "0927.vercel.app",
      "0xraiseup.com",
      "1-73g.pages.dev",
      "118274-zoomid.com",
      "11stnft.click",
      "1215.vercel.app",
      "123fisd.naveicoipg.online",
      "129react.pages.dev",
      "15248636.site",
      "166-88-54-158.nip.io",
      "1688dsj.com",
      "17.docsend.store",
      "172-86-114-141.dal.priv.octovpn.net",
      "172-86-114-170.dal.priv.octovpn.net",
      "172-86-89-213.cprapid.com",
      "1drvmicrosoft.com",
      "1winfans.com",
      "247l.net",
      "260120.vercel.app",
      "2ab9.watashinonegai.ru",
      "2daojnjnp666jla6.dropfile.online",
      "3.143.24.91.sslip.io",
      "360scanner.store",
      "360share.pro",
      "3la6ol.net",
      "49rjaf1fgrlzl1t82dpxmiqmyeedl4kku5y3hjvanjleyhpo3pjmbn23q0.pages.dev",
      "4bjt2rceijktwedi.onion",
      "4w9h8ps9.naveicoipa.tech",
      "4w9h8ps9.naveicoipc.tech",
      "5l.securemypc.xyz",
      "6la0cwds.naveicoiph.online",
      "7xvc.meeting-central.online",
      "7xvc.meeting-zone.online",
      "7xvc.roomconnect.online",
      "7xvc.virtual-collab.online",
      "8190ocvswfyd57v5.docsend.online",
      "91.90.121.87.sslip.io",
      "9yxqida1b.naveicoiph.online",
      "a.videotalks.site",
      "aat1pbil.naveicoipg.online",
      "abc.meeting-central.online",
      "abc.meeting-zone.online",
      "abc.preconnection.online",
      "abc.roomconnect.online",
      "abilityscan360.com",
      "abs.twitter.expublic.linkpc.net",
      "access.support.general-meet.site",
      "accounts.ceinbase.com",
      "acoustickoala.com",
      "acroadovw.com",
      "activity-179384736.site",
      "activity-permission.online",
      "additional.work.gd",
      "additionalpublic.work.gd",
      "addrcheck.corecheckmailsrv.com",
      "ade.dropfile.online",
      "admescolassystemf.com",
      "admin-8jy8o7jbg.vercel.sh",
      "admin.alwayswelcome.online",
      "admin.chrome-browser.cloud",
      "admin.docsend.online",
      "admin.docsend.site",
      "admin.drop-box.store",
      "admin.dropfile.online",
      "admin.echelonfnd.io",
      "admin.general-meet.site",
      "admin.luckyguys.cloud",
      "admin.luckyguys.site",
      "admin.meeting-central.online",
      "admin.meeting-zone.online",
      "admin.rohapowers.com",
      "admin.support.general-meet.site",
      "admin0.docsend.store",
      "adnoc.sbs",
      "aduresi.com",
      "advantims.com",
      "advisor-ecareerflare.pages.dev",
      "advisorflux.com",
      "advisorflux.pages.dev",
      "advisornetic.com",
      "advisoryfit.com",
      "advisoryfit.pages.dev",
      "advisorygrid.com",
      "adzjvazj.naveicoipg.online",
      "ae-zoom.us",
      "ae-zooom-hegne-meetingsfromf6758s.pages.dev",
      "aeroplans.info",
      "aes-secure.net",
      "affiliate.support.general-meet.site",
      "africamall.chat",
      "ag.centoservices.cz",
      "agafilime.com",
      "agora.assessintel.com",
      "ai.coinhouse360.com",
      "aiagentnow.online",
      "aideck.net",
      "aigtech.dev",
      "aihealthchains.com",
      "aionedev.best",
      "aixstore.info",
      "ajileuowl.dliklone.online",
      "akamaicloud.com",
      "akamaitechnologies.online",
      "akaunting25709.hostkey.in",
      "alahbabgroup.com",
      "alanservice.vercel.app",
      "alchemy-api-v3.cloud",
      "alchemy.motionassess.com",
      "alchemy.onchainhiringtool.com",
      "alchemy.talentscreeningtool.com",
      "alejandro.uefa-meeting.com",
      "allgraphicart.com",
      "allinfostudio.com",
      "allow-permission.online",
      "alltaxlab.com",
      "alpcoin.anomgaming.online",
      "alpha.preconnection.online",
      "alphanonega.org",
      "alqaflah.com",
      "alticgo.com",
      "alwayswait.online",
      "alwayswait.site",
      "alwayswelcome.online",
      "amazonaws1.info",
      "amazoncojp.one",
      "amazonfiso.com",
      "amene.homepc.it",
      "amytanathorn.com",
      "analytic.dropfile.online",
      "analytics-script-git-main.vercel.sh",
      "analyzicai.com",
      "anchoragedigitalhireflow.com",
      "anchoragehireflow.com",
      "anchoragehiring.com",
      "angeldonationblog.com",
      "angeldrop.cloud",
      "angeloper.com",
      "angeloperonline.online",
      "anglerstatic.com",
      "anifintech.xyz",
      "animoca.finance",
      "ann.support.general-meet.site",
      "anomgaming.online",
      "answerpanel.org",
      "answerpart.com",
      "answerpart.pages.dev",
      "antcapital.us",
      "antifirmware.online",
      "antifirmware.site",
      "antifirmware.store",
      "antiviruscheck.site",
      "antiviruscheck.store",
      "aosm8cts.naveicoipg.online",
      "api-agent-2pqjsxiut.vercel.sh",
      "api-git-main.vercel.sh",
      "api-server-mocha.vercel.app",
      "api-sub.jrodacooker.dev",
      "api-web3-auth.vercel.app",
      "api-www-avatar-25fcc9rbk.vercel.sh",
      "api-zoom.com",
      "api.africamall.chat",
      "api.alwayswelcome.online",
      "api.auto-fixer.online",
      "api.autocamfixer.online",
      "api.autodriverfix.online",
      "api.autofixer.online",
      "api.avax-test.dev",
      "api.betterevaluation.us",
      "api.bitzone.io",
      "api.camallupdate.cloud",
      "api.camdriverhelp.club",
      "api.camdriverhub.cloud",
      "api.camdrivers.cloud",
      "api.camdriverstore.cloud",
      "api.camdriversupport.com",
      "api.camera-drive.cloud",
      "api.camera-drive.org",
      "api.cameradriverx.cloud",
      "api.camtechdrivers.com",
      "api.camtuneup.online",
      "api.chrome-browser.cloud",
      "api.cincopa.org",
      "api.cleverbiz.us",
      "api.coinhar.io",
      "api.coinpricehub.io",
      "api.crm.koliinfotech.company",
      "api.deepdriverupdate.online",
      "api.detankzone.com",
      "api.devicefixer.online",
      "api.digipairx.com",
      "api.docsend.site",
      "api.docsend.store",
      "api.drive-release.cloud",
      "api.drivercamhub.cloud",
      "api.drivercams.cloud",
      "api.drivercamsupport.com",
      "api.driversnap.cloud",
      "api.driversofthub.online",
      "api.driverstream.cloud",
      "api.drivfixer.online",
      "api.drivhost.store",
      "api.dropfile.cloud",
      "api.dropfile.online",
      "api.drvfixer.online",
      "api.elemize.us",
      "api.entergenix.com",
      "api.equisphire.com",
      "api.ethzone.io",
      "api.evalium-expertises.us",
      "api.evaluateproficiency.com",
      "api.financecap.io",
      "api.fivebit.io",
      "api.fix-drivers.online",
      "api.fixdiskpro.online",
      "api.gappeo.us",
      "api.general-meet.site",
      "api.growzy.tech",
      "api.imoda.site",
      "api.info-job.org",
      "api.introon.com",
      "api.ixcareer.video",
      "api.jobecam.org",
      "api.jobecam.us",
      "api.jquery-release.com",
      "api.jz-aws.info",
      "api.keenest.org",
      "api.luckyguys.cloud",
      "api.macamhelp.online",
      "api.medincahub.com",
      "api.meeting-zone.online",
      "api.nvidia-cloud.online",
      "api.nvidia-drive.cloud",
      "api.nvidia-release.cloud",
      "api.nvidia-release.org",
      "api.nvidia-release.us",
      "api.olaestudiocreativo.com",
      "api.onchainassess.com",
      "api.pre-screen.net",
      "api.pre-screen.online",
      "api.provideodrivers.cloud",
      "api.quant-screen.com",
      "api.quickcamfix.online",
      "api.quickdriverupdate.online",
      "api.rapiddrivers.cloud",
      "api.release-driver.online",
      "api.release-drivers.online",
      "api.releasedrive.live",
      "api.retailpackagingpartner.xyz",
      "api.sapia.us",
      "api.skilllens360.com",
      "api.smartchecker.online",
      "api.smartdriverfix.cloud",
      "api.smartdriverfixer.com",
      "api.smartdrvupdate.online",
      "api.snap-screening.com",
      "api.softechsoftwares.co.ke",
      "api.softshare.online",
      "api.stockdata.tech",
      "api.stockinfo.io",
      "api.tailora.org",
      "api.talentacq.pro",
      "api.thaibit.io",
      "api.unimeta.biz",
      "api.updatecall.live",
      "api.updatemycam.online",
      "api.updatewebcamnow.live",
      "api.vblimitedgroup.com",
      "api.vcamdriverupdate.cloud",
      "api.vcamfixer.online",
      "api.vcamsupport.cloud",
      "api.viasto.us",
      "api.videocarddrivers.cloud",
      "api.videodriverzone.cloud",
      "api.videotechdrivers.cloud",
      "api.vidtechdrivers.com",
      "api.vidtechdrv.online",
      "api.vidtechhub.cloud",
      "api.web-cam.cloud",
      "api.webcamdrivers.cloud",
      "api.webcamfix.cloud",
      "api.webcamfixer.cloud",
      "api.webcamfixer.online",
      "api.webcamwizard.cloud",
      "api.wikahmart.com",
      "api.willoassessment.com",
      "api.yourdomainhost.store",
      "api.zoom-sdk.us",
      "api.zoomsdk.us",
      "api.zynoracreative.com",
      "apkv3.clarionhpdu.top",
      "apollo.support.general-meet.site",
      "app-center.download",
      "app-solaxy.world",
      "app-zoom.website",
      "app.advisornetic.com",
      "app.aixstore.info",
      "app.alwayswelcome.online",
      "app.animoca.finance",
      "app.answerpart.com",
      "app.aptitudespro.com",
      "app.askillo.online",
      "app.avasup.com",
      "app.axionara.com",
      "app.betterevaluation.us",
      "app.blockchain-assess.com",
      "app.blockchain-checkup.com",
      "app.breezyhr.us",
      "app.caesarx.trade",
      "app.cammio.org",
      "app.carrerlilla.com",
      "app.coinhouse360.com",
      "app.compassidea.org",
      "app.crypto-assessment.com",
      "app.detankzone.com",
      "app.docsend.site",
      "app.drop-box.store",
      "app.dropfile.cloud",
      "app.dropfile.online",
      "app.eboardcareer.com",
      "app.ecareerflare.com",
      "app.ehiremeasure.com",
      "app.eskillion.com",
      "app.evalcrew.com",
      "app.evalium-expertises.us",
      "app.evaliuminsights.com",
      "app.evalixhub.com",
      "app.evalsuit.com",
      "app.evaluino.com",
      "app.evaluza.com",
      "app.expertssavingai.com",
      "app.gappeo.us",
      "app.getevalor.com",
      "app.gumlet.us",
      "app.harqen.us",
      "app.highmatch.cloud",
      "app.highmatch.pro",
      "app.hiring-interview.com",
      "app.hiringinterview.org",
      "app.hiringtalent.pro",
      "app.hirvexo.com",
      "app.insighboard.com",
      "app.interviewnest.org",
      "app.ixcareer.video",
      "app.jumpshare.online",
      "app.keenest.org",
      "app.lenvny.com",
      "app.limesurvey.us",
      "app.meeting-zone.online",
      "app.merreo.org",
      "app.pancakeswap.studio",
      "app.poweem.com",
      "app.powerwize.org",
      "app.pre-screen.net",
      "app.proficiencycert.com",
      "app.prontoquiz.org",
      "app.quick-view.org",
      "app.quickvidintro.com",
      "app.qwary.org",
      "app.recroya.com",
      "app.rev-prot.org",
      "app.rolevia.us",
      "app.scoret.net",
      "app.skill-share.org",
      "app.sloneek.us",
      "app.speedvice.com",
      "app.spiralboard.com",
      "app.stablehouses.info",
      "app.survicate.us",
      "app.toptiercrew.com",
      "app.vereoy.com",
      "app.vervoe.org",
      "app.vervoe.us",
      "app.viasto.us",
      "app.vid-crypto-assess.com",
      "app.vidcruiter.us",
      "app.videoforrecruitment.com",
      "app.videoscreening.org",
      "app.vidintroexam.com",
      "app.vinterview.org",
      "app.visionaryte.org",
      "app.weboardtals.com",
      "app.willo-interview.us",
      "app.willoassess.com",
      "app.willoassessment.com",
      "app.willocandidate.com",
      "app.willohiring.com",
      "app.willohiringtalent.org",
      "app.willomexcvip.us",
      "app.willorecruit.com",
      "app.willotalant.com",
      "app.willotalent.pro",
      "app.willotalent.us",
      "app.willotalent.xyz",
      "app.willotalentes.com",
      "app.willotalents.org",
      "app.wilo-talent.com",
      "app.wonderlic.net",
      "app.wtalents.us",
      "app.zynoracreative.com",
      "apply-blocknovas.site",
      "apply-camera.com",
      "apply.blocknovas.com",
      "apply.blocknovasllc.com",
      "apply.ecareerflare.com",
      "apply.echelonfnd.io",
      "apply.waventic.com",
      "applylens.com",
      "apps.gappeo.us",
      "appsnabia.org",
      "aptitudespro.com",
      "arbor.companydetail.online",
      "arcashop.org",
      "archax.meetingverse.app",
      "archax.privymeet.com",
      "archax.skyboxdrive.cloud",
      "archax.team-meeting.pro",
      "archax.team-meeting.xyz",
      "archax.trustmeeting.live",
      "archax.videomeethub.online",
      "archblock.candidatescope.com",
      "archblock.careerscreeners.com",
      "archblock.quickproassess.com",
      "archblock.rolefit360.com",
      "areac-agr.com",
      "argoworkflow.chrome-browser.cloud",
      "as-zoom.us",
      "ascendrix.us",
      "askillo.online",
      "asl.dropfile.online",
      "assessalign.com",
      "assessbay.com",
      "assesscrew.com",
      "assessdome.com",
      "assessforhire.com",
      "assessintel.com",
      "assessiohq.com",
      "assessmentbay.com",
      "assesspro360.com",
      "assesstoday.com",
      "assesstrack.com",
      "asset.crypto-ecosystem.world",
      "assetslib.shop",
      "assureeval.com",
      "asteara.org",
      "astraluck-vercel.vercel.app",
      "atdfinancial.com",
      "atlas.small-forest-2b0b.workers.dev",
      "atlasnode-app204.vercel.app",
      "atlasnode-ext957.vercel.app",
      "atokyonews.com",
      "attisscmo.com",
      "audiocheck.store",
      "auditprovidre.online",
      "auditprovidre.site",
      "auditprovidre.store",
      "aumentarelevisite.com",
      "aurevian.cloud",
      "auth-drive-google.vercel.app",
      "auth.dropfile.online",
      "authenticate.azure-drive.com",
      "authnsecuresystems.com",
      "authsmtp.dropfile.online",
      "auto-ai.online",
      "auto-fixer.online",
      "auto-loader.org",
      "auto-patch.tech",
      "auto-protection.cloud",
      "auto-protection.services",
      "auto-secure.cloud",
      "autocamfixer.online",
      "autodiscover.vin",
      "autodriverfix.online",
      "autofixer.online",
      "automatic.antifirmware.store",
      "autonomousconsensuspipelines.cloud",
      "autoprotect.com.se",
      "autoprotect.gb.net",
      "autoserverupdate.line.pm",
      "autoupdate.xyz",
      "avalabs-digital.online",
      "avalabs-digital.space",
      "avalabs-digital.store",
      "avalabs-hiring.online",
      "avalabs-hiring.site",
      "avalabs-hiring.space",
      "avalabs-hiring.store",
      "avalabs-hiring.world",
      "avalabs-io.online",
      "avalabs-io.space",
      "avalabs-io.store",
      "avalabs-network.live",
      "avalabs-network.online",
      "avalabs-network.space",
      "avalabs-org.online",
      "avalabs-talent.online",
      "avalabs-talent.site",
      "avalabs-talent.space",
      "avalabs-talent.store",
      "avalabs-tech.online",
      "avalabs-tech.space",
      "avalabs-tech.store",
      "avasup.com",
      "avax-test.dev",
      "aveva.roleassessor.com",
      "aviamastersnetwork.com",
      "avillionrabbitry.com",
      "axieinfinity.assessalign.com",
      "axieinfinity.assessintel.com",
      "axieinfinity.certifyedge360.com",
      "axieinfinity.hirelytics360.com",
      "axionara.com",
      "ayr.dropfile.online",
      "ayrshire360.com",
      "azure-defender.cloud",
      "azure-drive.com",
      "azure-protect.cloud",
      "azure-protect.online",
      "azure-protection.cloud",
      "azure-protection.online",
      "azure.auto-protection.cloud",
      "azure.auto-protection.services",
      "azure.auto-secure.cloud",
      "azure.doc-protection.cloud",
      "azure.doc-protection.online",
      "azure.docs-protection.cloud",
      "azure.docs-protection.online",
      "azure.docs-protection.top",
      "azure.docs-view.cloud",
      "azure.online-protection.cloud",
      "azure.protection-service.cloud",
      "azuredefender.online",
      "azuredeploypackages.net",
      "azureglobalaccelerator.com",
      "b.videotalks.site",
      "b.watashinonegai.ru",
      "ba5827bf4e00.privatepool.store",
      "bac.dropfile.online",
      "backed.docsend.site",
      "backed.general-meet.site",
      "backend.alwayswelcome.online",
      "backend.chrome-browser.cloud",
      "backend.docsend.site",
      "backend.drop-box.store",
      "backend.dropfile.cloud",
      "backend.dropfile.online",
      "backend.meeting-zone.online",
      "backend.pre-screen.net",
      "backup.coinbase-backup.com",
      "backupwizard.net",
      "baincapitalcrypto.zm-meeting.com",
      "ballroller.fun",
      "banner-counter.com",
      "bapi.evalsuit.com",
      "barjobslasvegas-2f0akudpg-superbwebsolutions-e260a2eb.vercel.app",
      "base-cei.pages.dev",
      "bbcnewsagency.com",
      "bbs.topigsnorsvin.com.ec",
      "bcvbert.naveicoipe.tech",
      "beastgoc.com",
      "beenos.biz",
      "beeztrend.com",
      "belgiumchickenroad.com",
      "bensaru.site",
      "bestonlinefilmstudio.org",
      "beta-reactjs-org-1c98ufhjb-fbopensource.vercel.app",
      "beta.preconnection.online",
      "betterevaluation.us",
      "beyondnextventures.us",
      "bico-news.blog",
      "bico.tokentracking.info",
      "big-typl.online",
      "bigrocks918.com",
      "binancestransfers.com",
      "binshtok-cowan-test-pwjs2ggdx.vercel.sh",
      "biomedsurgcial.com",
      "bitensor.xyz",
      "bitfinex.internal-meeting.online",
      "bitfinex.video-meet.online",
      "bitfiniex.org",
      "bitgesell.finance",
      "bitgo.talentelevate360.com",
      "bitmart.hiremodozone.com",
      "bitscrunch.co",
      "bitscrunch.ddns.net",
      "bitscrunch.deck.linkpc.net",
      "bitscrunch.im.linkpc.net",
      "bitscrunch.linkpc.net",
      "bitscrunch.myvnc.com",
      "bitscrunch.pd.linkpc.net",
      "bitscrunch.presentations.life",
      "bitscrunch.publicvm.com",
      "bitscrunch.serveirc.com",
      "bitscrunch.tech.linkpc.net",
      "bitscrunch.zapto.org",
      "bitscrunchtech.linkpc.net",
      "bitscrunnch.linkpc.net",
      "bitscrunnch.run.place",
      "bitsvertise.com",
      "bitzone.io",
      "biz-meeting.site",
      "biz-zoom.us",
      "bizmeet.online",
      "bizmeet.org",
      "bizmeet.pro",
      "bizmeeting.org",
      "bizmeeting.video",
      "bizsupport365.com",
      "bizzyclub.org",
      "blackleopard.myvnc.com",
      "blackleopard.world",
      "blackskydev.org",
      "blastapi.org",
      "blgbeach.com",
      "blo.dropfile.online",
      "block-digital.fit",
      "block-digital.online",
      "block-digital.site",
      "block-digital.store",
      "blockassess.com",
      "blockchain-assess.com",
      "blockchain-checkup.com",
      "blockchain-newtech.com",
      "blockchain-talent-search.com",
      "blockchainjobassessment.com",
      "blockchainjobhub.com",
      "blockchainnews.vip",
      "blockchainrecruitment360.com",
      "blockchainworld.info",
      "blockfi-krollra.com",
      "blockfi.loans",
      "blocknovas.com",
      "blocknovas.talenthiringexpert.com",
      "blocknovasllc.com",
      "blockprices.io",
      "blocktechtalent.com",
      "blockterralab.com",
      "blocktestingto.com",
      "blog.br0vvnn.io",
      "blog.evalonboard.com",
      "bloombergnewsagency.com",
      "bloomcloud.org",
      "bloxholder.com",
      "bluecow.com",
      "bluemoonresearch.org",
      "blurbshop.com",
      "blxrbn.com",
      "bmanal.com",
      "boa.azuredefender.online",
      "boa.job-description.online",
      "boa.jobdescription.online",
      "bobshields.com",
      "bodyshoppechiropractic.com",
      "bofhintl.com",
      "bon.dropfile.online",
      "bonusdali.com",
      "boofparadise.com",
      "book-download.shop",
      "book.tomming.us",
      "boolnetwork.xyz",
      "bootcamp-coders.cnm.edu",
      "bot-protection-3bhbcw8wm.vercel.sh",
      "bot.dropfile.online",
      "botsc.autoupdate.xyz",
      "box-docsend.cloud",
      "box-docsend.online",
      "bqersape.dropfile.online",
      "brantwork.vercel.app",
      "breezyhr.us",
      "brianrep.com",
      "brightlaunch-app615.vercel.app",
      "brightlaunch-ext742.vercel.app",
      "bs-production.up.railway.app",
      "bsc-dash.us",
      "btcblender.live",
      "btfns.co",
      "bu-zoom.us",
      "buckfast-zucht.de",
      "bugnol.com",
      "buiweggajhqwj.naveicoipg.online",
      "bujey.store",
      "business-zoom.us",
      "businessgoogledoc.com",
      "businesshire.cv",
      "businesshire.top",
      "businessmeet.xyz",
      "bybit-assessment.com",
      "caesarx.trade",
      "caladangroup.xyz",
      "calendly.live",
      "callapp.us",
      "callsdk.online",
      "callservice.us",
      "calystiabusiness.com",
      "camallupdate.cloud",
      "camdriver.pro",
      "camdriverhelp.club",
      "camdriverhub.cloud",
      "camdrivers.cloud",
      "camdriverstore.cloud",
      "camdriversupport.com",
      "camera-drive.cloud",
      "camera-drive.org",
      "cameradriver.pro",
      "cameradriverupdates.com",
      "cameradriverx.cloud",
      "cammio.org",
      "camtechdrivers.com",
      "camtuneup.online",
      "candidateinsightinfo.com",
      "candidatescope.com",
      "candidatesnap.com",
      "canditech.co",
      "canditech.ink",
      "canditech.net",
      "canditech.online",
      "canditech.org",
      "canditech.us",
      "canditech.xyz",
      "candy-pdf.com",
      "canyonzcc.com",
      "capitalviabtc.com",
      "capitalviabtc.comhollow-jordan-narrow.on-fleek.app",
      "capmarketreport.com",
      "carandcclasic.com",
      "career-8hp.pages.dev",
      "careerboard.video",
      "careerinterview360.com",
      "careerpredictto.space",
      "careerpulsynk.xyz",
      "careerquestion.com",
      "careerscreeners.com",
      "careertrixauvex.ink",
      "carllamb4judge.com",
      "carrerlilla.com",
      "carrervision.com",
      "casteisland.sky-meeting.com",
      "casteisland.team-meeting.net",
      "castleisland.sky-meeting.com",
      "catalog-editorial-qdoii4smx-clg.vercel.app",
      "ccsnbao.com",
      "cctxtools.com",
      "ccuk.edu.ng",
      "ccwaterfall.com",
      "cdn-static-icons.vercel.app",
      "cdn-static-server.vercel.app",
      "cdn.clubinfo.io",
      "cdn.clublogos.io",
      "cdn.documentworkspace.io",
      "cdn.jqueryversion.net",
      "cdn.leaguehub.net",
      "cdn.logoeye.net",
      "cdn.logosports.net",
      "cdn.luckyguys.cloud",
      "cdn.onlinedocview.biz",
      "cdn.soccerlab.io",
      "cdn.wordonline.cloud",
      "cdpll-couk.top",
      "cecomtp3.naveicoipg.online",
      "ceinbase.com",
      "ceionbase.com",
      "celasllc.com",
      "centoservices.cz",
      "ceronet.work",
      "ceronetwork.org",
      "certifyedge360.com",
      "cestlaviewellnessretreat.com",
      "cex.apply-camera.com",
      "cgbrandh.short.gy",
      "chainanalyser.com",
      "chainfun365.com",
      "chaingrown.com",
      "chainlink-api-v3.cloud",
      "chainlink-api-v3.com",
      "chainnews-star.com",
      "changelog.rest",
      "chaoslabs.abilityscan360.com",
      "chaoslabs.motionassess.com",
      "chaoslabs.professionalsnapshot.com",
      "chat-services.online",
      "chat.blocknovas.com",
      "chat.luckyguys.cloud",
      "check.luckyguys.cloud",
      "checkdevinc.com",
      "checknewversion.com",
      "chemistryworld.us",
      "chickenbaloonsgame.com",
      "chickenfrroad.com",
      "chickenroad.chickenbaloonsgame.com",
      "chickenroad.chickenkitchengame.org",
      "chickenroad.eggfactorygame.es",
      "chickenroad.greatchickenescape.com",
      "chickenroad.happychickenmrs.com",
      "chickenroad.playskatepark.com",
      "chickenroad.plushtoytumama.com",
      "chickenroad.toadegged.com",
      "chickenroadbike.com",
      "chickenroadblast.com",
      "chickenroadcase.com",
      "chickenroadde.org",
      "chickenroadjump.org",
      "chickenroadjumping.com",
      "chickenroadpixel.com",
      "chickenroadrecipe.com",
      "chickenroadrocky.com",
      "chickenroadshow.com",
      "chickenroadsquad.com",
      "chickenroadstack.com",
      "chickenroadventures.com",
      "chinesekungfu.org",
      "chipmixer.live",
      "chrome-browser.cloud",
      "chvsvr.short.gy",
      "cicoinbase.com",
      "cienbase.com",
      "cincopa.org",
      "circle.talentmonitoringtool.com",
      "cisco-webex.online",
      "citce-group.com",
      "civ.team-meeting.net",
      "clarionhpdu.top",
      "cleverbiz.us",
      "cleverstack-app998.vercel.app",
      "cleverstack-ext301.vercel.app",
      "clients.socket.luckyguys.cloud",
      "clob-polymarket.com",
      "clob.health",
      "cloud-sheet.net",
      "cloud-storage.world",
      "cloud.bdcc.bio",
      "cloud.beenos.biz",
      "cloud.beyondnextventures.us",
      "cloud.cryptyk.info",
      "cloud.daiwa.ventures",
      "cloud.doc-shared.linkpc.net",
      "cloud.jbic.us",
      "cloud.medipoint.mccprod.site",
      "cloud.mizuhogroup.uk",
      "cloud.mufg.tokyo",
      "cloud.optvers.net",
      "cloud.prosec.ink",
      "cloud.smbcgroup.uk",
      "cloudflare-prevention.vercel.app",
      "cloudflare1.vercel.app",
      "cloudflarefirewall.vercel.app",
      "cloudflareinsights.vercel.app",
      "cloudflaresecurity.vercel.app",
      "cloudfly.org",
      "cloudharbor-app239.vercel.app",
      "cloudharbor-ext664.vercel.app",
      "cloudmgmt.org",
      "cloudplus.one",
      "cloudprotect.us.org",
      "cloudscare.xyz",
      "cloudshare.jumpshare.vip",
      "cloudstore.business",
      "cltpk.doomdns.org",
      "clubinfo.io",
      "clublogos.io",
      "cms.docsend.store",
      "cnbc.crypto-ecosystem.world",
      "co.intneral-document-he-gr-me.run.place",
      "coachzenblog.biz",
      "coalink.support",
      "cobinase.com",
      "cobinbase.com",
      "coca-cola.bond",
      "codebiogblog.com",
      "codepointlab.com",
      "codepool.cloud",
      "codevexillium.org",
      "codeviewer-fawn.vercel.app",
      "codeviewer-three.vercel.app",
      "coinbalse.com",
      "coinbase-backup.com",
      "coinbase-walet.biz",
      "coinbase-walet.me",
      "coinbase.abilityscan360.com",
      "coinbase.expublic.linkpc.net",
      "coinbase.motionassess.com",
      "coinbase.onchainhiringtool.com",
      "coinbase.professionalsnapshot.com",
      "coinbase.talentelevate360.com",
      "coinbase.talenthiringtool.com",
      "coinbase.talentmonitoringtool.com",
      "coinbase.talentscreeningtool.com",
      "coinbigex.com",
      "coinblase.com",
      "coinbrase.com",
      "coingecko.bond",
      "coingotrade.com",
      "coinhar.io",
      "coinhouse360.com",
      "coinibrase.com",
      "coininbase.com",
      "coinlenddefi.com",
      "coinlendefi.com",
      "coinmaketcape.com",
      "coinme.hiring-one.com",
      "coinoen.org",
      "coinpricehub.io",
      "col-link.linkpc.net",
      "comma3.biz-meeting.site",
      "comma3.videotalks.online",
      "commoncome.online",
      "commoncome.site",
      "communicationhub.us",
      "companydetail.online",
      "compassidea.org",
      "competency-core.com",
      "complexassess.com",
      "complexassessment.com",
      "concrecapital.com",
      "conf-2025-fcwpato0v.vercel.sh",
      "conference-go.online",
      "conferenceauth.coffeebrain.co",
      "connectptogether.ink",
      "consensys.willoassessment.com",
      "consulturbo.com",
      "consulturbo.pages.dev",
      "contactpredicttogether.ink",
      "contactpulsynk.ink",
      "contacttrixauvex.ink",
      "contentverge.com",
      "continue-meeting.site",
      "contract.waventic.com",
      "contradecapital.com",
      "control-plane-default-ehybkouwd.vercel.sh",
      "controller.rightwidth.dev",
      "coop-shop-next-jld7wvrxk-co-op-food-customer-experience.vercel.app",
      "coop-shop-next-philwolstenholme-co-op-food-customer-experience.vercel.app",
      "cooporatestock.com",
      "copia.vin",
      "copilot-ai.whisdev.org",
      "copper-fv73l6e9m.vercel.sh",
      "corebiz.fun",
      "corecheckmailsrv.com",
      "coredeal2.vercel.app",
      "coreladao.com",
      "coreviewer.vercel.app",
      "corjus.top",
      "coslyintra.online",
      "cosmoplanets.net",
      "coto.live",
      "cotrixauvex.ink",
      "coupang-marketing.rest",
      "coupang-network.pics",
      "coupang-networks.pics",
      "coupang-sales.rest",
      "coz.dropfile.online",
      "cpanel.wtalents.us",
      "cpromoter.com",
      "cr-zoom.us",
      "crabbedly.club",
      "craptioerne.com",
      "crawl-analysis-git-main.vercel.sh",
      "crawled-sitemap-git-main.vercel.sh",
      "craypot.live",
      "cro.dropfile.online",
      "crosstheages.eskillence.com",
      "crosstheages.hirehatch360.com",
      "crosstheages.hirelytics360.com",
      "crosstheages.skillence360.com",
      "crosstheages.talentelevate360.com",
      "crostox.com",
      "crownx-academy.com",
      "crtypk.run.place",
      "cryptais.com",
      "crypto-assess.com",
      "crypto-assessment.com",
      "crypto-briefings.com",
      "crypto-ecosystem.world",
      "crypto.blockchainworld.info",
      "crypto.hondchain.com",
      "cryptocopedia.com",
      "cryptofundsresearch.com",
      "cryptomn.vercel.app",
      "cryptopriceoffer.com",
      "cryptowave.capital",
      "cryptowave.internal-meeting.online",
      "cryptowave.video-meet.online",
      "cryptyk.cloud",
      "cryptyk.ddns.net",
      "cryptyk.hopto.org",
      "cryptyk.info",
      "cryptyk.sytes.net",
      "cryptyk.webredirect.org",
      "cryptykhost.work.gd",
      "ctmnews.kr",
      "ctrac.online",
      "culyrax.us",
      "curiofirenze.com",
      "curiosity-works-opschudding.vercel.app",
      "customizetions.com",
      "cv-8zz57gksb-simons-projects-486531f7.vercel.app",
      "cwwpxpxuswo7b6tr.onion",
      "cyberpanel78354.hostkey.in",
      "cyptian.com",
      "cyptoconnections.com",
      "czinfo.club",
      "d.diragame.com",
      "d.watashinonegai.ru",
      "d1.skyboxdrive.cloud",
      "d12rlkj8v5mwse.cloudfront.net",
      "d1yzmjg018adwf.cloudfront.net",
      "d20zx0lguyxj2p.cloudfront.net",
      "d3o9p0hkd7eul5.cloudfront.net",
      "d4yp8bphj3.naveicoiph.online",
      "dabacof.com",
      "dafom.dev",
      "dag.dropfile.online",
      "dailynewsagent.com",
      "daiwa.azure-defender.cloud",
      "daiwa.ventures",
      "dal-shared-22.hostwindsdns.com",
      "dal-shared-25.hostwindsdns.com",
      "dal-shared-37.hostwindsdns.com",
      "dalbinews.co.kr",
      "daniel-ayala.netlify.app",
      "data-kappa.vercel.app",
      "database.retrots.net",
      "datacentre.center",
      "datasecure-service.vercel.app",
      "datasend.linkpc.net",
      "dataxo.net",
      "davhub88.vercel.app",
      "dawiteewnetu-uxgr-ig97x97wa-dawite-ewnetus-projects.vercel.app",
      "dawiteewnetu-uxgr-l5fvt75j7-dawite-ewnetus-projects.vercel.app",
      "day.dropfile.online",
      "dbgsymbol.com",
      "dc-aeea9bdbc87b.dropfile.online",
      "dc-ba6f51b553e0.olidhealth.com",
      "de.ztec.store",
      "deadfellaz.candidatescope.com",
      "decentralizeddataexchangeinferencelayer.com",
      "decentscrippts.com",
      "deck.linkpc.net",
      "deep-ai-guard.store",
      "deepdriverupdate.online",
      "deepmindschematic.com",
      "default-configuration-sandy.vercel.app",
      "default-configuration.vercel.app",
      "defi.smart-contracts.blog",
      "defianceanalytics.abilityscan360.com",
      "defianceanalytics.easyhiringtool.com",
      "defitankzone.com",
      "deltaemis.com",
      "demo.alwayswelcome.online",
      "demo.chrome-browser.cloud",
      "demo.docsend.site",
      "demo.docsend.store",
      "demo.drop-box.store",
      "demo.dropfile.online",
      "demo.luckyguys.site",
      "demo.techsaeein.com",
      "deng-labs-6ts0pz3vm.vercel.sh",
      "deoft.com",
      "derek-site-2026-6g03r9taz-derek-martins-projects.vercel.app",
      "desarrollolab.com",
      "designautocad.org",
      "detankwar.com",
      "detankzone.com",
      "dev.alwayswelcome.online",
      "dev.caesarx.trade",
      "dev.chrome-browser.cloud",
      "dev.copia.vin",
      "dev.docsend.site",
      "dev.docsend.store",
      "dev.dropfile.online",
      "dev.general-meet.site",
      "dev.jmttrading.org",
      "dev.meeting-zone.online",
      "dev.microcravate.com",
      "dev.sslsharecloud.net",
      "devchallengehq.com",
      "development-server.aduresi.com",
      "devguardmap.org",
      "devicefixer.online",
      "devicelinkintel.com",
      "devprocloud.com",
      "dezertir.com",
      "dg.novaplayer.online",
      "diamondhilllaw.com",
      "digiboxes.us",
      "digipairx.com",
      "digital-skill-assessment.com",
      "digitalcurencygroup.co",
      "digitalguarder.com",
      "digitaltalent.review",
      "digitaltalentassess.com",
      "digitpotalent.com",
      "digitptalent.com",
      "dip.dropfile.online",
      "diragame.com",
      "diregame.live",
      "disneycareers.net",
      "distscrippts.com",
      "dldoc.net",
      "dliklone.online",
      "dmarc.fsdriveshare.org",
      "dmarc.onlineshares.cloud",
      "doc-protection.cloud",
      "doc-send.cloud",
      "doc-send.com",
      "doc-send.online",
      "doc-share.cloud",
      "doc-shared.linkpc.net",
      "doc.cooporatestock.com",
      "doc.documentshare.info",
      "doc.filesaves.cloud",
      "doc.global-link.run.place",
      "doc.gsheetshare.org",
      "docs-git-fix-issue-330-driveclub.vercel.app",
      "docs-payload-dgwy6heek.vercel.sh",
      "docs-protection.cloud",
      "docs-protection.online",
      "docs-protection.top",
      "docs-send.com",
      "docs-send.online",
      "docs-view.cloud",
      "docs.azure-protection.cloud",
      "docs.cooporatestock.com",
      "docs.drivegoogle.info",
      "docs.dsharefile.tech",
      "docs.gdriveshare.top",
      "docs.gsheetpage.com",
      "docs.mktrending.com",
      "docs.panteracapital.ventures",
      "docs.smbc-vc.com",
      "docs.tptf.cloud",
      "docsend-host.cloud",
      "docsend.apple.linkpc.net",
      "docsend.apple.work.gd",
      "docsend.camdvr.org",
      "docsend.linkpc.net",
      "docsend.online",
      "docsend.publicvm.com",
      "docsend.site",
      "docsend.store",
      "docsend.theworkpc.com",
      "docsenddata.linkpc.net",
      "docsendinfo.linkpc.net",
      "docshared.col-link.linkpc.net",
      "document-content.online",
      "document.antcapital.us",
      "document.coto.live",
      "document.shared-link.line.pm",
      "document.sharedrive.ink",
      "documentprotect.live",
      "documentprotect.pro",
      "documentshare.info",
      "documentworkspace.io",
      "docuprivacy.com",
      "docusend.coto.live",
      "docusign.agency",
      "docview.ink",
      "domatisc.ink",
      "donmuzzi.site",
      "doodles.careerquestion.com",
      "doodles.carrervision.com",
      "doodles.hirequestion.com",
      "doodles.interviews360.com",
      "doodles.skillquestion.com",
      "doodles.skillquestions.com",
      "doodles.workquestion.com",
      "down.1230578.com",
      "down.mykings.pw",
      "down.privatework.buzz",
      "download.azure-drive.com",
      "download.factrina.com",
      "download.getevalor.com",
      "download.inspach.com",
      "download.kooverly.org",
      "download.prontoquiz.org",
      "downloadcenter.website",
      "doxxela.ink",
      "dpkgrepo.com",
      "dprk-it.pages.dev",
      "dps.shconstmarket.com",
      "dragonfly.cloudstore.business",
      "dragonfly.virtual-collab.online",
      "draper.online-meeting.xyz",
      "drive-access.site",
      "drive-release.cloud",
      "drive.chrome-browser.cloud",
      "drive.cloudplus.one",
      "drivegoogle.info",
      "drivercamhub.cloud",
      "drivercams.cloud",
      "drivercamsupport.com",
      "driverhubpro.net",
      "driverpool.online",
      "driverservices.store",
      "driversnap.cloud",
      "driversofthub.online",
      "driverstream.cloud",
      "drivertools.org",
      "drivetools.xyz",
      "drivfixer.online",
      "drivhost.store",
      "drop-box.cloud",
      "drop-box.info",
      "drop-box.store",
      "drop.skyboxdrive.cloud",
      "drop.trailads.net",
      "dropbox-docsend.cloud",
      "dropbox-docsend.online",
      "dropbx-doc.online",
      "dropfile.cloud",
      "dropfile.online",
      "drupdate.club",
      "drvfixer.online",
      "dsharefile.tech",
      "dshellelink.gcloud-share.com",
      "dsx-app.com",
      "dtdgwgfvr.naveicoiph.online",
      "dubai.network.cloud.doc-shared.linkpc.net",
      "dubbedfinally.link",
      "dun.audiocheck.store",
      "dun.auditprovidre.online",
      "dun.wndlwndmfe.xyz",
      "dunamu.jp-zoom.com",
      "dynamic.expublic.linkpc.net",
      "eager-shockley.144-172-108-248.plesk.page",
      "eastvalex-peak.com",
      "easydriver.cloud",
      "easyhiringtool.com",
      "easyinterview360.com",
      "easyvps.net",
      "easywalletconnect.com",
      "eboardcareer.com",
      "eboardcareer.pages.dev",
      "ecareerflare.com",
      "ecareerflare.pages.dev",
      "ecareerscan.com",
      "echelonfnd.io",
      "eclairdomain.com",
      "ecombox.store",
      "ecordillos.com",
      "ecosystem.openfort.video",
      "edfeiyql.naveicoipg.online",
      "edge-runtime-git-main.vercel.sh",
      "edit.onlinedocview.biz",
      "edit.wpsonline.co",
      "editorsettings.vercel.app",
      "edividy.pro",
      "eduflex-eu.org",
      "effectiveengineeringleader.com",
      "ehireflex.com",
      "ehireflix.com",
      "ehiremeasure.com",
      "einei.line.pm",
      "electoralvictory.site",
      "element-3.bestleas.ru",
      "elemize.us",
      "eli.dropfile.online",
      "elitedrivva-app.dabacof.com",
      "elitehireaxis360.com",
      "eliteshire.com",
      "elitetalent360.com",
      "elitewholetalent.com",
      "elm.dropfile.online",
      "elsavora.us",
      "elwoodasset.xyz",
      "email.alwayswait.online",
      "email.dropfile.online",
      "email.instant-patch.online",
      "emeetings.zoominvites.com",
      "employ-check.com",
      "empowerpharmacy.space",
      "emv1.alwayswelcome.online",
      "emv1.chrome-browser.cloud",
      "emv1.dropfile.cloud",
      "emv1.dropfile.online",
      "emv1.general-meeting.team",
      "emv1.group-meet.online",
      "emv1.group-meet.site",
      "emv1.group-meeting.pro",
      "emv1.group-meeting.team",
      "emv1.meetingverse.app",
      "emv1.preconnection.online",
      "emv1.private-meet.online",
      "emv1.team-meet.xyz",
      "emv1.ubi-safemeeting.live",
      "emv1.videotalks.online",
      "en-zoom.us",
      "en.stocksindex.org",
      "en.stocksitem.org",
      "en.stockslab.org",
      "en.wfinance.org",
      "encorpost.com",
      "endesway.life",
      "energydonate.com",
      "enimvzud.mouradvps8hostwin.online",
      "enrollcrux.com",
      "entergenix.com",
      "eoinbase.com",
      "eoinlslsf.naveicoipg.online",
      "eon.dropfile.online",
      "eosszzc.hateoo.space",
      "equisphire.com",
      "equisphirep.com",
      "er-zoom.us",
      "esilet.com",
      "eskillence.com",
      "eskillfolio.com",
      "eskillforge.com",
      "eskillion.com",
      "eskillmetric.com",
      "eskillora.com",
      "eskillpilot.com",
      "eskillprof.com",
      "eskillprov.com",
      "essendantdock.online",
      "ethereum.blastapi.org",
      "ethzone.io",
      "etoffcoinbase.com",
      "etoro.careerquestion.com",
      "evalassesso.com",
      "evalcrew.com",
      "evalium-expertise1.pages.dev",
      "evalium-expertise360.com",
      "evalium-expertises.us",
      "evaliuminsights.com",
      "evalixhub.com",
      "evalonboard.com",
      "evalsuit.com",
      "evalswift.com",
      "evaluateiq.com",
      "evaluateproficiency.com",
      "evaluino.com",
      "evaluza.com",
      "evalvideo.com",
      "evalvidz.com",
      "everydaynodechecker-39143n.vercel.app",
      "ewha-ac.ml",
      "examples-basic-web.vercel.sh",
      "exbonus.mrbasic.com",
      "exceptions.coinbase.expublic.linkpc.net",
      "exceptions.expublic.linkpc.net",
      "exchange.dropfile.online",
      "exodus.linkpc.net",
      "expert-mode-1c2u0v83b-chainlinklabs.vercel.app",
      "expert-mode-1ruzfeq6x-chainlinklabs.vercel.app",
      "expert-mode-iebahb8mh-chainlinklabs.vercel.app",
      "expert-mode-ifa37strm-chainlinklabs.vercel.app",
      "expert-mode-ilj8udtti-chainlinklabs.vercel.app",
      "expert-mode-j12s18yqd-chainlinklabs.vercel.app",
      "expert-mode-kpwcznf9q-chainlinklabs.vercel.app",
      "expert-mode-n0lcsjlju-chainlinklabs.vercel.app",
      "expert-mode-omc4wsgd7-chainlinklabs.vercel.app",
      "expert-mode-otcucejsn-chainlinklabs.vercel.app",
      "expert-mode-retiqr6xk-chainlinklabs.vercel.app",
      "expert-mode-rr4zcmoka-chainlinklabs.vercel.app",
      "expertssavingai.com",
      "express--vpn.com",
      "expublic.linkpc.net",
      "ext-checkedin.vercel.app",
      "ext.luckyguys.cloud",
      "extrazoom.us",
      "facial.anomgaming.online",
      "factrina.com",
      "falcancoin.io",
      "fashdefi.store",
      "fast-video-recording.com",
      "fasttet.com",
      "fastwise.org",
      "faulttolerantdigitalengine.com",
      "fax-cover.com",
      "fclouddown.co",
      "febintllc.com",
      "felixpools.vercel.app",
      "fenbushi.general-meeting.team",
      "fenbushi.private-meet.online",
      "fenbushi.private-meet.team",
      "fenbushi.regular-meeting.team",
      "fetchtalent360.com",
      "fhewkhwjehwekjfhwehfwe.com",
      "fidelitydigitalsassets.com",
      "figuermarkets.com",
      "file-secure-sharing.com",
      "file.cestlaviewellnessretreat.com",
      "file.fclouddown.co",
      "file.fsdriveshare.org",
      "file.luckyguys.cloud",
      "file.rightwidth.dev",
      "filehost.network",
      "filehosting.store",
      "files-archive.online",
      "files.cestlaviewellnessretreat.com",
      "files.hirog.io",
      "filesaves.cloud",
      "filesspace.xyz",
      "final.hiringtalent.pro",
      "financecap.io",
      "financialtimes365.com",
      "find-dreamjob.com",
      "findhelptalent360.com",
      "finnt.evalonboard.com",
      "finorabsns.com",
      "finovec.co.ke",
      "fireblocks-assessment.com",
      "fireblocks.vip",
      "fireblockshireflow.com",
      "fireblockshiring.com",
      "fireblocksinsight.com",
      "firexch.com",
      "fitnessdirector.net",
      "fivebit.io",
      "fivefingerz.dev",
      "fix-driver.online",
      "fix-drivers.online",
      "fix.measureaptitudes.com",
      "fix.soft-dev.online",
      "fixdiskpro.online",
      "flag-git-main.vercel.sh",
      "floriventures.linkpc.net",
      "floriventures.publicvm.com",
      "floriventuresend.linkpc.net",
      "floriventuresfund.com",
      "flow.dropfile.online",
      "fmi-link.info",
      "fmose.com",
      "fob.dropfile.online",
      "focuscamere.com",
      "fog.dropfile.online",
      "forest.groundwolf.sbs",
      "forservercon.run.place",
      "foundationcap.regular-meet.team",
      "foxiebed.com",
      "framework.careerboard.video",
      "frameworkvc.icareerc.com",
      "frameworkvc.ixcareers.com",
      "frameworkvc.ixscreen.com",
      "france24.live",
      "free-loader.org",
      "freeconference.io",
      "freenet-zhilly.org",
      "front-bzi.pages.dev",
      "frontend-5e7.pages.dev",
      "frontend-dev-bnp.pages.dev",
      "frontend-eu1.pages.dev",
      "frontend-staging-egw.pages.dev",
      "frontend-us1.pages.dev",
      "fronterixbusiness.com",
      "fs.digiboxes.us",
      "fsdriveshare.org",
      "ftp.anchoragehireflow.com",
      "ftp.ccuk.edu.ng",
      "ftp.dataxo.net",
      "ftp.dropfile.online",
      "ftp.kaltura.studio",
      "ftp.skillview360.com",
      "ftp.talentevaluate.com",
      "ftp.teams-meets.com",
      "ftutech.store",
      "ftxstock.com",
      "fudcitydelivers.com",
      "fundcandidates.com",
      "funnyboy0719.fun",
      "fusionlayer-app463.vercel.app",
      "fusionlayer-ext807.vercel.app",
      "fw.docsend.online",
      "fwpoyktt.naveicoipg.online",
      "gamesmasterbb.com",
      "gappeo.us",
      "gatexpiring.com",
      "gatuga-api.cpromoter.com",
      "gbclabs.com",
      "gbflatinamerica.com",
      "gbmaudiologininstructions.esdinfra.com",
      "gcloud-share.com",
      "gcp.webzoom.video",
      "gdoc.wordonline.cloud",
      "gdocshare.com",
      "gdocshare.one",
      "gdriveupload.info",
      "gdrvup.xyz",
      "geist-docs-n03iy9wgb.vercel.sh",
      "geist-storybook-kbjruqxe3.vercel.sh",
      "geist-storybook-nyf9kazrs.vercel.sh",
      "gemini.crypto-assessment.com",
      "gemini.willoassess.com",
      "gemini.willohiring.com",
      "gemini.willohiringtalent.org",
      "geminiskill.willoassessment.com",
      "gen.dropfile.online",
      "gendoraduragonkgp126.com",
      "general-meet.online",
      "general-meet.site",
      "general-meet.team",
      "general-meeting.team",
      "geocollab.wegrowup.us",
      "georgeservice77.vercel.app",
      "getapilatency.onrender.com",
      "getcoinprice.info",
      "getdonald.xyz",
      "getevalor.com",
      "gethirednow.org",
      "gethiring360.com",
      "getpngdata.vercel.app",
      "getstockprice.com",
      "getstockprice.info",
      "gfinanzen.net",
      "gglab-poker.netlify.app",
      "ghostraper.top",
      "giantblock.org",
      "git-hub.me",
      "git.luckyguys.cloud",
      "git.luckyguys.site",
      "gitcheck-commit.vercel.app",
      "githelper.store",
      "githero-dev7uf163-gimenetes-projects.vercel.app",
      "github.expublic.linkpc.net",
      "gkins2p3i.naveicoiph.online",
      "gladneyocivpsdedinvme4.com",
      "glitchmedic.com",
      "global-job.org",
      "global-link.run.place",
      "globalelitehire.com",
      "globalskillconnect360.com",
      "globiscapital.co",
      "globiscapitals.com",
      "gmaildrive.site",
      "gnxcepro.com",
      "go.oncehub.co",
      "goglestorage.com",
      "goingladies.com",
      "goldllama4.sakura.ne.jp",
      "good.commoncome.site",
      "google-clouds.com",
      "google.coinbase.expublic.linkpc.net",
      "google.diragame.com",
      "googleauth.pro",
      "googledocpage.com",
      "googledriver.info",
      "googleproduct.org",
      "googlesheet.info",
      "googlesheetpage.org",
      "googleupload.info",
      "googlezauthtoken.vercel.app",
      "gorodmechty.ddns.net",
      "gossipsnare.com",
      "gowelknx.naveicoipf.online",
      "gp-core.com",
      "gp-main.com",
      "grace-ayodele.workers.dev",
      "grainituae.com",
      "greendottb.com",
      "greendtb.com",
      "greenhouselc.com",
      "greennovadigital.com",
      "greenroad.top",
      "greenservice.tech",
      "greenways.shop",
      "groundwolf.sbs",
      "group-meet.online",
      "group-meet.site",
      "group-meet.team",
      "group-meeting.online",
      "group-meeting.pro",
      "group-meeting.team",
      "group.evalaskatours.com",
      "group.link-net.publicvm.com",
      "group.superstatefund.co",
      "growzy.tech",
      "gsheetpage.com",
      "gsheetshare.org",
      "gsoftcompany.com",
      "gsuiteshare.com",
      "guildsmartchainpulse.com",
      "gumi-cryptos.group-meeting.online",
      "gumi-cryptos.group-meeting.team",
      "gumi-cryptos.loan",
      "gumi-cryptos.team-meet.online",
      "gumi-cryptos.team-meeting.xyz",
      "gumi-cryptos.video-meet.team",
      "gumicryptos.com",
      "gumlet.us",
      "gurucooldown.short.gy",
      "gwmspacegpt.com",
      "h34fdfbm.store",
      "hack-vc.video-meets.site",
      "hack-vc.video-meets.xyz",
      "hahaios.com",
      "haifeizhang.com",
      "hanagroup.live",
      "hanagroup.video",
      "happy.nanoace.co.kr",
      "happychickenmrs.com",
      "hare.1drvmicrosoft.com",
      "harqen.us",
      "hartmanmcapital.com",
      "hashkey.group-meeting.online",
      "hashkey.group-meeting.team",
      "hashkey.internal-meeting.online",
      "hashkey.online-meet.team",
      "hashkey.online-meet.xyz",
      "hashkey.online-meeting.team",
      "hashkey.online-meeting.xyz",
      "hashkey.team-meet.online",
      "hashkey.team-meeting.pro",
      "hashkey.team-meeting.xyz",
      "hashkey.video-meet.online",
      "hashkey.video-meet.team",
      "hashkey.video-meeting.team",
      "hateoo.space",
      "help-optus.com",
      "help.group-meeting.online",
      "help.mappo-on.life",
      "help.navreplya.live",
      "help.octo-manage.net",
      "help.team-meet.online",
      "help.video-meet.team",
      "help.video-meeting.team",
      "helpdeskassistance.org",
      "hentaikawaiiuwu.com",
      "heritage-netwk.com",
      "heritagetbk.com",
      "highmatch.cloud",
      "highmatch.pro",
      "hillokay.com",
      "hirebest.cv",
      "hirefeedbacker.com",
      "hirefiix.pro",
      "hireflix.pro",
      "hireflix360.com",
      "hirehatch360.com",
      "hirelytics360.com",
      "hiremodozone.com",
      "hiremployee.com",
      "hireone.top",
      "hireproflix.online",
      "hireqora.com",
      "hirequestion.com",
      "hireskillhub.com",
      "hiresyncer.us",
      "hiretestzone.com",
      "hireviavideo.com",
      "hirevision360.com",
      "hiring-intellipro.com",
      "hiring-interview.com",
      "hiring-one.com",
      "hiring-you.com",
      "hiring.crostox.com",
      "hiring.waventic.com",
      "hiring.willoassessment.com",
      "hiringinterview.org",
      "hiringinterview360.com",
      "hiringtalent.pro",
      "hiringtestpro.com",
      "hirog.io",
      "hirvexo.com",
      "hk05web.us",
      "hohoho.rightwidth.dev",
      "holi.intervu-talent.pro",
      "hollow-jordan-narrow.on-fleek.app",
      "home-continue.online",
      "home-proceed.online",
      "homemaxair.pro",
      "hondchain.com",
      "honehsn.com",
      "hopanatech.com",
      "hopehobo.com",
      "hostings.webredirect.org",
      "hotstreamx.stream",
      "http-qjhndbrw.roomconnect.online",
      "https-qjhndbrw.roomconnect.online",
      "huanying.remoteproweb.cfd",
      "huguotechltd.com",
      "huhuhu.rightwidth.dev",
      "human-check.com",
      "humingbot.io",
      "huweisge.dliklone.online",
      "hvdaconversions.com",
      "hwsrv-1033810.hostwindsdns.com",
      "hwsrv-1091010.hostwindsdns.com",
      "hwsrv-1093408.hostwindsdns.com",
      "hwsrv-1275416.hostwindsdns.com",
      "hyperchaincapital.online",
      "hyperdevpipline.org",
      "hyphen-connect.com",
      "hysf6-baaaa-aaaag-algfa-cai.icp0.io",
      "hytrycnc.naveicoipg.online",
      "iao.dropfile.online",
      "iba.dropfile.online",
      "icareerc.com",
      "ice.dropfile.online",
      "ich.dropfile.online",
      "icimp.swarkul.com",
      "id37093.com",
      "ido-epargne.com",
      "ignite.bizmeeting.org",
      "ignite.bizmeeting.video",
      "ignite.onlinemeet.pro",
      "ihsgpnsj.meetingverse.app",
      "illycafe.my",
      "illycoffee.my",
      "imap.dropfile.online",
      "imap1.dropfile.online",
      "imoda.site",
      "indaddy.xyz",
      "indagator.club",
      "indeedus.org",
      "inditechlab.com",
      "indobit.io",
      "industryinfostructure.com",
      "info-job.org",
      "info.floriventuresfund.com",
      "info.racondog.shop",
      "infuy.us",
      "innerteams.us",
      "innoenergy.info",
      "innovateinc.fun",
      "insighboard.com",
      "insight-hire.com",
      "insight-interview.com",
      "insighthire360.com",
      "insightquestion.com",
      "insights.online-meets.pro",
      "insomnianwin.site",
      "inspach.com",
      "inst.fetchtalent360.com",
      "inst.shconstmarket.com",
      "instant-patch.online",
      "instant-preview-site-9w675nmgg.vercel.sh",
      "intelcloudinsights.com",
      "inter.quickskill-review.com",
      "inter.vid-crypto-assess.com",
      "internal-engineering-documentation-site-mrj1hhs06.vercel.sh",
      "internal-meet.online",
      "internal-meet.team",
      "internal-meet.xyz",
      "internal-meeting.cyou",
      "internal-meeting.online",
      "internal-meeting.site",
      "internal-server.nextera.capital",
      "internal.bounceme.net",
      "internal.daiwa.ventures",
      "internal.group.link-net.publicvm.com",
      "internal.usncet.org",
      "internalpdfviewer.ddns.net",
      "interview-talent.com",
      "interview.private-meeting.online",
      "interviewhub.org",
      "interviewnest.org",
      "interviews360.com",
      "interviewskillmaster.com",
      "intervu-talent.pro",
      "intervwolf.com",
      "interzoom.us",
      "intneral-document-he-gr-me.run.place",
      "intro-crypto-assess.com",
      "intro.quickskill-review.com",
      "intro.vid-crypto-assess.com",
      "introon.com",
      "investbooking.de",
      "invesuccess.com",
      "invoicez.xyz",
      "ip-api-check-nine.vercel.app",
      "ip-api-server.vercel.app",
      "ip-api-test.vercel.app",
      "ip-check-api.vercel.app",
      "ip-check-notification-03.vercel.app",
      "ip-check-notification-firebase.vercel.app",
      "ip-check-notification-firebase03.vercel.app",
      "ip-check-notification-rkb.vercel.app",
      "ip-check-server.vercel.app",
      "ip-check-wh.vercel.app",
      "ip-checking-notification-firebase111.vercel.app",
      "ip-checking-notification-kgm.vercel.app",
      "ipcheck.cloud",
      "ipfs-url-validator.vercel.app",
      "iploglab.store",
      "ipservice.kro.kr",
      "ipv6.srv755058.hstgr.cloud",
      "ismartrium.com",
      "isvalid-region.vercel.app",
      "isvalid-regions.vercel.app",
      "it.zvc.capital",
      "itaddnet.com",
      "ixcareer-video.pages.dev",
      "ixcareer.com",
      "ixcareer.video",
      "ixcareers.com",
      "ixscreen.com",
      "j-ic.co.intneral-document-he-gr-me.run.place",
      "j-rl.com",
      "jaicvc.com",
      "jamesbillion.com",
      "jameslack.vercel.app",
      "jbic.us",
      "jbmnqpwp.naveicoipg.online",
      "jdkgradle.com",
      "jenn.shop",
      "jerryfox-platform.vercel.app",
      "jk.theworldofluck.site",
      "jmttrading.org",
      "job-career-portal.com",
      "job-description.online",
      "jobdescription.linkpc.net",
      "jobdescription.online",
      "jobecam.org",
      "jobecam.us",
      "jobinterview360.com",
      "jobinterviewguide.org",
      "jobinterviews360.com",
      "jobintro.linkpc.net",
      "joblitic.com",
      "jobskillmatch360.com",
      "join-room.meeting-online.site",
      "joinustoday.online",
      "jom.diregame.live",
      "josehub88.vercel.app",
      "jp-zoom.com",
      "jquery-release.com",
      "jquerycloud.io",
      "jqueryversion.net",
      "jrodacooker.dev",
      "json-project-hazel.vercel.app",
      "jumping-mechellen.com",
      "jumpshare.online",
      "juneprint.com",
      "jungfrau.co.kr",
      "justbuiltprojects.com.au",
      "jvnquetbon.naveicoipg.online",
      "jwt-alpha-woad.vercel.app",
      "jz-aws.info",
      "jzus0ve6iq-staging.onrocket.site",
      "kaltura.studio",
      "kashaccn4.naveicoiph.online",
      "kb102531x.vercel.app",
      "kdzdm1rq.naveicoipg.online",
      "keenest.org",
      "keondigital.com",
      "kerajaanmoshi.xyz",
      "key.sharedrive.ink",
      "kfcjn.com",
      "kingstar.publicvm.com",
      "kingsvc.cc",
      "kirschneigroup.com",
      "kit-haus.net",
      "kkvps.buzz",
      "knightsbridge-dex.vercel.app",
      "knockri.us",
      "koliinfotech.company",
      "koover.org",
      "kooverly.org",
      "kourosh.uefa-meeting.com",
      "kraken.group-meeting.online",
      "kraken.group-meeting.team",
      "kraken.livehiringpro.com",
      "kraken.team-meet.online",
      "kraken.video-meeting.team",
      "krakenfolio.com",
      "krakenhire.com",
      "krakenmeetings.com",
      "kryptoneer.com",
      "ksrtcaudiologininstructions.esdinfra.com",
      "ksrtceccsgbmaudiologininstructions.esdinfra.com",
      "kuadyhfnejh.meeting-hub.online",
      "kupaywallet.com",
      "kygfkdum.naveicoipg.online",
      "l1tog1iv.naveicoipg.online",
      "l3vywd.easypanel.host",
      "lab99.sbs",
      "lackservice.short.gy",
      "lad.dropfile.online",
      "lam.dropfile.online",
      "latamics.org",
      "lavaandstone.com",
      "lbmwbnbieo.naveicoipg.online",
      "ld-digitaal.com",
      "ldb.rightwidth.dev",
      "leaguehub.net",
      "leavetecs.online",
      "ledgemail.net",
      "ledgep.net",
      "ledgernowone.com",
      "lei.dropfile.online",
      "lenvny.com",
      "letsmeetnow.site",
      "levelframeblog.com",
      "levinpros.com",
      "lianxinxiao.com",
      "license.cloudplus.one",
      "lido.web05zoom.us",
      "lif0.top",
      "lightingmart.co.kr",
      "lightkingstar.com",
      "limesurvey.us",
      "limitlesstechltd.com",
      "limmatcampus.com",
      "link-net.publicvm.com",
      "linkedinservice.us",
      "links.ceinbase.com",
      "linkundlink.de",
      "litslink.online",
      "live-meeting.world",
      "live.bankdost.in",
      "live.econceptual.com",
      "livehirehub.com",
      "livehirepro.com",
      "livehiringhub.com",
      "livehiringpro.com",
      "liveonedrvshare.xyz",
      "livesnotnumbers.org",
      "livetalentpro.com",
      "liwoeson.online-meet.team",
      "liymgdc-aeea9bdbc87b.dropfile.online",
      "liz.dropfile.online",
      "lkpiedozd.naveicoiph.online",
      "llm.docsend.online",
      "llmtraininginference.xyz",
      "lm-career.com",
      "lmaxtrd.com",
      "loading-coinbase.com",
      "location-request-api.short.gy",
      "log-server-lovat.vercel.app",
      "log-writter.vercel.app",
      "log.pricesheet.ink",
      "logger.clob.health",
      "logicfield-app681.vercel.app",
      "logicfield-ext432.vercel.app",
      "login.ceinbase.com",
      "login.ceionbase.com",
      "login.cicoinbase.com",
      "login.cobinase.com",
      "login.cobinbase.com",
      "login.coinbalse.com",
      "login.coinblase.com",
      "login.coinbrase.com",
      "login.coinibrase.com",
      "login.coininbase.com",
      "login.docsend.online",
      "logkit-tau.vercel.app",
      "logn.navermanagecorp.site",
      "logn.noreplya.website",
      "logoeye.net",
      "logosports.net",
      "logs-bin.com",
      "long.waitingfor.cfd",
      "longhash.general-meet.site",
      "longhash.video-meets.online",
      "loopsoft.tech",
      "lostdungeon.openfort.xyz",
      "lrakkiqr.team-meeting.pro",
      "luc.uefa-meeting.com",
      "lucas-gaming.com",
      "luckyguys.cloud",
      "luckyguys.site",
      "lunoxbet77--yes.site",
      "lunoxbet77rain.baby",
      "lunoxbet77rain.online",
      "lunoxbet77rain.store",
      "lunoxbet77speed.site",
      "luosongs.shop",
      "m-omeets.online",
      "m-teams.live",
      "m.contradecapital.com",
      "m.docsend.online",
      "m.dropfile.online",
      "m.energydonate.com",
      "m21gk.wiremockapi.cloud",
      "macamhelp.online",
      "magmow.sourljsourhs.cfd",
      "mail-roundcube.site",
      "mail.aes-secure.net",
      "mail.anifintech.xyz",
      "mail.archblock.careerscreeners.com",
      "mail.big-typl.online",
      "mail.careerscreeners.com",
      "mail.ccuk.edu.ng",
      "mail.crypto-assess.com",
      "mail.digitpotalent.com",
      "mail.dropfile.online",
      "mail.eoinbase.com",
      "mail.gethirednow.org",
      "mail.gladneyocivpsdedinvme4.com",
      "mail.hireviavideo.com",
      "mail.interviewhub.org",
      "mail.kooverly.org",
      "mail.massmedia24.com",
      "mail.naveradmina.tech",
      "mail.navercomf.link",
      "mail.newson-6.com",
      "mail.privymeet.com",
      "mail.reuniao21.admescolassistema.com",
      "mail.support-ledger.net",
      "mail.tesolraria6.admescolassystemf.com",
      "mail.testforhire.com",
      "mail.usengineergroup.com",
      "mail.vyrabank.com",
      "mail.web021zoom.us",
      "mail.willomexcvip.us",
      "mail.wtalents.us",
      "mail1.dropfile.online",
      "mail1.fuchuangonline.com",
      "mail2.dropfile.online",
      "mailcontactteam.online",
      "mailcustomerservice.site",
      "mailer.dropfile.online",
      "mailgate.dropfile.online",
      "mailgw.dropfile.online",
      "mailhelp.online",
      "mailhost.dropfile.online",
      "mailin.dropfile.online",
      "mailmanagecorp.online",
      "mailout.dropfile.online",
      "mailpredicttogether.ink",
      "mailpulsynk.xyz",
      "mailsecurity.email",
      "mailserver.dropfile.online",
      "mailservicecorp.online",
      "mailserviceteam.email",
      "mailtrixauvex.ink",
      "mailx.dropfile.online",
      "main-8i4.pages.dev",
      "main-aptitudespro.pages.dev",
      "main-az8.pages.dev",
      "main.socket.luckyguys.cloud",
      "malicanbur.pro",
      "manage.luckyguys.cloud",
      "manchestercity.work.gd",
      "mante.li",
      "mantis-gewa.technisat-digital.de",
      "mantis.linkundlink.de",
      "mappo-on.life",
      "mariamchurch.com",
      "market.contradecapital.com",
      "markethubuk.com",
      "marketplace-neut52jgl.vercel.sh",
      "marketplacepcai.com",
      "markettrendingcenter.com",
      "massmedia24.com",
      "mat-techcore.org",
      "materialindia.in",
      "matias.uefa-meeting.com",
      "matrix-3.bestleas.ru",
      "matrixane.com",
      "mavenradar.com",
      "maverick-njkr6h6me-sohybes-projects.vercel.app",
      "maxbookpro.com",
      "mayonestore.online",
      "mbafleet.com",
      "mccprod.site",
      "mclearoptical.com",
      "mclland.com",
      "mdown.showprice.xyz",
      "me-c0h.pages.dev",
      "measureaptitudes.com",
      "medcialbiotop.com",
      "mediajourney.digital",
      "mediaprime.team",
      "medincahub.com",
      "meet-client.online",
      "meet-safe.online",
      "meet.caladangroup.xyz",
      "meet.capitalviabtc.com",
      "meet.capitalviabtc.comhollow-jordan-narrow.on-fleek.app",
      "meet.cryptowave.capital",
      "meet.globiscapital.co",
      "meet.globiscapitals.com",
      "meet.hanagroup.video",
      "meet.mythicaigames.foundation",
      "meet.mythicalgames.foundation",
      "meet.openfort-team.xyz",
      "meet.picwe-team.com",
      "meet.re7.network",
      "meet.rwa-team.video",
      "meet.ryzelabs.net",
      "meet.selinicapital.online",
      "meet.selinicapital.xyz",
      "meet.str8fire-team.network",
      "meet.superstatefund.co",
      "meet.synternetlab.com",
      "meet.twosigma-vc.com",
      "meet.ubi-safemeeting.online",
      "meetcentralhub.online",
      "meeting-central.online",
      "meeting-hub.online",
      "meeting-online.site",
      "meeting-pro.online",
      "meeting-zone.online",
      "meeting-zoom-witcam-tests-meet-id-5u83-82f3-8h39-83h9-d9e3.pages.dev",
      "meeting-zoom-witcam-tests-meet-id-5u83-82f3-8h39-83h9-n9e3.pages.dev",
      "meeting.document-content.online",
      "meeting.sellinicapital.com",
      "meeting.work.gd",
      "meetingjoin.us",
      "meetingverse.app",
      "meetingzoom.org",
      "meetup-zone.online",
      "meetwithhealthyh2o.com",
      "memecoinmania.net",
      "memo.ccuk.edu.ng",
      "menchro.pro",
      "merreo.org",
      "message.luckyguys.cloud",
      "metaschool.video-meets.online",
      "metric-analytics.vercel.app",
      "metrics-dashboard-7lgdhdfot-peter1.vercel.app",
      "mettl.app",
      "mettl.us",
      "mettl.xyz",
      "mhf8huuo.naveicoipe.tech",
      "microshare.cloud",
      "microsoft.customizetions.com",
      "micrsofts.tech",
      "migadyn.info",
      "mindfulbiz.link",
      "mingeloem.com",
      "mircosoftclouddocment.com",
      "mirotalk.net",
      "mizuhogroup.uk",
      "mktrending.com",
      "mlischagori.pro",
      "mo-events.online",
      "modelatelier.club",
      "momentumspace.top",
      "momls4ii.naveicoipa.tech",
      "momls4ii.naveicoipc.tech",
      "monade.online",
      "monobyte-code.vercel.app",
      "mopquanta.pro",
      "motionassess.com",
      "mouradvps43hostwin.online",
      "mouradvps8hostwin.online",
      "movis-es.ignorelist.com",
      "moxtern.com",
      "ms.msteam.biz",
      "ms.onlineshares.cloud",
      "msdeliverycontent.com",
      "mse.theworkpc.com",
      "msftoffice.com",
      "msg.luckyguys.cloud",
      "msldkopw.naveicoipe.tech",
      "mssrv.kro.kr",
      "msteam.biz",
      "mta-sts.meetingverse.app",
      "mta-sts.ubi-safemeeting.live",
      "mufg.tokyo",
      "mx.dropfile.online",
      "mx.hiring-you.com",
      "mx2.dropfile.online",
      "my-3d-portfolio-1o6x-j8oobuufq-hadi-arabis-projects.vercel.app",
      "my-3d-portfolio-598x-c8nb68kta-hadi-arabis-projects.vercel.app",
      "my-3d-portfolio-598x-git-main-hadi-arabis-projects.vercel.app",
      "my-c0m.pages.dev",
      "my-n8n-76.duckdns.org",
      "mydealoman.com",
      "myemail.works",
      "mygametoa.com",
      "mypatchauto.com",
      "mypatchfree.com",
      "myproject-f8d.pages.dev",
      "myqr-generator.com",
      "myself.hopto.org",
      "mythicaigames.foundation",
      "mythicalgames.foundation",
      "mythicalgames.hiremodozone.com",
      "mywalletsss.store",
      "mzweb3.bu-zoom.us",
      "mzweb3.er-zoom.us",
      "mzweb3.jp-zoom.com",
      "n34kr3z26f3jzp4ckmwuv5ipqyatumdxhgjgsmucc65jac56khdy5zqd.onion",
      "nadlan-dubai.com",
      "name.ownemail.me",
      "nansenpro.org",
      "natefi.org",
      "nav.cloudcentre.space",
      "nav.naveracom.link",
      "nav.naveradmin06.online",
      "nav.noreplyb.xyz",
      "nav.portalcorpteam.com",
      "navcopcenter.tech",
      "navcorpmanager.site",
      "naveeocorp.xyz",
      "naveicoipa.tech",
      "naveicoipc.tech",
      "naveicoipd.tech",
      "naveicoipe.tech",
      "naveicoipf.online",
      "naveicoipg.online",
      "naveicoiph.online",
      "navenida.live",
      "navenida.site",
      "navenidb.live",
      "navenidb.site",
      "navenidc.live",
      "navenidc.site",
      "navenidd.site",
      "navenide.site",
      "navenidf.site",
      "naveorseccorp.link",
      "naveracom.link",
      "naveradmin01.link",
      "naveranid.link",
      "naveranid.live",
      "naveranid.online",
      "naverbcom.link",
      "naverbnid.live",
      "naverbnid.online",
      "naverccom.link",
      "navercert.live",
      "navercert.online",
      "navercnid.link",
      "navercnid.online",
      "navercoa.store",
      "navercob.store",
      "navercoc.store",
      "navercod.store",
      "navercoe.store",
      "navercoma.link",
      "navercoma.online",
      "navercomb.link",
      "navercomb.online",
      "navercomb.tech",
      "navercomc.link",
      "navercomc.online",
      "navercomc.tech",
      "navercomd.link",
      "navercomd.online",
      "navercome.link",
      "navercome.online",
      "navercome.tech",
      "navercomf.link",
      "navercomf.online",
      "navercomg.link",
      "navercomh.link",
      "navercop.link",
      "navercop.online",
      "navercorp.email",
      "navercorp.live",
      "navercorpl.tech",
      "navercorpr.online",
      "navercorpservice.com",
      "navercorpteam.com",
      "navercscorp.com",
      "naverenid.online",
      "naverfnid.online",
      "navergnid.online",
      "naverhnid.online",
      "naverhost.live",
      "naverinid.com",
      "naverinid.online",
      "naverjnid.online",
      "naverk.myvnc.com",
      "naverlogn.live",
      "navermailcorp.com",
      "navermailmanage.com",
      "navermailservice.com",
      "navermailservice.online",
      "navermailteam.online",
      "navermanage.com",
      "navermanage.live",
      "navermanage.space",
      "navermanageteam.com",
      "navermcorp.com",
      "navernida.link",
      "navernida.online",
      "navernida.tech",
      "navernidb.link",
      "navernidb.online",
      "navernidb.tech",
      "navernidc.link",
      "navernidc.online",
      "navernidc.tech",
      "navernidd.live",
      "navernidd.online",
      "navernide.online",
      "navernidlog.live",
      "navernidmail.com",
      "naverorteam.link",
      "naverreda.xyz",
      "naverredc.xyz",
      "naverredd.xyz",
      "naverrede.xyz",
      "naverredirect.live",
      "naversecurityservice.online",
      "naversecurityteam.com",
      "naverservice.email",
      "naverservice.host",
      "naverservice.link",
      "naverserviceteam.com",
      "naverserviceteam.email",
      "naverteam.live",
      "naverteamcorp.live",
      "navigatorshub.com",
      "navreplya.live",
      "navreplya.online",
      "navreplyb.live",
      "navreplyd.live",
      "navreplye.live",
      "navreplyf.site",
      "navreplyg.site",
      "navreplyh.site",
      "navreplyi.site",
      "navreplyj.site",
      "navreplyk.site",
      "navteamcorp.link",
      "nd6u0.asia",
      "nemesistrade.work",
      "net.lightkingstar.com",
      "network.cloud.doc-shared.linkpc.net",
      "neugrenz.com",
      "neuraldock-app734.vercel.app",
      "neuraldock-ext126.vercel.app",
      "neuralnetworkdatalab.com",
      "new.hirvexo.com",
      "newcoming.cfd",
      "newfromjune.xyz",
      "newsbtctech.com",
      "newson-6.com",
      "next-master-pwg93975l-now-examples.vercel.app",
      "nextera.capital",
      "nextjs-conf-2024-jwokq4e6s.vercel.sh",
      "nextjs-stripe-template.vercel.sh",
      "ngc.private-meet.xyz",
      "ngc.regular-meet.site",
      "ngc.regular-meeting.site",
      "ngc.regular-meeting.team",
      "nhn-games.com",
      "nidbnaver.tech",
      "nidcnaver.tech",
      "niddnaver.tech",
      "nidnavera.online",
      "nidnavere.online",
      "nin.navercop.link",
      "nlog.noreplyb.space",
      "nomanstone.shop",
      "nor-health.xyz",
      "noreplya.xyz",
      "noreplyb.xyz",
      "notaiospuglisi.com",
      "notifypulsynk.ink",
      "novachainhub.com",
      "novaplayer.online",
      "now-examples-3ok9tvp04.zeit.sh",
      "now-examples-5onkajpkx.zeit.sh",
      "now-examples-6pn2lr1ir.zeit.sh",
      "now-examples-7v52p79xj.zeit.sh",
      "now-examples-7voymifaz.zeit.sh",
      "now-examples-7xu2100yl.zeit.sh",
      "now-examples-9zv8bcocf.zeit.sh",
      "now-examples-bd1jwqxdf.zeit.sh",
      "now-examples-crsku8zyd.zeit.sh",
      "now-examples-d8gbron9h.zeit.sh",
      "now-examples-dge5dpeg6.zeit.sh",
      "now-examples-dhev9x619.zeit.sh",
      "now-examples-enprlx5lm.zeit.sh",
      "now-examples-j447nc3bq.zeit.sh",
      "now-examples-nqk5yw2f2.zeit.sh",
      "now-examples-oiceysajh.zeit.sh",
      "now-examples-rnwbzp2r8.zeit.sh",
      "now-tgxhacluff.now.sh",
      "nowurisch.fit",
      "nredial.navermailteam.online",
      "ns.dropfile.online",
      "ns1.big-typl.online",
      "ns1.coponde.com",
      "ns1.dataxo.net",
      "ns1.dropfile.online",
      "ns1.salessgroupss.live",
      "ns2.bizsupport365.com",
      "ns2.contentverge.com",
      "ns2.dataxo.net",
      "ns2.dropfile.online",
      "ns2.salessgroupss.live",
      "ns2.videotalks.online",
      "nv-onlines.info",
      "nvidia-cloud.online",
      "nvidia-drive.cloud",
      "nvidia-release.cloud",
      "nvidia-release.org",
      "nvidia-release.us",
      "nvidiadriver.net",
      "nvidiasdk.fly.dev",
      "nvrcopa.link",
      "nvrcopb.link",
      "nvrcopc.link",
      "nvrcope.site",
      "nvrcopf.site",
      "nvricop.online",
      "nvrjcop.online",
      "nxlog.tech",
      "ny.silvergatehr.com",
      "nzssdm.com",
      "o1xyc6.easypanel.host",
      "octo-manage.net",
      "offerings.cloud",
      "office-theme.com",
      "office.microsoft.customizetions.com",
      "officezoom.us",
      "official.googleproduct.org",
      "ofo-home.top",
      "og-examples-4gnvoge9a.vercel.sh",
      "oidc-issuer-8pba9g3rc.vercel.sh",
      "oilycargo.com",
      "ok.preconnection.online",
      "okx.hiringinterview360.com",
      "okx.internal-meeting.online",
      "okx.talenthiring360.com",
      "okx.video-meet.online",
      "okx.video-meeting.team",
      "olaestudiocreativo.com",
      "olidhealth.com",
      "ollie.videotalks.online",
      "olsnvolqwe.naveicoipg.online",
      "on-global.xyz",
      "oncehub.co",
      "onchainassess.com",
      "onchainhiringtool.com",
      "onchainmodeltraining.com",
      "ondofinance.tech",
      "one.microshare.cloud",
      "onebalancelab.com",
      "onedocshare.com",
      "onedrive.azure-defender.cloud",
      "onehire.pro",
      "onelao.line.pm",
      "oneweb-host.com",
      "online-globaleurope.com",
      "online-meet.team",
      "online-meet.xyz",
      "online-meeting.co",
      "online-meeting.community",
      "online-meeting.pro",
      "online-meeting.site",
      "online-meeting.social",
      "online-meeting.team",
      "online-meeting.xyz",
      "online-meets.online",
      "online-meets.pro",
      "online-meets.site",
      "online-meets.xyz",
      "online-processing.online",
      "online-protection.cloud",
      "online-video-services.site",
      "online.advisornetic.com",
      "online.betterevaluation.us",
      "online.evalium-expertises.us",
      "online.prontoquiz.org",
      "online.rev-prot.org",
      "online.spiralboard.com",
      "online.stdheritb.com",
      "online.weboink.com",
      "online.zitlex.com",
      "onlinecloud.cloud",
      "onlinedoc.dev",
      "onlinedocview.biz",
      "onlinemeet.pro",
      "onlinesearchlic.com",
      "onlineshares.cloud",
      "onlinestockwatch.net",
      "onlynova.org",
      "onoplainai.ink",
      "onoplanoai.ink",
      "open-sc.xyz",
      "open-src.org",
      "open.googlesheetpage.org",
      "open.onlinecloud.cloud",
      "openfort-team.xyz",
      "openfort.businessmeet.xyz",
      "openfort.video",
      "openfort.xyz",
      "openmatrix-app882.vercel.app",
      "openmatrix-ext539.vercel.app",
      "openmodules.org",
      "opensend.linkpc.net",
      "opensend.online",
      "opsonew3org.sg",
      "optixauvex.us",
      "oracle-v1-beta.vercel.app",
      "orangecake.work.gd",
      "orbitstack-app318.vercel.app",
      "orbitstack-ext592.vercel.app",
      "origin.blackleopard.world",
      "ourhome.o-r.kr",
      "ovcloud.online",
      "ownemail.me",
      "oxdo.xyz",
      "palgong-cc.co.kr",
      "pancakeswap.studio",
      "panda.ourhome.o-r.kr",
      "panelcvedata.com",
      "pannel-get-data.us",
      "panteracapital.ventures",
      "papers0urce.com",
      "paradigm.hiremodozone.com",
      "parallaxdigital.online",
      "parallel.assesspro360.com",
      "parallel.eskillora.com",
      "parallel.eskillprov.com",
      "parallel.skillview360.com",
      "partner.hartmanmcapital.com",
      "partners.boolnetwork.xyz",
      "patch.levinpros.com",
      "patch.zynoracreative.com",
      "patchpal.pro",
      "pathsummitx.com",
      "pathsummitx.pages.dev",
      "paxos-apply.com",
      "paxos-video-interview.com",
      "paxos-video-interviews.com",
      "paxos-video-recording.com",
      "paxos-video-talk.com",
      "paxos.video-hiring.com",
      "paxosassessments.com",
      "paxosfuture.com",
      "paxosinterview.com",
      "paxosvideointerviewassesment.com",
      "pay.aihealthchains.com",
      "pay.resumegenie.us",
      "paycount.webbs-information.login.udaviemayas.com",
      "payload-beta-lemon.vercel.app",
      "payloadrpc.com",
      "pd.linkpc.net",
      "pdf-candy.com",
      "pdf.cisco-webex.online",
      "pdftool25.com",
      "pegasusco.net",
      "peninsulaparking-5ubyvdtqb-om-sanghvis-projects.vercel.app",
      "pepeartly-foundry.net",
      "pesncv.short.gy",
      "phantom-phantomwallet.us",
      "phantomwallet-us.us",
      "phubauto.space",
      "picktime.live",
      "picolink-jorisjgriffioen.vercel.app",
      "picwe-team.com",
      "pilotview.cloud",
      "pinkgoat.com",
      "pitisalot.site",
      "pkginstall.net",
      "playingwithcodex-git-codex-implement-en-954ce6-shnurps-projects.vercel.app",
      "playskatepark.com",
      "plexisco.com",
      "plugksa.com",
      "plushtoytumama.com",
      "pngconvert-p0kl4fodi-jhones-projects-f8ddbcbe.vercel.app",
      "pointdnt.com",
      "polblxpnl.space",
      "policyupdates.info",
      "polymarket-clob.com",
      "pop.dataxo.net",
      "pop.dropfile.online",
      "pop3.dropfile.online",
      "portal.ccuk.edu.ng",
      "portal.gfinanzen.net",
      "portalcorpteam.com",
      "portfolio-naylinmyats-projects.vercel.app",
      "post.dropfile.online",
      "postedviral.com",
      "postmaster.dropfile.online",
      "postprocesser.com",
      "poweem.com",
      "powerwize.org",
      "powerwize.pages.dev",
      "prajeshpatel.com",
      "pre-screen.net",
      "pre-screen.online",
      "pre-zoom.us",
      "precisioncoderss.com",
      "precommit.vercel.app",
      "preconnection.online",
      "predictcareertogether.space",
      "predicttocareer.space",
      "predicttogerecruit.store",
      "predicttogether.ink",
      "predicttogetherrecruit.store",
      "prehighiq.com",
      "prehireiq.com",
      "presentations.life",
      "presentonline.xyz",
      "previewaccess-doc.online",
      "price-oracle-v2.vercel.app",
      "pricesheet.ink",
      "primestacks.org",
      "primevector-app920.vercel.app",
      "primevector-ext483.vercel.app",
      "primez.online",
      "privacy.hopto.org",
      "privacysign.org",
      "private-kurier.com",
      "private-meet.online",
      "private-meet.team",
      "private-meet.xyz",
      "private-meeting.online",
      "private-meeting.site",
      "private-meeting.xyz",
      "privatemake.bounceme.net",
      "privatenetwork.online",
      "privatepool.store",
      "privatework.buzz",
      "privymeet.com",
      "process-log-update.vercel.app",
      "process-log.vercel.app",
      "product.onlinedoc.dev",
      "professionalsnapshot.com",
      "professiondesc.com",
      "proficiencycert.com",
      "proficientmint.com",
      "proficientmint.pages.dev",
      "prohirevideo.com",
      "pronoia-kkeeland-4878s-projects.vercel.app",
      "prontoquiz.org",
      "propertys-shop.com",
      "prosec.ink",
      "protect.antcapital.us",
      "protect.azure-drive.com",
      "protection-service.cloud",
      "protectli.online",
      "protectoffice.club",
      "provevidskillcheck.com",
      "provideodrivers.cloud",
      "publishapp.co",
      "pulsynk.org",
      "purewatertokyo.com",
      "purplebear.com",
      "pv5pnwlx.naveicoipg.online",
      "pypilibrary.com",
      "pypistorage.com",
      "pyra-docs-git-main.vercel.sh",
      "pyra-docs.vercel.sh",
      "qeiukdemo.docsend.store",
      "qogngnslel.naveicoipg.online",
      "qooqle.download",
      "quant-screen.com",
      "quantapath-app914.vercel.app",
      "quantapath-ext275.vercel.app",
      "quantumnodespro.com",
      "queryyard.com",
      "questionic.com",
      "questionnairehq.com",
      "quick-view.org",
      "quickassessio.com",
      "quickcamfix.online",
      "quickdriverupdate.online",
      "quickhire360.com",
      "quickhiretest.com",
      "quickinterview360.com",
      "quickproassess.com",
      "quickskill-review.com",
      "quickskillup.us",
      "quickvidintro.com",
      "quiz-nest.com",
      "quizpathway.com",
      "quizterview.com",
      "quonexa.com",
      "qwary.org",
      "r4liyq.easypanel.host",
      "rabbywallet-app.us",
      "racksuphde.xyz",
      "racondog.shop",
      "radarsync.pro",
      "rapiddrivers.cloud",
      "rapisigns.com",
      "rastreojerezexpress.com",
      "raxvatange.ink",
      "rbluckyguys.com",
      "rdweb.luckyguys.cloud",
      "re7.network",
      "readonlymemory.xyz",
      "real.unbelievableresult.store",
      "rebelthumb.net",
      "rec.vid-crypto-assess.com",
      "recent.bico-news.blog",
      "recroya.com",
      "recruit.vervoe.us",
      "recruitboard-base.pages.dev",
      "recruitboard.video",
      "recruiterlogon.company",
      "recruitptogether.xyz",
      "recruitvex.us",
      "red.naveradmin07.site",
      "red.nidnavere.online",
      "reddish-dawn.store",
      "redirect-smartwallet.com",
      "regioncheck.net",
      "regioncheck.xyz",
      "register-meeting.pages.dev",
      "regular-meet.online",
      "regular-meet.site",
      "regular-meet.team",
      "regular-meeting.online",
      "regular-meeting.pro",
      "regular-meeting.site",
      "regular-meeting.team",
      "regular-meeting.xyz",
      "relay.dropfile.online",
      "release-driver.online",
      "release-drivers.online",
      "releasedrive.live",
      "reliableservers.org",
      "remote.dropfile.online",
      "remoteproweb.cfd",
      "replaydreary.com",
      "repohost.online",
      "republic.biz-zoom.us",
      "republic.bu-zoom.us",
      "republic.cr-zoom.us",
      "republic.er-zoom.us",
      "republic.extrazoom.us",
      "republic.innerteams.us",
      "republic.officezoom.us",
      "republic.pre-zoom.us",
      "republic.usweb-zoom.us",
      "republic.web021zoom.us",
      "rest-icon-configure.vercel.app",
      "rest-icon-handler.store",
      "rest-icon-helper.store",
      "rest-icon-moduler.vercel.app",
      "rest-icon-provider.link",
      "rest-icon-provider.net",
      "resumegenie.us",
      "retailpackagingpartner.xyz",
      "retrots.net",
      "reuss-works.com",
      "rev-prot.org",
      "rewarded.fi",
      "rgedist.com",
      "ric-camid.re.kr",
      "riccardo.uefa-meeting.com",
      "rightwidth.dev",
      "ripple.quizterview.com",
      "ripple.speakure.com",
      "robinhood.eskillfolio.com",
      "robinhood.eskillpilot.com",
      "robinhood.eskillprof.com",
      "robinhood.evalvidz.com",
      "robinhood.interview.org",
      "robinhood.intervwolf.com",
      "robinhood.intro-crypto-assess.com",
      "robinhood.quickskill-review.com",
      "robonowlife.com",
      "rocket-resume.vercel.app",
      "roleassessor.com",
      "rolefit360.com",
      "rolematches.com",
      "rolevia.us",
      "rolltojoin.com",
      "ronaldo-nftprojects.shop",
      "room-connect.online",
      "room-meeting.xyz",
      "roomconnect.online",
      "rpc-amoy.polygon.technology",
      "rtupdates.net",
      "runningcloudx.com",
      "rustdesk.luckyguys.cloud",
      "rwa-team.video",
      "rwa.business-zoom.us",
      "rwa.businessmeet.xyz",
      "rxpz7z2yi8.naveicoiph.online",
      "ryze.privymeet.com",
      "ryzelabs.net",
      "ryzelabs.private-meeting.site",
      "saasbrief.vip",
      "sabrpartner.com",
      "sadborgroup.site",
      "safe-meeting.online",
      "safe-meeting.site",
      "safe.doc-share.cloud",
      "safefinanceltd.com",
      "safemeeting.online",
      "sakuramedia-git-cognito-sakura-media.vercel.app",
      "salessgroupss.live",
      "salmonrabbit.com",
      "salt1ending.com",
      "sammy.uefa-meeting.com",
      "sandwich-factory.buzz",
      "sap.misapor.ch",
      "sapia.us",
      "savannahpos.co.ke",
      "sbackservice.com",
      "scoret.net",
      "screenquestion.com",
      "screenquestions.com",
      "sctemarkets.com",
      "sdhsdfhsd.com",
      "sea-shared-10.hostwindsdns.com",
      "sec.naveralert.link",
      "secfilecert.com",
      "secure.azure-protect.cloud",
      "secure.azure-protection.cloud",
      "secure.azure-protection.online",
      "secure.dropfile.online",
      "secure.greendottb.com",
      "secure.greendtb.com",
      "secure.paycount.webbs-information.login.udaviemayas.com",
      "securemypc.xyz",
      "secureshares.online",
      "selfhonda.com",
      "selinicapital.online",
      "selinicapital.xyz",
      "sellinicapital.com",
      "server.dropfile.online",
      "server.pre-screen.net",
      "serversnoti.com",
      "sfdfsdf.icareerc.com",
      "share-meeting.online",
      "share.1drvmicrosoft.com",
      "share.bloomcloud.org",
      "share.cloudmgmt.org",
      "share.devprocloud.com",
      "share.fsdriveshare.org",
      "share.googlefiledrive.com",
      "share.onedrvfile.site",
      "share.prosec.ink",
      "share.stablemarket.org",
      "sharebusiness.xyz",
      "shared-link.line.pm",
      "shared.box-docsend.cloud",
      "shared.box-docsend.online",
      "shared.doc-send.cloud",
      "shared.drop-box.cloud",
      "shared.dropbox-docsend.cloud",
      "shared.dropbox-docsend.online",
      "sharefilesdocment.com",
      "sharemanage.elwoodasset.xyz",
      "sharesvr.net",
      "shconstmarket.com",
      "sheet.tresordocs.com",
      "shieldlabit.vip",
      "shimacapital.abilityscan360.com",
      "shimacapital.easyhiringtool.com",
      "ship-ai-2025-gguq0jdwo.vercel.sh",
      "shop.newsbtctech.com",
      "shopandtravelusa.com",
      "shopapppro.com",
      "shopapptech.com",
      "shopweblive.com",
      "shopwebstudio.com",
      "showmanroast.com",
      "shrill-breeze-e0f.grace-ayodele.workers.dev",
      "sicherdigitx.com",
      "sictradingc.com",
      "sightalent.org",
      "sightalent.pages.dev",
      "signalbase-app845.vercel.app",
      "signalbase-ext369.vercel.app",
      "signot.digital",
      "signum.group-meeting.pro",
      "signverydn.sharebusiness.xyz",
      "sihlquaiinst.com",
      "silencio.webzoom.video",
      "silserhafen.com",
      "silvergatehr.com",
      "silvermine.web05zoom.us",
      "silverrabbit.wegrowup.us",
      "singlelink.work.gd",
      "site-git-fix-issue-330-driveclub.vercel.app",
      "situsslotdepo10k.org",
      "skalelabs.as-zoom.us",
      "skalelabs.bu-zoom.us",
      "skalelabs.cr-zoom.us",
      "skalelabs.en-zoom.us",
      "skalelabs.mediaprime.team",
      "skalelabs.pre-zoom.us",
      "skalelabs.usweb-zoom.us",
      "skill-bridges.com",
      "skill-share.org",
      "skill.vidassessmentmaster.com",
      "skill.vidcruiterinterview.com",
      "skill.vidcruitermaster.com",
      "skillcheck.pro",
      "skillence360.com",
      "skillhiretrack.com",
      "skilllens360.com",
      "skillmasteryhub.org",
      "skillmasteryhub.us",
      "skillpilothq.com",
      "skillprooflab.com",
      "skillprops.com",
      "skillquestion.com",
      "skillquestions.com",
      "skillroar.com",
      "skillsquestions.com",
      "skillstandard360.com",
      "skilluplifestylehub.com",
      "skillview360.com",
      "skillvisions.com",
      "sktelecom.help",
      "sky-meeting.com",
      "skyboxdrive.cloud",
      "skypredict.org",
      "sloneek.us",
      "small-forest-2b0b.workers.dev",
      "smart-contracts.blog",
      "smartaudpor.com",
      "smartchecker.online",
      "smartdriverfix.cloud",
      "smartdriverfixer.com",
      "smartdrvupdate.online",
      "smarthiretop.online",
      "smartmanagerex.com",
      "smartonboardingportal.com",
      "smartscreenfilter.com",
      "smartvideoassess.com",
      "smartvideohire.com",
      "smartvirtual-assessment.com",
      "smartwalletfinder.com",
      "smbcgroup.uk",
      "smilekeepers.co",
      "smrtassess.com",
      "smtp.dropfile.online",
      "smtp1.dropfile.online",
      "smtp2.dropfile.online",
      "smtpauth.dropfile.online",
      "smtps.dropfile.online",
      "snap-screening.com",
      "soar.vip",
      "soc-log.vercel.app",
      "soccerlab.io",
      "socket.decentralizeddataexchangeinferencelayer.com",
      "socket.luckyguys.cloud",
      "soft-dev.online",
      "softcaredesk.pro",
      "softdebugnest.pro",
      "softechsoftwares.co.ke",
      "softglide.co",
      "softmedic.pro",
      "softshare.online",
      "softsquashers.pro",
      "softwareupdate.online",
      "soladify.fun",
      "solana.validator.blog",
      "solidicai.com",
      "solulab.hiremodozone.com",
      "solutions-subdomains-auth.vercel.sh",
      "song.th",
      "sourljsourhs.cfd",
      "sp-plus-api.mccprod.site",
      "spam.dropfile.online",
      "sparkforge-app790.vercel.app",
      "sparkforge-ext518.vercel.app",
      "speakure.com",
      "speeduneasy.com",
      "speedvice.com",
      "speedvice.pages.dev",
      "spiralboard.com",
      "sportsblogweb.com",
      "srv1283254.hstgr.cloud",
      "srv587993.hstgr.cloud",
      "srv755058.hstgr.cloud",
      "srv833039.hstgr.cloud",
      "sslsharecloud.net",
      "sssaaaafdafa.top",
      "stablehouses.info",
      "stablemarket.org",
      "staff.ccuk.edu.ng",
      "staffingedges.com",
      "stafnex.com",
      "stage-framework.recruitboard.video",
      "stage-yuga.recruitboard.video",
      "stage.bizmeet.online",
      "stage.bizmeet.org",
      "stage.bizmeet.pro",
      "stage.contradecapital.com",
      "stagging-apiresources.caspiansr.kz",
      "staging.alwayswelcome.online",
      "staging.chrome-browser.cloud",
      "staging.docsend.site",
      "staging.docsend.store",
      "staging.dropfile.online",
      "staging.meeting-zone.online",
      "stake.assesscrew.com",
      "stake.hiremodozone.com",
      "stake.staffingedges.com",
      "stake.talentedstarmodo.com",
      "stake.trueskilltest.com",
      "standard-ai.org",
      "star-bucks.autos",
      "star-bucks.beauty",
      "star-bucks.boats",
      "star-bucks.bond",
      "star-bucks.cam",
      "star-bucks.cfd",
      "star-bucks.click",
      "star-bucks.com",
      "star-bucks.fun",
      "star-bucks.gay",
      "star-bucks.guru",
      "star-bucks.homes",
      "star-bucks.lol",
      "star-bucks.makeup",
      "star-bucks.mom",
      "star-bucks.motorcycles",
      "star-bucks.net",
      "star-bucks.pics",
      "star-bucks.quest",
      "star-bucks.rest",
      "star-bucks.sbs",
      "star-bucks.shop",
      "star-bucks.skin",
      "star-bucks.store",
      "star-bucks.tattoo",
      "star-bucks.today",
      "star-bucks.top",
      "star-bucks.xyz",
      "star-bucks.yachts",
      "starbocks.shop",
      "starbocks.yachts",
      "starbuck-coffee.cfd",
      "starbuckex.beauty",
      "starbucks-corp.art",
      "starbucks-goodsitem.cfd",
      "starbucks-greenapron.lol",
      "starbucks-greenapron.rest",
      "starbucks-greenapronnft.click",
      "starbucks-greenaprons.cfd",
      "starbucks-newtech.bond",
      "starbucks-newtech.cfd",
      "starbucks-odyssey.shop",
      "starbucks-services.cyou",
      "starbucks-support.store",
      "starbuckscenter.autos",
      "starbuckscenter.beauty",
      "starbuckscenter.boats",
      "starbuckscenter.bond",
      "starbuckscenter.cam",
      "starbuckscenter.cfd",
      "starbuckscenter.click",
      "starbuckscenter.com",
      "starbuckscenter.fun",
      "starbuckscenter.gay",
      "starbuckscenter.guru",
      "starbuckscenter.homes",
      "starbuckscenter.life",
      "starbuckscenter.lol",
      "starbuckscenter.makeup",
      "starbuckscenter.mom",
      "starbuckscenter.motorcycles",
      "starbuckscenter.net",
      "starbuckscenter.pics",
      "starbuckscenter.quest",
      "starbuckscenter.rest",
      "starbuckscenter.sbs",
      "starbuckscenter.shop",
      "starbuckscenter.skin",
      "starbuckscenter.store",
      "starbuckscenter.tattoo",
      "starbuckscenter.today",
      "starbuckscenter.top",
      "starbuckscenter.xyz",
      "starbuckscenter.yachts",
      "starbucksevent.autos",
      "starbucksevent.beauty",
      "starbucksevent.boats",
      "starbucksevent.bond",
      "starbucksevent.cam",
      "starbucksevent.cfd",
      "starbucksevent.click",
      "starbucksevent.com",
      "starbucksevent.fun",
      "starbucksevent.gay",
      "starbucksevent.guru",
      "starbucksevent.homes",
      "starbucksevent.life",
      "starbucksevent.lol",
      "starbucksevent.makeup",
      "starbucksevent.mom",
      "starbucksevent.motorcycles",
      "starbucksevent.net",
      "starbucksevent.quest",
      "starbucksevent.rest",
      "starbucksevent.sbs",
      "starbucksevent.shop",
      "starbucksevent.skin",
      "starbucksevent.store",
      "starbucksevent.tattoo",
      "starbucksevent.today",
      "starbucksevent.top",
      "starbucksevent.xyz",
      "starbucksevent.yachts",
      "starbucksfirst.icu",
      "starbucksgoodsnft.click",
      "starbucksgreenapron.bond",
      "starbucksnft-service.xyz",
      "starbucksnftservice.homes",
      "starbucksservice.homes",
      "starbucls.top",
      "starbucls.xyz",
      "starglowventures.com",
      "statcounters.net",
      "stdheritb.com",
      "stn.equisphire.com",
      "stockdata.tech",
      "stockinfo.io",
      "stocksindex.org",
      "stocksitem.org",
      "stockslab.org",
      "str8fire-team.network",
      "str8fire.businessmeet.xyz",
      "strainservice.com",
      "stratosshipping.com",
      "stream-football.org",
      "stress.antiviruscheck.site",
      "studyholic.co.kr",
      "su05web.us",
      "sub-recruitboard.pages.dev",
      "sub.naverbcom.link",
      "successfulconnection.linkpc.net",
      "sumy.fun",
      "sunbutterfly.meme",
      "sunflowbikes.com",
      "sunlotustech.com",
      "suntcijm.mouradvps43hostwin.online",
      "superstarscanner.com",
      "superstate-team.xyz",
      "superstatefund.co",
      "support-ledger.net",
      "support-mac.online",
      "support-pishgam.site",
      "support.cisco-webex.online",
      "support.cloudstore.business",
      "support.cryptowave.capital",
      "support.docsend.site",
      "support.echelonfnd.io",
      "support.general-meet.site",
      "support.general-meeting.team",
      "support.group-meeting.online",
      "support.group-meeting.pro",
      "support.group-meeting.team",
      "support.internal-meeting.online",
      "support.internal-meeting.site",
      "support.meetcentralhub.online",
      "support.meeting-zone.online",
      "support.online-meet.xyz",
      "support.pilotview.cloud",
      "support.private-meeting.online",
      "support.privymeet.com",
      "support.regular-meet.online",
      "support.regular-meet.team",
      "support.safe-meeting.online",
      "support.skyboxdrive.cloud",
      "support.syncmeet.online",
      "support.team-meet.online",
      "support.team-meeting.xyz",
      "support.trustmeeting.live",
      "support.trustmeeting.online",
      "support.ubi-safemeeting.live",
      "support.ubi-safemeeting.online",
      "support.video-meet.online",
      "support.video-meet.site",
      "support.video-meet.team",
      "support.video-meet.xyz",
      "support.video-meeting.online",
      "support.video-meeting.team",
      "support.video-meeting.xyz",
      "support.video-meets.online",
      "support.video-meets.site",
      "support.videotalks.online",
      "support.virtual-collab.online",
      "support.waventic.com",
      "survelis.com",
      "survicate.us",
      "swissborg.blog",
      "syncmeet.online",
      "synternetlab.com",
      "sys.antiviruscheck.store",
      "sys.updatecheck.site",
      "sysdoctor.org",
      "system.updatecheck.store",
      "systemupdate.site",
      "systemupdate.store",
      "szynergy.org",
      "tableditermanaging.pro",
      "tailora.org",
      "tailora.pages.dev",
      "tailwind-version-4.vercel.app",
      "tailwind-version-four.vercel.app",
      "talent-hiring-step.com",
      "talent-hiringstep.com",
      "talent-hiringtalk.com",
      "talent-telusdigital.com",
      "talent.willo-interview.us",
      "talentacq.pro",
      "talentassesspro.com",
      "talentcatchingtool360.com",
      "talentcheck.pro",
      "talentcompetency.com",
      "talentedstarmodo.com",
      "talentelevate360.com",
      "talentestpro.com",
      "talentevaluate.com",
      "talentgauge360.com",
      "talenthireflow.com",
      "talenthiring360.com",
      "talenthiringexpert.com",
      "talenthiringtool.com",
      "talentmatchingtools.com",
      "talentmatchingtools.net",
      "talentmonitoringtool.com",
      "talentnexhr.ink",
      "talentpreview360.com",
      "talentradar360.com",
      "talentscreeningtool.com",
      "talentsnaptest.com",
      "talenttracker.us",
      "talentverge360.com",
      "talentvideopro.com",
      "talentvidintro.com",
      "talentview360.com",
      "tales.dliklone.online",
      "talesseries.com",
      "talynexistest.com",
      "task-hrec.vercel.app",
      "taskhandler-taupe.vercel.app",
      "tasksettingsnew.vercel.app",
      "tazmim.com",
      "tdlgzoom.com",
      "teachersrecruitmentboard.in",
      "team-meet.online",
      "team-meet.xyz",
      "team-meeting.net",
      "team-meeting.pro",
      "team-meeting.xyz",
      "team.business.in",
      "team.msteam.biz",
      "teampulsynk.team",
      "teams-live.cam",
      "teams-live.work",
      "teams-meet.co",
      "teams-meeting.in",
      "teams-meets.com",
      "teams-meets.online",
      "teams-meets.us.com",
      "teams-supports.online",
      "tech.linkpc.net",
      "tech.micrsofts.com",
      "tech.micrsofts.tech",
      "techaipactch.com",
      "techdesignshop.com",
      "technical-support.group-meeting.team",
      "technical-support.internal-meeting.online",
      "technical-support.safe-meeting.online",
      "technical-support.team-meet.online",
      "technical-support.video-meet.online",
      "technical-support.virtual-collab.online",
      "tecmlny.com",
      "tecsol.top",
      "teenbeanjs.com",
      "telloo.io",
      "tellus.evalonboard.com",
      "tenspick.shop",
      "tesolraria6.admescolassystemf.com",
      "test-assesment-kk37hvtef-mahs-projects-03bae667.vercel.app",
      "test-assesment-self.vercel.app",
      "test-wolf.com",
      "test.ccuk.edu.ng",
      "test.theplugmag.com",
      "test29292.com",
      "testforhire.com",
      "testserver-l0hpvjw5b.vercel.sh",
      "testwolf-assessment.com",
      "testwolfpro.com",
      "tether.trueskilltest.com",
      "tetrismic.vercel.app",
      "thaibit.io",
      "theapp.tobeht.com",
      "theboxart.xyz",
      "thecloudnet.org",
      "thediversityandinclusionteam.com",
      "theeffectiveengineeringleader.com",
      "thefifodoc.online",
      "thehubservice.cloud",
      "thelightstower.com",
      "theplugc.com",
      "theplugny.com",
      "theta.apply-camera.com",
      "theta.evalonboard.com",
      "theworldofluck.site",
      "thopywork.vercel.app",
      "thorequities.eskillence.com",
      "thorequities.skillence360.com",
      "threegood.cc",
      "tiena.einei.line.pm",
      "tiktoks.bio",
      "toa.mygametoa.com",
      "toadegged.com",
      "tob.mygametoa.com",
      "tobeht.com",
      "tofysz6a.naveicoipa.tech",
      "tofysz6a.naveicoipc.tech",
      "togetherhire.fun",
      "tokenais.com",
      "tokentracking.info",
      "tolerancemodernincruiter.com",
      "tom.uefa-meeting.com",
      "tonses.dliklone.online",
      "tonywangtech.com",
      "toolshare.cloud",
      "top-king.store",
      "topinnomastertech.com",
      "toptalentassess.com",
      "toptiercrew.com",
      "totalmateria.net",
      "toysbagonline.com",
      "tp0rw6ie.naveicoipg.online",
      "tpddata.com",
      "tptf.cloud",
      "tptf.ltd",
      "track.trandytics.com",
      "tracking.toptiercrew.com",
      "tradeboard.mefound.com",
      "tradeinsight360.com",
      "trailads.net",
      "trandytics.com",
      "transactions.publicvm.com",
      "transferwiser.io",
      "transplugin.io",
      "trappuzzle.com",
      "trashcrease.com",
      "treelifeups.com",
      "trendofferstore.com",
      "tresordocs.com",
      "trixauvex.org",
      "trixauvexnet.ink",
      "trollinguneaten.org",
      "troubleshoot.group-meeting.team",
      "troubleshoot.internal-meeting.online",
      "troubleshoot.team-meeting.xyz",
      "truehimalayahikes.com",
      "trueskilltest.com",
      "trustmeeting.live",
      "trustmeeting.online",
      "trustpdfs.com",
      "truthwillsetyoufree.online",
      "tsukan.online",
      "tudiapalmsprings.com",
      "turacodi.com",
      "turkishmob.com",
      "twlekqnwl.naveicoipg.online",
      "twosigma-vc.com",
      "tyidrtu.naveicoipe.tech",
      "uaaidmission.org",
      "ubi-safemeeting.live",
      "ubi-safemeeting.online",
      "ubisoft.group-meeting.online",
      "ubisoft.internal-meeting.online",
      "ubisoft.safe-meeting.online",
      "ubisoft.trustmeeting.live",
      "udaviemayas.com",
      "uefa-meeting.com",
      "ugethired360.com",
      "uk-link84.luckylink.top",
      "uk03web.us",
      "uk06web.us",
      "uk07web.us",
      "uktyukb.naveicoipe.tech",
      "ukweb05.us",
      "ukweb06.us",
      "ukweb07.us",
      "un-call.services",
      "unbelievableresult.site",
      "unbelievableresult.store",
      "unibotechreports.com",
      "unimeta.biz",
      "unioncrypto.vip",
      "unionminerscorp.com",
      "uniswap.assessforhire.com",
      "uniswap.prehireiq.com",
      "uniswap.quizterview.com",
      "uniswap.speakure.com",
      "unmannedsystemstechnology.org",
      "up.digifincx.com",
      "up.myemail.works",
      "update.jquerycloud.io",
      "update.koover.org",
      "update.toythieves.com",
      "updatecall.live",
      "updatecheck.publicvm.com",
      "updatecheck.site",
      "updatecheck.store",
      "updatemycam.online",
      "updatewebcamnow.live",
      "upload.rightwidth.dev",
      "upport.docsend.site",
      "upstash-docs-upstash.vercel.app",
      "urm1o6h0.naveicoipg.online",
      "us.evalium-expertises.us",
      "us.meeting.document-content.online",
      "us04office.us",
      "us04we.us",
      "us10web-zoom-usj72134381229pwdbnyi1fscht4pswnd37hhluqrkq5yjd.starspirit.org",
      "us13.yayachuhai.top",
      "usconsultinghub.blog",
      "usconsultinghub.cloud",
      "usengineergroup.com",
      "ushrt.us",
      "usinetechnologies.com",
      "usncet.org",
      "usweb-zoom.us",
      "usweb02.us",
      "uxicai.com",
      "uzzmuqwv.naveicoipa.tech",
      "uzzmuqwv.naveicoipc.tech",
      "v0-frame-render-engine-4vo9x0236.vercel.sh",
      "v0-frame-render-engine-ayk1sm54x.vercel.sh",
      "v0-frame-render-engine-git-iansbrash-promo-page.vercel.sh",
      "v0-frame-render-engine-git-ido-01-16-xwol1.vercel.sh",
      "v0-frame-render-engine-git-ma-fix-integration-layout.vercel.sh",
      "v0-frame-render-engine-git-max-01-15-update.vercel.sh",
      "v0-frame-render-engine-git-tz-chatzipupload0115.vercel.sh",
      "v0-frame.vercel.sh",
      "v0-vercel-webhook-automation-fp90rr464.vercel.sh",
      "v2ray.gelithagithmal.workers.dev",
      "vajrasilverstores.com",
      "validator.blog",
      "validator.uno",
      "valorecuiting.online",
      "varietyjob.com",
      "vaultchainblockpulse.com",
      "vblimitedgroup.com",
      "vcamdriverupdate.cloud",
      "vcamfixer.online",
      "vcamsupport.cloud",
      "vector-foundry.com",
      "veeki.org",
      "vek.equisphire.com",
      "venceos.pages.dev",
      "vercel-academy-lhaqud9fg.vercel.sh",
      "vercel-agent-bvszyn2w5.vercel.sh",
      "vercel-agent-code-review-2l2w1466s.vercel.sh",
      "vercel-agent-code-review-f2jv6t9a5.vercel.sh",
      "vercel-alerts-n4q8h9gnw.vercel.sh",
      "vercel-dash-3cr0qiedg.vercel.sh",
      "vercel-dash-hw9r7f35s.vercel.sh",
      "vercel-dash-keh9xf79l.vercel.sh",
      "vercel-dashboard-7epa04yyk.vercel.sh",
      "vercel-dashboard-nc6g2xtna.vercel.sh",
      "vercel-dashboard-q42jpk16z.vercel.sh",
      "vercel-docs-proxy-5ovwbe3iw.vercel.sh",
      "vercel-docs-proxy-5xb0awnoq.vercel.sh",
      "vercel-marketing-gkaxe8vec.vercel.sh",
      "vercel-marketing-n6pm8fju2.vercel.sh",
      "vercel-marketing-obv54w0jf.vercel.sh",
      "vercel-ship-f9ny6po6t.vercel.sh",
      "vercel-site-1ddnejsfa.vercel.sh",
      "vercel-site-33i0im1gu.vercel.sh",
      "vercel-site-git-main.vercel.sh",
      "vercel-site-gow03hmpw.vercel.sh",
      "vercel-site-ivfjv5dp5.vercel.sh",
      "vercel-site-r50pzdsjo.vercel.sh",
      "vercel-site.vercel.sh",
      "vercel-tmdb-wangsy1007s-projects.vercel.app",
      "verceljs-kappa.vercel.app",
      "vereoy.com",
      "vereoy.pages.dev",
      "verification-blockfi.com",
      "verify.azure-protect.online",
      "verifydocument.online",
      "vern.thehubservice.cloud",
      "versus-dash.us",
      "versus-x.us",
      "versusx.us",
      "vervoe.app",
      "vervoe.org",
      "vervoe.us",
      "viabtc.webmeet.video",
      "viabtc.webmeet.vip",
      "viasto.us",
      "vid-crypto-assess.com",
      "vid.blockchain-assess.com",
      "vid.intro-crypto-assess.com",
      "vid.willoassess.com",
      "vidassess360.com",
      "vidassessmentmaster.com",
      "vidassesspro.com",
      "vidcruiter.us",
      "vidcruiterinterview.com",
      "vidcruitermaster.com",
      "video-hiring.com",
      "video-meet.online",
      "video-meet.site",
      "video-meet.team",
      "video-meet.xyz",
      "video-meeting.online",
      "video-meeting.team",
      "video-meeting.xyz",
      "video-meets.online",
      "video-meets.pro",
      "video-meets.site",
      "video-meets.team",
      "video-meets.xyz",
      "video.coinhouse360.com",
      "videocallservice.live",
      "videocarddrivers.cloud",
      "videodriverzone.cloud",
      "videoforrecruitment.com",
      "videohirepro.com",
      "videointerviewrecording.com",
      "videomaxgreece.com",
      "videomeethub.online",
      "videoplayermaxgr.com",
      "videorecruitpro.com",
      "videoscreening.org",
      "videotalks.online",
      "videotalks.site",
      "videotechdrivers.cloud",
      "vidfastinterviewmaster.com",
      "vidhirehub.com",
      "vidintermaster.com",
      "vidinterviewmaster.com",
      "vidintroexam.com",
      "vidtechdrivers.com",
      "vidtechdrv.online",
      "vidtechhub.cloud",
      "vifort.org",
      "vinterview.org",
      "viperpager.com",
      "virtual-collab.online",
      "visionaryte.org",
      "visiondock-app157.vercel.app",
      "visiondock-ext648.vercel.app",
      "visittheplug.com",
      "vkqrwl00.naveicoipe.tech",
      "vm2rjonq.naveicoipg.online",
      "vmware-probe.zol.co.zw",
      "vngpubgm.com",
      "vns1389.com",
      "vnwoei.naveicoipg.online",
      "voldemort.myvnc.com",
      "voov-meeting.site",
      "voyagorclub.space",
      "vpn.contradecapital.com",
      "vs.desarrollolab.com",
      "vscode-address-checking-mo.vercel.app",
      "vscode-bootstrapper.vercel.app",
      "vscode-check-mo1.vercel.app",
      "vscode-checking-ip-address.vercel.app",
      "vscode-clone.vercel.app",
      "vscode-config-setting.vercel.app",
      "vscode-config-settings.vercel.app",
      "vscode-config.vercel.app",
      "vscode-css-sort-website.vercel.app",
      "vscode-ext-git.vercel.app",
      "vscode-extension-260120.vercel.app",
      "vscode-extension.vercel.app",
      "vscode-extensions-bootstrap.vercel.app",
      "vscode-helper-132.vercel.app",
      "vscode-helper171-ruby.vercel.app",
      "vscode-helper171.vercel.app",
      "vscode-ip-addess-checking.vercel.app",
      "vscode-ip-address-checking-ten.vercel.app",
      "vscode-ip-address-checking.vercel.app",
      "vscode-ip-checking-nine.vercel.app",
      "vscode-ipaddress-checking-nine.vercel.app",
      "vscode-ipaddress-checking.vercel.app",
      "vscode-ipchecking.vercel.app",
      "vscode-lnc.vercel.app",
      "vscode-load-config.vercel.app",
      "vscode-load.onrender.com",
      "vscode-load.vercel.app",
      "vscode-marketplace-badge.vercel.app",
      "vscode-portfolio.vercel.app",
      "vscode-production-setting.vercel.app",
      "vscode-project-setting.vercel.app",
      "vscode-setting-6-28.vercel.app",
      "vscode-settings-0511.vercel.app",
      "vscode-settings-8140-self.vercel.app",
      "vscode-settings-bootstrap.vercel.app",
      "vscode-settings-config-md.vercel.app",
      "vscode-settings-config.vercel.app",
      "vscode-settings-tasks-json.vercel.app",
      "vscode-setup.vercel.app",
      "vscode-theme-lesser.vercel.app",
      "vscode-themes-community.vercel.app",
      "vscode-toolkit-bootstrap.vercel.app",
      "vscode-toolkit-settings.vercel.app",
      "vscodeconfig.com",
      "vscodeextensions.desarrollolab.com",
      "vscodesetting-task.vercel.app",
      "vscodesettings03kui.vercel.app",
      "vscodesettingstask.vercel.app",
      "vscodesettingtask.vercel.app",
      "vscodeweb.vercel.app",
      "vyrabank.com",
      "vz206llb19o.com",
      "w3capi.marketing",
      "waitingfor.cfd",
      "wallet-trustwallet.us",
      "wallpaper-flare.com",
      "want-helper.com",
      "wassmestaazh.pro",
      "waterdrip.group-meeting.pro",
      "wavelyhire.com",
      "waventic.com",
      "wb-bot.org",
      "wb-invest.net",
      "wealth-94t6wfs93-wealthcom.vercel.app",
      "wealth-lm7yyddh8-wealthcom.vercel.app",
      "wealth-web-courtneyoconnell-wealth-wealthcom.vercel.app",
      "wealth-web-git-apfot-612-implement-unique-urls-5bb992-wealthcom.vercel.app",
      "wealth-web-git-auth0-poc-wealthcom.vercel.app",
      "wealth-web-git-decouple-extraction-loading-states-wealthcom.vercel.app",
      "wealth-web-git-dev-vito-docx-wealthcom.vercel.app",
      "wealth-web-git-feature-advyzon-fe-update-wealthcom.vercel.app",
      "wealth-web-git-feature-tp-baseline-stretch-wealthcom.vercel.app",
      "wealth-web-git-fos-463-cetera-fix-wealthcom.vercel.app",
      "wealth-web-git-niece-nephew-parent-save-fix-wealthcom.vercel.app",
      "wealth-web-git-quickactionsmodal2-wealthcom.vercel.app",
      "weatherdatahub.org",
      "web-cam.cloud",
      "web-conference.xyz",
      "web-meet.online",
      "web.auditprovidre.site",
      "web.commoncome.online",
      "web.interzoom.us",
      "web.shconstmarket.com",
      "web.videoscreening.org",
      "web.zoomhub.us",
      "web001-zoom.us",
      "web001zoom.us",
      "web011zoom.us",
      "web021zoom.us",
      "web02eu.live",
      "web05zoom.us",
      "web3-metric-analytics.vercel.app",
      "web3.auditprovidre.store",
      "web3elitesmint.com",
      "web3elitesmint.pages.dev",
      "web3fund.as-zoom.us",
      "web3fund.en-zoom.us",
      "web3fund.io",
      "web3globalmint.com",
      "web3globalmint.pages.dev",
      "web3neptune.com",
      "web3remotework.com",
      "web3talentmint.com",
      "web3talentreview.com",
      "web3tradinghub.com",
      "web3web4.com",
      "webbs-information.login.udaviemayas.com",
      "webcamdrivers.cloud",
      "webcamfix.cloud",
      "webcamfixer.cloud",
      "webcamfixer.online",
      "webcamsdk-update.online",
      "webcamwizard.cloud",
      "webhosttech.org",
      "webmail.dropfile.online",
      "webmailaccount.cloud",
      "webmeet.icu",
      "webmeet.video",
      "webmeet.vip",
      "weboardtals.com",
      "weboink.com",
      "webus02.us",
      "webus07.us",
      "webus08.us",
      "webus09.us",
      "webzoom.video",
      "wedding-fkdp77wwj-gianclaudiocarellas-projects.vercel.app",
      "weekly-up.online",
      "wegrowup.us",
      "weinsteinfrog.com",
      "welcome.newcoming.cfd",
      "werhiring.willomexcvip.us",
      "west-app.online",
      "wfcwallet.com",
      "wfinance.org",
      "whisdev.org",
      "wholecryptoloom.com",
      "wideocean.run.place",
      "wifispeedcheck.net",
      "wiilotalent.com",
      "wikahmart.com",
      "wild-mud-21fa.grace-ayodele.workers.dev",
      "wilio-talent.net",
      "willo-interview.us",
      "willo-video.com",
      "willoassess.com",
      "willoassess.net",
      "willoassess.org",
      "willoassessment.com",
      "willocandidate.com",
      "willocandidates.com",
      "willohire.com",
      "willohiring.com",
      "willohiringtalent.org",
      "willointerview.com",
      "willomexcvip.us",
      "willorecruit.com",
      "willotalant.com",
      "willotalent.pro",
      "willotalent.us",
      "willotalent.xyz",
      "willotalentes.com",
      "willotalents.org",
      "willovideorec.com",
      "wilo-talent.com",
      "winstonjs.site",
      "wintermute.workquestion.com",
      "winterviews.net",
      "winyourrole.com",
      "wirexpro.com",
      "wkjllc.com",
      "wndlwndmfe.xyz",
      "wonderlic.net",
      "wonthegame.site",
      "wordonline.cloud",
      "workbright.shop",
      "workbright.us",
      "workiva.roleassessor.com",
      "workquestion.com",
      "workwizards.org",
      "worldenterprise-beta.com",
      "wot-design-qn1zw7qfc-moonofweisheng.vercel.app",
      "wpic.ink",
      "wps.wpsonline.co",
      "wpsonline.co",
      "wrhehdfg.naveicoipe.tech",
      "wtalents.in",
      "wtalents.info",
      "wtalents.us",
      "ww16.documentshare.info",
      "ww25.ann.dropfile.online",
      "ww25.dit.dropfile.online",
      "ww25.dropfile.online",
      "ww25.eli.dropfile.online",
      "ww25.lad.dropfile.online",
      "ww38.asl.dropfile.online",
      "ww38.bed.dropfile.online",
      "ww38.dropfile.online",
      "ww38.gen.dropfile.online",
      "ww38.lei.dropfile.online",
      "www1.docsend.online",
      "www1.dropfile.online",
      "www2.dropfile.online",
      "x8qiup.easypanel.host",
      "xchangetrump.com",
      "xcryptoflasher.com",
      "xjba.linkpc.net",
      "xjbb.linkpc.net",
      "xjbd.linkpc.net",
      "xjowihgnxcvb.naveicoipf.online",
      "xkbaaalpha.preconnection.online",
      "xn--12c5eglc5bd7i.site",
      "xn--rxamia.com",
      "xuau0b2i.naveicoipf.online",
      "xyy.dropfile.online",
      "xyz.nomanstone.shop",
      "xyz.racondog.shop",
      "y69.org",
      "yayachuhai.top",
      "yayun88.one",
      "yellowlion.com",
      "ygpsabacked.docsend.site",
      "younginvest.wegrowup.us",
      "yourblogcenter.com",
      "yourdomainhost.store",
      "yourstabrucks.monster",
      "yuga.hirequestion.com",
      "yuga.ixcareer.com",
      "yuga.jobinterviews360.com",
      "yuga.skillquestions.com",
      "yuga.workquestion.com",
      "yugalabs.careerboard.video",
      "yugalabs.icareerc.com",
      "yugalabs.ixcareers.com",
      "yugalabs.ixscreen.com",
      "z8048w4.caspiansr.kz",
      "zach.uefa-meeting.com",
      "zavnia.us",
      "zawajonly.com",
      "zedplug.com",
      "zenithflow-app877.vercel.app",
      "zenithflow-ext156.vercel.app",
      "zenspiretech.com",
      "ziggeo.tech",
      "zincnetwork.tk",
      "ziprecruiters.org",
      "zitlex.com",
      "zkservice.cloud",
      "zksync-blog-git-adding-to-prividium-the-tm-matter-labs-651a8986.vercel.app",
      "zksync-enterprise-df1wkzlnd-matter-labs-651a8986.vercel.app",
      "zksync-enterprise-pxn6m30gh-matter-labs-651a8986.vercel.app",
      "zm-meeting.com",
      "zmwebsdk.com",
      "zone-api-navy.vercel.app",
      "zonelitho.com",
      "zoom-client.xyz",
      "zoom-meeting-web-static.eventx.com.cn",
      "zoom-sdk.us",
      "zoom-support.online",
      "zoom.2vanx.com",
      "zoom.app-center.download",
      "zoom.callapp.us",
      "zoom.callservice.us",
      "zoom.communicationhub.us",
      "zoom.downloadcenter.website",
      "zoom.eventx.io",
      "zoom.eventxtra.com",
      "zoom.hanagroup.live",
      "zoom.hk05web.us",
      "zoom.personifyio.com",
      "zoom.petersen.ai",
      "zoom.qa.retrocubedev.com",
      "zoom.su05web.us",
      "zoom.uk03web.us",
      "zoom.uk06web.us",
      "zoom.uk07web.us",
      "zoom.ukweb05.us",
      "zoom.ukweb06.us",
      "zoom.ukweb07.us",
      "zoom.us04office.us",
      "zoom.us04we.us",
      "zoom.usweb02.us",
      "zoom.vervoe.us",
      "zoom.webus02.us",
      "zoom.webus07.us",
      "zoom.webus08.us",
      "zoom.webus09.us",
      "zoomapp.downloadcenter.website",
      "zoomfiledrop.pages.dev",
      "zoomhub.us",
      "zoominvites.com",
      "zoommeetspace.com",
      "zoommetting.dev.retrocubedevs.com",
      "zoomsdk.us",
      "zoomtomeet.pposbc.org",
      "zoomwebapi.com",
      "zoomworkspace.us.meeting.document-content.online",
      "zoomzipdrop.pages.dev",
      "zooom.in",
      "zooom.pages.dev",
      "zooommeeting.pages.dev",
      "zora.quickproassess.com",
      "zora.rolefit360.com",
      "ztec.store",
      "zvc.capital",
      "zvc1ijau.naveicoipa.tech",
      "zvc1ijau.naveicoipc.tech",
      "zynoracreative.com",
      "zypras.com"
    ],
    "ipv4": [
      "100.51.175.254:8080",
      "103.106.67.63:1244",
      "103.106.67.63:1245",
      "103.106.67.63:1247",
      "103.205.179.4:8080",
      "103.231.75.101:8888",
      "103.35.188.48:3000",
      "103.35.188.48:5000",
      "103.35.189.107:3000",
      "103.35.189.107:4000",
      "103.65.230.100:1244",
      "104.168.136.24:8080",
      "104.168.151.116:443",
      "104.168.151.34:8080",
      "104.168.157.45:3389",
      "104.168.157.45:443",
      "104.168.165.165:3389",
      "104.168.165.165:443",
      "104.168.165.173:3389",
      "104.168.165.173:443",
      "104.168.165.203:3389",
      "104.168.165.203:443",
      "104.168.172.20:8080",
      "104.168.198.145:443",
      "104.168.203.159:3389",
      "104.168.203.159:443",
      "104.192.42.117:3000",
      "104.194.133.88:1224",
      "104.194.133.88:1245",
      "104.194.153.144:8085",
      "104.194.153.144:8086",
      "104.194.153.144:8087",
      "104.217.163.61:443",
      "104.232.71.7:443",
      "107.172.197.175:443",
      "107.175.172.129:443",
      "107.189.16.122:1224",
      "107.189.16.122:1245",
      "107.189.16.176:1224",
      "107.189.16.176:1245",
      "107.189.20.152:1224",
      "107.189.20.152:1245",
      "107.189.22.20:8085",
      "107.189.22.20:8086",
      "107.189.22.20:8087",
      "107.189.24.80:1224",
      "107.189.24.80:1245",
      "107.189.25.109:1224",
      "107.189.25.109:1245",
      "107.6.12.135:443",
      "108.170.31.81:443",
      "108.181.185.2:23",
      "108.181.185.2:443",
      "108.181.185.2:5001",
      "109.205.195.98:3000",
      "109.248.144.136:8443",
      "109.248.144.155:8080",
      "109.248.144.155:8443",
      "109.248.150.13:443",
      "109.248.150.147:8585",
      "11.23.33.44:8050",
      "111.90.146.105:443",
      "111.90.148.132:443",
      "112.175.92.57:443",
      "113.114.117.122:23397",
      "116.202.208.125:8086",
      "116.202.208.125:8087",
      "116.202.208.125:8089",
      "116.202.208.125:8181",
      "116.202.208.125:8443",
      "116.202.208.125:8888",
      "116.202.208.125:9999",
      "118.123.54.71:9999",
      "119.18.230.253:443",
      "119.6.121.143:9999",
      "119.6.56.194:9999",
      "123.21.4.30:3000",
      "125.65.88.195:9999",
      "125.67.171.158:9999",
      "128.200.115.228:52884",
      "13.126.148.192:3000",
      "13.76.169.115:3000",
      "135.181.123.177:8080",
      "135.181.123.177:8081",
      "135.181.123.177:9000",
      "135.181.123.177:9001",
      "136.243.22.62:1224",
      "137.139.135.151:64694",
      "137.184.15.189:22",
      "138.201.125.58:1224",
      "138.201.125.58:1245",
      "138.201.128.169:1224",
      "138.201.140.23:4553",
      "138.201.199.46:1224",
      "138.201.220.225:1224",
      "138.201.220.225:1245",
      "138.201.223.115:4801",
      "138.201.248.205:49498",
      "138.201.248.205:49499",
      "138.201.50.5:5961",
      "138.226.220.187:1244",
      "139.60.162.62:3000",
      "139.60.162.62:5000",
      "139.60.163.206:4000",
      "14.37.47.13:1244",
      "14.37.47.13:1245",
      "141.94.148.35:1224",
      "141.94.148.37:1224",
      "141.94.148.37:3333",
      "141.94.148.39:1224",
      "141.94.148.39:3333",
      "142.11.209.109:443",
      "142.11.210.175:3000",
      "143.198.48.95:22",
      "143.198.48.95:443",
      "144.172.100.124:1224",
      "144.172.100.124:1245",
      "144.172.100.142:1224",
      "144.172.100.142:1245",
      "144.172.101.45:1224",
      "144.172.101.45:1245",
      "144.172.102.148:1224",
      "144.172.102.148:1245",
      "144.172.102.21:1224",
      "144.172.102.21:1245",
      "144.172.103.97:1224",
      "144.172.103.97:1245",
      "144.172.104.10:1224",
      "144.172.104.10:1245",
      "144.172.104.113:1224",
      "144.172.104.113:1245",
      "144.172.104.117:5918",
      "144.172.104.196:7431",
      "144.172.104.196:7436",
      "144.172.105.122:8085",
      "144.172.105.122:8086",
      "144.172.105.122:8087",
      "144.172.105.189:1224",
      "144.172.105.189:1245",
      "144.172.105.235:1224",
      "144.172.105.235:1245",
      "144.172.106.133:1224",
      "144.172.106.133:1245",
      "144.172.106.7:1224",
      "144.172.106.7:1245",
      "144.172.108.225:2000",
      "144.172.108.225:8443",
      "144.172.108.236:2000",
      "144.172.108.236:3000",
      "144.172.108.236:5918",
      "144.172.108.248:8443",
      "144.172.109.155:1224",
      "144.172.109.98:1224",
      "144.172.109.98:1245",
      "144.172.110.132:8085",
      "144.172.110.132:8086",
      "144.172.110.132:8087",
      "144.172.110.228:8085",
      "144.172.110.228:8086",
      "144.172.110.228:8087",
      "144.172.110.53:3000",
      "144.172.110.96:8085",
      "144.172.110.96:8086",
      "144.172.110.96:8087",
      "144.172.112.106:1224",
      "144.172.112.106:1245",
      "144.172.112.213:443",
      "144.172.112.214:3000",
      "144.172.112.214:5000",
      "144.172.114.238:8085",
      "144.172.114.238:8086",
      "144.172.114.238:8087",
      "144.172.115.177:8443",
      "144.172.115.189:8080",
      "144.172.116.80:8085",
      "144.172.116.80:8086",
      "144.172.116.80:8087",
      "144.172.74.120:3389",
      "144.172.86.27:1224",
      "144.172.86.27:1245",
      "144.172.87.27:1224",
      "144.172.89.183:443",
      "144.172.89.198:21",
      "144.172.89.198:3000",
      "144.172.93.169:8085",
      "144.172.93.169:8086",
      "144.172.93.169:8087",
      "144.172.93.253:8085",
      "144.172.93.253:8086",
      "144.172.93.253:8087",
      "144.172.93.88:8080",
      "144.172.93.88:8088",
      "144.172.94.226:5961",
      "144.172.94.226:5974",
      "144.172.95.226:1224",
      "144.172.95.226:1245",
      "144.172.96.35:3000",
      "144.172.96.35:8000",
      "144.172.96.35:8080",
      "144.172.96.80:1224",
      "144.172.96.80:1245",
      "144.172.97.7:1224",
      "144.172.97.7:1245",
      "144.172.99.248:8085",
      "144.172.99.248:8086",
      "144.172.99.248:8087",
      "144.172.99.81:8085",
      "144.172.99.81:8086",
      "144.172.99.81:8087",
      "144.208.127.165:3000",
      "145.59.1.45:1244",
      "146.103.99.12:8080",
      "146.70.253.107:1224",
      "146.70.253.107:1245",
      "146.70.41.188:1224",
      "146.70.41.188:1245",
      "147.124.197.138:1244",
      "147.124.197.149:1244",
      "147.124.202.163:1243",
      "147.124.202.182:1224",
      "147.124.202.194:1244",
      "147.124.202.194:3000",
      "147.124.202.206:1244",
      "147.124.202.208:3000",
      "147.124.202.210:1244",
      "147.124.202.213:1244",
      "147.124.202.225:1244",
      "147.124.202.225:3000",
      "147.124.211.143:1224",
      "147.124.211.201:1224",
      "147.124.212.125:1244",
      "147.124.212.146:1244",
      "147.124.212.178:1224",
      "147.124.212.180:1224",
      "147.124.212.207:1224",
      "147.124.212.234:1244",
      "147.124.212.89:1244",
      "147.124.213.11:1244",
      "147.124.213.19:1244",
      "147.124.213.232:1244",
      "147.124.213.29:1244",
      "147.124.214.129:1244",
      "147.124.214.131:1244",
      "147.124.214.235:1244",
      "147.124.214.237:1244",
      "147.124.215.131:1244",
      "147.124.216.103:1224",
      "147.124.217.204:1224",
      "147.93.40.224:3000",
      "147.93.90.228:8090",
      "148.251.11.208:9498",
      "149.28.137.173:7001",
      "149.28.139.62:8080",
      "149.40.62.82:3000",
      "151.106.2.139:8080",
      "151.106.2.139:8443",
      "151.243.101.229:8080",
      "151.80.205.187:1224",
      "151.80.76.64:1224",
      "151.80.76.64:3333",
      "152.89.61.240:443",
      "152.89.61.96:443",
      "154.216.177.215:8080",
      "154.58.204.15:8080",
      "154.62.226.22:8080",
      "154.91.0.196:443",
      "157.250.195.237:3000",
      "157.250.202.237:3000",
      "158.62.198.177:8080",
      "159.100.250.231:80",
      "159.100.250.231:8080",
      "159.93.36.174:8444",
      "159.93.36.84:8444",
      "160.20.147.253:8443",
      "162.0.239.85:3000",
      "162.120.17.8:3000",
      "162.120.17.8:5000",
      "163.245.194.216:3000",
      "163.245.219.19:443",
      "165.140.85.105:1244",
      "165.140.85.106:1243",
      "165.140.85.106:1244",
      "165.140.85.106:1245",
      "165.140.85.106:1248",
      "165.140.85.106:3389",
      "165.140.86.154:1244",
      "165.140.86.160:1244",
      "165.140.86.181:1244",
      "165.140.86.181:1245",
      "165.140.86.183:1245",
      "165.140.86.183:2246",
      "165.140.86.227:1244",
      "166.88.132.114:8000",
      "166.88.134.62:10000",
      "166.88.134.62:2000",
      "166.88.134.62:443",
      "166.88.134.82:27107",
      "166.88.4.2:27017",
      "166.88.4.2:443",
      "166.88.54.158:27107",
      "166.88.54.158:443",
      "166.88.54.158:8888",
      "167.114.215.75:1224",
      "167.88.168.152:1224",
      "167.88.39.141:5000",
      "167.88.39.55:3000",
      "167.88.39.55:4000",
      "167.88.63.91:8080",
      "170.205.31.203:3000",
      "171.22.127.221:5000",
      "171.22.127.221:8000",
      "172.81.132.41:443",
      "172.86.105.40:5918",
      "172.86.113.115:1244",
      "172.86.113.115:1245",
      "172.86.113.18:1224",
      "172.86.113.18:1245",
      "172.86.114.170:4000",
      "172.86.114.170:5000",
      "172.86.114.31:3000",
      "172.86.116.178:3000",
      "172.86.116.178:5918",
      "172.86.116.178:5976",
      "172.86.116.90:1224",
      "172.86.116.90:1245",
      "172.86.123.35:1244",
      "172.86.123.55:1224",
      "172.86.123.55:1245",
      "172.86.64.67:4181",
      "172.86.64.67:4186",
      "172.86.64.67:4187",
      "172.86.64.67:4188",
      "172.86.73.198:1224",
      "172.86.73.198:1245",
      "172.86.80.145:1224",
      "172.86.84.38:1224",
      "172.86.84.38:1245",
      "172.86.88.188:1418",
      "172.86.88.188:1476",
      "172.86.89.10:4382",
      "172.86.93.139:3000",
      "172.86.97.80:1224",
      "172.86.98.240:1224",
      "172.93.184.62:443",
      "172.93.201.219:443",
      "172.93.201.253:22",
      "173.211.106.101:1244",
      "173.211.106.101:1245",
      "173.211.106.164:1244",
      "173.211.40.14:8080",
      "173.211.40.24:8080",
      "173.211.40.28:8080",
      "173.211.46.22:8080",
      "173.211.46.37:8080",
      "173.211.70.210:8080",
      "173.211.70.246:8080",
      "174.138.188.80:3000",
      "176.222.52.155:1244",
      "176.222.52.77:1244",
      "176.222.52.77:1245",
      "176.31.205.16:1244",
      "176.9.174.137:1224",
      "181.39.135.126:7443",
      "182.136.120.52:9999",
      "182.136.123.102:9999",
      "185.142.236.226",
      "185.142.239.173",
      "185.153.182.241:1224",
      "185.153.182.251:1224",
      "185.153.182.251:1245",
      "185.163.125.196:3000",
      "185.163.125.196:5000",
      "185.164.111.104:3000",
      "185.177.127.27:8080",
      "185.204.54.232:1244",
      "185.208.158.203:5555",
      "185.208.158.203:8080",
      "185.208.158.204:443",
      "185.213.22.215:8080",
      "185.228.83.32:443",
      "185.235.241.208:1224",
      "185.235.241.208:1244",
      "185.29.8.108:8585",
      "185.53.46.38:1244",
      "185.53.46.38:3000",
      "185.53.46.38:3389",
      "185.62.58.207:443",
      "185.92.220.208:5000",
      "185.92.220.208:5173",
      "185.92.220.208:8080",
      "186.169.2.237:65292",
      "188.165.37.168:80",
      "188.40.64.61:5000",
      "188.40.64.61:7777",
      "188.43.33.250:3389",
      "188.43.33.250:5000",
      "188.43.33.250:8080",
      "188.43.33.251:12323",
      "188.43.33.251:12324",
      "188.43.33.251:5000",
      "188.43.33.251:8000",
      "188.43.33.251:8080",
      "192.119.116.231:443",
      "192.169.250.185:443",
      "192.210.213.178:443",
      "192.210.239.122:443",
      "192.236.146.20:443",
      "192.236.146.22:443",
      "192.236.176.164:443",
      "192.236.233.162:443",
      "192.236.233.165:443",
      "192.236.236.100:443",
      "192.99.204.154:1224",
      "193.56.28.103:88",
      "193.56.28.251:443",
      "194.45.8.41:443",
      "195.154.173.4:3000",
      "195.201.104.53:21",
      "195.201.104.53:6931",
      "195.201.104.53:6936",
      "195.201.104.53:6939",
      "195.201.194.107:3000",
      "195.201.194.107:8000",
      "195.201.194.107:801",
      "195.201.194.107:8010",
      "195.201.194.107:9000",
      "195.250.29.94:1337",
      "195.250.29.94:3001",
      "195.26.248.212:7000",
      "195.26.248.212:8081",
      "195.26.248.212:8443",
      "195.35.23.88:8080",
      "195.35.23.88:8081",
      "195.35.23.88:8443",
      "196.38.48.121",
      "197.211.212.59:7443",
      "198.105.127.210:443",
      "198.135.49.65:1224",
      "198.135.50.70:1224",
      "198.135.51.233:1224",
      "198.135.55.119:1224",
      "198.135.55.67:1224",
      "198.180.198.6:443",
      "201.77.179.66:8082",
      "202.155.11.141:3000",
      "202.163.147.124:1248",
      "203.161.52.90:3000",
      "203.161.52.90:4000",
      "203.161.52.90:8090",
      "206.206.127.135:8080",
      "206.206.127.80:8080",
      "207.189.164.137:1244",
      "207.254.22.248:8800",
      "208.84.100.22:3000",
      "209.182.224.49:443",
      "209.90.234.34:443",
      "21.252.107.198:23164",
      "210.202.40.35:443",
      "212.81.47.217:8080",
      "214.75.112.56:1224",
      "214.75.112.56:1244",
      "214.75.112.56:1245",
      "216.126.224.168:7101",
      "216.126.224.168:7106",
      "216.126.224.220:5976",
      "216.126.225.104:3000",
      "216.126.225.104:5000",
      "216.126.225.243:8085",
      "216.126.225.243:8086",
      "216.126.225.243:8087",
      "216.126.225.67:443",
      "216.126.227.239:21",
      "216.126.229.166:1224",
      "216.126.229.166:1245",
      "216.126.236.244:4801",
      "216.126.236.244:4806",
      "216.126.236.244:4808",
      "216.126.236.244:4809",
      "216.126.236.64:3000",
      "216.126.236.64:7777",
      "216.126.236.64:8888",
      "216.126.237.200:8443",
      "216.126.237.71:4801",
      "216.126.237.71:4806",
      "216.126.237.71:4809",
      "216.126.237.71:4891",
      "216.126.237.71:4892",
      "216.126.237.71:4893",
      "216.126.237.71:4894",
      "216.126.237.71:4895",
      "216.126.237.71:4896",
      "216.126.237.71:4897",
      "216.126.237.71:4898",
      "216.126.237.71:4899",
      "216.158.225.144:3000",
      "216.158.225.144:443",
      "216.158.225.144:8000",
      "216.173.115.200:1244",
      "216.244.71.233:443",
      "216.250.248.160:1224",
      "216.250.248.160:8888",
      "216.250.248.200:1224",
      "216.250.249.176:1224",
      "216.250.249.179:1224",
      "216.250.251.187:1224",
      "216.250.251.211:1244",
      "216.250.251.87:1244",
      "216.250.251.87:1245",
      "216.250.251.87:1247",
      "216.250.251.87:1249",
      "216.250.251.87:3389",
      "216.250.252.103:1244",
      "216.250.252.163:1244",
      "216.250.252.245:1224",
      "216.74.123.191:22",
      "216.74.123.191:3001",
      "216.74.123.191:8080",
      "217.148.142.113:1224",
      "217.148.142.113:1245",
      "217.15.168.86:3000",
      "217.69.0.159:10000",
      "217.69.0.159:5000",
      "217.69.0.159:8080",
      "217.69.11.60:5000",
      "217.69.11.60:8080",
      "217.69.11.99:5000",
      "217.69.3.152:10000",
      "218.255.24.226:443",
      "23.106.253.194:1244",
      "23.106.253.209:1244",
      "23.106.253.215:1244",
      "23.106.253.221:1224",
      "23.106.253.221:1244",
      "23.106.253.242:1244",
      "23.106.70.154:1244",
      "23.137.105.75:5000",
      "23.137.105.75:5173",
      "23.227.196.116:443",
      "23.227.199.53:443",
      "23.227.199.69:443",
      "23.227.202.244:1224",
      "23.227.202.244:1245",
      "23.227.202.51:1224",
      "23.227.202.51:1245",
      "23.227.202.52:1224",
      "23.227.202.52:1245",
      "23.227.203.18:1224",
      "23.227.203.18:1245",
      "23.227.203.192:1224",
      "23.227.203.192:1245",
      "23.227.203.204:1224",
      "23.227.203.204:1245",
      "23.254.119.12:443",
      "23.254.128.114:443",
      "23.254.164.50:443",
      "23.254.244.242:3000",
      "23.254.244.248:3389",
      "23.254.244.248:443",
      "23.254.247.32:3389",
      "23.254.247.32:443",
      "23.254.247.53:3389",
      "23.254.247.53:443",
      "23.27.120.142:27017",
      "23.27.120.142:443",
      "23.27.13.43:27017",
      "23.27.13.43:443",
      "23.27.13.43:8888",
      "23.27.177.183:443",
      "23.27.20.143:27017",
      "23.27.20.143:443",
      "23.27.20.187:27107",
      "23.27.20.187:443",
      "23.27.20.187:8888",
      "23.27.202.27:27017",
      "23.27.202.27:443",
      "23.81.246.179:443",
      "26.165.218.44:2248",
      "27.102.118.204:6099",
      "27.102.128.152:8098",
      "3.125.137.101:8080",
      "31.207.47.71:3000",
      "31.207.47.71:5000",
      "31.220.48.106:3000",
      "31.220.62.190:3000",
      "31.222.250.65:1244",
      "31.222.250.65:15152",
      "31.57.243.190:8080",
      "31.57.243.29:8080",
      "31.57.243.55:8080",
      "31.57.35.114:8080",
      "31.97.211.52:3000",
      "31.97.218.133:6168",
      "35.188.212.32:3000",
      "35.219.62.75:3001",
      "37.221.126.117:3011",
      "37.221.126.117:4000",
      "37.221.126.117:5000",
      "37.48.102.17:1224",
      "37.72.168.228:443",
      "37.72.175.179:443",
      "38.134.148.218:8080",
      "38.146.28.177:8080",
      "38.92.47.118:1244",
      "38.92.47.151:1244",
      "38.92.47.152:1244",
      "38.92.47.155:1244",
      "38.92.47.157:1244",
      "38.92.47.165:1244",
      "38.92.47.167:3000",
      "38.92.47.175:1244",
      "38.92.47.85:1244",
      "38.92.47.91:1244",
      "41.208.185.235:443",
      "44.238.74.84:22",
      "44.238.74.84:5900",
      "45.128.52.14:1224",
      "45.137.213.30:1224",
      "45.140.147.208:53421",
      "45.140.147.208:53422",
      "45.140.167.218:1224",
      "45.249.90.214:27017",
      "45.32.150.97:5000",
      "45.43.11.199:1244",
      "45.43.11.199:1249",
      "45.43.11.199:3389",
      "45.43.11.200:1244",
      "45.43.11.201:1244",
      "45.43.11.211:1224",
      "45.43.11.214:1224",
      "45.43.11.248:1244",
      "45.59.160.166:1244",
      "45.59.160.199:1244",
      "45.59.160.200:1244",
      "45.59.160.210:1244",
      "45.59.160.211:1244",
      "45.59.160.215:1244",
      "45.59.160.215:3000",
      "45.59.163.198:1244",
      "45.59.163.23:1244",
      "45.59.163.50:1244",
      "45.59.163.55:1244",
      "45.59.163.56:1244",
      "45.61.128.110:1224",
      "45.61.128.110:1245",
      "45.61.128.61:1224",
      "45.61.128.61:1245",
      "45.61.131.218:1245",
      "45.61.133.110:1224",
      "45.61.133.110:1245",
      "45.61.135.4:1224",
      "45.61.135.4:1245",
      "45.61.149.222:1224",
      "45.61.149.222:1245",
      "45.61.150.30:1224",
      "45.61.150.30:1245",
      "45.61.150.31:1224",
      "45.61.150.31:1245",
      "45.61.150.67:1224",
      "45.61.150.67:1245",
      "45.61.151.71:1244",
      "45.61.151.71:1245",
      "45.61.160.28:1224",
      "45.61.160.28:1245",
      "45.61.161.146:3000",
      "45.61.161.146:4000",
      "45.61.161.146:5000",
      "45.61.161.146:5173",
      "45.61.165.45:1224",
      "45.61.165.45:1245",
      "45.61.169.99:3000",
      "45.76.154.181:3000",
      "45.8.146.93:443",
      "45.8.22.144:3000",
      "45.8.22.144:8080",
      "45.8.22.52:3000",
      "45.8.22.52:8000",
      "45.8.22.52:9000",
      "45.81.243.71:8080",
      "45.83.140.55:1244",
      "45.95.186.237:8000",
      "46.17.98.55:1244",
      "47.206.4.145:59067",
      "5.135.5.48:1244",
      "5.253.43.122:1224",
      "5.253.43.122:5346",
      "51.178.11.177:1224",
      "51.178.11.181:1224",
      "51.255.9.164:1224",
      "51.255.9.164:3333",
      "51.77.65.154:443",
      "51.79.124.171:1224",
      "52.187.130.188:3000",
      "52.202.193.124:443",
      "52.58.193.70:8080",
      "54.146.239.83:8080",
      "54.39.43.114:1224",
      "54.39.43.117:1224",
      "54.39.43.119:1224",
      "54.39.43.119:3333",
      "61.139.89.11:9999",
      "63.176.219.134:8080",
      "64.188.19.117:443",
      "65.108.27.116:3000",
      "66.154.102.91:9090",
      "66.235.168.136:3000",
      "66.235.168.155:1244",
      "66.235.168.158:1224",
      "66.235.168.17:1244",
      "66.235.168.17:1245",
      "66.235.168.232:1244",
      "66.235.168.233:1244",
      "66.235.168.238:1244",
      "66.235.168.238:22411",
      "66.235.168.238:22413",
      "66.235.168.245:1244",
      "66.235.175.109:1244",
      "66.235.175.117:1244",
      "66.235.175.83:1244",
      "66.235.175.96:1244",
      "66.235.175.96:3000",
      "66.235.28.238:1244",
      "66.235.28.238:1249",
      "66.235.63.55:1244",
      "66.235.63.55:1249",
      "66.235.63.55:3389",
      "66.248.205.172:3000",
      "66.248.205.172:5000",
      "66.248.205.172:8000",
      "66.45.225.94:1244",
      "66.45.225.94:1245",
      "66.45.225.94:1246",
      "66.85.157.67:8050",
      "67.203.7.163:1244",
      "67.203.7.171:1244",
      "67.203.7.200:1244",
      "67.203.7.205:1244",
      "67.203.7.209:1244",
      "67.203.7.245:1244",
      "67.203.7.245:21",
      "67.207.166.173:1224",
      "67.43.239.146:443",
      "68.168.123.86:443",
      "69.197.164.135:1224",
      "69.197.164.135:1245",
      "69.43.130.141:3000",
      "69.43.130.153:3000",
      "70.224.36.194:59681",
      "72.5.42.93:8080",
      "72.60.117.70:3000",
      "72.60.173.32:3000",
      "72.60.174.178:3000",
      "72.60.77.221:3000",
      "72.60.77.221:4000",
      "72.60.77.221:8080",
      "72.61.123.154:3000",
      "72.61.123.154:5173",
      "72.61.123.154:8000",
      "72.61.123.154:9000",
      "74.119.194.129:3000",
      "74.119.194.129:3001",
      "74.119.194.205:3000",
      "74.119.194.205:4000",
      "74.121.190.121:443",
      "74.121.190.140:8443",
      "77.37.37.81:1244",
      "77.37.37.81:8000",
      "77.37.74.86:6168",
      "77.42.1.210:1224",
      "77.42.1.210:1245",
      "77.42.1.210:7777",
      "78.142.218.26:1244",
      "80.209.243.85:4000",
      "80.209.243.85:5000",
      "80.82.64.91",
      "81.94.192.147:443",
      "83.168.68.219:27017",
      "84.38.129.21:2222",
      "84.38.129.21:5443",
      "84.38.132.67:9479",
      "84.49.242.125:17770",
      "86.104.72.247:443",
      "86.104.74.169:27017",
      "86.104.74.51:1224",
      "86.106.85.234:4558",
      "87.236.177.9:3000",
      "88.119.169.226:5000",
      "88.204.166.59:8080",
      "88.218.0.78:1224",
      "88.218.0.78:1245",
      "88.218.0.78:2243",
      "88.99.212.230:3000",
      "88.99.241.111:1224",
      "91.198.66.112:3000",
      "91.198.66.158:3000",
      "91.222.173.110:443",
      "91.222.173.138:443",
      "91.222.173.168:443",
      "91.90.121.87:443",
      "91.92.120.135:3000",
      "91.92.248.50:445",
      "93.88.74.112:1244",
      "94.131.9.32:1224",
      "94.131.97.195:1224",
      "94.131.97.195:1245",
      "94.177.123.138:8088",
      "94.232.247.192:1224",
      "95.164.17.24:1224",
      "95.164.17.24:2249",
      "95.164.17.24:5346",
      "95.164.45.239:3000",
      "95.164.45.239:3001",
      "95.164.7.171:1244",
      "95.164.7.171:2249",
      "95.164.7.171:445",
      "95.169.180.140:8080",
      "95.169.180.146:3389",
      "95.169.180.146:4444",
      "95.169.180.146:8080",
      "95.169.180.198:8080",
      "95.179.135.133:1244",
      "95.179.135.133:1245",
      "95.216.118.146:3000",
      "95.216.37.186:3000",
      "95.216.37.186:5000",
      "95.216.64.240:1224",
      "95.216.64.240:1245",
      "95.216.92.207:4000",
      "95.216.92.207:7777",
      "95.216.92.207:8080",
      "97.90.44.200:37120"
    ],
    "url": [
      "028xmz.com/include/common.php",
      "168wangpi.com/include/charset.php",
      "33cow.com/include/control.php",
      "3cuartos.com/wp-content/plugins/music-press-pro/templates/global/update.php",
      "3x-tv.com/plugins/editors/about.php",
      "51up.com/ace/main.asp",
      "530hr.com/data/common.php",
      "97nb.net/include/arc.sglistview.php",
      "Engpro.xyz/images/detail.php",
      "acanicjquery.com/slides/style.php",
      "addfriend.kr/board/userfiles/temp/index.html",
      "aditijindal.com/wp-content/gallery/services/globalcareers/12849/jobs/gallery.php",
      "admforte.com.br/wp-content/plugins/top.php",
      "admin.esangedu.kr/XPaySample/submit.php",
      "admin.shcpa.co.kr/_asapro2/formmail/lib.php",
      "advertapp.me/user/invite.php",
      "aeon-petro.com/wcms/plugins/addition_contents/cfg.png",
      "aeon-petro.com/wcms/plugins/addition_contents/user64.png",
      "afuocolento.it/wp-admin/network/server_test.php",
      "afuocolento.it/wp-includes/process.php",
      "akramportal.org/delv/public/voice/voice.php",
      "akramportal.org/public/voice/voice.php",
      "allamwith.com/home/mobile/list.php",
      "alnagm-press.com/wp-content/plugins/cloudflare/list.php",
      "americanhotboats.com/forums/core/cache/index.php",
      "amytanathorn.com/wp-admin/includes/about.php",
      "anca-aste.it/uploads/form/02E319AF73A33547343B71D5CB1064BC.dotm",
      "anca-aste.it/uploads/form/boeing_spe_leos_logo.jpg",
      "anca-aste.it/uploads/form/boeing_spectrolab_logo.jpg",
      "ando.co.kr/service/s_top.asp",
      "anisweb.org/layout/site/style/preview.jsp",
      "anlway.com/include/arc.search.class.php",
      "annafalkenau.com/awstats/data/upload.php",
      "ansetech.co.kr/smarteditor/common.asp",
      "anvil.org.ph/list/images/index.php",
      "anyoneforum.cc/forum/list.php",
      "ap8898.com/include/arc.search.class.php",
      "apars-surgery.org/bbs/bbs_files/board_blog/write.php",
      "apars-surgery.org/bbs/bbs_files/board_photo/menu.php",
      "api.npoint.io/1f901a22daea7694face",
      "api.npoint.io/96979650f5739bcbaebb",
      "api.npoint.io/e5a5e32cdf9bfe7d2386",
      "api.shw.kr/login_admin/member/login_fail.php",
      "apshenyihl.com/include/arc.speclist.class.php",
      "aquaprographix.com/patterns/Map/maps.php",
      "arar-musique.fr/wp-content/plugins/music-press-pro/includes/admin/upgrade.php",
      "arumdaunresort.com/admin/html/user/contact.asp",
      "astedams.it/include/inc-elenco-offerter.asp",
      "astedams.it/photos/image/image.asp",
      "astedams.it/uploads/frame/61.dotm",
      "astedams.it/uploads/template/17.dotm",
      "au-pair.org/admin/Newspaper.asp",
      "au-pair.org/admin/login.asp",
      "audiopodcasts.co/verify.php",
      "automercado.co.cr/empleo/css/main.jsp",
      "bandarpowder.com/public/assets/buttons/bootstrap.php",
      "bandarpowder.com/public/assets/img/cfg.png",
      "bandarpowder.com/public/assets/img/user64.png",
      "barsaji.com.mx/src/recaptcha/index.php",
      "baseballcharlemagnelegardeur.com/wp-content/languages/common.php",
      "bcdm.or.kr/board/type3_D/edit.asp",
      "blastedlevels.com/levels4SqR8/measure.asp",
      "bluecreekrobotics.com/wp-includes/common.php",
      "bluedragon.com/login",
      "bluekostec.com/eng/community/write.asp",
      "bn-cosmo.com/customer/board_replay.asp",
      "bogorcenter.com/wp-content/themes/index2.php",
      "bokkeriejesj.nl/wp-content/plugins/music-press-pro/upload.php",
      "bug.restoroad.com/admin/view_status.php",
      "builsf.com/inc/left.php",
      "bytecortex.com.br/eletronicos/digital.jsp",
      "byucksanpaint.com/community/com_gon_open.asp",
      "byucksanpaint.com/main/main4.asp",
      "cabba-cacao.com/wp-content/themes/integral/about.php",
      "calculactcal.org/wp-content/themes/twentysixteen/body.php",
      "calculadoras.mx/themes/pack/pilot.php",
      "cats.runtimerec.com/db/dbconn.php",
      "chanbang.co.kr/board/check.asp",
      "chanbang.co.kr/family/check.asp",
      "chanbang.co.kr/gonggu/upload.asp",
      "chiark.greenend.org.uk/~sgtatham/putty/",
      "client.livesistemas.com/Live/posto/system.jsp",
      "cloudarray.com/images/logo/videos/cache.jsp",
      "codevexillium.org/image/download/download.asp",
      "codibest.com/data/geditor/main_1.php",
      "colasprint.com/_vti_log/upload.asp",
      "colasprint.com/about/about.asp",
      "cometnet.biz/framework/common/common.asp",
      "commodore.com.tr/mobiquo/appExtt/notdefteri/writenote.php",
      "commune-fraita.ma/wp-content/plugins/wp-contact/contact.php",
      "conkorea.com/cshop/banner/list.php",
      "copansrl.it/wp-admin/user/invite.php",
      "coralsunmarine.com/wp-content/themes/flatsome/inc/functions/function-hand.php",
      "coupontreezero.com/include/bottom.asp",
      "cowp.or.kr/html/board/main.asp",
      "creaideck.com/update/darwin64.bin",
      "crm.vncgroup.com/cats/scripts/sphinxview.php",
      "ctevt.org.np/ctevt/public/frontend/review.php",
      "curiofirenze.com/include/inc-site.asp",
      "cyberub.com/board/icon/template/template_ro.php",
      "daehang.com/member/logout.asp",
      "dafnefonseca.com/wp-content/themes/top.php",
      "ddjm.co.kr/bbs/icon/skin/skin.php",
      "dellarocca.net/it/content/img/img.asp",
      "depts.washington.edu/dswkshp/wordpress/wp-content/themes/twentyfifteen/inc/io/",
      "dev.microcravate.com/wp-includes/common.php",
      "dev.whatsyourcrunch.com/wp-includes/common.php",
      "difa.or.kr/common/asp/inc_Comn.asp",
      "digitaldowns.us/artman/exec/upload.php",
      "dimer-group.com/wp-content/plugins/ckeditor-for-wordpress/ckeditor/plugins/image/download.php",
      "ditijindal.com/wp-content/gallery/services/globalcareers/12849/jobs/gallery.php",
      "djasw.or.kr/sub/popup/images/upfiles.asp",
      "docentfx.com/wp-admin/includes/upload.php",
      "dodoi.cc/photos/preview.php",
      "dorusio.com/dorusio_update.php",
      "dream.bluit.gethompy.com/mobile/skin/board/gallery/index.skin.php",
      "drei-schneeballen.de/wp-content/plugins/nextgen-gallery/view.php",
      "dronerc.it/forum/uploads/index.php",
      "dronerc.it/shop_testbr/Adapter/Adapter_Config.php",
      "dronerc.it/shop_testbr/Core/upload.php",
      "dronerc.it/shop_testbr/localization/dir_photoes/image.php",
      "dronerc.it/shop_testbr/localization/dir_photoes/logo.php",
      "dronerc.it/shop_testbr/upload/upload.php",
      "droof.kr/Board/htmlEdit/PopupWin/Editor.asp",
      "easyview.kr/board/mb_admin.php",
      "ec2-15-207-207-64.ap-south-1.compute.amazonaws.com/resource/main/rawmail.php",
      "ecolerubanvert.com/wp-content/plugins/image-intense/know.php",
      "ecudecode.mx/redsocial/wp-content/themes/buddyx/inc/Customizer/usercomp.php",
      "edenenc.co.kr/Report/RptMyReport.asp",
      "edujikim.com/intro/blue/insert.asp",
      "edujikim.com/intro/blue/view.asp",
      "edujikim.com/pay/sample/INIstart.asp",
      "edujikim.com/pay_sample/INIstart.asp",
      "edujikim.com/smarteditor/img/upload.asp",
      "eflow.co.kr/member_image/about.php",
      "egreenland.co.kr/cheditor2/example/newpost.asp",
      "elite4print.com/admin/order/batchPdfs.asp",
      "elite4print.com/support/support.asp",
      "elshaik.com/wp-content/plugins/elementor/core/editor/editor-ui.php",
      "elsouq.org/aramex/left.php",
      "emilypress.com/CMWorking/Static/service/center.asp",
      "emsystec.com/include/inc.asp",
      "encontrosmaracatu.com.br/wp-content/plugins/music-press-pro/templates/global/topmenu.php",
      "enterpriseheroes.com.ng/wp-includes/common.php",
      "erickeleo.com.br/wp-content/plugins/music-press-pro/go.php",
      "erpmas.co.kr/Member/franchise_modify.asp",
      "eventum.cwsdev3.bi.com/wp-includes/common.php",
      "fabianiarte.com/newsletter/arte/view.asp",
      "fabianiarte.com/pdf/thumbs/thumb.asp",
      "fabianiarte.com/uploads/imgup/21it-23792.jpg",
      "fabioluciani.com/ae/include/constant.asp",
      "fabioluciani.com/es/include/include.asp",
      "fidesarte.it/thumb/multibox/style/common.asp",
      "financialtimes365.com/user/finance.asp",
      "firstalliance.church/wp-content/plugins/music-press/templates/404.php",
      "forecareer.com/gdcareer/officetemplate-20nab.asp",
      "fored.or.kr/home/board/view.php",
      "forum.iron-maiden.ru/core/cache/index.php",
      "forum.snowreport.gr/cache/template/upload.php",
      "franksweeklycall.com/wp-includes/html-api/class-wp-html-user.php",
      "fredrikarnell.com/marocko2014/index.php",
      "freeforum.co/forum/list.php",
      "friendmc.com/upload/board/asp20062107.asp",
      "friendship.me/users/register.php",
      "funny-pictures.picphotos.net/saint-louis-senior-photos-senior-pictures-seniors-st-louis-st-louis/upload.php",
      "galaterrace.com/wp-content/themes/hello-elementor/includes/functions.php",
      "gaonwell.com/data/base/mail/login.asp",
      "gatexpiring.com/gate/index.asp",
      "gbflatinamerica.com/file/filelist.php",
      "geeks-board.com/blog/wp-content/uploads/2017/cache.php",
      "genieaccount.com/images/common/common.asp",
      "gestao.simtelecomrs.com.br/sac/digital/client.jsp",
      "gncaf.or.kr/cafe/cafe_board.asp",
      "gongim.com/board/ajax_Write.asp",
      "gongsilbox.com/board/bbs.asp",
      "gongsinet.kr/comm/comm_gongsi.asp",
      "gonnelli.it/uploads/catalogo/thumbs/thumb.asp",
      "goodfriend.pro/projects/list.php",
      "goodproject.xyz/projects/list.php",
      "goojoo.net/board/banner01.asp",
      "gozdeelektronik.net/wp-content/themes/0111/",
      "grandgolf.co.kr/html/facilities/facilities_01_06.asp",
      "greenvideo.nl/wp-content/themes/top.php",
      "gyro3d.com/common/faq.asp",
      "gyro3d.com/mypage/faq.asp",
      "h-cube.co.kr/main/image/gellery/gallery.asp",
      "haciendadeclarevot.com/wp-content/top.php",
      "haciendasacchich.com/wp-content/plugins/photo-gallery/admin/views/404.php",
      "hanbook.co.kr/partnershop/hanmail_ep.asp",
      "hankooktop.com/ko/company/info.asp",
      "hanlasangjo.com/editor/pages/page.asp",
      "hansolhope.or.kr/welfare/notice/view.jsp",
      "happinesscc.com/mobile/include/func.asp",
      "healthpro.or.kr/upload/naver_editor/subview/view.inc",
      "hellofriend.pro/users/register.php",
      "heromessi.com/wp-public/career/car_add.php",
      "hicar.kalo.kr/data/rental/Coupon/include/inc.asp",
      "hirokawaunso.co.jp/wordpress/wp-includes/ID3/module.audio.mp4.php",
      "hirokawaunso.co.jp/wordpress/wp-includes/review.php",
      "hivekorea.com/jdboard/member/list.php",
      "hmedical.co.kr/include/edit.php",
      "hospitality-partners.co.jp/works/performance/consumer.php",
      "hpc.kau.ac.kr/error2.php",
      "hpc.kau.ac.kr/rolling_banner/tmp4c5ae3.p3a",
      "hrgp.asselsolutions.com/wp-includes/common.php",
      "hsbutton.co.kr/bbs/bbs_write.asp",
      "hspje.com/menu6/teacher_qna.asp",
      "hstudymall.co.kr/easypay/web/bottom.asp",
      "htns.com/eng/skin/member/basic/skin.php",
      "http://103.179.142.171",
      "http://103.225.168.159/admin/verify.php",
      "http://103.35.190.170",
      "http://103.53.176.145:8080/ServiceDeskPlus/products.do",
      "http://104.243.41.127",
      "http://108.181.185.2",
      "http://109.248.144.155",
      "http://109.248.150.13",
      "http://111.68.126.155:8080/ServiceDeskPlus/products.do",
      "http://121.146.68.233/fileserver/temp/platform.asp",
      "http://121.254.224.218/angkor.ylw.common.fileserviceserver/web/document/netframework.asp",
      "http://125.206.177.152/old/viewer.php",
      "http://135.181.123.177",
      "http://135.181.242.24",
      "http://137.117.57.244:8080/ServiceDeskPlus/products.do",
      "http://137.74.114.227/theveniaux/webliotheque/public/css/main.php",
      "http://138.201.50.5",
      "http://141.98.168.79",
      "http://143.198.48.95",
      "http://144.172.100.204",
      "http://144.172.101.178",
      "http://144.172.103.75",
      "http://144.172.105.92",
      "http://144.172.110.72",
      "http://144.172.112.106",
      "http://144.172.112.50",
      "http://144.172.114.159",
      "http://144.172.114.56",
      "http://144.172.115.235",
      "http://144.172.116.19",
      "http://144.172.116.67",
      "http://144.172.117.86",
      "http://144.172.89.183",
      "http://144.172.89.227",
      "http://144.172.91.252",
      "http://144.172.93.69",
      "http://144.172.94.226",
      "http://144.172.95.14",
      "http://144.172.96.35",
      "http://144.172.97.203",
      "http://144.172.97.67",
      "http://144.172.98.156",
      "http://144.172.98.170",
      "http://144.172.98.23",
      "http://144.217.86.88",
      "http://144.76.201.229",
      "http://145.232.235.222",
      "http://146.4.21.94",
      "http://146.70.253.10",
      "http://147.189.172.105",
      "http://15.235.33.14",
      "http://151.106.2.139",
      "http://152.89.247.236",
      "http://152.89.61.240",
      "http://152.89.61.96",
      "http://153.75.91.138",
      "http://154.91.0.196",
      "http://155.94.208.209",
      "http://155.94.210.11",
      "http://156.236.76.9",
      "http://156.245.16.55/admin/admin.asp",
      "http://158.69.57.135",
      "http://159.100.18.177",
      "http://163.245.219.19",
      "http://166.88.134.62",
      "http://166.88.54.158",
      "http://172.86.109.49",
      "http://172.86.113.12",
      "http://172.86.114.141",
      "http://172.86.116.178",
      "http://172.86.64.67",
      "http://172.86.70.173",
      "http://172.86.73.46",
      "http://172.86.88.188",
      "http://173.249.5.112",
      "http://178.128.253.67/tbl_add.php",
      "http://185.231.205.75",
      "http://185.29.8.53",
      "http://191.96.31.38",
      "http://193.56.28.251",
      "http://193.56.28.32",
      "http://195.201.104.22",
      "http://195.201.104.4",
      "http://195.201.104.41",
      "http://195.201.104.53",
      "http://195.201.53.165",
      "http://195.250.29.94",
      "http://198.105.127.210",
      "http://206.71.148.38",
      "http://209.182.224.49",
      "http://213.180.180.154",
      "http://216.107.137.53",
      "http://216.126.224.195",
      "http://216.126.225.83",
      "http://216.126.225.84",
      "http://216.126.227.161",
      "http://216.126.227.187",
      "http://216.126.229.172",
      "http://216.126.236.138",
      "http://216.126.236.244",
      "http://216.126.237.112",
      "http://216.126.237.200",
      "http://216.126.237.86",
      "http://216.158.225.144",
      "http://217.69.0.159",
      "http://217.69.11.60",
      "http://217.69.11.99",
      "http://217.69.3.152",
      "http://23.127.202.249",
      "http://23.227.202.242",
      "http://23.254.164.156",
      "http://23.254.164.232",
      "http://23.254.204.184",
      "http://23.27.13.43",
      "http://23.27.177.183",
      "http://23.27.20.187",
      "http://27.102.113.93",
      "http://3.89.226.234",
      "http://37.238.135.70/img/anan.jpg",
      "http://38.110.228.112",
      "http://40.121.90.194",
      "http://41.208.185.235",
      "http://45.12.134.206",
      "http://45.140.147.208",
      "http://45.159.248.110",
      "http://45.32.150.97",
      "http://45.42.40.200",
      "http://45.42.40.208",
      "http://45.57.245.17",
      "http://45.61.136.204",
      "http://45.61.148.153",
      "http://45.76.160.53",
      "http://45.76.44.240",
      "http://45.8.146.93",
      "http://45.84.226.239",
      "http://45.89.53.54",
      "http://45.95.186.237",
      "http://47.91.56.21/verify.php",
      "http://5.175.184.52",
      "http://5.230.251.49",
      "http://5.230.252.157",
      "http://5.230.44.79",
      "http://52.202.193.124",
      "http://52.79.92.249/bbs/bbs_post.asp",
      "http://62.33.223.164",
      "http://64.188.27.73",
      "http://66.154.102.91",
      "http://69.10.53.86",
      "http://74.119.194.244",
      "http://84.201.189.216",
      "http://86.104.72.247",
      "http://91.206.178.125",
      "http://91.222.173.110",
      "http://91.222.173.138",
      "http://91.222.173.168",
      "http://91.92.120.132",
      "http://91.92.248.50",
      "http://92.222.106.229",
      "http://95.179.235.55",
      "http://95.216.46.218",
      "humingbot.io/cdn/js.asp",
      "hurricanepub.com/include/include.php",
      "ics-kr.com/video/player.php",
      "ictm.or.kr/UPLOAD_file/board/free/edit/index.php",
      "ikrea.or.kr/main/main_board.asp",
      "ilhak.co.kr/images/data/upload.asp",
      "ilovesvc.com/HomePage1/Inquiry/privacy.asp",
      "img.kindermom.co.kr/frameart/print/footer.mov",
      "index-consulting.jp/eng/news/index.php",
      "indoweb.org/love/data/common/common.php",
      "infocop.me/products/list.php",
      "inovecommerce.com.br/public/pdf/view.php",
      "insideforum.me/forum/list.php",
      "iski.silogica.net/events/serial.jsp",
      "ja-fc.or.jp/shop/shopping.php",
      "jinjinpig.co.kr/Anyboard/skin/board.php",
      "jkmusic.co.kr/shop/data/theme/",
      "jsonkeeper.com/b/7EBZP",
      "jsonkeeper.com/b/YY8VI",
      "juliesoskin.com/includes/common/list.php",
      "justholdfast.com/doodle/wp-content/plugins/top.php",
      "juvillage.co.kr/img/upload.asp",
      "k-kiosk.com/bbs/notice_write.asp",
      "kadsm.org/skin/board/basic/write_comment_skin.php",
      "kannadagrahakarakoota.org/forums/admincp/upload.php",
      "kapata-arkeologi.kemdikbud.go.id/pages/payment/payment.php",
      "karin-store.com/recaptcha.php",
      "kartacnictvi.cz/wp-content/plugins/ckeditor-for-wordpress/ckeditor/plugins/image/upload.php",
      "katawaku.jp/bbs/data/theme/profile2.php",
      "kazitradebd.com/wp-content/themes/hello-elementor/includes/customizer/customizer-hand.php",
      "kbcwainwrightchallenge.org.uk/connections/dbconn.asp",
      "kdone.co.kr/Utils/EmailUtil.asp",
      "kenpa.org/yokohama/main.php",
      "kerstpakketten.horesca-meppel.nl/wp-content/plugins/woocommerce/lib.php",
      "keyang.co.kr/pub/editor/wa_path.asp",
      "kgsa1015.co.kr/upload/member/member.asp",
      "khmcpharm.com/Lib/Modules/HtmlEditor/Util/read.cer",
      "kingsvc.cc/index.php",
      "kittimasszazs.hu/images/virag.php",
      "kne.co.kr/upload/Customer/BBS.asp",
      "kscmfs.or.kr/member/handle/log_proc.php",
      "ksmarathon.com/admin/excel2.asp",
      "kstr.radiology.or.kr/upload/schedule/29431_1687715624.inc",
      "ktri.or.kr/upload/mail/upload.asp",
      "kwwa.org/DR6001/FN6006LS.asp",
      "kwwa.org/popup/160307/popup_160308.asp",
      "lastedforcast.com/list.php",
      "lavaandstone.com/wp-content/plugins/fusion-core/about.php",
      "leadsblue.com/wp-content/wp-utility/index.php",
      "leemble.com/5mai-lyon/public/webconf.php",
      "little-pet.com/web/board/skin/default/read.php",
      "locknlockmall.com/common/popup_left.asp",
      "loneeaglerecords.com/wp-content/uploads/2020/01/images.tgz.001",
      "loonsaloon.com/wp-content/plugins/revslider/hello.php",
      "luxmodelagency.com/wp-incluses/random_compat/zeus/wongs/wongs.php",
      "lwac.com/wp-content/plugins/gallery-plugin/includes/demo-data/images/music/photo.php",
      "lyzeum.com/board/bbs/bbs_read.asp",
      "lyzeum.com/images/board/upload.asp",
      "lyzeum.com/popup/popup.asp",
      "magazineschool.co.kr/includes/lm9.asp",
      "mail.clicktocareers.com/dev_clicktocareers/public/mailview.php",
      "mail.clicktocareers.com/public/jobapplications/jdviewer.php",
      "mail.namusoft.kr/jsp/user/eam/board.jsp",
      "mail.neocyon.com/jsp/user/sms/sms_recv.jsp",
      "mail.sisnet.co.kr/jsp/user/sms/sms_recv.jsp",
      "mainbiz.or.kr/SmartEditor2/photo_uploader/popup/edit.asp",
      "mainbiz.or.kr/include/common.asp",
      "manhotline.or.kr/data/member/search.php",
      "mannpublicwhseltd.com/cservice.asp",
      "mantis.jancom.pl/bluemantis/image/addon/addin.php",
      "mantis.westlinks.net/api/soap/mc_enum.php",
      "marmarademo.com/include/extend.php",
      "martiancartel.com/forum/customavatars/avatars.php",
      "materialindia.in/wp/wp-main/gallery/profile2.php",
      "materic.or.kr/files/board/equip/equip_ok.asp",
      "materic.or.kr/include/main/main_top.asp",
      "materic.or.kr/include/main/main_top.xn--asp",
      "matteoragazzini.it/wp-content/uploads/2017/06/category.php",
      "mbrainingevents.com/wp-admin/network/server_test.php",
      "mdim.in.ua/core/cache/index.php",
      "mediostresbarbas.com.ar/php_scrip/banahosting/index.php",
      "medric.or.kr/Controls/Board/certificate.cer",
      "mge.sn/themes/classic/modules/ps_rssfeed/feed.zip",
      "mge.sn/themes/classic/modules/ps_rssfeed/feedmd.zip",
      "mileage.krb.co.kr/common/db_conf.asp",
      "mk.bital.com.br/sac/Formule/Manager.jsp",
      "mnmathleague.com/ckeditor/adapters/index.php",
      "mnmathleague.org/ckeditor/adapters/index.php",
      "mocki.io/v1/32f16c80-602a-4c80-80af-32a9b8220a6b",
      "mokawafm.com/wp-content/plugins/ckeditor-for-wordpress/ckeditor/plugins/image/dialog.php",
      "moonge.cc/wp-content/plugins/google-sitemap-generator/sitemap-builder-embed.php",
      "mudeungsan.or.kr/gbbs/bbs/template/g_botton.php",
      "muijae.com/daumeditor/pages/template/",
      "muijae.com/daumeditor/pages/template/simple.asp",
      "muijae.com/daumeditor/pages/template/template.asp",
      "muzeyyengroup.com/wp-content/help.php",
      "myungokhun.co.kr/_proc/member/member_bk.asp",
      "namchoncc.co.kr/include/?ind=",
      "namchuncheon.co.kr/admin/BookAppl/Search_left.asp",
      "namchuncheon.co.kr/html/notice/list.asp",
      "ne-ba.org/files/gallery/img/img.asp",
      "ne-ba.org/files/news/thumbs/thumbs.asp",
      "necaled.com/modules/applet/list.php",
      "neohr.co.kr/bbs/data/notice/notice.php",
      "new-q-cells.com/upload/newsletter/cn/frame.php",
      "newbusantour.co.kr/gallery/left.asp",
      "newidealupvc.com:443/img/prettyPhoto/jquery.max.php",
      "nextlevelliving.pro/wp-content/uploads/js_composer/images/8c206b81-f5b1-4242-84d3-237ce728ff35.php",
      "nonstopexpress.com/community/include/index.asp",
      "notebooksell.kr/mall/m_schema.php",
      "nrfm.lk/wp-includes/simplepie/content.php",
      "od.lk/d/MzBfMjA1Njc0ODdf/pubmaterial.dotm",
      "okkids.kr/html/program/display/?re=",
      "oldlinewoodwork.com/wp-content/themes/zubin/inc/index.php",
      "olidhealth.com/wp-includes/php-compat/compat.php",
      "ougreen.com/zone",
      "paghera.com/content/view/thumb/info.asp",
      "paghera.com/include/inc-main-default-news.asp",
      "partnerls.pl/wp-content/themes/public/index.php",
      "paulkaren.com/synthpop/main.asp",
      "pcdesk.co.kr/Freeboard/mn_board.asp",
      "pediatrics.or.kr/PubReader/build_css.php",
      "pennontraders.com/assets/slides/view.jsp",
      "pgak.net/service/engine/release.asp",
      "phukien2a.net/images/images.zip.000",
      "pierregems.com/wp-content/themes/woodmart/inc/configs/js-hand.php",
      "pms.nninc.co.kr/app/content/board/inc_list.asp",
      "polyboatowners.com/2010/images/BOTM/upload.php",
      "polyboatowners.com/css/index.php",
      "prestigein-am.jp/akita/wp-includes/wp-rss1.php",
      "projectcell.niv.co.in/non_scientific/service.php",
      "propro.jp/wp-content/documents/docsmgmt.php",
      "prototypetrains.com:443/forums/core/cache/index.php",
      "publishapp.co/update/check.php",
      "puskesmas-terminal.com/wp-content/help.php",
      "pvacek.cz/wp-content/plugins/akismet/control/en/en.jpg",
      "quecue.kr/okproj/ex_join.asp",
      "qwerty.creativehonduras.com/wp-includes/class-wp-redirect.php",
      "radiographers.org/aboutus/aboutus.php",
      "raiestatesandbuilders.com/admin/installer/installer/index.php",
      "recruitment.raystechserv.com/lib/artichow/BarPlotDashboard.object.php",
      "rhythm86.com/wp-content/themes/twentysixteen/about.php",
      "rodaxsankyokorea.com/upload/favicon/favicon.asp",
      "roit.co.kr/xyz/adminer/edit_fail_decoded.asp",
      "roit.co.kr/xyz/mainpage/view.asp",
      "rowdensurname.org/slideshow/slides/show.asp",
      "royalsevres.com/bbs/bbs_img/btn_list.psd",
      "royalsevres.com/javascript/activex_patch.hwp",
      "rsdf.kr/wp-content/uploads/2024/01/index.php",
      "sac.najatelecom.com.br/sac/Dados/ntlm.jsp",
      "sac.onecenter.com.br/sac/masks/wfr_masks.jsp",
      "safemotors.co.kr/daumeditor/pages/template/template.asp",
      "sales.alitho.com/wp-content/themes/sketch/about.php",
      "samwoosystem.co.kr/board/list/write.asp",
      "sanatoliacare.com/include/index.asp",
      "sanlorenzoyacht.com/newsl/include/inc-map.asp",
      "sanlorenzoyacht.com/newsl/uploads/docs/",
      "sanlorenzoyacht.com/newsl/uploads/docs/43.dotm",
      "scertodisha.nic.in/wp-content/plugins/photo-gallery/admin/controllers/Photo.php",
      "scgestor.com.br/wp-content/themes/vantage/inc/template-headers.php",
      "scimpex.com/admin/assets/backup/requisition/requisition.php",
      "semiconductboard.com/xcror",
      "sensationalsecrets.com/js/left.php",
      "seoulanesthesia.or.kr/mail/mail_211230.html",
      "seouldementia.or.kr/_manage/inc/bbs/jiyeuk1_ok.asp",
      "shahrtdc.com/wp-content/plugins/top.php",
      "shcpump.com/admin/form/skin/formBasic/style.php",
      "shieldonline.co.za/sitemap.asp",
      "shikshakibaat.com/classes/detail.jsp",
      "shinwonbook.co.kr/basket/pay/open.asp",
      "shinwonbook.co.kr/board/editor/upload.asp",
      "shipshorejob.com/ckeditor/samples/samples.php",
      "shoppingbagsdirect.com/media/images/?ui=",
      "sideforum.cc/forum/list.php",
      "sinae.or.kr/sub01/index.asp",
      "sinokor-eng.com/sub/sub01_09.asp",
      "siriuskorea.co.kr/mall/community/bbs_read.asp",
      "sistema.celllab.com.br/webrun/Navbar/auth.jsp",
      "sixbitsmedia.com/wp-content/uploads/wp-logs/category.php",
      "snum.or.kr/skin_img/skin.php",
      "sofa.rs/wp-admin/network/server_test.php",
      "sofa.rs/wp-content/themes/twentynineteen/sass/layout/h1.jpg",
      "softapp.co.kr/sub/cscenter/privacy.asp",
      "sora.bz/xoops_root_path/templates_c/login.php",
      "sora.bz/xoops_root_path/uploads/information/about.php",
      "spaincaramoon.com/realestate/wp-content/plugins/gravityforms/forward.php",
      "ssoc.cl/wp-content/plugins/webmention/libraries/emoji-detector/src/Detector.php",
      "stracarrara.org/images/img.asp",
      "stracarrara.org/public/photos/image/image.asp",
      "stracarrara.org/public/photos/image/image.xn--asp",
      "streamf.ru/wp-content/index2.php",
      "style1.co.kr/main/view.asp",
      "sunlin.org/info/style?title=",
      "support.medicalinthecloud.com/TechCenter/include/slide.asp",
      "swedishmassageamsterdam.nl/wp-content/themes/top.php",
      "swt-keystonevalve.com/data/editor/index.php",
      "syadplus.com/search/search_00.asp",
      "tag-cloud-photo.freeware.filetransit.com/login.php",
      "tangowithcolette.com/pages/common.php",
      "teamspit.pro/adverts/follow.php",
      "tecnojournals.com/general",
      "tecnojournals.com/prest",
      "teenbeanjs.com/cloud/javascript.asp",
      "teslacontrols.ir/wp-includes/images/detail31.jpg",
      "teslacontrols.ir/wp-includes/images/detail32.jpg",
      "the.earth.li/~sgtatham/putty/0.80/w64/",
      "theblackout.fr/wp-content/plugins/music-press-pro/music-pro.php",
      "theforceawakenstoys.com/vBulletin/core/cache/upload.php",
      "thek-portal.com/eng/career/index.asp",
      "theorigin.co.kr:443/admin/management/index.php",
      "thestreetsmartsalesman.com/wp-content/uploads/wp-logs/category.php",
      "thetalkingcanvas.com/jobs/en-gb/jobs/9/details.php",
      "thetalkingcanvas.com/thetalking/globalcareers/us/5/careers/jobinfo.php",
      "thevagabondsatchel.com/wp-content/uploads/2019/09/public.avi",
      "threegood.cc/api/manage/customers",
      "tiramisu.it/wp-content/plugins/wp-comment-form.php",
      "torgirf.ru/loginhome.css",
      "totalmateria.net/wp/profile2.php",
      "towingoperations.com/chat/chat.php",
      "tpddata.com/skins/skin-6.thm",
      "tpddata.com/skins/skin-8.thm",
      "trainingpharmacist.co.uk/bootstrap/bootstrap.php",
      "transplugin.io/upload/upload.asp",
      "tronslog.com/public/appstore.php",
      "trophylab.com/design/trophy/product/lmages/logo.png",
      "trophylab.com/notice/images/renewal/upload.asp",
      "turnscor.com/ACT/images/slide/view.jsp",
      "turnscor.com/wp-includes/contacts.php",
      "turnscor.com/wp-includes/feedback.php",
      "ucware.net/skins/PHPMailer-master/index.php",
      "unsunozo.org/include/notes/notes.asp",
      "upload.childu.co.kr/include/OnlyOne1.asp",
      "urbankizomba.se/wp-content/plugins/photo-gallery/filemanager/upload.php",
      "vadtalmandir.org/admin/ckeditor/plugins/icontact/about.php",
      "valentinsblog.de/wp-admin/includes/list.php",
      "varietyjob.com/sitemap/sitemap.asp",
      "vega.mh-tec.jp/.well-known/gallery/siteview.php",
      "vega.mh-tec.jp/.well-known/index.php",
      "vietjetairkorea.com/INFO/info.asp",
      "vinhsake.com/wp-content/uploads/index2.php",
      "vnfmal2022.com/niabbs5/upload/gongji/index.php",
      "warevalley.com/en/common/include/page_tab.asp",
      "warevalley.com/support/orange_open.asp",
      "waterdoblog.com/uploads/index.asp",
      "worldfoodstory.co.uk/wp-includes/register.php",
      "worldspia.kr/upload_images/inc/LOG.PHP",
      "wowpress.co.kr/customer/refuse_05.asp",
      "yakufreshperu.com/facturacion/public/css/main.php",
      "yoohannet.kr/min/tmp/process/proc.php",
      "yoshinorihirano.net/wp-includes/feed-xml.php",
      "youdermoscopy.org/media/fly.avi",
      "youdermoscopy.org/media/fly312.avi",
      "zeandf.com/wp-content/help.php",
      "zeduzeventos.busqueabuse.com/wpadmin/js/widgets/sub/wids.php",
      "zndance.com/shop/post.asp"
    ],
    "url_path": [
      "/.well-known/pki-validation/go/akgo.php",
      "/.well-known/pki-validation/go/boing",
      "/018ueCdS/",
      "/018ueCdS/018ueCdS32.acm",
      "/018ueCdS32.acm",
      "/0lvNAK1t/",
      "/0lvNAK1t/0lvNAK1t32.acm",
      "/0lvNAK1t32.acm",
      "/1uFnvppj/",
      "/1uFnvppj/1uFnvppj32.acm",
      "/1uFnvppj/1uFnvppj64.acm",
      "/1uFnvppj32.acm",
      "/1uFnvppj64.acm",
      "/5Ek9724mz8oncul8Zx7E7CVDCdBNxuFFUO6pLk/",
      "/C0sHwcGMH2/",
      "/DAhkMrMq7/",
      "/DmJMFYpwLPP3ygS/",
      "/Jy5S7hSx0K/",
      "/KcyRbGDJKRZoaLq8lHh8/",
      "/KcyRbGDJKRZoaLq8lHh8/C0sHwcGMH2/",
      "/N3RFYU07",
      "/OJITWH2WFx/",
      "/Of56cYsfVV8/",
      "/Of56cYsfVV8/OJITWH2WFx/Jy5S7hSx0K/fP7saoiPBc/",
      "/QWERTYU890T12HML",
      "/Z7vD3kT0Q5a9N1bW8LxYc4E2rF6pJHsUm_gettext",
      "/Z7vD3kT0Q5a9N1bW8LxYc4E2rF6pJHsUm_upload",
      "/_manage/inc/bbs/jiyeuk1_ok.asp",
      "/aaa000/support.php",
      "/adc/empOQO",
      "/adm_bord/login_new_check.php",
      "/angkor.ylw.common.fileserviceserver/web/document/netframework.asp",
      "/apikey/QWERTYU890T12HML",
      "/asdfghjkl",
      "/bro/ZU1RIOk9",
      "/bro/ZU1WJVq1",
      "/bro/ahNjWa2",
      "/bro/gbNsNg6",
      "/bro/ugDtMe1",
      "/brow/N3RFYU07",
      "/cam-v-ri69.fix",
      "/client/marstech1",
      "/data/geditor/main_1.php",
      "/daumeditor/pages/template/",
      "/daumeditor/pages/template/simple.asp",
      "/daumeditor/pages/template/template.asp",
      "/dnquery.phpinteger",
      "/editor/session/aaa000/support.php",
      "/fP7saoiPBc/",
      "/fileserver/temp/platform.asp",
      "/gallery/profile2.php",
      "/gbNsNg6",
      "/grepmonux.php",
      "/inc/bbs/jiyeuk1_ok.asp",
      "/j/marstech1",
      "/jsp/user/sms/sms_recv.jsp",
      "/ktBaRVjQMhMhzjExBFN9HHONH5W0zuR6qEVaYWfxCaxn2AFeYac9Ai0MDY8GFqgs_gettext",
      "/ktBaRVjQMhMhzjExBFN9HHONH5W0zuR6qEVaYWfxCaxn2AFeYac9Ai0MDY8GFqgs_upload",
      "/levels4SqR8/measure.asp",
      "/logs/officetemplate.php",
      "/mac-v-ri69.fixer",
      "/mall/community/bbs_read.asp",
      "/marstech1",
      "/michalcaladanxyz/",
      "/michalcaladanxyz/caladanecomvp",
      "/niabbs5/upload/gongji/",
      "/niabbs5/upload/gongji/index.php",
      "/paQbmQO0YPKDRyPi7CqrbTV",
      "/payl/ZU1RIOk9",
      "/payl/ZU1WJVq1",
      "/payl/ahNjWa2",
      "/payl/gbNsNg6",
      "/payl/ugDtMe1",
      "/payload/99/81",
      "/payload/99/root",
      "/payload/N3RFYU07",
      "/payload/empOQO",
      "/qwertyuiop",
      "/qwertyuiop/asdfghjkl",
      "/random_compat/zeus/wongs/wongs.php",
      "/realtekwin.update",
      "/tbl_add.php",
      "/theme/profile2.php",
      "/update_coingotrade.php",
      "/video-questions/create/531fbaedf67046d6904478f15d3e7142",
      "/well-known/pki-validation/go/akgo.php",
      "/well-known/pki-validation/go/boing",
      "/wp-admin/network/server_test.php",
      "/wp/profile2.php",
      "/zeus/wongs/wongs.php"
    ]
  },
  "last_modified": "2026-08-07T08:13:46+00:00",
  "maltrail_groups": [
    "LAZARUS"
  ],
  "references": [
    "http://report.threatbook.cn/LS.pdf (Chinese)",
    "https://0x0d4y.blog/arsenal-analysis-of-a-nation-state-actor-an-in-depth-look-at-lazarus-scoringmathtea/",
    "https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/",
    "https://adelnz.com/writing/npm-install-is-dangerous/",
    "https://analyze.intezer.com/analyses/13d64c6e-6ac7-4888-a682-138a06cbaf16/",
    "https://any.run/cybersecurity-blog/ottercookie-malware-analysis/",
    "https://any.run/cybersecurity-blog/pylangghost-malware-analysis/",
    "https://app.any.run/tasks/01497f45-7fba-4356-bbdc-4270e51c2465/",
    "https://app.any.run/tasks/109752e9-2c7f-4d5c-9c3f-300bddc4c0db/",
    "https://app.any.run/tasks/42c972b1-ec38-4637-9354-9de930ff50b2/",
    "https://app.any.run/tasks/5ddb7e93-bfc8-49a9-bd52-6b70f57c3846/",
    "https://app.any.run/tasks/ff306f89-64d4-4d30-8b72-7c0be0b1f9fb/",
    "https://app.validin.com/axon?find=62.133.61.204&type=ip",
    "https://app.validin.com/axon?source=DNS&type=ip&find=23.254.129.6",
    "https://app.validin.com/detail?find=%20Solar%20Explorer&type=raw&ref_id=2c9cf18cb5d#tab=host_pairs (# 2025-08-26)",
    "https://app.validin.com/detail?find=%2Fzoom%2Ferror&type=raw&ref_id=cca7f8289eb#tab=host_pairs (# 2025-03-14)",
    "https://app.validin.com/detail?find=%2Fzoom%2Fjoin&type=raw&ref_id=cca7f8289eb#tab=host_pairs (# 2025-03-14)",
    "https://app.validin.com/detail?find=%3A%3A%22og%3Adescription%22%3A%22description%22%3A%22Willo%20is%20a%20platform%20for%20structured%2C%20asynchronous%2C%20video%20creation%20and%20sharing.%20We%20help%20organisations%20everywhere%20discover%20and%20connect%20with%20more%20people.%22&type=raw&ref_id=a33de82ac6e#tab=host_pairs (# 2024-12-28)",
    "https://app.validin.com/detail?find=%3A%3A%22og%3Atitle%22%3A%3A%22SITUS%20SLOT%20DEPO%2010K%20%F0%9F%92%8E%20Situs%20Viral%20Minimal%20DP%2010.000%20Gampang%20Menang%22&type=raw&ref_id=92eff97ba42#tab=host_pairs",
    "https://app.validin.com/detail?find=%3A%3A%3A%22keywords%22%3A%22hiring%20platform%2C%20recruitment%20software%2C%20candidate%20screening%2C%20talent%20evaluation%2C%20skills-based%20hiring%2C%20interview%20tools%2C%20tech%20hiring%2C%20remote%20hiring%2C%20hiring%20automation%2C%20team%20building%22&type=raw#tab=host_pairs (# 2025-09-08)",
    "https://app.validin.com/detail?find=%3A%3A%3A%22keywords%22%3A%22hiring%2C%20recruitment%2C%20assessment%2C%20talent%20evaluation%2C%20interview%20platform%2C%20employee%20skills%22&type=raw&ref_id=b6a09e2884b#tab=host_pairs (# 2025-07-16)",
    "https://app.validin.com/detail?find=%3A%3A%3A%22twitter%3Acard%22%3A%22MotionAssess%20Card%22&type=raw&ref_id=060cb05f4b2#tab=host_pairs (# 2025-07-16)",
    "https://app.validin.com/detail?find=%3A%3A%3A%22twitter%3Acreator%22%3A%22%40skillvisions%22&type=raw&ref_id=91cf464b398#tab=host_pairs (# 2025-07-16)",
    "https://app.validin.com/detail?find=0a4bb3c47c527ff1cd8b53fbe0dcd159&type=hash#tab=host_pairs (# 2025-03-05)",
    "https://app.validin.com/detail?find=135.181.163.182&type=ip4&ref_id=9058ba7500b#tab=resolutions",
    "https://app.validin.com/detail?find=138.128.165.91&type=ip4&ref_id=d07daaf12d1#tab=resolutions (# 2025-02-27)",
    "https://app.validin.com/detail?find=167.88.36.13&type=ip4&ref_id=545b0c93f1c#tab=resolutions",
    "https://app.validin.com/detail?find=185.100.87.82&type=ip4&ref_id=2c13cb80e43#tab=resolutions",
    "https://app.validin.com/detail?find=185.135.84.58&type=ip4&ref_id=5a6b4dd9f9e#tab=resolutions",
    "https://app.validin.com/detail?find=190.97.166.164&type=ip4&ref_id=ce0a2dc7d44#tab=resolutions",
    "https://app.validin.com/detail?find=195.133.88.31&type=ip4&ref_id=24685dca12a#tab=resolutions",
    "https://app.validin.com/detail?find=195.35.38.215&type=ip4&ref_id=25087bf71b4#tab=resolutions (# 2025-03-01)",
    "https://app.validin.com/detail?find=1da7c4f8368cdc8cf054e3f3ef560ec8&type=hash&ref_id=c4a2719f1ec#tab=host_pairs (# 2025-04-25)",
    "https://app.validin.com/detail?find=23.254.244.74&type=ip4&ref_id=263630d721d#tab=resolutions",
    "https://app.validin.com/detail?find=23.254.253.148&type=ip4&ref_id=5af70a4c3a0#tab=resolutions (# 2025-04-17)",
    "https://app.validin.com/detail?find=2e8498a098fd04d28ee900521de053b3&type=hash&ref_id=4d03061f4ff#tab=host_pairs (# 2025-04-27)",
    "https://app.validin.com/detail?find=31.220.40.22&type=ip4&ref_id=e4480ae66af#tab=resolutions",
    "https://app.validin.com/detail?find=38.110.228.112&type=ip4&ref_id=7b554bab928#tab=resolutions (# 2025-03-14)",
    "https://app.validin.com/detail?find=3934696b4640069f357c788ff3508f4f&type=hash&ref_id=029fac138c3#tab=host_pairs (# 2025-02-27)",
    "https://app.validin.com/detail?find=45.32.90.176&type=ip4&ref_id=d162d0bbffd#tab=resolutions",
    "https://app.validin.com/detail?find=45.86.230.189&type=ip4&ref_id=2dd37ed5db5#tab=resolutions",
    "https://app.validin.com/detail?find=45.89.245.88&type=ip4&ref_id=49b32a66a80#tab=resolutions (# 2025-02-26)",
    "https://app.validin.com/detail?find=51.210.235.36&type=ip4&ref_id=9c0bb8dc123#tab=host_pairs (# 2025-04-13)",
    "https://app.validin.com/detail?find=51.210.235.45&type=ip4&ref_id=d5055d61a61#tab=resolutions (# 2025-03-07)",
    "https://app.validin.com/detail?find=51.79.133.76&type=ip4&ref_id=e843c726398#tab=resolutions",
    "https://app.validin.com/detail?find=528ab116aa10f63a5156ed906744fcc9&type=hash#tab=host_pairs (# 2025-03-24)",
    "https://app.validin.com/detail?find=65.21.19.33&type=ip4&ref_id=9058ba7500b#tab=resolutions",
    "https://app.validin.com/detail?find=66.29.141.73&type=ip4&ref_id=5db4210a5c4#tab=resolutions",
    "https://app.validin.com/detail?find=6c38526ceb115206329131fc840bb881&type=hash&ref_id=04d59776778#tab=host_pairs",
    "https://app.validin.com/detail?find=78.110.166.82&type=ip4&ref_id=3862e914a67#tab=resolutions (# 2025-03-01)",
    "https://app.validin.com/detail?find=8452ce8ad04afa240e1e8b65d4b3343a&type=hash&ref_id=e867567f0d8#tab=host_pairs (# 2025-02-24)",
    "https://app.validin.com/detail?find=91.222.173.30&type=ip4&ref_id=8b2f0b868b7#tab=resolutions (# 2025-02-24)",
    "https://app.validin.com/detail?find=91.90.121.28&type=ip4&ref_id=8c1f7873b55#tab=resolutions",
    "https://app.validin.com/detail?find=92e6a5d3a7f7f2cf909fa50522b44b4d33719202db005383be611a2e68a3d5b3&type=hash&ref_id=77a108e8213#tab=host_pairs_v2",
    "https://app.validin.com/detail?find=954d80b823db3724aa3936475f9a7505&type=hash&ref_id=8ae40870ea8#tab=host_pairs",
    "https://app.validin.com/detail?find=Alphanomics%20Racer&type=raw&ref_id=48da85c573d#tab=host_responses (# 2025-04-26)",
    "https://app.validin.com/detail?find=BlockOvas&type=raw#tab=host_pairs (# 2025-07-21)",
    "https://app.validin.com/detail?find=Coinbase%20-%20Buy%20and%20Sell%20Bitcoin%2C%20Ethereum%2C%20and%20more%20with%20trust&type=raw&ref_id=c888fcffa16#tab=host_pairs (# 2025-03-31)",
    "https://app.validin.com/detail?find=Coinlend%20DeFi&type=raw&ref_id=af6318fa6e3#tab=host_pairs (# 2025-05-22)",
    "https://app.validin.com/detail?find=Crypto%20Ledger&type=raw&ref_id=fb1de658046#tab=host_pairs (# 2025-01-20)",
    "https://app.validin.com/detail?find=IT%20Company%20Website&type=raw#tab=host_pairs (# 2025-08-26)",
    "https://app.validin.com/detail?find=Interview&type=raw&ref_id=64a8ed2f563#tab=host_pairs",
    "https://app.validin.com/detail?find=L-Administrator&type=raw&ref_id=7c876e7935a#tab=host_pairs",
    "https://app.validin.com/detail?find=Node.js%20upload%20multiple%20files&type=raw&ref_id=02496d38d39#tab=host_pairs (# 2025-04-30)",
    "https://app.validin.com/detail?find=Node.js%20upload%20multiple%20files&type=raw&ref_id=02496d38d39#tab=host_pairs (# 2025-08-02)",
    "https://app.validin.com/detail?find=SkillMaster&type=raw&ref_id=04a9609e38c#tab=host_pairs (# 2025-03-05)",
    "https://app.validin.com/detail?find=Talent%20Hire%20Flow&type=raw&ref_id=060cb05f4b2#tab=host_pairs (# 2025-07-15)",
    "https://app.validin.com/detail?find=TalentCheck&type=raw#tab=host_pairs",
    "https://app.validin.com/detail?find=Team%20Monitor&type=raw&ref_id=48da85c573d#tab=host_responses (# 2025-04-26)",
    "https://app.validin.com/detail?find=VScode&type=raw&ref_id=689da69896f#tab=host_pairs (# 2026-04-10)",
    "https://app.validin.com/detail?find=Video%20Recruting%20-%20Find%2C%20Interview&type=raw&ref_id=6b735d3d78d#tab=host_pairs (# 2025-02-24)",
    "https://app.validin.com/detail?find=Zoom%20Meeting&type=raw#tab=host_pairs (# 2025-06-19)",
    "https://app.validin.com/detail?find=Zoom%20Meeting&type=raw&ref_id=af1604aa97f#tab=host_pairs",
    "https://app.validin.com/detail?find=a142257525e31628ead74927c88695f8&type=hash#tab=host_pairs (# 2025-03-08)",
    "https://app.validin.com/detail?find=b68075c8f2aaef80fa70d7c562804f25&type=hash&ref_id=799956bbc73#tab=host_pairs (# 2025-04-26)",
    "https://app.validin.com/detail?find=b99acd5a518e05c1adbb592ad4192334&type=hash&ref_id=05f30f00222#tab=host_pairs (# 2025-04-26)",
    "https://app.validin.com/detail?find=c35874ba204e503c8e96bd275956e0cb&type=hash&ref_id=f5e249222ea#tab=host_pairs (# 2025-07-22)",
    "https://app.validin.com/detail?find=c87d57c84529f76a1212c0050d434162c729617c#tab=host_pairs (# 2025-08-26)",
    "https://app.validin.com/detail?find=contato.impreza.email&type=dom&ref_id=63a84babf20#tab=dns (# 2025-06-13)",
    "https://app.validin.com/detail?find=d590539b3bdf826ec5f7ce7be46d7dcb&type=hash&ref_id=8e7c052fd41#tab=host_pairs (# 2025-02-11)",
    "https://app.validin.com/detail?find=d7434f80ddd2395783c6f935cab65a6c&type=hash&ref_id=85f9a34e59c#tab=host_pairs (# 2025-06-16)",
    "https://app.validin.com/detail?find=dd5bd7746a6f5cbc843f54ecfc7ed780&type=hash&ref_id=056495bef48#tab=host_pairs (# 2025-06-24)",
    "https://app.validin.com/detail?find=f002a88cbb7b49e66036&type=hash&ref_id=a4d0e878c1e#tab=host_pairs (# 2025-06-05)",
    "https://app.validin.com/detail?find=f4407a84d90c5ecc1025&type=hash&ref_id=297005cc469#tab=host_pairs (# 2025-07-22)",
    "https://app.validin.com/detail?find=regular-meeting.online&type=dom#tab=resolutions",
    "https://app.validin.com/detail?find=regular-meeting.pro&type=dom#tab=resolutions",
    "https://app.validin.com/detail?find=rockhoster.gmail.com&type=dom&ref_id=b801936350f#tab=dns (# 2025-05-29)",
    "https://app.validin.com/detail?find=wassmestaazh.pro&type=raw&ref_id=22540801568#tab=host_pairs (# 2024-12-10)",
    "https://app.validin.com/detail?type=hash&find=b68075c8f2aaef80fa70d7c562804f25#tab=host_pairs (# 2025-04-27)",
    "https://app.validin.com/detail?type=ip&find=104.168.203.161",
    "https://app.validin.com/detail?type=ip&find=194.59.183.241#tab=resolutions",
    "https://app.validin.com/detail?type=ip&find=45.11.181.47#tab=resolutions",
    "https://app.validin.com/detail?type=ip&find=45.61.158.14#tab=resolutions",
    "https://app.validin.com/detail?type=ip&find=67.43.234.98#tab=resolutions",
    "https://app.validin.com/detail?type=ip&find=94.247.42.70#tab=resolutions",
    "https://app.validin.com/detail?type=raw&find=BlockNovas#tab=host_pairs (# 2025-04-26)",
    "https://app.validin.com/detail?type=raw&find=BlockNovas+LLC#tab=host_pairs (# 2025-04-25)",
    "https://app.validin.com/detail?type=raw&find=Just+a+moment...#tab=reputation (# 2026-02-25)",
    "https://asec.ahnlab.com/1323 (Korean)",
    "https://asec.ahnlab.com/en/54195/",
    "https://asec.ahnlab.com/en/56405/",
    "https://asec.ahnlab.com/en/59073/",
    "https://asec.ahnlab.com/en/63192/",
    "https://asec.ahnlab.com/en/85400/",
    "https://asec.ahnlab.com/en/87299/",
    "https://asec.ahnlab.com/ko/33034/ (Korean)",
    "https://asec.ahnlab.com/ko/33706/",
    "https://asec.ahnlab.com/ko/48416/",
    "https://blog.alyac.co.kr/2219",
    "https://blog.alyac.co.kr/2388 (Korean)",
    "https://blog.alyac.co.kr/2500 (Korean)",
    "https://blog.fox-it.com/2025/09/01/three-lazarus-rats-coming-for-your-cheese/",
    "https://blog.fox-it.com/2026/05/22/remotepe-the-lazarus-rat-that-lives-in-memory/",
    "https://blog.google/threat-analysis-group/active-north-korean-campaign-targeting-security-researchers/",
    "https://blog.google/threat-analysis-group/countering-threats-north-korea/",
    "https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/",
    "https://blog.malwarebytes.com/threat-analysis/2020/05/new-mac-variant-of-lazarus-dacls-rat-distributed-via-trojanized-2fa-app/",
    "https://blog.netlab.360.com/dacls-the-dual-platform-rat/",
    "https://blog.nviso.eu/2025/11/13/contagious-interview-actors-now-utilize-json-storage-services-for-malware-delivery/",
    "https://blog.phylum.io/north-korea-still-attacking-developers-via-npm/",
    "https://blog.reversinglabs.com/blog/hidden-cobra",
    "https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/",
    "https://blog.talosintelligence.com/2020/11/crat-and-plugins.html",
    "https://blog.talosintelligence.com/2022/09/lazarus-magicrat.html",
    "https://blog.talosintelligence.com/beavertail-and-ottercookie/",
    "https://blog.talosintelligence.com/lazarus-collectionrat/",
    "https://blog.talosintelligence.com/lazarus_new_rats_dlang_and_telegram/",
    "https://blog.talosintelligence.com/python-version-of-golangghost-rat/ (# pychollima)",
    "https://blogs.jpcert.or.jp/en/2020/08/Lazarus-malware.html",
    "https://blogs.jpcert.or.jp/en/2020/09/BLINDINGCAN.html",
    "https://blogs.jpcert.or.jp/en/2021/01/Lazarus_malware2.html",
    "https://blogs.jpcert.or.jp/en/2022/07/vsingle.html",
    "https://blogs.jpcert.or.jp/en/2022/07/yamabot.html",
    "https://blogs.jpcert.or.jp/en/2023/07/dangerouspassword_dev.html",
    "https://cdn.securelist.com/files/2017/04/Lazarus_Under_The_Hood_PDF_final.pdf",
    "https://checkmarx.com/blog/a-new-north-korean-group-emerges-disrupting-the-open-source-ecosystem/",
    "https://checkmarx.com/zero-post/chainveil-a-malicious-npm-supply-chain-attack-by-successkey/",
    "https://cloud.google.com/blog/topics/threat-intelligence/mitigating-dprk-it-worker-threat",
    "https://community.emergingthreats.net/t/ruleset-update-summary-2022-12-02-v10187/190",
    "https://community.emergingthreats.net/t/ruleset-update-summary-2023-10-30-v10452/1080",
    "https://community.emergingthreats.net/t/ruleset-update-summary-2023-12-06-v10480/1183",
    "https://community.emergingthreats.net/t/ruleset-update-summary-2025-03-05-v10872/2497",
    "https://cybersecuritynews.com/lazarus-group-infostealer-malwares-attacking-developers/",
    "https://dmpdump.github.io/posts/NorthKorea_Backdoor_Stealer/",
    "https://enki.co.kr/blog/2021/02/04/ie_0day.html (Korean)",
    "https://expel.com/blog/inside-lazarus-how-north-korea-uses-ai-to-industrialize-attacks-on-developers/",
    "https://explore.avertium.com/resource/an-in-depth-look-at-north-korean-threat-actor-zinc",
    "https://g-les.github.io/yara/2024/01/04/100DaysofYARA-CosmicRust.html",
    "https://gbhackers.com/lazarus-group-malware-with-ottercookie/",
    "https://gist.github.com/danslo/1778c3bf30d65967db2d680727cbc89d",
    "https://gist.github.com/danslo/18962c2dc0e41650d9db92adf0d7fc1a",
    "https://gist.github.com/danslo/390782908532ef78b137cf14bd403a7e",
    "https://gist.github.com/danslo/edb46198720ed0f4ad6e4b1c4b481efe",
    "https://gist.githubusercontent.com/danslo/f27bda16ead7ec8d1604922869fa5568/raw/13d3af30dfb306edaaade5aa723114d96f08518e/analysis.txt",
    "https://gist.githubusercontent.com/danslo/fb62df9fcc65ae252ffb0c416fe35b4d/raw/e895416c7b708966ab1b3973c648dec39d6cf129/gistfile1.txt",
    "https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-02-04-IOCs-for-December-2025-Contagious-Interview-activity.txt",
    "https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/North%20Korea/APT/Lazarus/2020-05-05/Analysis.md#IOC",
    "https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/North%20Korea/APT/Lazarus/2020-05-05/CSV/IOC-Lazarus_2020_05_05.csv",
    "https://github.com/ThreatLabz/iocs/blob/main/contagiousinterview/c2s.txt",
    "https://github.com/advanced-threat-research/IOCs/blob/master/2017/2017-11-20-android-malware-appears-linked-to-lazarus-cybercrime-group/android-malware-appears-linked-to-lazarus-cybercrime-group.csv",
    "https://github.com/advanced-threat-research/IOCs/blob/master/2018/2018-02-12-lazarus-resurfaces-targets-global-banks-bitcoin-users/lazarus-resurfaces-targets-global-banks-bitcoin-users.csv",
    "https://github.com/advanced-threat-research/IOCs/blob/master/2018/2018-03-08-hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant.csv",
    "https://github.com/blackorbird/APT_REPORT/blob/master/lazarus/2024-10-14%20Lazarus%20InvisibleFerret.pdf",
    "https://github.com/eSentire/iocs/blob/main/Lazarus/lazarus_iocs_10-15-2024.txt",
    "https://github.com/eset/malware-ioc/tree/master/nukesped_lazarus",
    "https://github.com/motuariki/IOCs/blob/main/DPRK%20Tracking/04-12-2025-DPRK-Fake-Meeting-Infrastructure",
    "https://github.com/ti-research-io/ti/blob/main/ioc_extender/ET_Lazarus.json",
    "https://github.com/ti-research-io/ti/blob/main/ioc_extender/ET_Lazarus_APT_Related.json",
    "https://gitlab-com.gitlab.io/gl-security/security-tech-notes/threat-intelligence-tech-notes/north-korean-malware-sept-2025/",
    "https://hackernoon.com/cybercrooks-are-using-fake-job-listings-to-steal-crypto",
    "https://hunt.io/blog/dprk-lazarus-kimsuky-infrastructure-uncovered",
    "https://hunt.io/blog/suspected-north-korean-hackers-target-blockchain-community-via-telegram",
    "https://ics-cert.kaspersky.com/publications/reports/2021/12/16/pseudomanuscrypt-a-mass-scale-spyware-attack-campaign/",
    "https://ics-cert.kaspersky.com/reports/2021/12/16/pseudomanuscrypt-a-mass-scale-spyware-attack-campaign/",
    "https://intel.breakglass.tech/post/lazarus-group-is-using-the-solana-blockchain-as-a-dead-drop-c2-channel-and-nobody-noticed-for-4-months",
    "https://jp.security.ntt/insights_resources/tech_blog/ottercandy_malware_e/",
    "https://jp.security.ntt/insights_resources/tech_blog/stoatwaffle_malware_en/",
    "https://jp.security.ntt/tech_blog/contagious-interview-ottercookie",
    "https://jp.security.ntt/tech_blog/en-waterplum-ottercookie",
    "https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_302_kodera_jp.pdf (Japanese)",
    "https://kl4r10n.tech/blog/dprk-new-malware",
    "https://kmsec.uk/blog/pylangghost-npm/",
    "https://labs.sentinelone.com/dprk-hidden-cobra-update-north-korean-malicious-cyber-activity/",
    "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/18092216/Updated-MATA-attacks-Eastern-Europe_full-report_ENG.pdf",
    "https://medium.com/@DCSO_CyTec/andariels-jupiter-malware-and-the-case-of-the-curious-c2-dbfe29f57499",
    "https://medium.com/deriv-tech/how-a-fake-ai-recruiter-delivers-five-staged-malware-disguised-as-a-dream-job-64cc68fec263",
    "https://medium.com/s2wlab/analysis-of-lazarus-malware-abusing-non-activex-module-in-south-korea-7d52b9539c12",
    "https://mp.weixin.qq.com/s/2sV-DrleHiJMSpSCW0kAMg (Korean)",
    "https://mp.weixin.qq.com/s/3kwDMAXviaE1TUDnkYlqrg",
    "https://mp.weixin.qq.com/s/84lUaNSGo4lhQlpnCVUHfQ",
    "https://mp.weixin.qq.com/s/USitU4jAg9y2XkQxbwcAPQ",
    "https://mp.weixin.qq.com/s/Xs54_RDKU5MvkvsPPCGKEw (Chinese)",
    "https://mp.weixin.qq.com/s/f5YE12w3x3wad5EO0EB53Q",
    "https://mp.weixin.qq.com/s/y-SHoh9f5qwAwqml3uf8vw",
    "https://mp.weixin.qq.com/s?__biz=MzUyMjk4NzExMA%3D%3D&mid=2247492789&idx=1&sn=a991e6c5ed7388515d75f02e9c33428f",
    "https://mp.weixin.qq.com/s?__biz=MzUyMjk4NzExMA==&mid=2247505438&idx=1&sn=cf1947c7af6581f4a66460ae6d14dc2f",
    "https://mp.weixin.qq.com/s?__biz=MzUyMjk4NzExMA==&mid=2247505519&idx=1&sn=594229f2c0123673d1fa9c6cf729858b&chksm=f9c1e566ceb66c701d875de8481fe02d89654d4b56cfc51088de6e421cb701437cdab52a0851&scene=178&cur_album_id=1955835290309230595",
    "https://nkinternet.com/2026/05/26/dprk-captive-portal-infrastructure-found-in-testing/",
    "https://objective-see.com/blog/blog_0x49.html (# AppleJeus)",
    "https://objective-see.com/blog/blog_0x57.html",
    "https://objective-see.org/blog/blog_0x7A.html",
    "https://opensourcemalware.com/blog/dprk-git-hooks-malware",
    "https://opensourcemalware.com/blog/latest-contagious-interview-malware-campaign-abuses-microsoft-vscode-tasks",
    "https://opensourcemalware.com/blog/tasksjacker-blog-post",
    "https://otx.alienvault.com/pulse/5c8b8e19261a7451de02bf60/",
    "https://otx.alienvault.com/pulse/5c9a4d9f90726d0988873a2b",
    "https://otx.alienvault.com/pulse/5d24562845fe64e37ffc46a7",
    "https://otx.alienvault.com/pulse/5d2c64b174175b03e7db85cd",
    "https://otx.alienvault.com/pulse/5d2dca0a1c7d00fa07be15e5",
    "https://otx.alienvault.com/pulse/5d6940cb9e719255258969f5",
    "https://otx.alienvault.com/pulse/5d88b31dea7f4b9d4701d7e8",
    "https://otx.alienvault.com/pulse/5db06ad90686f3bad959d7fc",
    "https://otx.alienvault.com/pulse/5e15b526b4f8bc605744ad76",
    "https://otx.alienvault.com/pulse/5eb2fabf6c26a287f705ca20",
    "https://otx.alienvault.com/pulse/5ef2252af73ae43d92eecd15",
    "https://otx.alienvault.com/pulse/5f4d20e8d417f271a62e0aeb",
    "https://otx.alienvault.com/pulse/5f7389601681e32d5bf045f6",
    "https://otx.alienvault.com/pulse/5faf04431c479940b422288b",
    "https://otx.alienvault.com/pulse/5fb4044fd5f18831c24c6af6",
    "https://otx.alienvault.com/pulse/5fd8dbfcfed23b6fa1393ea9",
    "https://otx.alienvault.com/pulse/5fe36c30dbe6a83c04783415",
    "https://otx.alienvault.com/pulse/60103a3268891c63b1f24d74",
    "https://otx.alienvault.com/pulse/601052e27a2c451b3ba5ed31",
    "https://otx.alienvault.com/pulse/6037c3cea83bb963f5be0d51/",
    "https://otx.alienvault.com/pulse/60739323ef1b2b3a187f0f15",
    "https://otx.alienvault.com/pulse/608af383c5be4591c5da02e5",
    "https://otx.alienvault.com/pulse/60e6d2a6786d43397db19bc7",
    "https://otx.alienvault.com/pulse/60f930c9c1a69acdb28adea6",
    "https://otx.alienvault.com/pulse/61bca21cf212a6842e17c00b",
    "https://otx.alienvault.com/pulse/61c9aff8d72c2a4731021bee",
    "https://otx.alienvault.com/pulse/6246c2c9082f5d1a7c15ffba",
    "https://otx.alienvault.com/pulse/625d3bb7b78be557e145d2c7",
    "https://otx.alienvault.com/pulse/625e65bf6aa1f7977a316d65",
    "https://otx.alienvault.com/pulse/625e688f46dbcbce7ac0668d",
    "https://otx.alienvault.com/pulse/62d153ef7d6fbe552403bc90",
    "https://otx.alienvault.com/pulse/6336cd77cbc019c475aa2034",
    "https://otx.alienvault.com/pulse/633c7f2703c1f6dec01555e5",
    "https://otx.alienvault.com/pulse/637f670d45a399f00e8aea3c",
    "https://otx.alienvault.com/pulse/63ff76797371033cf70b2df3",
    "https://otx.alienvault.com/pulse/6490761db8416aad20dd9404",
    "https://otx.alienvault.com/pulse/64a2f58febf38755c4240c34",
    "https://otx.alienvault.com/pulse/64f0a87de1d155ccb31c3561",
    "https://otx.alienvault.com/pulse/64fa0325f88b5109856801c8",
    "https://otx.alienvault.com/pulse/653c0681ae38ba0d7d84e538",
    "https://otx.alienvault.com/pulse/65534130052d1800f62e7ba2",
    "https://otx.alienvault.com/pulse/655dd802326b4dba522c9d84",
    "https://otx.alienvault.com/pulse/655e254bda9c2bd236bc188f",
    "https://otx.alienvault.com/pulse/655f0ab585a20bff0cac8b7c",
    "https://otx.alienvault.com/pulse/65773dc2466c7161e66b3d07",
    "https://panther.com/blog/tracking-an-ottercookie-infostealer-campaign-across-npm",
    "https://pastebin.com/G0Ad5Ut6",
    "https://pastebin.com/raw/cLWvyJ20",
    "https://platform.censys.io/search?q=b86140ad75113e930e40228d3e1d7ba1f9e48abb0e02ee293bdd40d6cde8c061",
    "https://radar.securityalliance.org/vs-code-tasks-abuse-by-contagious-interview-dprk/",
    "https://raw.githubusercontent.com/0xKoda/ioc-public/main/ioc.json",
    "https://redasgard.com/blog/hunting-lazarus-contagious-interview-c2-infrastructure",
    "https://redasgard.com/blog/hunting-lazarus-part2-blockchain-dead-drop",
    "https://redasgard.com/blog/hunting-lazarus-part4-real-blood-on-the-wire",
    "https://redasgard.com/blog/hunting-lazarus-part5-eleven-hours-on-his-disk",
    "https://research.jfrog.com/post/hijacked-npm-vscode-tasks-blockchain/",
    "https://research.jfrog.com/post/rollup-polyfill-masquerading/",
    "https://roman.pt/posts/linkedin-backdoor/",
    "https://sandyclaw.permiso.io/shared/9cC7Jc0sJawMbpikB3ONEehU5aoK91bFu65CtaRUwzU",
    "https://sansec.io/research/north-korea-magecart",
    "https://search.censys.io/hosts/185.153.182.241/data/table#1224-TCP-HTTP",
    "https://search.censys.io/hosts/185.53.46.38",
    "https://search.censys.io/hosts/216.173.115.200/data/table#1244-TCP-UNKNOWN",
    "https://search.censys.io/hosts/45.61.128.122",
    "https://search.censys.io/hosts/67.203.7.209/data/table#1244-TCP-HTTP",
    "https://search.censys.io/hosts/74.119.194.129/",
    "https://search.censys.io/hosts/95.164.45.239/",
    "https://search.censys.io/hosts/95.164.7.171https://search.censys.io/hosts/95.164.7.171",
    "https://search.censys.io/hosts/95.169.180.146",
    "https://search.censys.io/hosts/95.179.135.133",
    "https://search.censys.io/search?q=services.http.response.headers%3A+%28key%3A+%60ETag%60+and+value.headers%3A+%60W%2F%22841-18e75d61ccb%22%60%29&resource=hosts",
    "https://search.censys.io/search?q=services.http.response.headers%3A+%28key%3A+%60ETag%60+and+value.headers%3A+%60W%2F%2286b-1886de13223%22%60%29&resource=hosts",
    "https://search.censys.io/search?q=services.http.response.html_tags%3D%22%3Ctitle%3ENode.js+upload+multiple+files%3C%2Ftitle%3E%22&resource=hosts",
    "https://search.censys.io/search?q=services.http.response.html_title%3D%22Node.js+upload+multiple+files%22&resource=hosts (# 2024-12-23)",
    "https://search.censys.io/search?resource=hosts&sort=RELEVANCE&per_page=25&virtual_hosts=EXCLUDE&q=services.jarm.fingerprint%3A+2ad2ad0002ad2ad00042d42d00000000f78d2dc0ce6e5bbc5b8149a4872356+AND+%22hwc-hwp-7982830%22",
    "https://securelist.com/andariel-deploys-dtrack-and-maui-ransomware/107063/",
    "https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/102811/",
    "https://securelist.com/cryptocurrency-businesses-still-being-targeted-by-lazarus/90019/",
    "https://securelist.com/dtrack-targeting-europe-latin-america/107798/",
    "https://securelist.com/lazarus-apt-steals-crypto-with-a-tank-game/114282/",
    "https://securelist.com/lazarus-covets-covid-19-related-intelligence/99906/",
    "https://securelist.com/lazarus-threatneedle/100803/",
    "https://securelist.com/lazarus-trojanized-defi-app/106195/",
    "https://securelist.com/mata-multi-platform-targeted-malware-framework/97746/",
    "https://securelist.com/my-name-is-dtrack/93338/",
    "https://securelist.com/operation-applejeus-sequel/95596/",
    "https://securelist.com/operation-applejeus/87553/",
    "https://securelist.com/operation-synchole-watering-hole-attacks-by-lazarus/116326/",
    "https://securelist.com/unveiling-lazarus-new-campaign/110888/",
    "https://securelist.com/updated-mata-attacks-industrial-companies-in-eastern-europe/110829/",
    "https://securityscorecard.com/wp-content/uploads/2025/02/Operation-Marstech-Mayhem-Report_021025_03.pdf",
    "https://slowmist.medium.com/analysis-of-north-korean-hackers-targeted-phishing-scams-on-telegram-872db3f7392b",
    "https://slowmist.medium.com/cryptocurrency-apt-intelligence-unveiling-lazarus-groups-intrusion-techniques-a1a6efda7d34",
    "https://slowmist.medium.com/threat-intelligence-uncovering-a-web3-interview-scam-bb366694b7f3",
    "https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages",
    "https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages (# hexeval loader, xorindex loader)",
    "https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket",
    "https://socket.dev/blog/lazarus-strikes-npm-again-with-a-new-wave-of-malicious-packages",
    "https://socket.dev/blog/new-pypi-malware-exfiltrates-ethereum-private-keys",
    "https://socket.dev/blog/north-korea-contagious-interview-campaign-338-malicious-npm-packages",
    "https://socket.dev/blog/north-korea-contagious-interview-npm-attacks",
    "https://socket.dev/blog/north-korean-apt-lazarus-targets-developers-with-malicious-npm-package",
    "https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages",
    "https://socket.dev/blog/npm-malware-targets-telegram-bot-developers",
    "https://socket.dev/blog/stegabin-26-malicious-npm-packages-use-pastebin-steganography",
    "https://socket.dev/npm/package/ozonex-sdk/files/1.0.5/postinstall.js",
    "https://socradar.io/blog/dprk-clickfake-pylangghost-golangghost-rats/",
    "https://sourcecodered.com/malicious-arcus-npm-package/",
    "https://sp4rk.medium.com/beyond-the-backdoor-how-contagious-interview-is-surgically-tampering-with-metamask-wallets-0314ae901d85",
    "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-dream-job-chemical",
    "https://threatray.com/blog/establishing-the-tigerrat-and-tigerdownloader-malware-families/",
    "https://ti.qianxin.com/blog/articles/analysis-of-lazarus-apt-targeted-attack-against-south-korea-using-new-crown-outbreak-bait/",
    "https://tria.ge/250124-1k3bxs1paj/behavioral2",
    "https://tria.ge/260706-qky96abw2q/behavioral1",
    "https://twitter.com/0xD0CF11E0A1B11/status/1187264570861076481",
    "https://twitter.com/1ZRR4H/status/1771912721031663841",
    "https://twitter.com/360CoreSec/status/1402920149754155010",
    "https://twitter.com/360CoreSec/status/1405790277034418177",
    "https://twitter.com/360CoreSec/status/1410127120177635328",
    "https://twitter.com/500mk500/status/1353992570519609344",
    "https://twitter.com/AffableKraut/status/1234726033930248198",
    "https://twitter.com/AnonySecAgency/status/1290115260116897792",
    "https://twitter.com/AnonySecAgency/status/1366971633458548738",
    "https://twitter.com/Bank_Security/status/1107543887462064128",
    "https://twitter.com/BaoshengbinCumt/status/1570579732399558656",
    "https://twitter.com/BitsOfBinary/status/1321488299932983296",
    "https://twitter.com/BitsOfBinary/status/1337330286787518464",
    "https://twitter.com/BitsOfBinary/status/1339623925274296323",
    "https://twitter.com/BushidoToken/status/1353684625382641664",
    "https://twitter.com/ClearskySec/status/1084463729633316864",
    "https://twitter.com/Cyberteam008/status/1782983614701162993",
    "https://twitter.com/Dashowl/status/1354264740692942848",
    "https://twitter.com/DeadlyLynn/status/1257504361577496576",
    "https://twitter.com/Des00464472/status/1546403794871001093",
    "https://twitter.com/Des00464472/status/1569331099305918465",
    "https://twitter.com/Des00464472/status/1580021488433831936",
    "https://twitter.com/Des00464472/status/1590966132596695040",
    "https://twitter.com/Des00464472/status/1610535596262580230",
    "https://twitter.com/Des00464472/status/1613893230004965381",
    "https://twitter.com/DrN1ght/status/1374026917343543301",
    "https://twitter.com/ESETresearch/status/1458438169502826508",
    "https://twitter.com/ESETresearch/status/1521735320852643840",
    "https://twitter.com/ESETresearch/status/1521735343497695232",
    "https://twitter.com/ESETresearch/status/1559553324998955010",
    "https://twitter.com/ESETresearch/status/1656385173968019456",
    "https://twitter.com/ESETresearch/status/1656386549594857472",
    "https://twitter.com/HONKONE_K/status/1374178555634933762",
    "https://twitter.com/HaoZhixiang/status/1572434427942432772",
    "https://twitter.com/IntezerLabs/status/1268158680593313794",
    "https://twitter.com/IntezerLabs/status/1300403461809491969",
    "https://twitter.com/JAMESWT_MHT/status/1275396942139469824",
    "https://twitter.com/JAMESWT_MHT/status/1276471822217891840",
    "https://twitter.com/Jup1a/status/1402470227292561412",
    "https://twitter.com/KSeznec/status/1717542794942660771",
    "https://twitter.com/K_N1kolenko/status/1353975032104558592",
    "https://twitter.com/KevinPerlow/status/1083759627714682880",
    "https://twitter.com/KevinPerlow/status/1136994848341409792",
    "https://twitter.com/KorbenD_Intel/status/1158479283549089792",
    "https://twitter.com/KseProso/status/1178580006047539200",
    "https://twitter.com/KseProso/status/1788114018722595188",
    "https://twitter.com/MBThreatIntel/status/1270741821560406019",
    "https://twitter.com/MichalKoczwara/status/1785379113517154732",
    "https://twitter.com/MichalKoczwara/status/1787783113742885332",
    "https://twitter.com/MichalKoczwara/status/1788980517812994267",
    "https://twitter.com/RedDrip7/status/1148887458152472576",
    "https://twitter.com/RedDrip7/status/1186562944311517184",
    "https://twitter.com/RedDrip7/status/1254678135133442048",
    "https://twitter.com/RedDrip7/status/1270201358721769475",
    "https://twitter.com/RedDrip7/status/1293462469214531584",
    "https://twitter.com/RedDrip7/status/1354038387603197952",
    "https://twitter.com/Rmy_Reserve/status/1181528617374777344",
    "https://twitter.com/Rmy_Reserve/status/1188235835956551680",
    "https://twitter.com/Rmy_Reserve/status/1230881875767377920",
    "https://twitter.com/Rmy_Reserve/status/1246404220040802309 (# DangerousPassword)",
    "https://twitter.com/ScarletSharkSec/status/1575130042627244038",
    "https://twitter.com/ShadowChasing1/status/1257511608189743105",
    "https://twitter.com/ShadowChasing1/status/1267431134662541317",
    "https://twitter.com/ShadowChasing1/status/1270728525926944768",
    "https://twitter.com/ShadowChasing1/status/1276324740878102529",
    "https://twitter.com/ShadowChasing1/status/1302180729174937600",
    "https://twitter.com/ShadowChasing1/status/1328208737933246464",
    "https://twitter.com/ShadowChasing1/status/1339195498519875585 (# DangerousPassword)",
    "https://twitter.com/ShadowChasing1/status/1339933511973699584 (# DangerousPassword)",
    "https://twitter.com/ShadowChasing1/status/1349924271791882247",
    "https://twitter.com/ShadowChasing1/status/1349927630183694339",
    "https://twitter.com/ShadowChasing1/status/1353972356759187456",
    "https://twitter.com/ShadowChasing1/status/1362362744909930496",
    "https://twitter.com/ShadowChasing1/status/1366988046294376450",
    "https://twitter.com/ShadowChasing1/status/1367368069618700291",
    "https://twitter.com/ShadowChasing1/status/1377610488830291973",
    "https://twitter.com/ShadowChasing1/status/1377628563000594433",
    "https://twitter.com/ShadowChasing1/status/1382514587589742597",
    "https://twitter.com/ShadowChasing1/status/1384016097494507521",
    "https://twitter.com/ShadowChasing1/status/1391981731394187266",
    "https://twitter.com/ShadowChasing1/status/1393356174506921985",
    "https://twitter.com/ShadowChasing1/status/1397768682776895491",
    "https://twitter.com/ShadowChasing1/status/1398468263818928136",
    "https://twitter.com/ShadowChasing1/status/1399369260577681426",
    "https://twitter.com/ShadowChasing1/status/1405515076149284870",
    "https://twitter.com/ShadowChasing1/status/1406592585796177924",
    "https://twitter.com/ShadowChasing1/status/1407993219720224771",
    "https://twitter.com/ShadowChasing1/status/1412932935523573760",
    "https://twitter.com/ShadowChasing1/status/1412934665292316677",
    "https://twitter.com/ShadowChasing1/status/1412953330700062726",
    "https://twitter.com/ShadowChasing1/status/1455489336850325519",
    "https://twitter.com/ShadowChasing1/status/1465998017836707840",
    "https://twitter.com/ShadowChasing1/status/1465998020734898176",
    "https://twitter.com/ShadowChasing1/status/1486530954382348290",
    "https://twitter.com/ShadowChasing1/status/1490958579930517504",
    "https://twitter.com/ShadowChasing1/status/1502240130702065664",
    "https://twitter.com/ShadowChasing1/status/1508637858927587328",
    "https://twitter.com/ShadowChasing1/status/1508706298640052225",
    "https://twitter.com/ShadowChasing1/status/1509520460974723072",
    "https://twitter.com/ShadowChasing1/status/1511144288830119941",
    "https://twitter.com/ShadowChasing1/status/1514899414367694851",
    "https://twitter.com/ShadowChasing1/status/1557034048345997312",
    "https://twitter.com/ShadowChasing1/status/1564980900785373185",
    "https://twitter.com/ShadowChasing1/status/1681947062471098368",
    "https://twitter.com/StopMalvertisin/status/1574329188793733120",
    "https://twitter.com/StopMalvertisin/status/1574749887203143680",
    "https://twitter.com/StopMalvertisin/status/1575055809104334848",
    "https://twitter.com/VK_Intel/status/1182722604240719872",
    "https://twitter.com/ValidinLLC/status/1788128803698450591",
    "https://twitter.com/ValidinLLC/status/1788134423273034033",
    "https://twitter.com/Vishnyak0v/status/1269635930878545922",
    "https://twitter.com/_re_fox/status/1260931809103101957",
    "https://twitter.com/_re_fox/status/1301564536575733760",
    "https://twitter.com/_re_fox/status/1301565785345863689",
    "https://twitter.com/asdasd13asbz/status/1705140120222105777",
    "https://twitter.com/asdasd13asbz/status/1711617213944492293",
    "https://twitter.com/asdasd13asbz/status/1758054481957450034",
    "https://twitter.com/asdasd13asbz/status/1788848468947296398",
    "https://twitter.com/bad_packets/status/1148864469486854144",
    "https://twitter.com/blackorbird/status/1110750919082147842",
    "https://twitter.com/blackorbird/status/1111449536910680065",
    "https://twitter.com/blackorbird/status/1148843702690832385",
    "https://twitter.com/blackorbird/status/1187619261612609536",
    "https://twitter.com/blackorbird/status/1202177008572092417",
    "https://twitter.com/blackorbird/status/1357259907448229888",
    "https://twitter.com/blackorbird/status/1507040337097027584",
    "https://twitter.com/blackorbird/status/1516300076523548674",
    "https://twitter.com/blackorbird/status/1519504288849874944",
    "https://twitter.com/blackorbird/status/1675803174551314432",
    "https://twitter.com/blackorbird/status/1700047882441908674",
    "https://twitter.com/c3rb3ru5d3d53c/status/1225581378840006656 (# DangerousPasswords)",
    "https://twitter.com/ccxsaber/status/1268020350605910016",
    "https://twitter.com/cyber__sloth/status/1285510760303656960",
    "https://twitter.com/cyber__sloth/status/1344208175168368641 (# DangerousPassword)",
    "https://twitter.com/cyber__sloth/status/1344208380525752321 (# DangerousPassword)",
    "https://twitter.com/cyberoverdrive/status/1490839283803951106",
    "https://twitter.com/cyberoverdrive/status/1550175620927299584",
    "https://twitter.com/cyberwar_15/status/1152035187196223488",
    "https://twitter.com/cyberwar_15/status/1153123863435214848",
    "https://twitter.com/cyberwar_15/status/1166282138179624960",
    "https://twitter.com/cyberwar_15/status/1175940165425958912",
    "https://twitter.com/cyberwar_15/status/1254736896330133504",
    "https://twitter.com/cyberwar_15/status/1264353716930412544",
    "https://twitter.com/cyberwar_15/status/1265266629044080642",
    "https://twitter.com/cyberwar_15/status/1287291019537473538",
    "https://twitter.com/cyberwar_15/status/1384462513249546244",
    "https://twitter.com/czy_1116/status/1485813878550597632",
    "https://twitter.com/czy_1116/status/1498190652412203008",
    "https://twitter.com/darktracer_int/status/1380309710721622016",
    "https://twitter.com/dimitribest/status/1782609281897902426",
    "https://twitter.com/felixaime/status/1280053007036624896",
    "https://twitter.com/felixaime/status/1699865970041348506",
    "https://twitter.com/ffforward/status/1456239300593524741",
    "https://twitter.com/fr0s7_/status/1381328726819020804",
    "https://twitter.com/fr0s7_/status/1402394083331559431",
    "https://twitter.com/fr0s7_/status/1695001873604903348",
    "https://twitter.com/fr0s7_/status/1695012385705148748",
    "https://twitter.com/fr0s7_/status/1695012576600498679",
    "https://twitter.com/greglesnewich/status/1742926817827422712",
    "https://twitter.com/greglesnewich/status/1750500025346445609",
    "https://twitter.com/gwillem/status/1281128245052805120",
    "https://twitter.com/h2jazi/status/1311644338812792833",
    "https://twitter.com/h2jazi/status/1334353120038678528",
    "https://twitter.com/h2jazi/status/1354880834092859395",
    "https://twitter.com/h2jazi/status/1362109944791764993",
    "https://twitter.com/h2jazi/status/1369305004922855431",
    "https://twitter.com/h2jazi/status/1369307165807280135",
    "https://twitter.com/h2jazi/status/1370024802791096320",
    "https://twitter.com/h2jazi/status/1373985591814197250",
    "https://twitter.com/h2jazi/status/1375528365587894272",
    "https://twitter.com/h2jazi/status/1406401709157629952",
    "https://twitter.com/h2jazi/status/1445596955552272389",
    "https://twitter.com/h2jazi/status/1455601350222417926",
    "https://twitter.com/h2jazi/status/1462832390632583168",
    "https://twitter.com/h2jazi/status/1483521532433473536",
    "https://twitter.com/h2jazi/status/1483521535268769793",
    "https://twitter.com/h2jazi/status/1486448926081302536",
    "https://twitter.com/h2jazi/status/1487070198955978753",
    "https://twitter.com/h2jazi/status/1490057626134192136",
    "https://twitter.com/h2jazi/status/1503826030812925962",
    "https://twitter.com/h2jazi/status/1503826034923388929",
    "https://twitter.com/h2jazi/status/1505965580075114498",
    "https://twitter.com/h2jazi/status/1505983796897894401",
    "https://twitter.com/h2jazi/status/1509206625701220356",
    "https://twitter.com/h2jazi/status/1549780561551675393",
    "https://twitter.com/h2jazi/status/1553024107989635073",
    "https://twitter.com/h2jazi/status/1555205042331947011",
    "https://twitter.com/h2jazi/status/1559259261665943553",
    "https://twitter.com/h2jazi/status/1570501870954905600",
    "https://twitter.com/h2jazi/status/1582809597051826177",
    "https://twitter.com/h2jazi/status/1582809599023124481",
    "https://twitter.com/h2jazi/status/1582919568384663552",
    "https://twitter.com/h2jazi/status/1602302208325947394",
    "https://twitter.com/h2jazi/status/1602314597926576131",
    "https://twitter.com/h2jazi/status/1602314600753598465",
    "https://twitter.com/h2jazi/status/1618630926891913217",
    "https://twitter.com/h2jazi/status/1681426768597778440",
    "https://twitter.com/h2jazi/status/1702726275012382747",
    "https://twitter.com/h2jazi/status/1712115378933977444",
    "https://twitter.com/h2jazi/status/1757798585611997236",
    "https://twitter.com/imp0rtp3/status/1589263364274155520",
    "https://twitter.com/imp0rtp3/status/1589263367650578434",
    "https://twitter.com/jaydinbas/status/1468521246862233603",
    "https://twitter.com/jaydinbas/status/1506970733997604867",
    "https://twitter.com/jaydinbas/status/1598660262751604738",
    "https://twitter.com/jaydinbas/status/1598722899556577280",
    "https://twitter.com/jaydinbas/status/1608077663532449792",
    "https://twitter.com/jaydinbas/status/1623295609703636993",
    "https://twitter.com/k3yp0d/status/1448552868907204612",
    "https://twitter.com/k3yp0d/status/1468485748269662208",
    "https://twitter.com/k3yp0d/status/1709851707427975382",
    "https://twitter.com/karol_paciorek/status/1749376208477786172",
    "https://twitter.com/kyleehmke/status/1184120287199223808",
    "https://twitter.com/malwrhunterteam/status/1503640289810038786",
    "https://twitter.com/malwrhunterteam/status/1504573045750571010",
    "https://twitter.com/malwrhunterteam/status/1506008938197643266",
    "https://twitter.com/malwrhunterteam/status/1557077792075829249",
    "https://twitter.com/malwrhunterteam/status/1560563222624710656",
    "https://twitter.com/malwrhunterteam/status/1573305740252663809",
    "https://twitter.com/malwrhunterteam/status/1593744606172168195",
    "https://twitter.com/malwrhunterteam/status/1598405604317442048",
    "https://twitter.com/malwrhunterteam/status/1710379117869150506",
    "https://twitter.com/malwrhunterteam/status/1715075131175751740",
    "https://twitter.com/malwrhunterteam/status/1750492037936222291",
    "https://twitter.com/malwrhunterteam/status/1764037492812943550",
    "https://twitter.com/malwrhunterteam/status/1769840338745659896",
    "https://twitter.com/mattnotmax/status/1370311682354941954",
    "https://twitter.com/mattyb1512/status/1354070629469872129",
    "https://twitter.com/mg2_tracy1/status/1337335098224508928",
    "https://twitter.com/navSi16/status/1148192534654439426",
    "https://twitter.com/navSi16/status/1166287915959214080",
    "https://twitter.com/patrickwardle/status/1286109626941845504",
    "https://twitter.com/pkalnai/status/1489269982814949382",
    "https://twitter.com/s1ckb017/status/1447476954639347712",
    "https://twitter.com/s1ckb017/status/1484451637653614592",
    "https://twitter.com/s1ckb017/status/1489591023030448129",
    "https://twitter.com/sS55752750/status/1354059524739653633",
    "https://twitter.com/souiten/status/1468818352156020737",
    "https://twitter.com/souiten/status/1593449165349978113",
    "https://twitter.com/souiten/status/1653999722477268992",
    "https://twitter.com/spider_girl22/status/1258224278194941953",
    "https://twitter.com/spider_girl22/status/1265486116393713665",
    "https://twitter.com/spider_girl22/status/1275366600560873473",
    "https://twitter.com/tiresearch1/status/1695342915281965409",
    "https://twitter.com/tiresearch1/status/1696067977463087376",
    "https://twitter.com/tiresearch1/status/1701155845608964391",
    "https://twitter.com/tiresearch1/status/1706312971054412039",
    "https://twitter.com/tiresearch1/status/1708141542261809360",
    "https://twitter.com/tiresearch1/status/1708539447908958382",
    "https://twitter.com/tiresearch1/status/1709900227241758810",
    "https://twitter.com/tiresearch1/status/1712004829978190112",
    "https://twitter.com/tiresearch1/status/1712839519366795733",
    "https://twitter.com/tiresearch1/status/1713828674750017852",
    "https://twitter.com/tiresearch1/status/1714149818753507596",
    "https://twitter.com/tiresearch1/status/1714283158588600641",
    "https://twitter.com/tiresearch1/status/1717496437985128862",
    "https://twitter.com/tiresearch1/status/1717554754023526564",
    "https://twitter.com/tiresearch1/status/1717922111749288043",
    "https://twitter.com/tiresearch1/status/1718902558922834192",
    "https://twitter.com/tiresearch1/status/1719979579170009130",
    "https://twitter.com/tiresearch1/status/1721811568814624831",
    "https://twitter.com/tiresearch1/status/1722534103751540999",
    "https://twitter.com/tiresearch1/status/1725052270910538103",
    "https://twitter.com/tiresearch1/status/1727306536522043677",
    "https://twitter.com/tiresearch1/status/1727956853794250850",
    "https://twitter.com/tiresearch1/status/1729392929612218731",
    "https://twitter.com/tiresearch1/status/1729754195903844484",
    "https://twitter.com/tiresearch1/status/1730114476786229304",
    "https://twitter.com/tiresearch1/status/1731600500259524993",
    "https://twitter.com/tiresearch1/status/1733020053426282778",
    "https://twitter.com/tiresearch1/status/1755176085610721337",
    "https://twitter.com/tiresearch1/status/1784118099278741797",
    "https://twitter.com/vngkv123/status/1357247638228226053",
    "https://unit42.paloaltonetworks.com/gleaming-pisces-applejeus-poolrat-and-pondrat/",
    "https://unit42.paloaltonetworks.com/inside-tdrop2-technical-analysis-of-new-dark-seoul-malware/",
    "https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/",
    "https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/",
    "https://urlscan.io/result/019ae9c9-3021-722e-a3db-20cc2005fc0f/",
    "https://urlscan.io/search/#hash%3A6b7038bab8c410aeb6714e1d98d609a61b6dc3e418a6b5c74a17f2d6d6cb4aaf",
    "https://www.abstract.security/blog/contagious-interview-evolution-of-vscode-and-cursor-tasks-infection-chains",
    "https://www.abstract.security/blog/contagious-interview-tracking-the-vs-code-tasks-infection-vector",
    "https://www.aikido.dev/blog/fast-draft-open-vsx-bloktrooper",
    "https://www.aikido.dev/blog/glassworm-chrome-extension-rat",
    "https://www.aikido.dev/blog/malicious-package-web3",
    "https://www.alienvault.com/blogs/labs-research/malicious-documents-from-lazarus-group-targeting-south-korea",
    "https://www.bleepingcomputer.com/news/security/north-korean-hackers-linked-to-credit-card-stealing-attacks-on-us-stores/",
    "https://www.cert.si/tz016/",
    "https://www.cisa.gov/uscert/ncas/alerts/aa22-108a",
    "https://www.ctfiot.com/267223.html",
    "https://www.elastic.co/cn/security-labs/DPRK-strikes-using-a-new-variant-of-rustbucket",
    "https://www.elastic.co/security-labs/contagious-interview-malware-svg-steganography",
    "https://www.elastic.co/security-labs/dprk-code-of-conduct",
    "https://www.enki.co.kr/en/media-center/blog/contagious-interview-campaign-abusing-vscode-distributed-on-github",
    "https://www.esentire.com/blog/bored-beavertail-yacht-club-a-lazarus-lure",
    "https://www.flashpoint-intel.com/blog/disclosure-chilean-redbanc-intrusion-lazarus-ties/",
    "https://www.fortinet.com/blog/threat-research/deep-analysis-nukesped-rat.html",
    "https://www.gendigital.com/blog/insights/research/apt-cyber-alliances-2025",
    "https://www.group-ib.com/blog/apt-lazarus-python-scripts/",
    "https://www.group-ib.com/blog/btc_changer",
    "https://www.group-ib.com/blog/stealthy-attributes-of-apt-lazarus/",
    "https://www.hybrid-analysis.com/sample/7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be/5c8a414a0388381b3f329926",
    "https://www.jamf.com/blog/flexibleferret-malware-continues-to-adapt/",
    "https://www.linkedin.com/feed/update/urn:li:activity:7290126497732837378/",
    "https://www.linkedin.com/feed/update/urn:li:activity:7455559719282241536/",
    "https://www.malwarebytes.com/blog/news/2022/12/lazarus-group-uses-fake-cryptocurrency-apps-to-plant-applejeus-malware",
    "https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/",
    "https://www.microsoft.com/en-us/security/blog/2023/11/22/diamond-sleet-supply-chain-compromise-distributes-a-modified-cyberlink-installer/",
    "https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/",
    "https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/",
    "https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/",
    "https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/",
    "https://www.microsoft.com/security/blog/2021/01/28/zinc-attacks-against-security-researchers/",
    "https://www.microsoft.com/security/blog/2022/09/29/zinc-weaponizing-open-source-software/",
    "https://www.nccgroup.com/es/research-blog/north-korea-s-lazarus-their-initial-access-trade-craft-using-social-media-and-social-engineering/",
    "https://www.ossprey.com/blog/how-ossprey-uncovered-a-large-scale-dprk-contagious-interview-campaign",
    "https://www.picussecurity.com/resource/blog/lazarus-group-apt38-explained-timeline-ttps-and-major-attacks",
    "https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal",
    "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/lazarus-recruitment/",
    "https://www.recordedfuture.com/research/purplebravos-targeting-it-software-supply-chain",
    "https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto",
    "https://www.reversinglabs.com/blog/fake-recruiter-campaign-crypto-devs",
    "https://www.reversinglabs.com/blog/vmconnect-supply-chain-campaign-continues",
    "https://www.security.com/blog-post/lazarus-medusa-ransomware",
    "https://www.securonix.com/blog/research-update-threat-actors-behind-the-devpopper-campaign-have-retooled-and-are-continuing-to-target-software-developers-via-social-engineering/",
    "https://www.sentinelone.com/blog/lazarus-operation-interception-targets-macos-users-dreaming-of-jobs-in-crypto/",
    "https://www.sentinelone.com/blog/macos-flexibleferret-further-variants-of-dprk-malware-family-unearthed/",
    "https://www.sentinelone.com/labs/dprk-it-workers-a-network-of-active-front-companies-and-their-links-to-china/",
    "https://www.silentpush.com/blog/contagious-interview-front-companies/",
    "https://www.sonatype.com/hubfs/White_Papers/How-North-Korea-Backed-Lazarus-Group-is-Weaponizing-Open-Source-Whitepaper.pdf",
    "https://www.team-cymru.com/post/dprk-fake-it-worker-cyber-threat-actors-infrastructure",
    "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/26/d/void-dokkaebi/Void-Dokkaebi-Uses-Fake-Job-Interview-Lure-to-Spread-Malware-via-Code-Repositories-IoCs.txt",
    "https://www.trendmicro.com/en_us/research/26/d/void-dokkaebi-uses-fake-job-interview-lure-to-spread-malware-via-code-repositories.html",
    "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A",
    "https://www.us-cert.gov/ncas/analysis-reports/ar20-045a",
    "https://www.us-cert.gov/ncas/analysis-reports/ar20-045b",
    "https://www.us-cert.gov/ncas/analysis-reports/ar20-045d",
    "https://www.us-cert.gov/ncas/analysis-reports/ar20-045e",
    "https://www.us-cert.gov/ncas/analysis-reports/ar20-045f",
    "https://www.validin.com/blog/bybit_hack_infrastructure_hunt/",
    "https://www.validin.com/blog/crawl_history_artifact_upgrade/",
    "https://www.validin.com/blog/hunting-lazarus-dns-history-host-responses/",
    "https://www.validin.com/blog/inoculating_contagious_interview_with_validin/",
    "https://www.validin.com/blog/inside_dprk_fake_job_platform/",
    "https://www.validin.com/blog/zooming_through_bluenoroff_pivots/",
    "https://www.veracode.com/blog/north-korean-crypto-stealing-campaign-again/",
    "https://www.virustotal.com/graph/embed/g4784ec032b3f4cb987a616f4b2dbc9aa9a982d9b20494f8980ae611a4ca3a1d8",
    "https://www.virustotal.com/gui/domain/cloudmgmt.org/relations",
    "https://www.virustotal.com/gui/domain/teslacontrols.ir/relations",
    "https://www.virustotal.com/gui/file/000752074544950ae9020a35ccd77de277f1cd5026b4b9559279dc3b86965eee/detection",
    "https://www.virustotal.com/gui/file/00433ebf3b21c1c055d4ab8a599d3e84f03b328496236b54e56042cef2146b1c/detection",
    "https://www.virustotal.com/gui/file/0048b92365f3ab21540b20a00a306c20ad016b334bce1dbb4fd85999278d5b54/detection",
    "https://www.virustotal.com/gui/file/01184a5acb8b3ec56c9e90f2e6cd6673ae83b4fd6982e17329b33da2f77bcf5b/detection",
    "https://www.virustotal.com/gui/file/0160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1/detection",
    "https://www.virustotal.com/gui/file/01611aa9fe649335a7d813fa1693b9421d8585155351f3a696e8bfdcf45440d3/detection",
    "https://www.virustotal.com/gui/file/02d55193310ea19a4ce4c8a7f095c84b0511946d11a647e12758569292014882/detection",
    "https://www.virustotal.com/gui/file/03cd4ec3defa490e68b1ca2efaf8daea6f89d3cceed51c91f4c4f9e2222d258d/detection",
    "https://www.virustotal.com/gui/file/03f6c8f173413302d9c22a44a593fc9a5203fbb7652d3a36b3ace79f3cdc39a3/detection",
    "https://www.virustotal.com/gui/file/0463351dc7858ac1f9038c4c2bf27a1977f462ac0e4a494b7c51f1c8005e0587/detection",
    "https://www.virustotal.com/gui/file/05d7113cd17ee12b26c772716d3370dc0f0fa3c7f996d25d516d22b45b68a43e/detection",
    "https://www.virustotal.com/gui/file/068505fab1dc1b784ddc845c9eeeba8e04da512383ecd55a7a3d076879656393/detection",
    "https://www.virustotal.com/gui/file/06ea41ee563f0ecb884d0640344a1e0006a9e8b1b3d4cda9a769a896f18c4b6d/detection",
    "https://www.virustotal.com/gui/file/08c3aaeec3da9a106536ad1beff4d2ed23d1e31c9481be60f5dbd5eb1a01d2e5/detection",
    "https://www.virustotal.com/gui/file/0937cbb980cb898eacd8458366fc4de3510266b8fbcd68010aa04e58bf72df28/detection",
    "https://www.virustotal.com/gui/file/0988384971ae7a2213793eab632112599031694fba074516b615ca0367f2bf8d/detection",
    "https://www.virustotal.com/gui/file/09b83a501b8f919fc4861735097dd50957f21e81209d362b4fa425bd3348a495/detection",
    "https://www.virustotal.com/gui/file/09cc7c879b7facbda5349a8d273f8fac6b9be8c3f9927820bcd04583114564eb/detection",
    "https://www.virustotal.com/gui/file/09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38/detection",
    "https://www.virustotal.com/gui/file/0a133d4b96fc7b750a7b2ac14c152b61befd8dfa670e1fcd99661e531b49886e/detection",
    "https://www.virustotal.com/gui/file/0a472fdc188c9da6b8610e9eabed467b4a76457fb01ab16cf3a887d24adb9065/detection",
    "https://www.virustotal.com/gui/file/0a716920017fba0b70b7295c6d7a06710df38c0d6158a12d3723343919da7fd2/detection",
    "https://www.virustotal.com/gui/file/0b5db31e47b0dccfdec46e74c0e70c6a1684768dbacc9eacbb4fd2ef851994c7/detection",
    "https://www.virustotal.com/gui/file/0b79e1194644431c2e28c48aa3654e658a2907e1003cd0484cd00a0796ebe6bb/detection",
    "https://www.virustotal.com/gui/file/0b8d7a851920d4584777505f9fb484b226a8457d4049885a87c847f7d3532d28/detection",
    "https://www.virustotal.com/gui/file/0bc7517aa2f0c1820ced399bfd66b993f10ad77e8d72727b0f3dc1ca35cad7ba/detection",
    "https://www.virustotal.com/gui/file/0be2375362227f846c56c4de2db4d3113e197f0c605c297a7e0e0c154e94464e/detection",
    "https://www.virustotal.com/gui/file/0c78a1c0809a6a8bcd9e857272817ceafd20c49051fbb8540c4bc1777c7356e6/detection",
    "https://www.virustotal.com/gui/file/0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b/detection",
    "https://www.virustotal.com/gui/file/0e3b1ad900604f0f27bcf718592beb50a7ace9af6b7d9c1439a416647e47dd7b/detection",
    "https://www.virustotal.com/gui/file/0e416e3cc1673d8fc3e7b2469e491c005152b9328515ea9bbd7cf96f1d23a99f/detection",
    "https://www.virustotal.com/gui/file/0f6b6c1596e38e840fb03420317db224739a18dbef0b98285637f5887e90a191/detection",
    "https://www.virustotal.com/gui/file/0fa91cac5712cfc0848af092190fd3d09948f1a7750547f0f16d1867dac6288a/detection",
    "https://www.virustotal.com/gui/file/0fe69e67286203ca2dcd080b4c25ab76fc4ca925e6207b193d47f02da1481843/detection",
    "https://www.virustotal.com/gui/file/1540cbb8eac28dab396cbd95445bc936d4114a0c2bcc48ffe9630896df09a8a1/detection",
    "https://www.virustotal.com/gui/file/15e2d1390aff1c4b83607152cb75ecf5c9b5a20cb732780379265a7b8df80f6b/detection",
    "https://www.virustotal.com/gui/file/163e4a72cbe392c073eddc60aee69dc1cf87ce492c375af74e923d75d8084683/detection",
    "https://www.virustotal.com/gui/file/1939d9fdcf831dc4cac001ba193669c75a336258bc99a1775471554229e4a69b/detection",
    "https://www.virustotal.com/gui/file/196fb1b6eff4e7a049cea323459cfd6c0e3900d8d69e1d80bffbaabd24c06eba/detection",
    "https://www.virustotal.com/gui/file/1a3146e3df64507fd9ab933f7ca395fe9355843e108dde346e806808b2c79001/detection",
    "https://www.virustotal.com/gui/file/1aadea997fc4eda5a8a04e68f6e1828c93e00e817e50c5b6ef874faef43f7fca/detection",
    "https://www.virustotal.com/gui/file/1ab4af3bb2a343e9bc29e177aebe7d175a6b8af317ee3a8527271ed41148212e/detection",
    "https://www.virustotal.com/gui/file/1b0c82e71a53300c969da61b085c8ce623202722cf3fa2d79160dac16642303f/behavior/VMRay",
    "https://www.virustotal.com/gui/file/1cd0ce9ce247b8cabe491515dcd70f5b23209ec08c1a7f80ee9663c946e6365c/detection",
    "https://www.virustotal.com/gui/file/1e154b2976cc00d457c0dc2b83ebe81911294c8276691617085c03a3304fd87f/detection",
    "https://www.virustotal.com/gui/file/1e6487b7fbb9a0ff4c1d7032bfecd153fa6b9cc3c523243e8183588a98168267/detection",
    "https://www.virustotal.com/gui/file/1ef484513c027ccc747a88777559f96018e2b5cad830025911f0786e24d491f3/detection",
    "https://www.virustotal.com/gui/file/1fa62f29313e55ee1bca18820d2f1ca3aaecf438a137a67106d413c655004f0e/detection",
    "https://www.virustotal.com/gui/file/1fd921159de8ccf3c33c7ad3d52a4186c2695b858435e8e327c4d95a8d1b048a/detection",
    "https://www.virustotal.com/gui/file/225d7482772a26e4236d91cae51197ab1dfbdd42232157c3e169c19177a384e1/detection",
    "https://www.virustotal.com/gui/file/24326e187f082c73f1aa8952696dc1b0b47f8cf205c518194c2c4bb20d8e36b7/detection",
    "https://www.virustotal.com/gui/file/259e8845176a665765f488e136931b2aca27be30eb27eb1074606213473d0446/detection",
    "https://www.virustotal.com/gui/file/2727e1775588fee0f9e6d69460338cb526a8d0bb34c5d9df6e4609d1b3d56386/detection",
    "https://www.virustotal.com/gui/file/27bfac11c1f9184b515fbf5fcd946e921c95506f89eb273e148fcf0068e50932/detection",
    "https://www.virustotal.com/gui/file/294acafed42c6a4f546486636b4859c074e53d74be049df99932804be048f42c/detection",
    "https://www.virustotal.com/gui/file/29de2289a2b111a4873e49402c310b2ad0e3de51b5562ee1422a37c514910c71/detection",
    "https://www.virustotal.com/gui/file/2aaf4c62372fb1c84178d258576561d35d2a437341905db0c7c7a3d75219333f/detection",
    "https://www.virustotal.com/gui/file/2fc71184be22ed1b504b75d7bde6e46caac0bf63a913e7a74c3b65157f9bf1df/detection",
    "https://www.virustotal.com/gui/file/2fdba1e332203ca0d01992b137ebeaa1f21f7c3daec7230e6b8a4d36182caed4/detection",
    "https://www.virustotal.com/gui/file/315503862cb7ebb0a731483827016015e355bad51f872db5c650a822de744937/detection",
    "https://www.virustotal.com/gui/file/322b2eb4e4d61ec6a746e3da421e8fd9c62ce4f919f03aed373f663de539b2ba/detection",
    "https://www.virustotal.com/gui/file/3315e5a4590e430550a4d85d0caf5f521d421a2966b23416fcfc275a5fd2629a/detection",
    "https://www.virustotal.com/gui/file/33be1a646e5ed46aa707455637e2116715592d1ef63feafb0fd2f66c872a634d/detection",
    "https://www.virustotal.com/gui/file/347d6886aa799d5db7068367d3873fec699b5224d292b7eeec9afa079adb5d07/detection",
    "https://www.virustotal.com/gui/file/353f82475fcfad5b3f06ed85a931bda46ec34279793b5d70085aa8c603e8ebec/detection",
    "https://www.virustotal.com/gui/file/3542078fd524e3cb141d5bebf96aea73467505a07ae72fc58395afa14f22e8a3/detection",
    "https://www.virustotal.com/gui/file/35a39299c47bc701dbe7cb72fcb695d08eb2095d1a5b8b7942d3034d16435e89/detection",
    "https://www.virustotal.com/gui/file/382a209ce5745c85507b0bd80b87496ad92128e6870199d0c33d6ddedc542dd1/detection",
    "https://www.virustotal.com/gui/file/390f9aae2dd5f0584106e3aa315bbd28a8c6479f126a4f13c7c3a62e19356634/detection",
    "https://www.virustotal.com/gui/file/392aba0070375051d7bc3cc478c4bb66c5f55be87ad797800f50a338c3e2479b/detection",
    "https://www.virustotal.com/gui/file/3a4aed5b9ad0827696a1bb5f3497a6a2aa26b453d27bfacbe3c8c47673aac98d/detection",
    "https://www.virustotal.com/gui/file/3ac93cd715dc191464703b988ba1d72d4bd97836bcddea9a653232fd57facf00/detection",
    "https://www.virustotal.com/gui/file/3ad42864371905aa4618ab74dcd67b2ddb578b9e3ecaa998f9a54a59fd3fa50c/detection",
    "https://www.virustotal.com/gui/file/3b33b0739107411b978c3cbafb312a44b7488bd7adabae3e7b02059240b6dc83/detection",
    "https://www.virustotal.com/gui/file/3b70c3ebffcfd6a97859f8d9e5a31f6902756e23fd6688ca7c7446d24ec76d9d/detection",
    "https://www.virustotal.com/gui/file/3bba04f277e7f51a5500f7b144fdbd851954e4f94bb0290e49fc63f6fc807321/detection",
    "https://www.virustotal.com/gui/file/3fb46ed9876d5f3a0aaa57a3726a574fa7e3626f16c86dea685cbf63d721f3ce/detection",
    "https://www.virustotal.com/gui/file/40273d18abc0d623a1798766e0d388f2f46bfa7ad535cad46098a5262382fa13/detection",
    "https://www.virustotal.com/gui/file/4059fea324e27cfbd4955f37dc7791709dbf35a800449373c6715bc53b88f7c5/detection",
    "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
    "https://www.virustotal.com/gui/file/41ee7ddb2be173686dc3a73a49b4e93bc883ef363acca770f7ede891451122ab/detection",
    "https://www.virustotal.com/gui/file/4291da6d5461c51ff0f852ca40a557739e955667df66c359cb0952542bb796b2/detection",
    "https://www.virustotal.com/gui/file/442c2b7b8e7ec13306bfb6c1332bd87e4d9cac242fd86555df355a606b895c46/detection",
    "https://www.virustotal.com/gui/file/4524b20f1d3c3299c66058e9bcba6f7a18675b7a6eea52c593a08259220c37ae/detection",
    "https://www.virustotal.com/gui/file/456b3100d6e0364c036a33ca2d1c68f9e237520ab26da2b78d9dd55f1a2eec09/detection",
    "https://www.virustotal.com/gui/file/46fcbc170e84d8ad48434251421bd8f6fa49a7e741d2c24d31c170c607c60d51/detection",
    "https://www.virustotal.com/gui/file/47b8b4d55d75505d617e53afcb6c32dd817024be209116f98cbbc3d88e57b4d1/detection",
    "https://www.virustotal.com/gui/file/47e017b40d418374c0889e4d22aa48633b1d41b16b61b1f2897a39112a435d30/detection",
    "https://www.virustotal.com/gui/file/48bd1c5cf9ccc3d454ab80d7284abaf39028a228607d132bfa92ab2ceca47ca2/detection",
    "https://www.virustotal.com/gui/file/49046dfeaefc59747e45e013f3ab5a2895b4245cfaa218dd2863d86451104506/detection",
    "https://www.virustotal.com/gui/file/4a6b7409d79e51113e88c1e62c7f5bad55e5c27a19d0b986b9347c4869233893/detection",
    "https://www.virustotal.com/gui/file/4b2b157041e8bbeace43320ec93a4206daa9818a6406279999636b2fbc3d08c9/detection",
    "https://www.virustotal.com/gui/file/4c4cc3abd3ddb15d5306fb647c6d779b18df5b949673bb3f3f87faa2c5f56a6a/detection",
    "https://www.virustotal.com/gui/file/4c574c1a2b126c8a5ba1ef9560516d0ac9990c0253119f874eb084b57742e3d7/detection",
    "https://www.virustotal.com/gui/file/4cbad835586faf1d91431d5421b58b4acda0bd280cfbaf8a5d4820aec486b0e6/detection",
    "https://www.virustotal.com/gui/file/500ae0f1ab40a254f81c73331c9848bada4c26adad613d53d339d14ca3599a32/detection",
    "https://www.virustotal.com/gui/file/5081f54761947bc9ce4aa2a259a0bd60b4ec03d32605f8e3635c4d4edaf48894/detection",
    "https://www.virustotal.com/gui/file/5115be816d0cd579915d079573bfa384d78ac0bd33cc845b7a83a488b0fc1b99/detection",
    "https://www.virustotal.com/gui/file/51d53ca36a662b4aad5878987548f0f22f2a53545790577d8043373b6bf7eb75/detection",
    "https://www.virustotal.com/gui/file/51e1f3a97629e8db50ca1f9a0b68c019e74c07ce5209d5eefd4a2e3f4fe62869/detection",
    "https://www.virustotal.com/gui/file/534f5612954db99c86baa67ef51a3ad88bc21735bce7bb591afa8a4317c35433/detection",
    "https://www.virustotal.com/gui/file/55571ac52e1f02f18af77e2f3314382c982a37744b58732dfc15faac9d66619f/detection",
    "https://www.virustotal.com/gui/file/56655ea5ba27f14b860bac62c37e4c45940908e8a45d7c2a6117ce9951baf10d/detection",
    "https://www.virustotal.com/gui/file/56a666601e66a01cc8dcb53a470d9ea092633c76197cd13919c7749e51ebccbc/detection",
    "https://www.virustotal.com/gui/file/576d1688f744a9f6ae4c1fb4cec1cda3daecabf3a13cb3bafabf083c54d1fcb6/detection",
    "https://www.virustotal.com/gui/file/57959c2be2ac6349aa37edb73cd8a88fe8d3e69678cac4b38fac401bd3141fdf/detection",
    "https://www.virustotal.com/gui/file/5816eb32cbaadfc3477c823293a8c49cdf690b443c8fa3c19f98399c143df2b3/detection",
    "https://www.virustotal.com/gui/file/58fef66f346fe3ed320e22640ab997055e54c8704fc272392d71e367e2d1c2bb/detection",
    "https://www.virustotal.com/gui/file/5b02fc3cfb5d74c09cab724b5b54c53a7c07e5766bffe5b1adf782c9e86a8541/detection",
    "https://www.virustotal.com/gui/file/5c2f339362d0cd8e5a8e3105c9c56971087bea2701ea3b7324771b0ea2c26c6c/detection",
    "https://www.virustotal.com/gui/file/5c9bc15e2db6ca97ff325159d6c07fd381a39f9e55ef69499bbfde51bb064808/detection",
    "https://www.virustotal.com/gui/file/5db4182efcfd449078b1b9e96b68cf3be05bbc42543a0b11ed6d50ed951cb576/detection",
    "https://www.virustotal.com/gui/file/5e523ba395d7b92001d14d0d0e607410af9acb61d724a4a7651c3d80a79fb532/detection",
    "https://www.virustotal.com/gui/file/5f00106f7f15e0ca00df4dbb0eeccd57930b4b81bc9aa3fca0c5af4eda339ab7/detection",
    "https://www.virustotal.com/gui/file/5f4063e3a5583e62ddec2f84ca88eb97fbcfbee31d9269742ab438f441f0cd58/detection",
    "https://www.virustotal.com/gui/file/5f9c4af7ac12197fb8df152d27f9aa6cc1add0613eb3ecfd7699807b0d35e577/detection",
    "https://www.virustotal.com/gui/file/5fc61384dd6f15e6bb510e0421000c1301a40d7acf05cedbeb6bc789c0a99d00/detection",
    "https://www.virustotal.com/gui/file/60674602836323647634016774ea123232160c1b4dfcf3fcd2d2c28c652aa00e/detection",
    "https://www.virustotal.com/gui/file/60914b8df5b5d64070f71ef13817499b3a85de98433ae5c01bd235abec9464f6/detection",
    "https://www.virustotal.com/gui/file/610047be0b2360d609baa71be22ddc5814743868886f8d85ab9985d3f01229d6/detection",
    "https://www.virustotal.com/gui/file/6149bacfb02eb3db6f95947bc57d89bfb92b90f16f92a61266ea6fbec81d10b7/detection",
    "https://www.virustotal.com/gui/file/6156127355d8016c8e741de98ee4ef2a4cb5cb02cd44f22fd3c8fef033b69830/detection",
    "https://www.virustotal.com/gui/file/628d0ebf940db13e740382c3b34d69d44f7bdcf5f7787f02be4249a8f1e0a8eb/detection",
    "https://www.virustotal.com/gui/file/65b5709f67bb0fac31ec977f98cda6f89f4b38703ee5aeef0b633c33669ea88a/detection",
    "https://www.virustotal.com/gui/file/66e5371c3da7dc9a80fb4c0fabfa23a30d82650c434eec86a95b6e239eccab88/behavior/QiAnXin%20RedDrip",
    "https://www.virustotal.com/gui/file/66e96fbd6e977ddef3f0a2924978d92e5d67bd96e68dc4832f5041dbd40bcfc9/detection",
    "https://www.virustotal.com/gui/file/672757d8ead192ea797570b0bc25a07cd0e6424af7819bd6bab33f49a304f6bf/detection",
    "https://www.virustotal.com/gui/file/672ec8899b8ee513dbfc4590440a61023846ddc2ca94c88ae637144305c497e7/detection",
    "https://www.virustotal.com/gui/file/6744ca5d49833c9b90aee0f3be39d28dec94579b028b05c647354ec5e1ab53e1/detection",
    "https://www.virustotal.com/gui/file/6779f9b40beaf172950372303d89452358403189d236c5856d305ded2e82a15f/detection",
    "https://www.virustotal.com/gui/file/68725d4cbc05d8e344addd27c3d831a62faa7860042ed5dbef55b12ad6fbe4b8/detection",
    "https://www.virustotal.com/gui/file/689d5513ad52ad5e7a631a9147049c4cc494ad514b81cf41e841fb244c766b8b/detection",
    "https://www.virustotal.com/gui/file/69e5cc9d865301f7e8dd7d4dbf5624db2859c614112d339b2fc07ea6176c776d/detection",
    "https://www.virustotal.com/gui/file/69ef7c4cb3849283c03eaa593b02ebbfd1d08d25ef9a58355d2a9909678d6c6d/detection",
    "https://www.virustotal.com/gui/file/6a0ed1976dd871000ab3dad9228e7e8df01df77d17ba4f50fa210d409200d437/detection",
    "https://www.virustotal.com/gui/file/6a104f07ab6c5711b6bc8bf6ff956ab8cd597a388002a966e980c5ec9678b5b0/detection",
    "https://www.virustotal.com/gui/file/6b3c6a4c07f77016ef05a5994bcc4e228cbfc474733cd091b0edc6493fe8465a/detection",
    "https://www.virustotal.com/gui/file/6be45e165de60b61e9b7cb9e1f9b72c652c388a04c02d2068de6188cc88fc3fe/detection",
    "https://www.virustotal.com/gui/file/6c5d9aa7c498b89fceb2197f2544a3a403763c021b20d7f0ee39d3c6409e5c6e/detection",
    "https://www.virustotal.com/gui/file/6d2ecc3b0a43f0c377ea6d9a68aa5ac0d48635a04219264fb0702976efea8ef6/detection",
    "https://www.virustotal.com/gui/file/6f11c52f01e5696b1ac0faf6c19b0b439ba6f48f1f9851e34f0fa582b09dfa48/detection",
    "https://www.virustotal.com/gui/file/70db987e2545cbc3e22bac0503f89f46a441cc9f206d0aa41d66b54f511638d6/detection",
    "https://www.virustotal.com/gui/file/70f732e98634c3f887d84ba8acb1ee7b62e4f865ea4cb1be1edf32c40c27ae51/detection",
    "https://www.virustotal.com/gui/file/7165aa2157b7cb4e20a0ed68b26a2b9c6957ae370d6bcb58918efb47b595744f/detection",
    "https://www.virustotal.com/gui/file/741be5e53a5dc7cebaa63d6ff624c5eff1a0e1817ede1e7fc0473a28b1ed7a33/detection",
    "https://www.virustotal.com/gui/file/75699cc6d3cfc2e4d0f2fe920e45f559f084acc65f2df48c117016d2642b154b/detection",
    "https://www.virustotal.com/gui/file/75d3d96033db529c9ae698ac6de8fba420c2daa5d97614d7118f49e03c2d83d3/detection",
    "https://www.virustotal.com/gui/file/760bbec57ef20807abebecfbc6fa345b5ac83483de0cb26dcf0306806e98f317/detection",
    "https://www.virustotal.com/gui/file/7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be/detection",
    "https://www.virustotal.com/gui/file/76cb3de448bdbd761beb917eed0d71c058db643fca6a37f7bbf00afbcec9d22d/detection",
    "https://www.virustotal.com/gui/file/773760fd71d52457ba53a314f15dddb1a74e8b2f5a90e5e150dea48a21aa76df/detection (# CollectionRAT)",
    "https://www.virustotal.com/gui/file/78b845050c78daf92ed44f7928d8755cc6b4773bd774409a21b09b5a4dd7ddf1/detection",
    "https://www.virustotal.com/gui/file/78deace2e76fe8678d65018b1f136965f4ebad5e8d92568e5e2d2335e292146b/detection",
    "https://www.virustotal.com/gui/file/795034792aa705f730dd498c51cbd6e472bae2e823d3a865f52bc3814fdeafd0/detection",
    "https://www.virustotal.com/gui/file/79e15cc02c6359cdb84885f6b84facbf91f6df1254551750dd642ff96998db35/detection",
    "https://www.virustotal.com/gui/file/7b5843c32b8ee8ac3a54b6c09bff6d67140e74e548b4b31e7c3c5e35ba4341dc/detection",
    "https://www.virustotal.com/gui/file/7c2721b4beedcff6f8d7af585516af86287a9bab703e8050e97365aa9fd849cb/detection",
    "https://www.virustotal.com/gui/file/7dc3082d2fb8f7fadf4de5155405fbadda2b402e0210f982fa313b99f2b29a11/detection",
    "https://www.virustotal.com/gui/file/82d4a0fef550af4f01a07041c16d851f262d859a3352475c62630e2c16a21def/detection",
    "https://www.virustotal.com/gui/file/8562f6b2a95963f076f7bc6ff00401d96656eafda1cfad3af53b3e3b99ae6452/detection",
    "https://www.virustotal.com/gui/file/8637fb723054087f42c0ba93b4528588adc4954a077dc0860912bbfbcbdd8013/detection",
    "https://www.virustotal.com/gui/file/8672acfb06258f5b6dec3700cd7f91a0c013a70a9664dbc6cf33a4c6406756ed/detection",
    "https://www.virustotal.com/gui/file/867c8b49d29ae1f6e4a7cd31b6fe7e278753a1ba03d4be338ed11fd1efc7dd36/detection",
    "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
    "https://www.virustotal.com/gui/file/875b0cbad25e04a255b13f86ba361b58453b6f3c5cc11aca2db573c656e64e24/detection",
    "https://www.virustotal.com/gui/file/89b5e248c222ebf2cb3b525d3650259e01cf7d8fff5e4aa15ccd7512b1e63957/detection",
    "https://www.virustotal.com/gui/file/8a23dd86da0aff9b460b8ebc9dd3e891d44ea0183ace4f5d28a7e4ddab47664a/detection",
    "https://www.virustotal.com/gui/file/8afdf8513a6e3bede16187004daccc95e193a29062415d9ba0c29b98a5a927d1/detection",
    "https://www.virustotal.com/gui/file/8b427c47a43e6c357d8439fefa7f0ff34b72a2abdaf0461193fb9e6086807e17/detection",
    "https://www.virustotal.com/gui/file/8d48a77e7a4b8c824d8c1b890dc3e2b904e6fa8fbe8dae1a22f5870916c01c20/detection",
    "https://www.virustotal.com/gui/file/8e1746829851d28c555c143ce62283bc011bbd2acfa60909566339118c9c5c97/detection",
    "https://www.virustotal.com/gui/file/8e271b07ad050b648321af5aa98ae9f9057342a6c4d3de40ee07a4fbec1ef2b9/detection",
    "https://www.virustotal.com/gui/file/8f05021071c4bfd4cfce3d02bd30bf16f1322170515d796e13f75eb25b09d533/detection",
    "https://www.virustotal.com/gui/file/8ff100ca86cb62117f1290e71d5f9c0519661d6c955d9fcfb71f0bbdf75b51b3/detection",
    "https://www.virustotal.com/gui/file/914ebde62460fa8daf6dd57fa91f88000314c8aeb48e2de41576d3c15899cf98/detection",
    "https://www.virustotal.com/gui/file/91ba814a86ddedc7a9d546e26f912c541205b47a853d227756ab1334ade92c3f/detection",
    "https://www.virustotal.com/gui/file/91eaf215be336eae983d069de16630cc3580e222c427f785e0da312d0692d0fd/detection",
    "https://www.virustotal.com/gui/file/93f11750014fa65066ffa7f7896c3a5b127ef8e68a4062a38610931057fe3dae/detection",
    "https://www.virustotal.com/gui/file/94a669041ef572e3fb089179f5c29e2811e2e82613290e39a2ce1b6c273727c9/detection",
    "https://www.virustotal.com/gui/file/95fdd6fe3c222a51a8038d8340e43338b7655d477da6f7eaede7925cf22f0106/detection",
    "https://www.virustotal.com/gui/file/96f79c766d045e4c0733eda16fc9c5fd3a9ac567e0c5d61c4976de874c20ee30/detection",
    "https://www.virustotal.com/gui/file/972b598d709b66b35900dc21c5225e5f0d474f241fefa890b381089afd7d44ee/detection",
    "https://www.virustotal.com/gui/file/979ef0f43f25a6707fd98f6f0cb6e8452c24f41216ff53486781f487803d69c4/detection",
    "https://www.virustotal.com/gui/file/99eae95f3271fe7cd2b25aca9a2b69ca8f5cc034f3416b554a4af38903f14233/detection",
    "https://www.virustotal.com/gui/file/9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a/detection",
    "https://www.virustotal.com/gui/file/9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c/detection",
    "https://www.virustotal.com/gui/file/9c906c2f3bfb24883a8784a92515e6337e1767314816d5d9738f9ec182beaf44/detection",
    "https://www.virustotal.com/gui/file/9d7576046152695728ead43e9752a105ef2641ef6317ff8d47094b8f541835b2/detection",
    "https://www.virustotal.com/gui/file/9dc04153455d054d7e04d46bcd8c13dd1ca16ab2995e518ba9bf33b43008d592/detection",
    "https://www.virustotal.com/gui/file/9efd70e4bbf658dc374594d8c1251810a954ffa7ccc7155abc1a831c77f9fb6b/detection",
    "https://www.virustotal.com/gui/file/a08d24f74027256c6fd5c5a2fdb15b12889971fbdcfa7a28ffebbfe8b15aaefb/detection",
    "https://www.virustotal.com/gui/file/a0bf5af3f931a428b905fd14d43b61af47b7f272425ae4ff4d78b5cb139b8276/detection",
    "https://www.virustotal.com/gui/file/a0d070b66408654cdcb84784e77914dc355a23c81e3e6ef36362470619c4de96/detection",
    "https://www.virustotal.com/gui/file/a1171ffade3d147e54fab021bc4d56f30645aeb401a88517e9df93d852b78c73/detection",
    "https://www.virustotal.com/gui/file/a1e96380809fa22b8ba0c9377e52b7919515d22a309ed8eae9783d42a04c7455/detection",
    "https://www.virustotal.com/gui/file/a3bb64de9782d000a1fb50401a8c26a65ea99cb2698cccbb3916dc546761587f/detection",
    "https://www.virustotal.com/gui/file/a3ef9fd758bca1c94054a43995a99069abaef672495c1bd3ee831217c1f5e498/detection",
    "https://www.virustotal.com/gui/file/a3f087c83453cde2bc845122c05ebeb60e8891e395b45823c192869ec1b72ea6/detection",
    "https://www.virustotal.com/gui/file/a45b34c97e45d73fd60b683e8543a1bb50d73eb30823b9e933fe2436edc35f2b/detection",
    "https://www.virustotal.com/gui/file/a51cad94475e0af91d270146379574b5a8ae70a03098318ddf9912784ace3cba/detection",
    "https://www.virustotal.com/gui/file/a6c803d7a185f896a6c90f78891c5dbb904df3535825764e05432641ab059fb1/detection",
    "https://www.virustotal.com/gui/file/a6d2f0c3892b443d022d4c77835a85efb1131b0a12d3464b01cec3563194c73c/detection",
    "https://www.virustotal.com/gui/file/a75886b016d84c3eaacaf01a3c61e04953a7a3adf38acf77a4a2e3a8f544f855/detection",
    "https://www.virustotal.com/gui/file/a7c17e5fa55bcc60d4cff64dd37d0a1f0cc93f4f44b3cebd5633ca5af413e5cc/detection",
    "https://www.virustotal.com/gui/file/a803c043e12a5dac467fae092b75aa08b461b8e9dd4c769cea375ff87287a361/detection",
    "https://www.virustotal.com/gui/file/a87b6664b718a9985267f9670e10339372419b320aa3d3da350f9f71dff35dd1/detection",
    "https://www.virustotal.com/gui/file/a897fb39d3e62c760d998511913785e30bfb703caf89af13a80cb1b18e83dfd9/detection",
    "https://www.virustotal.com/gui/file/a8cc70bcd0ef98e3eea54f953166f518a2cf1d898e4eb9e85cf70861f8ec7578/detection",
    "https://www.virustotal.com/gui/file/a9b3bc337043c04f529b2c19b3e33df1ad59bce27c074427e7b563db3a83c37b/detection",
    "https://www.virustotal.com/gui/file/ab65cef60fc097c2a9fb03a7855c9c03dfe3ccc874080720f0e631c6ee2c3e51/detection",
    "https://www.virustotal.com/gui/file/ac7b6ca73207db6ec6d4af2632a7c842c32af6658e3214753e589b567d809125/detection",
    "https://www.virustotal.com/gui/file/adeeff8fc41d1ba4922e92a5907f430122b9edc3b6dbe51f3d104fbee464b8ae/detection",
    "https://www.virustotal.com/gui/file/ae7275988753fffb29bdb254babdf46773daf935b2721006fe66a1747af3d1d4/detection",
    "https://www.virustotal.com/gui/file/aec3ced40a3451dc2c6b1704cc50b0e0c8e549faaa8ae42b6d6f421b4fc2ef8a/detection",
    "https://www.virustotal.com/gui/file/aee26c1ac2cbb598bd2ed4747e58efe68de20cb4c6cf5863c1a9dcf33dc6aae9/detection",
    "https://www.virustotal.com/gui/file/aef28d1fb239269b74b85903ddeb62feb75e3dd2f037b6a72ad57e0d065c8a31/detection",
    "https://www.virustotal.com/gui/file/aefc12b500b58fbc09ebbf34fe64b34cb32a27513478f4769447280ad23af4d2/detection",
    "https://www.virustotal.com/gui/file/afb2d4d88f59e528f0e388705113ae54b7b97db4f03a35ae43cc386a48f263a0/detection",
    "https://www.virustotal.com/gui/file/b0921142f8d3067c8253931977999a5092470ff3e562586d87af68c28ec66a99/detection",
    "https://www.virustotal.com/gui/file/b2a203b9391987049ad60c826e6d7a76554f38dfc8b9ce88fea083ca1b106800/detection",
    "https://www.virustotal.com/gui/file/b3646d8cbadc7620ca7782f2525cc019740a3088f32e2ea9a6c97cc1432537b0/detection",
    "https://www.virustotal.com/gui/file/b557fa6a92e1ecd768aa723258cb453beb6597c583dbe76d8e82ffdf392f5932/detection",
    "https://www.virustotal.com/gui/file/b5ed9eb0073ba18e5aee28ff3bc41923ed7e9dbc14c9175c8f2d9bfc58f47402/detection",
    "https://www.virustotal.com/gui/file/b8e69d6a766b9088d650e850a638d7ab7c9f59f4e24e2bc8eac41c380876b0d8/detection",
    "https://www.virustotal.com/gui/file/b9f6a9d4f837f5b8a5dc9987a91ba44bc7ae7f39aa692b5b21dba460f935a0ae/detection",
    "https://www.virustotal.com/gui/file/ba8cd92cc059232203bcadee260ddbae273fc4c89b18424974955607476982c4/detection",
    "https://www.virustotal.com/gui/file/ba90a3f1b6b4fd1a5c8606c7ab097a871bd26061418e65e94214a4f46575867a/detection",
    "https://www.virustotal.com/gui/file/bc229eca6d7a46acd195a7364c1caa97db96ea8c6c1f0bec10d3929930e89457/detection",
    "https://www.virustotal.com/gui/file/bdad5b5e2f92a70036958b9ba27705231c0d22f2dc0b7ffcf1bc1006902b791c/detection",
    "https://www.virustotal.com/gui/file/bdd109cba8346548dd6fe5110180aa23eb9f5805c90733025344a5881c15c985/detection",
    "https://www.virustotal.com/gui/file/bdf9fffe1c9ffbeec307c536a2369eefb2a2c5d70f33a1646a15d6d152c2a6fa/detection",
    "https://www.virustotal.com/gui/file/bf1986ecd37dbc9917b31077615c48fb5d64b904b95e789f9e73be47b1573c0d/detection",
    "https://www.virustotal.com/gui/file/bfd74b4a1b413fa785a49ca4a9c0594441a3e01983fc7f86125376fdbd4acf6b/detection",
    "https://www.virustotal.com/gui/file/bffe910904efd1f69544daa9b72f2a70fb29f73c51070bde4ea563de862ce4b1/detection",
    "https://www.virustotal.com/gui/file/c0682c72db57aae7c05d08e79f2d82825be2c2cdcb162c19e4c8bf5a737dcb20/detection",
    "https://www.virustotal.com/gui/file/c105f8c14f3903af3051ae1811ea4ba8898c49b45687f20e22e13a40685c7521/detection",
    "https://www.virustotal.com/gui/file/c107419b6b4c793c92289f00cbb229a344fbe6fad1f34bc53e3e9147fb0a242e/detection",
    "https://www.virustotal.com/gui/file/c114b73da17eb5c8aff5a7b5509ffe26b9770e28c7123f038e98d42f8a065632/detection",
    "https://www.virustotal.com/gui/file/c12a0565ea1c59d7c2b73e9c022604dbc827980df58ede7ce42d648f9dd4e096",
    "https://www.virustotal.com/gui/file/c12a0565ea1c59d7c2b73e9c022604dbc827980df58ede7ce42d648f9dd4e096/detection",
    "https://www.virustotal.com/gui/file/c19064733f2a23f09c8b16b3847cceeac8f61488be57911cefceb75425501097/detection",
    "https://www.virustotal.com/gui/file/c226eb59cf696a85ed7134b57f12d82cb392d42b908dd6a463cd4d8c980ee5e8/detection",
    "https://www.virustotal.com/gui/file/c28e4031129f3e6e5c6fbd7b1cebd8dd21b6f87a8564b0fb9ee741a9b8bc0197/detection",
    "https://www.virustotal.com/gui/file/c2fe5b1d2c4cef27ab22fa8bc960a78264418e02ab3787bf0053c8f3a37c95ca/detection",
    "https://www.virustotal.com/gui/file/c4399052e5801f4947edf3bf634c43a77870ca46ec0c27ded50062f8219aef28/detection",
    "https://www.virustotal.com/gui/file/c4b8ac6b919c61315a3ed47ee5e2839813a6e87888e4bb518f916d4582bbf6b4/detection",
    "https://www.virustotal.com/gui/file/c52028b494c37505cbe073e3b0fcdeb6b7b48636c6fd00a41108e6dc1a66a4ce/detection",
    "https://www.virustotal.com/gui/file/c64e2993563345fd497cfc382de27c7791b4f172d2c50d79b6290c2f9c06102c/detection",
    "https://www.virustotal.com/gui/file/c67e8f51c086ce3c7f6fbd3e0d6d29212def08c321197449afbaecdd799173f1/detection",
    "https://www.virustotal.com/gui/file/c6edbb0d733798e5e8168a9df2bccaad7834e40f3c30d09816cc9a8ecc431376/detection",
    "https://www.virustotal.com/gui/file/c7a24e1fc68b7233e1c93c02409e9429a1ea5cf0662eb4cd03364373df7d7044/detection",
    "https://www.virustotal.com/gui/file/c83c7b000a955f2b8cb92bb112ed606ffd9fbebbe3422f80d90d06b167f2f37b/detection",
    "https://www.virustotal.com/gui/file/c8a8d2caa429a8bbe885ef8d59d982b4bfd9c48f1255ff69e3b81c6bbd7b2925/detection",
    "https://www.virustotal.com/gui/file/c9b4893bdb85d67c13826814ef0cf392648089f416aed40078907054624fba72/detection",
    "https://www.virustotal.com/gui/file/cabb45c99ffd8dd189e4e3ed5158fac1d0de4e2782dd704b2b595db5f63e2610/detection",
    "https://www.virustotal.com/gui/file/cba0189ba9f6ef80ce03948c07a8e85fffb41a835d90502903a6f306927f5653/detection",
    "https://www.virustotal.com/gui/file/cc92280557b399ec9271af08c5b6f576c8478a7e2660f8fe1b4e8df3d0d80904/detection",
    "https://www.virustotal.com/gui/file/cd6e548b085eaaee31b260489c932088f1ea58390bccce54b546cba9e8dca228/detection",
    "https://www.virustotal.com/gui/file/cdadeb1e8358a00ea6f74a42a2f536acc53981762aa1c01b53c62f8b4e278fb7/detection",
    "https://www.virustotal.com/gui/file/cf10c1cad090ab31d9e579df3bd22f3d0653792cb010e1d6ac0e2cd1ced52076",
    "https://www.virustotal.com/gui/file/cf2e793eac702b70865c79d550cea3f2e1c43966565aa05f2a82d0d19b5873eb/detection",
    "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection",
    "https://www.virustotal.com/gui/file/d05f805d172583f1436eac2cfddcc5413ef6be0b37eda98ebca0cb0cfae8ad9e/detection",
    "https://www.virustotal.com/gui/file/d09041e3d635ddb28540b11cf180a30a28fc04c2ee6e5d994aa0bacc9633e944/detection",
    "https://www.virustotal.com/gui/file/d0a41dfe8f5b5c8ba6a5d0bdc3754543210ec2d36290564d9a774e9d22e3ad97/detection",
    "https://www.virustotal.com/gui/file/d0cf9c1f87eac9b8879684a041dd6a2e1a0c15e185d4814a51adda19f9399a9b/detection",
    "https://www.virustotal.com/gui/file/d287388e5ff978bf6f8af477460a9b76a74fdc33535e392b70e58176fc9ad805/detection",
    "https://www.virustotal.com/gui/file/d2f1cccfe688c074c3d58ae8f7be7b10dbea5d7ae53320c3f7b6e48cd4f62955/detection",
    "https://www.virustotal.com/gui/file/d390d23d6d96f105de24e85ecd4d2d2d2379bb565ca7cc3923c604518b6a97fa/detection",
    "https://www.virustotal.com/gui/file/d39f0e201762e5eb4c335371abf29b3192367808f95815123bb58a4f59436476/detection",
    "https://www.virustotal.com/gui/file/d3a402458682c4febacc6ae4bc98e15e92142603a97d51316eeee9e8bca77f88/detection",
    "https://www.virustotal.com/gui/file/d4c7dba741ee2eb888de9e3117fb2b1a759586b84e67b176d891c6811754ef3f/detection",
    "https://www.virustotal.com/gui/file/d78e925950df009a753f9eb193c8536551d38f84b9fe15de0c457c1441e9276d/detection",
    "https://www.virustotal.com/gui/file/d78fe3bd46a1fddddaee98634a4fb082dd47d84bf6a24c3d9b422efef1a01a03/detection",
    "https://www.virustotal.com/gui/file/d8de31bcaf5b9ebb99bef36244b0ab3c21367821947a789dff69c33d49aaffc9/detection",
    "https://www.virustotal.com/gui/file/dae9f37ae5c2a030c0fb3f55d5731cdb37a4f68560a6f2ba38bb54c9533f8805/detection",
    "https://www.virustotal.com/gui/file/db6a9934570fa98a93a979e7e0e218e0c9710e5a787b18c6948f2eedd9338984/detection (# CollectionRAT)",
    "https://www.virustotal.com/gui/file/dbe48dc08216850e93082b4d27868a7ca51656d9e55366f2642fc5106e3af980/detection",
    "https://www.virustotal.com/gui/file/dc20873b80f5cd3cf221ad5738f411323198fb83a608a8232504fd2567b14031/detection",
    "https://www.virustotal.com/gui/file/dcb232409c799f6ddfe4bc0566161c2d0b372db6095a0018e6059e34c2b79c61/detection",
    "https://www.virustotal.com/gui/file/dd038040283793c67cd50252fb9ef20eb07e2f36d284f70cb2340e501dcb99d7/detection",
    "https://www.virustotal.com/gui/file/dd9607913e9c422d6dcf2e8d11be71afbc76f761c8208f76f6ed80a0efa75255/detection",
    "https://www.virustotal.com/gui/file/e04848c1e2908335975dd52793c94624d06a598fdd75d5d3eb6ea8c5d569b8bc/detection",
    "https://www.virustotal.com/gui/file/e05142f8375070d1ea25ed3a31404ca37b4e1ac88c26832682d8d2f9f4f6d0ae/detection",
    "https://www.virustotal.com/gui/file/e087d06c552aeef36c2ba9fdd14b06fca499f2d37dfea21e480a02a748b19bf1/detection",
    "https://www.virustotal.com/gui/file/e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10/detection",
    "https://www.virustotal.com/gui/file/e29d0db8c013e7eb5820a6f40aae92a085d9550f2f0b2ebc10c8c2c08d14f6d5/detection",
    "https://www.virustotal.com/gui/file/e3027062e602c5d1812c039739e2f93fc78341a67b77692567a4690935123abe/detection (# Trojanized Plink)",
    "https://www.virustotal.com/gui/file/e3a4e97e27bcfb6126ebfe92827cfb6b7e0c04eb7f5426bf17dd366e4723d1ef/detection",
    "https://www.virustotal.com/gui/file/e514d83d2aaa1357b34f5f11ecc35afe10b6240796e085977e9d4a56145bb8b3/detection",
    "https://www.virustotal.com/gui/file/e58864cc22cd8ec17ae35dd810455d604aadab7c3f145b6c53b3c261855a4bb1/detection",
    "https://www.virustotal.com/gui/file/e615ea30dd37644526060689544c1a1d263b6bb77fe3084aa7883669c1fde12f/detection",
    "https://www.virustotal.com/gui/file/e62a7d9184a841e2b53e41f2d85aa278b427e2e427dbfd8f4be072108e3089c1/detection",
    "https://www.virustotal.com/gui/file/e637c86ae20a7f36a0ad43618b00c48f47b5591a03af3fb689a16c45afa43733/detection",
    "https://www.virustotal.com/gui/file/e79e28865cfa4b31030133b62d26367ceb06a49b3f449fdd85e136d4f6443edf/detection",
    "https://www.virustotal.com/gui/file/e7a4d8b80dc653a47440db2a8deaf782109bb710e5d4311bc3d7685dba715865/detection",
    "https://www.virustotal.com/gui/file/e90cedfce785b0f1ed30661914a0c169edf8ccb039cd722fec7fd5a85a3e99ad/detection",
    "https://www.virustotal.com/gui/file/e967097a02185995ae58cded08f57e8984152124a3a34adc9543bd4ca1569e5e/detection",
    "https://www.virustotal.com/gui/file/e9894893a8a1f74d7d6a8768dda9ef5ddaf8aac18634a1110e9a79652c9f13ee/detection",
    "https://www.virustotal.com/gui/file/eb73c57c6f4ce8bf197ddc689b7e0afd3703a9bf9a78212c9cb838528441df7a/detection",
    "https://www.virustotal.com/gui/file/ed8ec7a8dd089019cfd29143f008fa0951c56a35d73b2e1b274315152d0c0ee6/detection (# QietRAT)",
    "https://www.virustotal.com/gui/file/ede27865d869f073d2bcafd7c633eee87e3fbfb6dcf115a9a8f39be9840fa6cd/detection",
    "https://www.virustotal.com/gui/file/ef2d3e488b781a7c6144afa8fc8ba2b6d085ca671100d04686097f3b4dd2ed42/detection",
    "https://www.virustotal.com/gui/file/efd555e779a25e1be16e594866d4cb758b078ae336b589421c3b9f676cd2ef5d/detection",
    "https://www.virustotal.com/gui/file/f00fe4e6da3aaad25d1ac8b268ffeebc98bda184e3df224905626908be24d415/detection",
    "https://www.virustotal.com/gui/file/f14c5bad5219b1ed5166eb02f5ff08a890a181cef2af565f3fe7bcea9c870e22/detection",
    "https://www.virustotal.com/gui/file/f1ade73b9c61f2f4b774a1b5003a5d70d7a12e0872abe98c52fbf9e9e3a90fc5/detection",
    "https://www.virustotal.com/gui/file/f1eed93e555a0a33c7fef74084a6f8d06a92079e9f57114f523353d877226d72/detection",
    "https://www.virustotal.com/gui/file/f226086b5959eb96bd30dec0ffcbf0f09186cd11721507f416f1c39901addafb/detection",
    "https://www.virustotal.com/gui/file/f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703/detection",
    "https://www.virustotal.com/gui/file/f42c637db03edf83a08e944bc190265167ecea84d77508f37fc1269d267fe5a8/detection",
    "https://www.virustotal.com/gui/file/f59035192098e44b86c4648a0de4078edbe80352260276f4755d15d354f5fc58/detection",
    "https://www.virustotal.com/gui/file/f5a24d157881801fd13c5e6b6e870dea2873010e75765c231c1437b42fa82dd2/detection",
    "https://www.virustotal.com/gui/file/f6827dc5af661fbb4bf64bc625c78283ef836c6985bb2bfb836bd0c8d5397332/detection",
    "https://www.virustotal.com/gui/file/f7170b70a89f4b5d196e3a09c1d6135d36320548f66cdc2c55bf725b0f8d4ab8/detection",
    "https://www.virustotal.com/gui/file/f7559f6d4346f412c2c4ea18363efba3075345b7533af9964298803ffe75f919/detection",
    "https://www.virustotal.com/gui/file/f78b85fc5c9a5f6c8d735f13180d318bf8f5639e71556e2ae0f2c6b9b4181a6c/detection",
    "https://www.virustotal.com/gui/file/f78cabf7a0e7ed3ef2d1c976c1486281f56a6503354b87219b466f2f7a0b65c4/detection",
    "https://www.virustotal.com/gui/file/f91188d23b14526676706a5c9ead05c1a91ea0b9d6ac902623bc565e1c200a59/detection",
    "https://www.virustotal.com/gui/file/fe336a032b564eef07afb2f8a478b0e0a37d9a1a6c4c1e7cd01e404cc5dd2853/detection",
    "https://www.virustotal.com/gui/file/fe51590db6f835a3a210eba178d78d5eeafe8a47bf4ca44b3a6b3dfb599f1702/detection",
    "https://www.virustotal.com/gui/file/fe80e890689b0911d2cd1c29196c1dad92183c40949fe6f8c39deec8e745de7f/detection",
    "https://www.virustotal.com/gui/file/ff1d5ee6dbf77b79eec7e7405d864eb2445213aa0f5b5b665d322c4565d5b6a5/detection",
    "https://www.virustotal.com/gui/ip-address/103.179.142.171/relations",
    "https://www.virustotal.com/gui/ip-address/104.168.137.21/relations",
    "https://www.virustotal.com/gui/ip-address/104.168.138.7/relations",
    "https://www.virustotal.com/gui/ip-address/104.168.157.45/relations",
    "https://www.virustotal.com/gui/ip-address/104.168.158.103/relations",
    "https://www.virustotal.com/gui/ip-address/104.168.165.165/relations",
    "https://www.virustotal.com/gui/ip-address/104.168.165.173/relations",
    "https://www.virustotal.com/gui/ip-address/104.168.165.203/relations",
    "https://www.virustotal.com/gui/ip-address/104.168.203.159/relations",
    "https://www.virustotal.com/gui/ip-address/104.168.214.151/relations",
    "https://www.virustotal.com/gui/ip-address/104.168.237.182/relations",
    "https://www.virustotal.com/gui/ip-address/104.21.32.1/relations",
    "https://www.virustotal.com/gui/ip-address/104.21.39.124/relations",
    "https://www.virustotal.com/gui/ip-address/104.243.33.214/relations",
    "https://www.virustotal.com/gui/ip-address/116.202.208.125/community",
    "https://www.virustotal.com/gui/ip-address/120.138.8.26/relations",
    "https://www.virustotal.com/gui/ip-address/13.248.213.45/relations",
    "https://www.virustotal.com/gui/ip-address/131.226.2.120/relations",
    "https://www.virustotal.com/gui/ip-address/135.181.123.177/relations",
    "https://www.virustotal.com/gui/ip-address/144.172.110.53/relations",
    "https://www.virustotal.com/gui/ip-address/144.202.17.28/relations",
    "https://www.virustotal.com/gui/ip-address/145.223.77.219/relations",
    "https://www.virustotal.com/gui/ip-address/147.45.167.128/relations",
    "https://www.virustotal.com/gui/ip-address/147.93.44.252/relations",
    "https://www.virustotal.com/gui/ip-address/148.230.98.183/relations",
    "https://www.virustotal.com/gui/ip-address/149.28.162.113/relations",
    "https://www.virustotal.com/gui/ip-address/15.235.132.77/relations",
    "https://www.virustotal.com/gui/ip-address/155.138.159.45/relations",
    "https://www.virustotal.com/gui/ip-address/155.138.219.140/relations",
    "https://www.virustotal.com/gui/ip-address/157.173.209.152/relations",
    "https://www.virustotal.com/gui/ip-address/162.254.39.9/relations",
    "https://www.virustotal.com/gui/ip-address/168.231.70.177/relations",
    "https://www.virustotal.com/gui/ip-address/172.86.121.130/relations",
    "https://www.virustotal.com/gui/ip-address/185.228.83.129/relations",
    "https://www.virustotal.com/gui/ip-address/191.101.15.48/relations",
    "https://www.virustotal.com/gui/ip-address/192.119.81.146/relations",
    "https://www.virustotal.com/gui/ip-address/192.236.194.152/relations",
    "https://www.virustotal.com/gui/ip-address/192.236.233.51/relations",
    "https://www.virustotal.com/gui/ip-address/193.242.184.2/relations",
    "https://www.virustotal.com/gui/ip-address/194.164.64.193/relations",
    "https://www.virustotal.com/gui/ip-address/194.164.64.90/relations",
    "https://www.virustotal.com/gui/ip-address/195.201.194.107/relations",
    "https://www.virustotal.com/gui/ip-address/195.250.29.94/relations",
    "https://www.virustotal.com/gui/ip-address/198.251.81.14/relations",
    "https://www.virustotal.com/gui/ip-address/198.251.84.129/relations",
    "https://www.virustotal.com/gui/ip-address/198.54.116.86/relations",
    "https://www.virustotal.com/gui/ip-address/199.188.200.35/relations",
    "https://www.virustotal.com/gui/ip-address/2.57.90.16/relations",
    "https://www.virustotal.com/gui/ip-address/206.206.123.151/relations",
    "https://www.virustotal.com/gui/ip-address/209.126.83.186/relations",
    "https://www.virustotal.com/gui/ip-address/212.85.28.229/relations",
    "https://www.virustotal.com/gui/ip-address/212.85.29.150/relations",
    "https://www.virustotal.com/gui/ip-address/212.85.29.40/relations",
    "https://www.virustotal.com/gui/ip-address/216.107.136.10/relations",
    "https://www.virustotal.com/gui/ip-address/216.24.57.1/relations",
    "https://www.virustotal.com/gui/ip-address/217.20.117.39/relations",
    "https://www.virustotal.com/gui/ip-address/218.255.24.226/relations",
    "https://www.virustotal.com/gui/ip-address/23.254.129.6/relations",
    "https://www.virustotal.com/gui/ip-address/23.254.244.242/relations",
    "https://www.virustotal.com/gui/ip-address/23.81.246.131/relations",
    "https://www.virustotal.com/gui/ip-address/23.82.19.179/relations",
    "https://www.virustotal.com/gui/ip-address/3.33.130.190/relations",
    "https://www.virustotal.com/gui/ip-address/31.97.218.133/relations",
    "https://www.virustotal.com/gui/ip-address/35.167.150.110/relations",
    "https://www.virustotal.com/gui/ip-address/44.227.65.245/relations",
    "https://www.virustotal.com/gui/ip-address/45.147.231.213",
    "https://www.virustotal.com/gui/ip-address/45.15.167.146/relations",
    "https://www.virustotal.com/gui/ip-address/45.153.242.37/relations",
    "https://www.virustotal.com/gui/ip-address/45.61.132.114/relations",
    "https://www.virustotal.com/gui/ip-address/45.61.136.133/relations",
    "https://www.virustotal.com/gui/ip-address/45.63.1.46/relations",
    "https://www.virustotal.com/gui/ip-address/45.76.77.197/relations",
    "https://www.virustotal.com/gui/ip-address/5.206.227.51/relations",
    "https://www.virustotal.com/gui/ip-address/5.230.252.157/relations",
    "https://www.virustotal.com/gui/ip-address/50.6.4.97/relations",
    "https://www.virustotal.com/gui/ip-address/51.210.235.45/relations",
    "https://www.virustotal.com/gui/ip-address/52.223.13.41/relations",
    "https://www.virustotal.com/gui/ip-address/54.39.128.125/relations",
    "https://www.virustotal.com/gui/ip-address/64.44.141.13/relations",
    "https://www.virustotal.com/gui/ip-address/64.44.141.15/relations",
    "https://www.virustotal.com/gui/ip-address/66.42.86.109/detection",
    "https://www.virustotal.com/gui/ip-address/68.170.2.240/relations",
    "https://www.virustotal.com/gui/ip-address/72.60.28.66/relations",
    "https://www.virustotal.com/gui/ip-address/72.60.32.153/relations",
    "https://www.virustotal.com/gui/ip-address/72.60.71.89/relations",
    "https://www.virustotal.com/gui/ip-address/76.76.21.21/relations",
    "https://www.virustotal.com/gui/ip-address/76.76.21.241/relations",
    "https://www.virustotal.com/gui/ip-address/77.37.37.81/relations",
    "https://www.virustotal.com/gui/ip-address/78.110.166.82/relations",
    "https://www.virustotal.com/gui/ip-address/82.197.80.64/relations",
    "https://www.virustotal.com/gui/ip-address/82.197.83.216/relations",
    "https://www.virustotal.com/gui/ip-address/82.198.232.148/relations",
    "https://www.virustotal.com/gui/ip-address/82.25.83.175/relations",
    "https://www.virustotal.com/gui/ip-address/82.25.87.27/relations",
    "https://www.virustotal.com/gui/ip-address/82.29.157.117/relations",
    "https://www.virustotal.com/gui/ip-address/82.29.199.129/relations",
    "https://www.virustotal.com/gui/ip-address/82.29.199.206/relations",
    "https://www.virustotal.com/gui/ip-address/82.29.80.153/relations",
    "https://www.virustotal.com/gui/ip-address/82.29.81.1/relations",
    "https://www.virustotal.com/gui/ip-address/82.29.87.223/relations",
    "https://www.virustotal.com/gui/ip-address/84.32.84.32/relations",
    "https://www.virustotal.com/gui/ip-address/91.195.240.123/relations",
    "https://www.virustotal.com/gui/ip-address/91.197.243.143/relations",
    "https://www.virustotal.com/gui/ip-address/91.222.173.108/relations",
    "https://www.virustotal.com/gui/ip-address/91.222.173.30/relations",
    "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
    "https://www.welivesecurity.com/2020/11/16/lazarus-supply-chain-attack-south-korea/",
    "https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/",
    "https://www.welivesecurity.com/2022/09/30/amazon-themed-campaigns-lazarus-netherlands-belgium/",
    "https://www.welivesecurity.com/en/eset-research/gotta-fly-lazarus-targets-uav-sector/",
    "https://www.welivesecurity.com/en/eset-research/lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company/",
    "https://www.zoomeye.hk/searchResult?q=%22%3Ctitle%3ENode.js+upload+multiple+files%3C%2Ftitle%3E%22&page=1&pageSize=50",
    "https://x.com/0x6rss/status/2036819936232763746",
    "https://x.com/0xKoda/status/1897787501592617160",
    "https://x.com/0xmh1/status/1894951955333865918",
    "https://x.com/0xmh1/status/1907245404766531772",
    "https://x.com/1ZRR4H/status/1814476691911090466",
    "https://x.com/1ZRR4H/status/1856985633153053060",
    "https://x.com/2eroHunter/status/2059205570393997429",
    "https://x.com/500mk500/status/1814696344272986483",
    "https://x.com/80vul/status/1844345021627236578",
    "https://x.com/AlvieriD/status/1933822421007847594",
    "https://x.com/AzakaSekai_/status/1871118429501128863",
    "https://x.com/AzakaSekai_/status/1871960523698545069",
    "https://x.com/BaoshengbinCumt/status/1914881621226033430",
    "https://x.com/CreateFileInt_/status/1894739132678599091",
    "https://x.com/CreateFileInt_/status/1894741888743223449",
    "https://x.com/Cybercyberbp04/status/1892039442157666815",
    "https://x.com/DaveLikesMalwre/status/1866981595111895209",
    "https://x.com/Fact_Finder03/status/2039577095664525728",
    "https://x.com/G60930953/status/1876050261023875128",
    "https://x.com/JamfThreatLabs/status/2057495360235245881",
    "https://x.com/JangPr0/status/1818787100130787428",
    "https://x.com/KfishNFT/status/2014379828787494923",
    "https://x.com/KirkDerpca/status/2065027462761787802",
    "https://x.com/KseProso/status/2084984281785389166",
    "https://x.com/L0Psec/status/1992348070101791152",
    "https://x.com/L0Psec/status/2020850377801781319",
    "https://x.com/L0Psec/status/2034002954949128237",
    "https://x.com/L0Psec/status/2034002958946337065",
    "https://x.com/L0Psec/status/2036098821059461256",
    "https://x.com/L0Psec/status/2049158325372125450",
    "https://x.com/L0Psec/status/2066540844006375831",
    "https://x.com/L0Psec/status/2077401458505359828",
    "https://x.com/LPX_404/status/1860977091690615172",
    "https://x.com/Merlax_/status/1826417594766651777",
    "https://x.com/MichalKoczwara/status/1812580245645766928",
    "https://x.com/MichalKoczwara/status/1826162083332829323",
    "https://x.com/MichalKoczwara/status/1833241777374900497",
    "https://x.com/MichalKoczwara/status/1843725315664912877",
    "https://x.com/MichalKoczwara/status/1844302222911476079",
    "https://x.com/MichalKoczwara/status/1853481507848908950",
    "https://x.com/MichalKoczwara/status/1856633769668616614",
    "https://x.com/MichalKoczwara/status/1878451947734204660",
    "https://x.com/MichalKoczwara/status/1898074044274294948",
    "https://x.com/P4nd3m1cb0y/status/1841829124404343223",
    "https://x.com/P4nd3m1cb0y/status/1856123619417428061",
    "https://x.com/P4nd3m1cb0y/status/1856520422583353696",
    "https://x.com/RakeshKrish12/status/1894626162061840605",
    "https://x.com/RedDrip7/status/1954801591938170935",
    "https://x.com/RedDrip7/status/1968500301377458222",
    "https://x.com/RedDrip7/status/1970391207051436538",
    "https://x.com/RedDrip7/status/2029459268626465203",
    "https://x.com/Reelix/status/2058168545758851184",
    "https://x.com/RexorVc0/status/1881973724712452577",
    "https://x.com/StrikeReadyLabs/status/1826432976894189825",
    "https://x.com/StrikeReadyLabs/status/1873182889128673422",
    "https://x.com/StrikeReadyLabs/status/1873388149566747069",
    "https://x.com/StrikeReadyLabs/status/1878822875081372108",
    "https://x.com/StrikeReadyLabs/status/1880368325047521678",
    "https://x.com/SttyK/status/1956180410104471917",
    "https://x.com/TLP_R3D/status/1856645765185110265",
    "https://x.com/TLP_R3D/status/1856648392295797009",
    "https://x.com/TLP_R3D/status/1881385663897231704",
    "https://x.com/TLP_R3D/status/1900511506518970638",
    "https://x.com/TLP_R3D/status/1900528743732367865",
    "https://x.com/TLP_R3D/status/1915851139301708283",
    "https://x.com/TekDefense/status/2056022823592702452",
    "https://x.com/ThreatBookLabs/status/1935542389793341808",
    "https://x.com/TomHegel/status/1859663831510942204",
    "https://x.com/TuringAlex/status/1986746682084839459",
    "https://x.com/ValidinLLC/status/1861021649522348124",
    "https://x.com/ValidinLLC/status/1879884999652229588",
    "https://x.com/ValidinLLC/status/1899512759965868072",
    "https://x.com/ValidinLLC/status/1994006209284788529",
    "https://x.com/__pberba__/status/1992762008069161317",
    "https://x.com/_eremit4/status/1856707514936492089",
    "https://x.com/_notdodo_/status/1888867769006850395",
    "https://x.com/abh1sek/status/2039637787742507381",
    "https://x.com/abh1sek/status/2044260573324685605",
    "https://x.com/abuse_ch/status/1889398273376424103",
    "https://x.com/asdasd13asbz/status/1859467358013895092",
    "https://x.com/asdasd13asbz/status/1859512243471446165",
    "https://x.com/banthisguy9349/status/1795545335164490137",
    "https://x.com/banthisguy9349/status/1873329177312875005",
    "https://x.com/banthisguy9349/status/1873338361928466759",
    "https://x.com/banthisguy9349/status/1873348678540493273",
    "https://x.com/banthisguy9349/status/1873358841053949966",
    "https://x.com/banthisguy9349/status/2012552220101738625",
    "https://x.com/banthisguy9349/status/2025523138641965532",
    "https://x.com/banthisguy9349/status/2051667828928086143",
    "https://x.com/banthisguy9349/status/2072492697764642939",
    "https://x.com/banthisguy9349/status/2074129793692688798",
    "https://x.com/banthisguy9349/status/2079077405113860398",
    "https://x.com/blackbigswan/status/2079687425757249884",
    "https://x.com/blackorbird/status/1848262847689887757",
    "https://x.com/blackorbird/status/1848563899064586701",
    "https://x.com/blackorbird/status/1853724721520775677",
    "https://x.com/blackorbird/status/1924832471621030031",
    "https://x.com/blackorbird/status/1993135605623218560",
    "https://x.com/blackorbird/status/2011064658212634920",
    "https://x.com/blackorbird/status/2066892874839687418",
    "https://x.com/bluish_red_/status/1960735923743678648",
    "https://x.com/byrne_emmy12099/status/1945890954604605497",
    "https://x.com/byrne_emmy12099/status/1946062275183575474",
    "https://x.com/capodieci/status/1903075585414533144",
    "https://x.com/cyber__sloth/status/1879848914230374457",
    "https://x.com/dazhengzhang/status/1899776299725680975",
    "https://x.com/dimitribest/status/1796191215626440908",
    "https://x.com/dimitribest/status/1815789250656301211",
    "https://x.com/dimitribest/status/1869572308178010492",
    "https://x.com/dimitribest/status/1872743641166606737",
    "https://x.com/dimitribest/status/1873003988536230241",
    "https://x.com/dimitribest/status/1873024742690857009",
    "https://x.com/dimitribest/status/1873367811822903765",
    "https://x.com/dyingbreeds_/status/1881986240020709401",
    "https://x.com/eastside_nci/status/1836605224020033548",
    "https://x.com/eastside_nci/status/1884354415387365458",
    "https://x.com/elasticseclabs/status/1960730276834775158",
    "https://x.com/elasticseclabs/status/1960730309487395314",
    "https://x.com/g0njxa/status/2014800328105894004",
    "https://x.com/h2jazi/status/1818715043800006982",
    "https://x.com/im23pds/status/1895284359911088358",
    "https://x.com/ishivtripathi/status/1844313316241645886",
    "https://x.com/ishivtripathi/status/2084907438243991883",
    "https://x.com/jamieantisocial/status/1911968062062166078",
    "https://x.com/lazarusholic/status/1873360845939621945",
    "https://x.com/lazarusholic/status/1885289504401142011",
    "https://x.com/lazarusholic/status/1893684791406715003",
    "https://x.com/lazarusholic/status/1935329204020855066",
    "https://x.com/lazarusholic/status/1937865917289168970",
    "https://x.com/lazarusholic/status/1950911891498488244",
    "https://x.com/lazarusholic/status/1953086237193150753",
    "https://x.com/lazarusholic/status/1988962619659886724",
    "https://x.com/lazarusholic/status/1990925548269568447",
    "https://x.com/lontze7/status/1856611739166470347",
    "https://x.com/lontze7/status/1894676242349048110",
    "https://x.com/lontze7/status/1895044097129496782",
    "https://x.com/lontze7/status/1896131895223841044",
    "https://x.com/lontze7/status/1897214445107175780",
    "https://x.com/lontze7/status/1903091260216189306",
    "https://x.com/malwrhunterteam/status/1812792291876119034",
    "https://x.com/malwrhunterteam/status/1820375076312604830",
    "https://x.com/malwrhunterteam/status/1820385406002872541",
    "https://x.com/malwrhunterteam/status/1860965771242864867",
    "https://x.com/malwrhunterteam/status/1894301990286471388",
    "https://x.com/malwrhunterteam/status/1908069353796292714",
    "https://x.com/malwrhunterteam/status/1910604983201902976",
    "https://x.com/malwrhunterteam/status/1910818212834353408",
    "https://x.com/malwrhunterteam/status/1915157662733394036",
    "https://x.com/malwrhunterteam/status/1917538786478538829",
    "https://x.com/malwrhunterteam/status/1925298281329901682",
    "https://x.com/malwrhunterteam/status/1991488257708945474",
    "https://x.com/malwrhunterteam/status/2008866701707038749",
    "https://x.com/malwrhunterteam/status/2064325045938274373",
    "https://x.com/malwrhunterteam/status/2069411902774472896",
    "https://x.com/malwrhunterteam/status/2074106725951590709",
    "https://x.com/meow_mfer/status/1954866701897805865",
    "https://x.com/meow_mfer/status/2055981353674654105",
    "https://x.com/moonlock_lab/status/1980683916571996312",
    "https://x.com/moonlock_lab/status/1980685980895236162",
    "https://x.com/morimolymoly2/status/1889722965459181881",
    "https://x.com/morimolymoly2/status/1926877622350279117",
    "https://x.com/nextronresearch/status/2049775774027124938",
    "https://x.com/nextronresearch/status/2074031725764633010",
    "https://x.com/nextronresearch/status/2079118025236566357",
    "https://x.com/nextronresearch/status/2079454428038406646",
    "https://x.com/npm_malware/status/2048749068051247429",
    "https://x.com/r3dactt/status/2026525340135469486",
    "https://x.com/safe/status/1897663514975649938",
    "https://x.com/safedepio/status/2058848260845076651",
    "https://x.com/skocherhan/status/2074059180256739719",
    "https://x.com/smica83/status/1883855708963442892",
    "https://x.com/smica83/status/2007012261744030069",
    "https://x.com/smica83/status/2067587696134889943",
    "https://x.com/solostalking/status/1889307324453625988",
    "https://x.com/superducktoes/status/2059302288552812818",
    "https://x.com/tayvano_/status/1848785112101691511",
    "https://x.com/tayvano_/status/1872980013542457802",
    "https://x.com/tayvano_/status/1899896814536712334",
    "https://x.com/tayvano_/status/1971206871076991302",
    "https://x.com/teamcymru_S2/status/1915827990774063179",
    "https://x.com/tuckner/status/2065140621497561236",
    "https://x.com/unpacker/status/2022669422411043001",
    "https://x.com/v0lundr_/status/2065375317682696560",
    "https://x.com/vedovelli74/status/2059340087696273828",
    "https://x.com/vedovelli74/status/2059341681216905519",
    "https://x.com/veryseriouseng/status/2071518552910151726",
    "https://x.com/veryseriouseng/status/2071525899313283528",
    "https://x.com/veryseriouseng/status/2071981111723331617",
    "https://x.com/veryseriouseng/status/2072735310178402450",
    "https://x.com/veryseriouseng/status/2074132007106359730",
    "https://x.com/volrant136/status/1965126588745613721",
    "https://x.com/zoomeye_team/status/1901822378348568825",
    "https://x.threatbook.cn/nodev4/vb4/article?threatInfoID=3051"
  ],
  "related": [
    {
      "evidence": [
        {
          "detail": "56 shared indicators",
          "kind": "infrastructure",
          "weight": 56.0
        },
        {
          "detail": "2 reports cite both",
          "kind": "reporting",
          "weight": 2.0
        },
        {
          "detail": "shares ECCENTRICBANDWAGON, HOPLIGHT",
          "kind": "software",
          "weight": 1.0
        }
      ],
      "slug": "G0082"
    },
    {
      "evidence": [
        {
          "detail": "2 shared indicators",
          "kind": "infrastructure",
          "weight": 2.0
        }
      ],
      "slug": "UNC2970"
    },
    {
      "evidence": [
        {
          "detail": "2 reports cite both",
          "kind": "reporting",
          "weight": 2.0
        }
      ],
      "slug": "G0121"
    },
    {
      "evidence": [
        {
          "detail": "2 reports cite both",
          "kind": "reporting",
          "weight": 2.0
        }
      ],
      "slug": "G0138"
    },
    {
      "evidence": [
        {
          "detail": "1 report cite both",
          "kind": "reporting",
          "weight": 1.0
        }
      ],
      "slug": "G1002"
    },
    {
      "evidence": [
        {
          "detail": "1 report cite both",
          "kind": "reporting",
          "weight": 1.0
        }
      ],
      "slug": "CARETO"
    },
    {
      "evidence": [
        {
          "detail": "1 report cite both",
          "kind": "reporting",
          "weight": 1.0
        }
      ],
      "slug": "G0097"
    },
    {
      "evidence": [
        {
          "detail": "1 report cite both",
          "kind": "reporting",
          "weight": 1.0
        }
      ],
      "slug": "G0094"
    },
    {
      "evidence": [
        {
          "detail": "shares Responder",
          "kind": "software",
          "weight": 0.333
        }
      ],
      "slug": "G0007"
    },
    {
      "evidence": [
        {
          "detail": "shares Responder",
          "kind": "software",
          "weight": 0.333
        }
      ],
      "slug": "G1003"
    }
  ],
  "slug": "G0032",
  "timeline": [
    {
      "counts": {
        "ipv4": 10
      },
      "first_seen": "2026-08-07",
      "indicators": {
        "ipv4": [
          "141.94.148.37:1224",
          "141.94.148.37:3333",
          "141.94.148.39:1224",
          "141.94.148.39:3333",
          "151.80.76.64:1224",
          "151.80.76.64:3333",
          "51.255.9.164:1224",
          "51.255.9.164:3333",
          "54.39.43.119:1224",
          "54.39.43.119:3333"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/"
      ],
      "total": 10
    },
    {
      "counts": {
        "ipv4": 3
      },
      "first_seen": "2026-08-06",
      "indicators": {
        "ipv4": [
          "141.94.148.35:1224",
          "51.79.124.171:1224",
          "54.39.43.114:1224"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 3
      },
      "first_seen": "2026-08-05",
      "indicators": {
        "domain": [
          "logkit-tau.vercel.app"
        ],
        "ipv4": [
          "66.45.225.94:1244",
          "66.45.225.94:1245",
          "66.45.225.94:1246"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/ishivtripathi/status/2084907438243991883",
        "https://www.virustotal.com/gui/file/ab65cef60fc097c2a9fb03a7855c9c03dfe3ccc874080720f0e631c6ee2c3e51/detection",
        "https://www.virustotal.com/gui/file/225d7482772a26e4236d91cae51197ab1dfbdd42232157c3e169c19177a384e1/detection",
        "https://www.virustotal.com/gui/file/5c9bc15e2db6ca97ff325159d6c07fd381a39f9e55ef69499bbfde51bb064808/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-08-05",
      "indicators": {
        "domain": [
          "blackskydev.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/KseProso/status/2084984281785389166"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-08-03",
      "indicators": {
        "domain": [
          "kerajaanmoshi.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.fox-it.com/2025/09/01/three-lazarus-rats-coming-for-your-cheese/",
        "https://blog.fox-it.com/2026/05/22/remotepe-the-lazarus-rat-that-lives-in-memory/",
        "https://www.virustotal.com/gui/file/d8de31bcaf5b9ebb99bef36244b0ab3c21367821947a789dff69c33d49aaffc9/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 5,
        "ipv4": 6,
        "url": 2
      },
      "first_seen": "2026-07-29",
      "indicators": {
        "domain": [
          "166-88-54-158.nip.io",
          "desarrollolab.com",
          "uk-link84.luckylink.top",
          "vs.desarrollolab.com",
          "vscodeextensions.desarrollolab.com"
        ],
        "ipv4": [
          "23.27.13.43:27017",
          "23.27.13.43:443",
          "23.27.13.43:8888",
          "23.27.20.187:27107",
          "23.27.20.187:443",
          "23.27.20.187:8888"
        ],
        "url": [
          "http://23.27.13.43",
          "http://23.27.20.187"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tuckner/status/2065140621497561236",
        "https://gist.github.com/danslo/1778c3bf30d65967db2d680727cbc89d"
      ],
      "total": 13
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-07-28",
      "indicators": {
        "domain": [
          "iploglab.store"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/malwrhunterteam/status/2064325045938274373",
        "https://x.com/malwrhunterteam/status/2069411902774472896",
        "https://www.virustotal.com/gui/file/c7a24e1fc68b7233e1c93c02409e9429a1ea5cf0662eb4cd03364373df7d7044/detection",
        "https://www.virustotal.com/gui/file/9d7576046152695728ead43e9752a105ef2641ef6317ff8d47094b8f541835b2/detection",
        "https://www.virustotal.com/gui/file/70f732e98634c3f887d84ba8acb1ee7b62e4f865ea4cb1be1edf32c40c27ae51/detection",
        "https://www.virustotal.com/gui/file/51e1f3a97629e8db50ca1f9a0b68c019e74c07ce5209d5eefd4a2e3f4fe62869/detection",
        "https://www.virustotal.com/gui/file/322b2eb4e4d61ec6a746e3da421e8fd9c62ce4f919f03aed373f663de539b2ba/detection",
        "https://www.virustotal.com/gui/file/068505fab1dc1b784ddc845c9eeeba8e04da512383ecd55a7a3d076879656393/detection",
        "https://www.virustotal.com/gui/file/0988384971ae7a2213793eab632112599031694fba074516b615ca0367f2bf8d/detection",
        "https://www.virustotal.com/gui/file/3ad42864371905aa4618ab74dcd67b2ddb578b9e3ecaa998f9a54a59fd3fa50c/detection",
        "https://www.virustotal.com/gui/file/4524b20f1d3c3299c66058e9bcba6f7a18675b7a6eea52c593a08259220c37ae/detection",
        "https://www.virustotal.com/gui/file/cc92280557b399ec9271af08c5b6f576c8478a7e2660f8fe1b4e8df3d0d80904/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-07-28",
      "indicators": {
        "ipv4": [
          "95.216.118.146:3000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/KirkDerpca/status/2065027462761787802",
        "https://panther.com/blog/tracking-an-ottercookie-infostealer-campaign-across-npm"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-07-23",
      "indicators": {
        "domain": [
          "172-86-89-213.cprapid.com",
          "softwareupdate.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/2eroHunter/status/2059205570393997429",
        "https://www.virustotal.com/gui/file/163e4a72cbe392c073eddc60aee69dc1cf87ce492c375af74e923d75d8084683/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 2
      },
      "first_seen": "2026-07-22",
      "indicators": {
        "domain": [
          "everydaynodechecker-39143n.vercel.app"
        ],
        "ipv4": [
          "31.222.250.65:1244",
          "31.222.250.65:15152"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/blackbigswan/status/2079687425757249884"
      ],
      "total": 3
    },
    {
      "counts": {
        "ipv4": 2
      },
      "first_seen": "2026-07-22",
      "indicators": {
        "ipv4": [
          "138.201.220.225:1224",
          "138.201.220.225:1245"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/zoomeye_team/status/1901822378348568825",
        "https://x.com/blackorbird/status/1993135605623218560",
        "https://socket.dev/blog/lazarus-strikes-npm-again-with-a-new-wave-of-malicious-packages",
        "https://www.gendigital.com/blog/insights/research/apt-cyber-alliances-2025",
        "https://app.validin.com/detail?find=L-Administrator&type=raw&ref_id=7c876e7935a#tab=host_pairs",
        "https://www.virustotal.com/gui/file/c6edbb0d733798e5e8168a9df2bccaad7834e40f3c30d09816cc9a8ecc431376/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-07-22",
      "indicators": {
        "domain": [
          "api.avax-test.dev",
          "avax-test.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/nextronresearch/status/2079454428038406646",
        "https://www.virustotal.com/gui/file/1aadea997fc4eda5a8a04e68f6e1828c93e00e817e50c5b6ef874faef43f7fca/detection",
        "https://www.virustotal.com/gui/file/c107419b6b4c793c92289f00cbb229a344fbe6fad1f34bc53e3e9147fb0a242e/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-07-22",
      "indicators": {
        "domain": [
          "l3vywd.easypanel.host"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 21,
        "ipv4": 3
      },
      "first_seen": "2026-07-21",
      "indicators": {
        "domain": [
          "api.sapia.us",
          "canditech.co",
          "canditech.ink",
          "canditech.net",
          "canditech.online",
          "canditech.org",
          "canditech.us",
          "canditech.xyz",
          "employ-check.com",
          "mettl.app",
          "mettl.us",
          "mettl.xyz",
          "nvidiadriver.net",
          "sapia.us",
          "szynergy.org",
          "tecmlny.com",
          "workbright.shop",
          "workbright.us",
          "y69.org",
          "zavnia.us",
          "ziggeo.tech"
        ],
        "ipv4": [
          "95.216.92.207:4000",
          "95.216.92.207:7777",
          "95.216.92.207:8080"
        ]
      },
      "precision": "exact",
      "references": [
        "https://socradar.io/blog/dprk-clickfake-pylangghost-golangghost-rats/"
      ],
      "total": 24
    },
    {
      "counts": {
        "ipv4": 10
      },
      "first_seen": "2026-07-21",
      "indicators": {
        "ipv4": [
          "166.88.134.82:27107",
          "166.88.4.2:27017",
          "166.88.4.2:443",
          "23.27.120.142:27017",
          "23.27.120.142:443",
          "23.27.20.143:27017",
          "23.27.20.143:443",
          "23.27.202.27:27017",
          "23.27.202.27:443",
          "45.249.90.214:27017"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/malwrhunterteam/status/1991488257708945474",
        "https://x.com/banthisguy9349/status/2012552220101738625",
        "https://research.jfrog.com/post/hijacked-npm-vscode-tasks-blockchain/",
        "https://checkmarx.com/zero-post/chainveil-a-malicious-npm-supply-chain-attack-by-successkey/",
        "https://www.virustotal.com/gui/file/0a133d4b96fc7b750a7b2ac14c152b61befd8dfa670e1fcd99661e531b49886e/detection"
      ],
      "total": 10
    },
    {
      "counts": {
        "ipv4": 2
      },
      "first_seen": "2026-07-21",
      "indicators": {
        "ipv4": [
          "66.235.175.96:1244",
          "66.235.175.96:3000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?find=Node.js%20upload%20multiple%20files&type=raw&ref_id=02496d38d39#tab=host_pairs (# 2025-08-02)",
        "https://app.validin.com/detail?find=VScode&type=raw&ref_id=689da69896f#tab=host_pairs (# 2026-04-10)"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-07-21",
      "indicators": {
        "domain": [
          "assetslib.shop"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/malwrhunterteam/status/2064325045938274373",
        "https://x.com/malwrhunterteam/status/2069411902774472896",
        "https://www.virustotal.com/gui/file/c7a24e1fc68b7233e1c93c02409e9429a1ea5cf0662eb4cd03364373df7d7044/detection",
        "https://www.virustotal.com/gui/file/9d7576046152695728ead43e9752a105ef2641ef6317ff8d47094b8f541835b2/detection",
        "https://www.virustotal.com/gui/file/70f732e98634c3f887d84ba8acb1ee7b62e4f865ea4cb1be1edf32c40c27ae51/detection",
        "https://www.virustotal.com/gui/file/51e1f3a97629e8db50ca1f9a0b68c019e74c07ce5209d5eefd4a2e3f4fe62869/detection",
        "https://www.virustotal.com/gui/file/322b2eb4e4d61ec6a746e3da421e8fd9c62ce4f919f03aed373f663de539b2ba/detection",
        "https://www.virustotal.com/gui/file/068505fab1dc1b784ddc845c9eeeba8e04da512383ecd55a7a3d076879656393/detection",
        "https://www.virustotal.com/gui/file/0988384971ae7a2213793eab632112599031694fba074516b615ca0367f2bf8d/detection",
        "https://www.virustotal.com/gui/file/3ad42864371905aa4618ab74dcd67b2ddb578b9e3ecaa998f9a54a59fd3fa50c/detection",
        "https://www.virustotal.com/gui/file/4524b20f1d3c3299c66058e9bcba6f7a18675b7a6eea52c593a08259220c37ae/detection",
        "https://www.virustotal.com/gui/file/cc92280557b399ec9271af08c5b6f576c8478a7e2660f8fe1b4e8df3d0d80904/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-07-21",
      "indicators": {
        "domain": [
          "talynexistest.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/82.29.157.117/relations",
        "https://app.validin.com/detail?find=%3A%3A%3A%22keywords%22%3A%22hiring%20platform%2C%20recruitment%20software%2C%20candidate%20screening%2C%20talent%20evaluation%2C%20skills-based%20hiring%2C%20interview%20tools%2C%20tech%20hiring%2C%20remote%20hiring%2C%20hiring%20automation%2C%20team%20building%22&type=raw#tab=host_pairs (# 2025-09-08)"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-07-21",
      "indicators": {
        "domain": [
          "rest-icon-provider.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/76.76.21.241/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-07-20",
      "indicators": {
        "domain": [
          "cdn-static-icons.vercel.app",
          "rest-icon-configure.vercel.app",
          "rest-icon-moduler.vercel.app",
          "rest-icon-provider.link",
          "verceljs-kappa.vercel.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/banthisguy9349/status/2079077405113860398",
        "https://www.virustotal.com/gui/file/41ee7ddb2be173686dc3a73a49b4e93bc883ef363acca770f7ede891451122ab/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-07-20",
      "indicators": {
        "domain": [
          "rest-icon-helper.store"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/nextronresearch/status/2079118025236566357"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-07-20",
      "indicators": {
        "domain": [
          "r4liyq.easypanel.host"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-07-20",
      "indicators": {
        "ipv4": [
          "162.0.239.85:3000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/KfishNFT/status/2014379828787494923",
        "https://x.com/g0njxa/status/2014800328105894004",
        "https://radar.securityalliance.org/vs-code-tasks-abuse-by-contagious-interview-dprk/",
        "https://www.abstract.security/blog/contagious-interview-tracking-the-vs-code-tasks-infection-vector",
        "https://www.virustotal.com/gui/file/60914b8df5b5d64070f71ef13817499b3a85de98433ae5c01bd235abec9464f6/detection",
        "https://www.virustotal.com/gui/file/6be45e165de60b61e9b7cb9e1f9b72c652c388a04c02d2068de6188cc88fc3fe/detection",
        "https://www.virustotal.com/gui/file/c226eb59cf696a85ed7134b57f12d82cb392d42b908dd6a463cd4d8c980ee5e8/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-07-20",
      "indicators": {
        "domain": [
          "digital-skill-assessment.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/104.21.39.124/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 7,
        "ipv4": 5
      },
      "first_seen": "2026-07-18",
      "indicators": {
        "domain": [
          "controller.rightwidth.dev",
          "file.rightwidth.dev",
          "hohoho.rightwidth.dev",
          "huhuhu.rightwidth.dev",
          "ldb.rightwidth.dev",
          "rightwidth.dev",
          "upload.rightwidth.dev"
        ],
        "ipv4": [
          "188.40.64.61:5000",
          "188.40.64.61:7777",
          "195.26.248.212:7000",
          "195.26.248.212:8081",
          "195.26.248.212:8443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.elastic.co/security-labs/contagious-interview-malware-svg-steganography"
      ],
      "total": 12
    },
    {
      "counts": {
        "domain": 2,
        "ipv4": 4
      },
      "first_seen": "2026-07-18",
      "indicators": {
        "domain": [
          "91.90.121.87.sslip.io",
          "talent-telusdigital.com"
        ],
        "ipv4": [
          "216.126.236.64:3000",
          "216.126.236.64:7777",
          "216.126.236.64:8888",
          "91.90.121.87:443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 10
      },
      "first_seen": "2026-07-17",
      "indicators": {
        "domain": [
          "vscode-address-checking-mo.vercel.app",
          "vscode-check-mo1.vercel.app",
          "vscode-clone.vercel.app",
          "vscode-ip-addess-checking.vercel.app",
          "vscode-ip-address-checking-ten.vercel.app",
          "vscode-ipaddress-checking-nine.vercel.app",
          "vscode-ipaddress-checking.vercel.app",
          "vscode-ipchecking.vercel.app",
          "vscode-setting-6-28.vercel.app",
          "vscode-settings-8140-self.vercel.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2077401458505359828",
        "https://www.virustotal.com/gui/file/795034792aa705f730dd498c51cbd6e472bae2e823d3a865f52bc3814fdeafd0/detection"
      ],
      "total": 10
    },
    {
      "counts": {
        "ipv4": 3
      },
      "first_seen": "2026-07-17",
      "indicators": {
        "ipv4": [
          "144.172.108.236:2000",
          "144.172.108.236:3000",
          "144.172.108.236:5918"
        ]
      },
      "precision": "exact",
      "references": [
        "https://kl4r10n.tech/blog/dprk-new-malware"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-07-13",
      "indicators": {
        "domain": [
          "x8qiup.easypanel.host"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-07-10",
      "indicators": {
        "domain": [
          "o1xyc6.easypanel.host"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-07-10",
      "indicators": {
        "ipv4": [
          "65.108.27.116:3000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/KfishNFT/status/2014379828787494923",
        "https://x.com/g0njxa/status/2014800328105894004",
        "https://radar.securityalliance.org/vs-code-tasks-abuse-by-contagious-interview-dprk/",
        "https://www.abstract.security/blog/contagious-interview-tracking-the-vs-code-tasks-infection-vector",
        "https://www.virustotal.com/gui/file/60914b8df5b5d64070f71ef13817499b3a85de98433ae5c01bd235abec9464f6/detection",
        "https://www.virustotal.com/gui/file/6be45e165de60b61e9b7cb9e1f9b72c652c388a04c02d2068de6188cc88fc3fe/detection",
        "https://www.virustotal.com/gui/file/c226eb59cf696a85ed7134b57f12d82cb392d42b908dd6a463cd4d8c980ee5e8/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 8
      },
      "first_seen": "2026-07-09",
      "indicators": {
        "ipv4": [
          "147.124.216.103:1224",
          "147.124.217.204:1224",
          "151.80.205.187:1224",
          "167.114.215.75:1224",
          "192.99.204.154:1224",
          "51.178.11.177:1224",
          "51.178.11.181:1224",
          "54.39.43.117:1224"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-07-08",
      "indicators": {
        "domain": [
          "bitensor.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/a1e96380809fa22b8ba0c9377e52b7919515d22a309ed8eae9783d42a04c7455/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 5,
        "ipv4": 1
      },
      "first_seen": "2026-07-07",
      "indicators": {
        "domain": [
          "callsdk.online",
          "coalink.support",
          "team.business.in",
          "web02eu.live",
          "webcamsdk-update.online"
        ],
        "ipv4": [
          "144.172.110.53:3000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/malwrhunterteam/status/2074106725951590709",
        "https://www.virustotal.com/gui/ip-address/144.172.110.53/relations",
        "https://tria.ge/260706-qky96abw2q/behavioral1"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-07-07",
      "indicators": {
        "domain": [
          "cameradriver.pro",
          "cctxtools.com",
          "hiring-intellipro.com",
          "sysdoctor.org",
          "zonelitho.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2026-07-07",
      "indicators": {
        "url": [
          "http://5.175.184.52"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/veryseriouseng/status/2074132007106359730"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4,
        "ipv4": 1
      },
      "first_seen": "2026-07-06",
      "indicators": {
        "domain": [
          "app.vereoy.com",
          "cameradriverupdates.com",
          "paxos-apply.com",
          "vereoy.com"
        ],
        "ipv4": [
          "144.208.127.165:3000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "ipv4": 2
      },
      "first_seen": "2026-07-06",
      "indicators": {
        "ipv4": [
          "95.216.64.240:1224",
          "95.216.64.240:1245"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/zoomeye_team/status/1901822378348568825",
        "https://x.com/blackorbird/status/1993135605623218560",
        "https://socket.dev/blog/lazarus-strikes-npm-again-with-a-new-wave-of-malicious-packages",
        "https://www.gendigital.com/blog/insights/research/apt-cyber-alliances-2025",
        "https://app.validin.com/detail?find=L-Administrator&type=raw&ref_id=7c876e7935a#tab=host_pairs",
        "https://www.virustotal.com/gui/file/c6edbb0d733798e5e8168a9df2bccaad7834e40f3c30d09816cc9a8ecc431376/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-07-06",
      "indicators": {
        "domain": [
          "knockri.us"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/skocherhan/status/2074059180256739719"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2026-07-06",
      "indicators": {
        "url": [
          "http://104.243.41.127"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/nextronresearch/status/2074031725764633010"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-07-06",
      "indicators": {
        "domain": [
          "figuermarkets.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/banthisguy9349/status/2074129793692688798"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2026-07-03",
      "indicators": {
        "url": [
          "http://62.33.223.164"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/veryseriouseng/status/2071981111723331617",
        "https://x.com/banthisguy9349/status/2072492697764642939"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 37,
        "url": 2
      },
      "first_seen": "2026-07-02",
      "indicators": {
        "domain": [
          "uaaidmission.org"
        ],
        "ipv4": [
          "103.35.188.48:3000",
          "103.35.188.48:5000",
          "138.201.140.23:4553",
          "139.60.162.62:3000",
          "139.60.162.62:5000",
          "144.172.104.196:7431",
          "144.172.104.196:7436",
          "144.172.112.214:3000",
          "144.172.112.214:5000",
          "147.124.202.210:1244",
          "147.124.202.213:1244",
          "162.120.17.8:3000",
          "162.120.17.8:5000",
          "216.126.224.168:7101",
          "216.126.224.168:7106",
          "216.126.225.104:3000",
          "216.126.225.104:5000",
          "216.126.237.71:4891",
          "216.126.237.71:4892",
          "216.126.237.71:4893",
          "216.126.237.71:4894",
          "216.126.237.71:4895",
          "216.126.237.71:4896",
          "216.126.237.71:4897",
          "216.126.237.71:4898",
          "31.207.47.71:3000",
          "31.207.47.71:5000",
          "38.92.47.157:1244",
          "38.92.47.175:1244",
          "45.140.167.218:1224",
          "45.59.160.215:3000",
          "45.59.163.198:1244",
          "66.248.205.172:3000",
          "66.248.205.172:5000",
          "66.248.205.172:8000",
          "95.216.37.186:3000",
          "95.216.37.186:5000"
        ],
        "url": [
          "http://147.189.172.105",
          "http://216.126.225.83"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/veryseriouseng/status/2072735310178402450",
        "https://www.ossprey.com/blog/how-ossprey-uncovered-a-large-scale-dprk-contagious-interview-campaign"
      ],
      "total": 40
    },
    {
      "counts": {
        "ipv4": 4,
        "url": 29
      },
      "first_seen": "2026-06-29",
      "indicators": {
        "ipv4": [
          "216.126.236.244:4801",
          "216.126.236.244:4806",
          "216.126.236.244:4808",
          "216.126.236.244:4809"
        ],
        "url": [
          "http://144.172.100.204",
          "http://144.172.101.178",
          "http://144.172.103.75",
          "http://144.172.105.92",
          "http://144.172.110.72",
          "http://144.172.114.159",
          "http://144.172.114.56",
          "http://144.172.115.235",
          "http://144.172.116.19",
          "http://144.172.116.67",
          "http://144.172.117.86",
          "http://144.172.89.227",
          "http://144.172.91.252",
          "http://144.172.93.69",
          "http://144.172.95.14",
          "http://144.172.97.203",
          "http://144.172.97.67",
          "http://144.172.98.156",
          "http://144.172.98.170",
          "http://153.75.91.138",
          "http://216.126.224.195",
          "http://216.126.225.84",
          "http://216.126.227.161",
          "http://216.126.227.187",
          "http://216.126.229.172",
          "http://216.126.236.138",
          "http://216.126.236.244",
          "http://216.126.237.112",
          "http://216.126.237.86"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/veryseriouseng/status/2071525899313283528",
        "https://x.com/veryseriouseng/status/2071518552910151726",
        "https://research.jfrog.com/post/rollup-polyfill-masquerading/"
      ],
      "total": 33
    },
    {
      "counts": {
        "ipv4": 2
      },
      "first_seen": "2026-06-29",
      "indicators": {
        "ipv4": [
          "198.135.49.65:1224",
          "216.250.252.245:1224"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-06-29",
      "indicators": {
        "domain": [
          "cloudflare-prevention.vercel.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/KirkDerpca/status/2065027462761787802",
        "https://panther.com/blog/tracking-an-ottercookie-infostealer-campaign-across-npm"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-06-28",
      "indicators": {
        "domain": [
          "savannahpos.co.ke"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 3
      },
      "first_seen": "2026-06-26",
      "indicators": {
        "ipv4": [
          "198.135.51.233:1224",
          "216.250.249.179:1224",
          "216.250.251.187:1224"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/"
      ],
      "total": 3
    },
    {
      "counts": {
        "ipv4": 2
      },
      "first_seen": "2026-06-26",
      "indicators": {
        "ipv4": [
          "69.197.164.135:1224",
          "69.197.164.135:1245"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/zoomeye_team/status/1901822378348568825",
        "https://x.com/blackorbird/status/1993135605623218560",
        "https://socket.dev/blog/lazarus-strikes-npm-again-with-a-new-wave-of-malicious-packages",
        "https://www.gendigital.com/blog/insights/research/apt-cyber-alliances-2025",
        "https://app.validin.com/detail?find=L-Administrator&type=raw&ref_id=7c876e7935a#tab=host_pairs",
        "https://www.virustotal.com/gui/file/c6edbb0d733798e5e8168a9df2bccaad7834e40f3c30d09816cc9a8ecc431376/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "ipv4": 3,
        "url": 3
      },
      "first_seen": "2026-06-24",
      "indicators": {
        "ipv4": [
          "166.88.134.62:10000",
          "166.88.134.62:2000",
          "166.88.134.62:443"
        ],
        "url": [
          "http://154.91.0.196",
          "http://166.88.134.62",
          "http://198.105.127.210"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.trendmicro.com/en_us/research/26/d/void-dokkaebi-uses-fake-job-interview-lure-to-spread-malware-via-code-repositories.html",
        "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/26/d/void-dokkaebi/Void-Dokkaebi-Uses-Fake-Job-Interview-Lure-to-Spread-Malware-via-Code-Repositories-IoCs.txt",
        "https://research.jfrog.com/post/hijacked-npm-vscode-tasks-blockchain/"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 3
      },
      "first_seen": "2026-06-24",
      "indicators": {
        "domain": [
          "githelper.store"
        ],
        "ipv4": [
          "104.194.153.144:8085",
          "104.194.153.144:8086",
          "104.194.153.144:8087"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/malwrhunterteam/status/2064325045938274373",
        "https://x.com/malwrhunterteam/status/2069411902774472896",
        "https://www.virustotal.com/gui/file/c7a24e1fc68b7233e1c93c02409e9429a1ea5cf0662eb4cd03364373df7d7044/detection",
        "https://www.virustotal.com/gui/file/9d7576046152695728ead43e9752a105ef2641ef6317ff8d47094b8f541835b2/detection",
        "https://www.virustotal.com/gui/file/70f732e98634c3f887d84ba8acb1ee7b62e4f865ea4cb1be1edf32c40c27ae51/detection",
        "https://www.virustotal.com/gui/file/51e1f3a97629e8db50ca1f9a0b68c019e74c07ce5209d5eefd4a2e3f4fe62869/detection",
        "https://www.virustotal.com/gui/file/322b2eb4e4d61ec6a746e3da421e8fd9c62ce4f919f03aed373f663de539b2ba/detection",
        "https://www.virustotal.com/gui/file/068505fab1dc1b784ddc845c9eeeba8e04da512383ecd55a7a3d076879656393/detection",
        "https://www.virustotal.com/gui/file/0988384971ae7a2213793eab632112599031694fba074516b615ca0367f2bf8d/detection",
        "https://www.virustotal.com/gui/file/3ad42864371905aa4618ab74dcd67b2ddb578b9e3ecaa998f9a54a59fd3fa50c/detection",
        "https://www.virustotal.com/gui/file/4524b20f1d3c3299c66058e9bcba6f7a18675b7a6eea52c593a08259220c37ae/detection",
        "https://www.virustotal.com/gui/file/cc92280557b399ec9271af08c5b6f576c8478a7e2660f8fe1b4e8df3d0d80904/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-06-23",
      "indicators": {
        "domain": [
          "ip-api-check-nine.vercel.app",
          "test-assesment-kk37hvtef-mahs-projects-03bae667.vercel.app",
          "test-assesment-self.vercel.app",
          "vscode-checking-ip-address.vercel.app",
          "vscode-setup.vercel.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://opensourcemalware.com/blog/latest-contagious-interview-malware-campaign-abuses-microsoft-vscode-tasks"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-06-21",
      "indicators": {
        "domain": [
          "theapp.tobeht.com",
          "tobeht.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/v0lundr_/status/2065375317682696560"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-06-20",
      "indicators": {
        "domain": [
          "aigtech.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/v0lundr_/status/2065375317682696560"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 26
      },
      "first_seen": "2026-06-19",
      "indicators": {
        "domain": [
          "17.docsend.store",
          "3.143.24.91.sslip.io",
          "5l.securemypc.xyz",
          "admin0.docsend.store",
          "ag.centoservices.cz",
          "centoservices.cz",
          "cloud.medipoint.mccprod.site",
          "cms.docsend.store",
          "dg.novaplayer.online",
          "docview.ink",
          "eduflex-eu.org",
          "ftp.teams-meets.com",
          "gorodmechty.ddns.net",
          "jk.theworldofluck.site",
          "mccprod.site",
          "novaplayer.online",
          "securemypc.xyz",
          "sp-plus-api.mccprod.site",
          "teams-live.cam",
          "teams-live.work",
          "teams-meet.co",
          "teams-meeting.in",
          "teams-meets.com",
          "teams-meets.online",
          "teams-meets.us.com",
          "theworldofluck.site"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/smica83/status/2067587696134889943",
        "https://www.virustotal.com/gui/file/7dc3082d2fb8f7fadf4de5155405fbadda2b402e0210f982fa313b99f2b29a11/detection",
        "https://www.virustotal.com/gui/file/d78e925950df009a753f9eb193c8536551d38f84b9fe15de0c457c1441e9276d/detection"
      ],
      "total": 26
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-06-16",
      "indicators": {
        "domain": [
          "rest-icon-handler.store"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/blackorbird/status/2066892874839687418",
        "https://roman.pt/posts/linkedin-backdoor/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 1,
        "url": 1
      },
      "first_seen": "2026-06-15",
      "indicators": {
        "domain": [
          "driverhubpro.net"
        ],
        "ipv4": [
          "45.95.186.237:8000"
        ],
        "url": [
          "http://45.95.186.237"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2066540844006375831",
        "https://www.virustotal.com/gui/file/95fdd6fe3c222a51a8038d8340e43338b7655d477da6f7eaede7925cf22f0106/detection",
        "https://www.virustotal.com/gui/file/1a3146e3df64507fd9ab933f7ca395fe9355843e108dde346e806808b2c79001/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "ipv4": 3,
        "url": 1
      },
      "first_seen": "2026-06-12",
      "indicators": {
        "ipv4": [
          "166.88.54.158:27107",
          "166.88.54.158:443",
          "166.88.54.158:8888"
        ],
        "url": [
          "http://166.88.54.158"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tuckner/status/2065140621497561236",
        "https://gist.github.com/danslo/1778c3bf30d65967db2d680727cbc89d"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-06-11",
      "indicators": {
        "domain": [
          "cloudflare1.vercel.app",
          "datasecure-service.vercel.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/KirkDerpca/status/2065027462761787802",
        "https://panther.com/blog/tracking-an-ottercookie-infostealer-campaign-across-npm"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-06-11",
      "indicators": {
        "domain": [
          "vscode-ip-address-checking.vercel.app",
          "vscode-ip-checking-nine.vercel.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/KfishNFT/status/2014379828787494923",
        "https://x.com/g0njxa/status/2014800328105894004",
        "https://radar.securityalliance.org/vs-code-tasks-abuse-by-contagious-interview-dprk/",
        "https://www.abstract.security/blog/contagious-interview-tracking-the-vs-code-tasks-infection-vector",
        "https://www.virustotal.com/gui/file/60914b8df5b5d64070f71ef13817499b3a85de98433ae5c01bd235abec9464f6/detection",
        "https://www.virustotal.com/gui/file/6be45e165de60b61e9b7cb9e1f9b72c652c388a04c02d2068de6188cc88fc3fe/detection",
        "https://www.virustotal.com/gui/file/c226eb59cf696a85ed7134b57f12d82cb392d42b908dd6a463cd4d8c980ee5e8/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-06-11",
      "indicators": {
        "domain": [
          "oxdo.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2036098821059461256",
        "https://x.com/L0Psec/status/2049158325372125450",
        "https://www.virustotal.com/gui/file/4291da6d5461c51ff0f852ca40a557739e955667df66c359cb0952542bb796b2/detection",
        "https://www.virustotal.com/gui/file/c2fe5b1d2c4cef27ab22fa8bc960a78264418e02ab3787bf0053c8f3a37c95ca/detection",
        "https://www.virustotal.com/gui/file/a6d2f0c3892b443d022d4c77835a85efb1131b0a12d3464b01cec3563194c73c/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-06-10",
      "indicators": {
        "domain": [
          "admin.rohapowers.com",
          "alqaflah.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2036098821059461256",
        "https://x.com/L0Psec/status/2049158325372125450",
        "https://www.virustotal.com/gui/file/4291da6d5461c51ff0f852ca40a557739e955667df66c359cb0952542bb796b2/detection",
        "https://www.virustotal.com/gui/file/c2fe5b1d2c4cef27ab22fa8bc960a78264418e02ab3787bf0053c8f3a37c95ca/detection",
        "https://www.virustotal.com/gui/file/a6d2f0c3892b443d022d4c77835a85efb1131b0a12d3464b01cec3563194c73c/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 47,
        "ipv4": 2
      },
      "first_seen": "2026-06-09",
      "indicators": {
        "domain": [
          "alphanonega.org",
          "asteara.org",
          "careerpredictto.space",
          "careerpulsynk.xyz",
          "careertrixauvex.ink",
          "ceronet.work",
          "ceronetwork.org",
          "connectptogether.ink",
          "contactpredicttogether.ink",
          "contactpulsynk.ink",
          "contacttrixauvex.ink",
          "coslyintra.online",
          "cotrixauvex.ink",
          "culyrax.us",
          "deep-ai-guard.store",
          "domatisc.ink",
          "doxxela.ink",
          "elsavora.us",
          "empowerpharmacy.space",
          "hyperdevpipline.org",
          "mailpredicttogether.ink",
          "mailpulsynk.xyz",
          "mailtrixauvex.ink",
          "migadyn.info",
          "nemesistrade.work",
          "notifypulsynk.ink",
          "nowurisch.fit",
          "nxlog.tech",
          "ondofinance.tech",
          "onoplainai.ink",
          "onoplanoai.ink",
          "optixauvex.us",
          "predictcareertogether.space",
          "predicttocareer.space",
          "predicttogerecruit.store",
          "predicttogether.ink",
          "predicttogetherrecruit.store",
          "pulsynk.org",
          "raxvatange.ink",
          "recruitptogether.xyz",
          "recruitvex.us",
          "talentnexhr.ink",
          "teampulsynk.team",
          "togetherhire.fun",
          "trixauvex.org",
          "trixauvexnet.ink",
          "valorecuiting.online"
        ],
        "ipv4": [
          "23.137.105.75:5000",
          "23.137.105.75:5173"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal"
      ],
      "total": 49
    },
    {
      "counts": {
        "domain": 14,
        "ipv4": 12,
        "url": 3
      },
      "first_seen": "2026-06-09",
      "indicators": {
        "domain": [
          "3la6ol.net",
          "backup.coinbase-backup.com",
          "bugnol.com",
          "coinbase-backup.com",
          "dezertir.com",
          "eager-shockley.144-172-108-248.plesk.page",
          "fax-cover.com",
          "hahaios.com",
          "hvdaconversions.com",
          "id37093.com",
          "lab99.sbs",
          "mail.reuniao21.admescolassistema.com",
          "monade.online",
          "recruiterlogon.company"
        ],
        "ipv4": [
          "144.172.108.225:2000",
          "144.172.108.225:8443",
          "144.172.108.248:8443",
          "144.172.112.213:443",
          "144.172.115.177:8443",
          "144.172.89.183:443",
          "209.182.224.49:443",
          "216.126.225.243:8085",
          "216.126.225.243:8086",
          "216.126.225.243:8087",
          "216.126.225.67:443",
          "216.126.237.200:8443"
        ],
        "url": [
          "http://144.172.89.183",
          "http://209.182.224.49",
          "http://216.126.237.200"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/malwrhunterteam/status/2064325045938274373",
        "https://x.com/malwrhunterteam/status/2069411902774472896",
        "https://www.virustotal.com/gui/file/c7a24e1fc68b7233e1c93c02409e9429a1ea5cf0662eb4cd03364373df7d7044/detection",
        "https://www.virustotal.com/gui/file/9d7576046152695728ead43e9752a105ef2641ef6317ff8d47094b8f541835b2/detection",
        "https://www.virustotal.com/gui/file/70f732e98634c3f887d84ba8acb1ee7b62e4f865ea4cb1be1edf32c40c27ae51/detection",
        "https://www.virustotal.com/gui/file/51e1f3a97629e8db50ca1f9a0b68c019e74c07ce5209d5eefd4a2e3f4fe62869/detection",
        "https://www.virustotal.com/gui/file/322b2eb4e4d61ec6a746e3da421e8fd9c62ce4f919f03aed373f663de539b2ba/detection",
        "https://www.virustotal.com/gui/file/068505fab1dc1b784ddc845c9eeeba8e04da512383ecd55a7a3d076879656393/detection",
        "https://www.virustotal.com/gui/file/0988384971ae7a2213793eab632112599031694fba074516b615ca0367f2bf8d/detection",
        "https://www.virustotal.com/gui/file/3ad42864371905aa4618ab74dcd67b2ddb578b9e3ecaa998f9a54a59fd3fa50c/detection",
        "https://www.virustotal.com/gui/file/4524b20f1d3c3299c66058e9bcba6f7a18675b7a6eea52c593a08259220c37ae/detection",
        "https://www.virustotal.com/gui/file/cc92280557b399ec9271af08c5b6f576c8478a7e2660f8fe1b4e8df3d0d80904/detection"
      ],
      "total": 29
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-06-09",
      "indicators": {
        "domain": [
          "tolerancemodernincruiter.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2036098821059461256",
        "https://x.com/L0Psec/status/2049158325372125450",
        "https://www.virustotal.com/gui/file/4291da6d5461c51ff0f852ca40a557739e955667df66c359cb0952542bb796b2/detection",
        "https://www.virustotal.com/gui/file/c2fe5b1d2c4cef27ab22fa8bc960a78264418e02ab3787bf0053c8f3a37c95ca/detection",
        "https://www.virustotal.com/gui/file/a6d2f0c3892b443d022d4c77835a85efb1131b0a12d3464b01cec3563194c73c/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 2
      },
      "first_seen": "2026-06-03",
      "indicators": {
        "url": [
          "http://206.71.148.38",
          "magazineschool.co.kr/includes/lm9.asp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://mp.weixin.qq.com/s/3kwDMAXviaE1TUDnkYlqrg",
        "https://www.virustotal.com/gui/file/09cc7c879b7facbda5349a8d273f8fac6b9be8c3f9927820bcd04583114564eb/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "ipv4": 8
      },
      "first_seen": "2026-06-01",
      "indicators": {
        "ipv4": [
          "147.124.211.143:1224",
          "147.124.212.178:1224",
          "147.124.212.180:1224",
          "147.124.212.207:1224",
          "176.9.174.137:1224",
          "37.48.102.17:1224",
          "45.43.11.214:1224",
          "66.235.168.158:1224"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-05-29",
      "indicators": {
        "domain": [
          "analyzicai.com",
          "novachainhub.com",
          "solidicai.com",
          "uxicai.com",
          "web3web4.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/superducktoes/status/2059302288552812818",
        "https://nkinternet.com/2026/05/26/dprk-captive-portal-infrastructure-found-in-testing/",
        "https://adelnz.com/writing/npm-install-is-dangerous/"
      ],
      "total": 5
    },
    {
      "counts": {
        "ipv4": 2
      },
      "first_seen": "2026-05-29",
      "indicators": {
        "ipv4": [
          "136.243.22.62:1224",
          "138.201.128.169:1224"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 11
      },
      "first_seen": "2026-05-27",
      "indicators": {
        "domain": [
          "akamaicloud.com",
          "appsnabia.org",
          "btfns.co",
          "devicelinkintel.com",
          "intelcloudinsights.com",
          "mail.aes-secure.net",
          "mail.newson-6.com",
          "msdeliverycontent.com",
          "newson-6.com",
          "track.trandytics.com",
          "trandytics.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.fox-it.com/2025/09/01/three-lazarus-rats-coming-for-your-cheese/",
        "https://blog.fox-it.com/2026/05/22/remotepe-the-lazarus-rat-that-lives-in-memory/",
        "https://www.virustotal.com/gui/file/d8de31bcaf5b9ebb99bef36244b0ab3c21367821947a789dff69c33d49aaffc9/detection"
      ],
      "total": 11
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 3
      },
      "first_seen": "2026-05-27",
      "indicators": {
        "domain": [
          "guildsmartchainpulse.com"
        ],
        "ipv4": [
          "72.60.77.221:3000",
          "72.60.77.221:4000",
          "72.60.77.221:8080"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2036098821059461256",
        "https://x.com/L0Psec/status/2049158325372125450",
        "https://www.virustotal.com/gui/file/4291da6d5461c51ff0f852ca40a557739e955667df66c359cb0952542bb796b2/detection",
        "https://www.virustotal.com/gui/file/c2fe5b1d2c4cef27ab22fa8bc960a78264418e02ab3787bf0053c8f3a37c95ca/detection",
        "https://www.virustotal.com/gui/file/a6d2f0c3892b443d022d4c77835a85efb1131b0a12d3464b01cec3563194c73c/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 9
      },
      "first_seen": "2026-05-26",
      "indicators": {
        "domain": [
          "admescolassystemf.com",
          "mail.tesolraria6.admescolassystemf.com",
          "mail.vyrabank.com",
          "support-mac.online",
          "teams-supports.online",
          "tesolraria6.admescolassystemf.com",
          "vyrabank.com",
          "weekly-up.online",
          "zoom-support.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/2eroHunter/status/2059205570393997429",
        "https://www.virustotal.com/gui/file/163e4a72cbe392c073eddc60aee69dc1cf87ce492c375af74e923d75d8084683/detection"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 4
      },
      "first_seen": "2026-05-26",
      "indicators": {
        "domain": [
          "vaultchainblockpulse.com"
        ],
        "ipv4": [
          "72.61.123.154:3000",
          "72.61.123.154:5173",
          "72.61.123.154:8000",
          "72.61.123.154:9000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2036098821059461256",
        "https://x.com/L0Psec/status/2049158325372125450",
        "https://www.virustotal.com/gui/file/4291da6d5461c51ff0f852ca40a557739e955667df66c359cb0952542bb796b2/detection",
        "https://www.virustotal.com/gui/file/c2fe5b1d2c4cef27ab22fa8bc960a78264418e02ab3787bf0053c8f3a37c95ca/detection",
        "https://www.virustotal.com/gui/file/a6d2f0c3892b443d022d4c77835a85efb1131b0a12d3464b01cec3563194c73c/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-05-26",
      "indicators": {
        "domain": [
          "gglab-poker.netlify.app",
          "payload-beta-lemon.vercel.app",
          "taskhandler-taupe.vercel.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/vedovelli74/status/2059340087696273828",
        "https://x.com/vedovelli74/status/2059341681216905519"
      ],
      "total": 3
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-05-25",
      "indicators": {
        "ipv4": [
          "195.201.194.107:801"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/abh1sek/status/2044260573324685605",
        "https://x.com/safedepio/status/2058848260845076651",
        "https://www.virustotal.com/gui/ip-address/195.201.194.107/relations",
        "https://socket.dev/blog/new-pypi-malware-exfiltrates-ethereum-private-keys",
        "https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto",
        "https://www.virustotal.com/gui/file/96f79c766d045e4c0733eda16fc9c5fd3a9ac567e0c5d61c4976de874c20ee30/detection",
        "https://www.virustotal.com/gui/file/aef28d1fb239269b74b85903ddeb62feb75e3dd2f037b6a72ad57e0d065c8a31/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-05-23",
      "indicators": {
        "domain": [
          "vscode-settings-0511.vercel.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/Reelix/status/2058168545758851184"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-05-21",
      "indicators": {
        "domain": [
          "auth-drive-google.vercel.app",
          "gitcheck-commit.vercel.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/JamfThreatLabs/status/2057495360235245881",
        "https://www.virustotal.com/gui/file/78deace2e76fe8678d65018b1f136965f4ebad5e8d92568e5e2d2335e292146b/detection",
        "https://www.virustotal.com/gui/file/347d6886aa799d5db7068367d3873fec699b5224d292b7eeec9afa079adb5d07/detection",
        "https://www.virustotal.com/gui/file/628d0ebf940db13e740382c3b34d69d44f7bdcf5f7787f02be4249a8f1e0a8eb/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-05-21",
      "indicators": {
        "domain": [
          "precommit.vercel.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://opensourcemalware.com/blog/dprk-git-hooks-malware",
        "https://x.com/JamfThreatLabs/status/2057495360235245881",
        "https://www.virustotal.com/gui/file/78deace2e76fe8678d65018b1f136965f4ebad5e8d92568e5e2d2335e292146b/detection",
        "https://www.virustotal.com/gui/file/347d6886aa799d5db7068367d3873fec699b5224d292b7eeec9afa079adb5d07/detection",
        "https://www.virustotal.com/gui/file/628d0ebf940db13e740382c3b34d69d44f7bdcf5f7787f02be4249a8f1e0a8eb/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 3
      },
      "first_seen": "2026-05-20",
      "indicators": {
        "ipv4": [
          "195.201.194.107:3000",
          "195.201.194.107:8000",
          "195.201.194.107:9000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/abh1sek/status/2044260573324685605",
        "https://x.com/safedepio/status/2058848260845076651",
        "https://www.virustotal.com/gui/ip-address/195.201.194.107/relations",
        "https://socket.dev/blog/new-pypi-malware-exfiltrates-ethereum-private-keys",
        "https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto",
        "https://www.virustotal.com/gui/file/96f79c766d045e4c0733eda16fc9c5fd3a9ac567e0c5d61c4976de874c20ee30/detection",
        "https://www.virustotal.com/gui/file/aef28d1fb239269b74b85903ddeb62feb75e3dd2f037b6a72ad57e0d065c8a31/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "ipv4": 4
      },
      "first_seen": "2026-05-18",
      "indicators": {
        "ipv4": [
          "144.172.89.198:21",
          "144.172.89.198:3000",
          "195.201.104.53:21",
          "216.126.227.239:21"
        ]
      },
      "precision": "exact",
      "references": [
        "https://redasgard.com/blog/hunting-lazarus-part5-eleven-hours-on-his-disk"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-05-17",
      "indicators": {
        "domain": [
          "logs-bin.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/meow_mfer/status/2055981353674654105",
        "https://x.com/TekDefense/status/2056022823592702452",
        "https://sandyclaw.permiso.io/shared/9cC7Jc0sJawMbpikB3ONEehU5aoK91bFu65CtaRUwzU",
        "https://www.virustotal.com/gui/file/e58864cc22cd8ec17ae35dd810455d604aadab7c3f145b6c53b3c261855a4bb1/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-05-17",
      "indicators": {
        "domain": [
          "bitgesell.finance"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/meow_mfer/status/1954866701897805865"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 3
      },
      "first_seen": "2026-05-14",
      "indicators": {
        "domain": [
          "smartonboardingportal.com"
        ],
        "ipv4": [
          "195.35.23.88:8080",
          "195.35.23.88:8081",
          "195.35.23.88:8443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2036098821059461256",
        "https://x.com/L0Psec/status/2049158325372125450",
        "https://www.virustotal.com/gui/file/4291da6d5461c51ff0f852ca40a557739e955667df66c359cb0952542bb796b2/detection",
        "https://www.virustotal.com/gui/file/c2fe5b1d2c4cef27ab22fa8bc960a78264418e02ab3787bf0053c8f3a37c95ca/detection",
        "https://www.virustotal.com/gui/file/a6d2f0c3892b443d022d4c77835a85efb1131b0a12d3464b01cec3563194c73c/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-05-11",
      "indicators": {
        "ipv4": [
          "198.135.50.70:1224"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 2
      },
      "first_seen": "2026-05-10",
      "indicators": {
        "ipv4": [
          "170.205.31.203:3000",
          "208.84.100.22:3000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/KirkDerpca/status/2065027462761787802",
        "https://panther.com/blog/tracking-an-ottercookie-infostealer-campaign-across-npm"
      ],
      "total": 2
    },
    {
      "counts": {
        "ipv4": 3
      },
      "first_seen": "2026-05-08",
      "indicators": {
        "ipv4": [
          "147.124.202.182:1224",
          "198.135.55.119:1224",
          "45.43.11.211:1224"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-05-07",
      "indicators": {
        "domain": [
          "llmtraininginference.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2036098821059461256",
        "https://x.com/L0Psec/status/2049158325372125450",
        "https://www.virustotal.com/gui/file/4291da6d5461c51ff0f852ca40a557739e955667df66c359cb0952542bb796b2/detection",
        "https://www.virustotal.com/gui/file/c2fe5b1d2c4cef27ab22fa8bc960a78264418e02ab3787bf0053c8f3a37c95ca/detection",
        "https://www.virustotal.com/gui/file/a6d2f0c3892b443d022d4c77835a85efb1131b0a12d3464b01cec3563194c73c/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-05-06",
      "indicators": {
        "ipv4": [
          "202.155.11.141:3000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2036098821059461256",
        "https://x.com/L0Psec/status/2049158325372125450",
        "https://www.virustotal.com/gui/file/4291da6d5461c51ff0f852ca40a557739e955667df66c359cb0952542bb796b2/detection",
        "https://www.virustotal.com/gui/file/c2fe5b1d2c4cef27ab22fa8bc960a78264418e02ab3787bf0053c8f3a37c95ca/detection",
        "https://www.virustotal.com/gui/file/a6d2f0c3892b443d022d4c77835a85efb1131b0a12d3464b01cec3563194c73c/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 11
      },
      "first_seen": "2026-05-05",
      "indicators": {
        "domain": [
          "blockterralab.com",
          "teachersrecruitmentboard.in",
          "tradeinsight360.com",
          "trendofferstore.com",
          "truehimalayahikes.com",
          "tudiapalmsprings.com",
          "unibotechreports.com",
          "usinetechnologies.com",
          "vajrasilverstores.com",
          "web3tradinghub.com",
          "xcryptoflasher.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/banthisguy9349/status/2051667828928086143"
      ],
      "total": 11
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 1
      },
      "first_seen": "2026-05-02",
      "indicators": {
        "domain": [
          "neuralnetworkdatalab.com"
        ],
        "ipv4": [
          "147.93.90.228:8090"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2036098821059461256",
        "https://x.com/L0Psec/status/2049158325372125450",
        "https://www.virustotal.com/gui/file/4291da6d5461c51ff0f852ca40a557739e955667df66c359cb0952542bb796b2/detection",
        "https://www.virustotal.com/gui/file/c2fe5b1d2c4cef27ab22fa8bc960a78264418e02ab3787bf0053c8f3a37c95ca/detection",
        "https://www.virustotal.com/gui/file/a6d2f0c3892b443d022d4c77835a85efb1131b0a12d3464b01cec3563194c73c/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 26,
        "ipv4": 10
      },
      "first_seen": "2026-05-01",
      "indicators": {
        "domain": [
          "api-sub.jrodacooker.dev",
          "app.caesarx.trade",
          "bensaru.site",
          "blxrbn.com",
          "caesarx.trade",
          "changelog.rest",
          "clob-polymarket.com",
          "clob.health",
          "copilot-ai.whisdev.org",
          "dev.caesarx.trade",
          "fivefingerz.dev",
          "ghostraper.top",
          "ipfs-url-validator.vercel.app",
          "jrodacooker.dev",
          "log.pricesheet.ink",
          "logger.clob.health",
          "mywalletsss.store",
          "navigatorshub.com",
          "polblxpnl.space",
          "polymarket-clob.com",
          "pricesheet.ink",
          "rpc-amoy.polygon.technology",
          "soladify.fun",
          "validator.uno",
          "whisdev.org",
          "winstonjs.site"
        ],
        "ipv4": [
          "195.201.194.107:8010",
          "45.61.161.146:3000",
          "45.61.161.146:4000",
          "45.61.161.146:5000",
          "45.61.161.146:5173",
          "45.8.22.144:3000",
          "45.8.22.144:8080",
          "45.8.22.52:3000",
          "45.8.22.52:8000",
          "45.8.22.52:9000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/abh1sek/status/2044260573324685605",
        "https://x.com/safedepio/status/2058848260845076651",
        "https://www.virustotal.com/gui/ip-address/195.201.194.107/relations",
        "https://socket.dev/blog/new-pypi-malware-exfiltrates-ethereum-private-keys",
        "https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto",
        "https://www.virustotal.com/gui/file/96f79c766d045e4c0733eda16fc9c5fd3a9ac567e0c5d61c4976de874c20ee30/detection",
        "https://www.virustotal.com/gui/file/aef28d1fb239269b74b85903ddeb62feb75e3dd2f037b6a72ad57e0d065c8a31/detection"
      ],
      "total": 36
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-05-01",
      "indicators": {
        "ipv4": [
          "198.135.55.67:1224"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 18
      },
      "first_seen": "2026-04-30",
      "indicators": {
        "domain": [
          "admin.luckyguys.cloud",
          "api.luckyguys.cloud",
          "cdn.luckyguys.cloud",
          "chat.luckyguys.cloud",
          "check.luckyguys.cloud",
          "clients.socket.luckyguys.cloud",
          "ext.luckyguys.cloud",
          "file.luckyguys.cloud",
          "git.luckyguys.cloud",
          "luckyguys.cloud",
          "main.socket.luckyguys.cloud",
          "manage.luckyguys.cloud",
          "message.luckyguys.cloud",
          "msg.luckyguys.cloud",
          "rbluckyguys.com",
          "rdweb.luckyguys.cloud",
          "rustdesk.luckyguys.cloud",
          "socket.luckyguys.cloud"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.linkedin.com/feed/update/urn:li:activity:7455559719282241536/",
        "https://www.virustotal.com/gui/ip-address/45.15.167.146/relations"
      ],
      "total": 18
    },
    {
      "counts": {
        "ipv4": 12
      },
      "first_seen": "2026-04-30",
      "indicators": {
        "ipv4": [
          "138.226.220.187:1244",
          "165.140.86.183:1245",
          "165.140.86.183:2246",
          "176.222.52.155:1244",
          "185.204.54.232:1244",
          "38.92.47.165:1244",
          "45.59.163.50:1244",
          "46.17.98.55:1244",
          "66.235.168.155:1244",
          "66.235.168.245:1244",
          "66.235.175.83:1244",
          "78.142.218.26:1244"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/npm_malware/status/2048749068051247429",
        "https://socket.dev/npm/package/ozonex-sdk/files/1.0.5/postinstall.js",
        "https://www.aikido.dev/blog/fast-draft-open-vsx-bloktrooper",
        "https://expel.com/blog/inside-lazarus-how-north-korea-uses-ai-to-industrialize-attacks-on-developers/",
        "https://gist.github.com/danslo/edb46198720ed0f4ad6e4b1c4b481efe",
        "https://gist.github.com/danslo/390782908532ef78b137cf14bd403a7e",
        "https://gist.github.com/danslo/18962c2dc0e41650d9db92adf0d7fc1a",
        "https://gist.githubusercontent.com/danslo/fb62df9fcc65ae252ffb0c416fe35b4d/raw/e895416c7b708966ab1b3973c648dec39d6cf129/gistfile1.txt",
        "https://gist.githubusercontent.com/danslo/f27bda16ead7ec8d1604922869fa5568/raw/13d3af30dfb306edaaade5aa723114d96f08518e/analysis.txt"
      ],
      "total": 12
    },
    {
      "counts": {
        "domain": 1,
        "url_path": 1
      },
      "first_seen": "2026-04-30",
      "indicators": {
        "domain": [
          "49rjaf1fgrlzl1t82dpxmiqmyeedl4kku5y3hjvanjleyhpo3pjmbn23q0.pages.dev"
        ],
        "url_path": [
          "/paQbmQO0YPKDRyPi7CqrbTV"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/nextronresearch/status/2049775774027124938",
        "https://www.virustotal.com/gui/file/5fc61384dd6f15e6bb510e0421000c1301a40d7acf05cedbeb6bc789c0a99d00/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 4
      },
      "first_seen": "2026-04-28",
      "indicators": {
        "url": [
          "http://195.201.104.22",
          "http://195.201.104.4",
          "http://195.201.104.41",
          "http://195.201.53.165"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/npm_malware/status/2048749068051247429",
        "https://socket.dev/npm/package/ozonex-sdk/files/1.0.5/postinstall.js",
        "https://www.aikido.dev/blog/fast-draft-open-vsx-bloktrooper",
        "https://expel.com/blog/inside-lazarus-how-north-korea-uses-ai-to-industrialize-attacks-on-developers/",
        "https://gist.github.com/danslo/edb46198720ed0f4ad6e4b1c4b481efe",
        "https://gist.github.com/danslo/390782908532ef78b137cf14bd403a7e",
        "https://gist.github.com/danslo/18962c2dc0e41650d9db92adf0d7fc1a",
        "https://gist.githubusercontent.com/danslo/fb62df9fcc65ae252ffb0c416fe35b4d/raw/e895416c7b708966ab1b3973c648dec39d6cf129/gistfile1.txt",
        "https://gist.githubusercontent.com/danslo/f27bda16ead7ec8d1604922869fa5568/raw/13d3af30dfb306edaaade5aa723114d96f08518e/analysis.txt"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 1,
        "url_path": 2
      },
      "first_seen": "2026-04-28",
      "indicators": {
        "domain": [
          "faulttolerantdigitalengine.com"
        ],
        "ipv4": [
          "148.251.11.208:9498"
        ],
        "url_path": [
          "/ktBaRVjQMhMhzjExBFN9HHONH5W0zuR6qEVaYWfxCaxn2AFeYac9Ai0MDY8GFqgs_gettext",
          "/ktBaRVjQMhMhzjExBFN9HHONH5W0zuR6qEVaYWfxCaxn2AFeYac9Ai0MDY8GFqgs_upload"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2036098821059461256",
        "https://x.com/L0Psec/status/2049158325372125450",
        "https://www.virustotal.com/gui/file/4291da6d5461c51ff0f852ca40a557739e955667df66c359cb0952542bb796b2/detection",
        "https://www.virustotal.com/gui/file/c2fe5b1d2c4cef27ab22fa8bc960a78264418e02ab3787bf0053c8f3a37c95ca/detection",
        "https://www.virustotal.com/gui/file/a6d2f0c3892b443d022d4c77835a85efb1131b0a12d3464b01cec3563194c73c/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "ipv4": 1,
        "url": 2
      },
      "first_seen": "2026-04-27",
      "indicators": {
        "ipv4": [
          "216.126.224.220:5976"
        ],
        "url": [
          "http://195.201.104.53",
          "jsonkeeper.com/b/7EBZP"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/npm_malware/status/2048749068051247429",
        "https://socket.dev/npm/package/ozonex-sdk/files/1.0.5/postinstall.js",
        "https://www.aikido.dev/blog/fast-draft-open-vsx-bloktrooper",
        "https://expel.com/blog/inside-lazarus-how-north-korea-uses-ai-to-industrialize-attacks-on-developers/",
        "https://gist.github.com/danslo/edb46198720ed0f4ad6e4b1c4b481efe",
        "https://gist.github.com/danslo/390782908532ef78b137cf14bd403a7e",
        "https://gist.github.com/danslo/18962c2dc0e41650d9db92adf0d7fc1a",
        "https://gist.githubusercontent.com/danslo/fb62df9fcc65ae252ffb0c416fe35b4d/raw/e895416c7b708966ab1b3973c648dec39d6cf129/gistfile1.txt",
        "https://gist.githubusercontent.com/danslo/f27bda16ead7ec8d1604922869fa5568/raw/13d3af30dfb306edaaade5aa723114d96f08518e/analysis.txt"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2026-04-24",
      "indicators": {
        "domain": [
          "aihealthchains.com",
          "akaunting25709.hostkey.in",
          "codepointlab.com",
          "cyberpanel78354.hostkey.in",
          "element-3.bestleas.ru",
          "matrix-3.bestleas.ru",
          "pay.aihealthchains.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/npm_malware/status/2048749068051247429",
        "https://socket.dev/npm/package/ozonex-sdk/files/1.0.5/postinstall.js",
        "https://www.aikido.dev/blog/fast-draft-open-vsx-bloktrooper",
        "https://expel.com/blog/inside-lazarus-how-north-korea-uses-ai-to-industrialize-attacks-on-developers/",
        "https://gist.github.com/danslo/edb46198720ed0f4ad6e4b1c4b481efe",
        "https://gist.github.com/danslo/390782908532ef78b137cf14bd403a7e",
        "https://gist.github.com/danslo/18962c2dc0e41650d9db92adf0d7fc1a",
        "https://gist.githubusercontent.com/danslo/fb62df9fcc65ae252ffb0c416fe35b4d/raw/e895416c7b708966ab1b3973c648dec39d6cf129/gistfile1.txt",
        "https://gist.githubusercontent.com/danslo/f27bda16ead7ec8d1604922869fa5568/raw/13d3af30dfb306edaaade5aa723114d96f08518e/analysis.txt"
      ],
      "total": 7
    },
    {
      "counts": {
        "ipv4": 2
      },
      "first_seen": "2026-04-24",
      "indicators": {
        "ipv4": [
          "216.250.248.160:1224",
          "216.250.248.160:8888"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/"
      ],
      "total": 2
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-04-24",
      "indicators": {
        "ipv4": [
          "147.124.202.206:1244"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?find=Node.js%20upload%20multiple%20files&type=raw&ref_id=02496d38d39#tab=host_pairs (# 2025-08-02)",
        "https://app.validin.com/detail?find=VScode&type=raw&ref_id=689da69896f#tab=host_pairs (# 2026-04-10)"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 16,
        "ipv4": 3
      },
      "first_seen": "2026-04-23",
      "indicators": {
        "domain": [
          "cgbrandh.short.gy",
          "chvsvr.short.gy",
          "data-kappa.vercel.app",
          "davhub88.vercel.app",
          "default-configuration-sandy.vercel.app",
          "ext-checkedin.vercel.app",
          "gurucooldown.short.gy",
          "lackservice.short.gy",
          "pesncv.short.gy",
          "tailwind-version-4.vercel.app",
          "vscode-ext-git.vercel.app",
          "vscode-extension-260120.vercel.app",
          "vscode-extensions-bootstrap.vercel.app",
          "vscode-production-setting.vercel.app",
          "vscode-settings-config-md.vercel.app",
          "vscode-toolkit-settings.vercel.app"
        ],
        "ipv4": [
          "154.91.0.196:443",
          "198.105.127.210:443",
          "83.168.68.219:27017"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.trendmicro.com/en_us/research/26/d/void-dokkaebi-uses-fake-job-interview-lure-to-spread-malware-via-code-repositories.html",
        "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/26/d/void-dokkaebi/Void-Dokkaebi-Uses-Fake-Job-Interview-Lure-to-Spread-Malware-via-Code-Repositories-IoCs.txt",
        "https://research.jfrog.com/post/hijacked-npm-vscode-tasks-blockchain/"
      ],
      "total": 19
    },
    {
      "counts": {
        "ipv4": 3
      },
      "first_seen": "2026-04-23",
      "indicators": {
        "ipv4": [
          "195.201.104.53:6931",
          "195.201.104.53:6936",
          "195.201.104.53:6939"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/npm_malware/status/2048749068051247429",
        "https://socket.dev/npm/package/ozonex-sdk/files/1.0.5/postinstall.js",
        "https://www.aikido.dev/blog/fast-draft-open-vsx-bloktrooper",
        "https://expel.com/blog/inside-lazarus-how-north-korea-uses-ai-to-industrialize-attacks-on-developers/",
        "https://gist.github.com/danslo/edb46198720ed0f4ad6e4b1c4b481efe",
        "https://gist.github.com/danslo/390782908532ef78b137cf14bd403a7e",
        "https://gist.github.com/danslo/18962c2dc0e41650d9db92adf0d7fc1a",
        "https://gist.githubusercontent.com/danslo/fb62df9fcc65ae252ffb0c416fe35b4d/raw/e895416c7b708966ab1b3973c648dec39d6cf129/gistfile1.txt",
        "https://gist.githubusercontent.com/danslo/f27bda16ead7ec8d1604922869fa5568/raw/13d3af30dfb306edaaade5aa723114d96f08518e/analysis.txt"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 4,
        "ipv4": 4,
        "url": 2
      },
      "first_seen": "2026-04-22",
      "indicators": {
        "domain": [
          "admin.luckyguys.site",
          "demo.luckyguys.site",
          "git.luckyguys.site",
          "luckyguys.site"
        ],
        "ipv4": [
          "163.245.219.19:443",
          "216.158.225.144:3000",
          "216.158.225.144:443",
          "216.158.225.144:8000"
        ],
        "url": [
          "http://163.245.219.19",
          "http://216.158.225.144"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.team-cymru.com/post/dprk-fake-it-worker-cyber-threat-actors-infrastructure"
      ],
      "total": 10
    },
    {
      "counts": {
        "ipv4": 2
      },
      "first_seen": "2026-04-22",
      "indicators": {
        "ipv4": [
          "138.201.125.58:1224",
          "138.201.125.58:1245"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/zoomeye_team/status/1901822378348568825",
        "https://x.com/blackorbird/status/1993135605623218560",
        "https://socket.dev/blog/lazarus-strikes-npm-again-with-a-new-wave-of-malicious-packages",
        "https://www.gendigital.com/blog/insights/research/apt-cyber-alliances-2025",
        "https://app.validin.com/detail?find=L-Administrator&type=raw&ref_id=7c876e7935a#tab=host_pairs",
        "https://www.virustotal.com/gui/file/c6edbb0d733798e5e8168a9df2bccaad7834e40f3c30d09816cc9a8ecc431376/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-04-17",
      "indicators": {
        "ipv4": [
          "147.124.211.201:1224"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3,
        "ipv4": 24
      },
      "first_seen": "2026-04-14",
      "indicators": {
        "domain": [
          "cloudflarefirewall.vercel.app",
          "cloudflareinsights.vercel.app",
          "cloudflaresecurity.vercel.app"
        ],
        "ipv4": [
          "107.189.22.20:8085",
          "107.189.22.20:8086",
          "107.189.22.20:8087",
          "144.172.110.132:8085",
          "144.172.110.132:8086",
          "144.172.110.132:8087",
          "144.172.110.228:8085",
          "144.172.110.228:8086",
          "144.172.110.228:8087",
          "144.172.110.96:8085",
          "144.172.110.96:8086",
          "144.172.110.96:8087",
          "144.172.93.169:8085",
          "144.172.93.169:8086",
          "144.172.93.169:8087",
          "144.172.93.253:8085",
          "144.172.93.253:8086",
          "144.172.93.253:8087",
          "144.172.99.248:8085",
          "144.172.99.248:8086",
          "144.172.99.248:8087",
          "144.172.99.81:8085",
          "144.172.99.81:8086",
          "144.172.99.81:8087"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/KirkDerpca/status/2065027462761787802",
        "https://panther.com/blog/tracking-an-ottercookie-infostealer-campaign-across-npm"
      ],
      "total": 27
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-04-14",
      "indicators": {
        "ipv4": [
          "38.92.47.167:3000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/P4nd3m1cb0y/status/1856123619417428061",
        "https://x.com/P4nd3m1cb0y/status/1856520422583353696",
        "https://x.com/DaveLikesMalwre/status/1866981595111895209"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-04-13",
      "indicators": {
        "ipv4": [
          "66.235.168.233:1244"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/80vul/status/1844345021627236578",
        "https://www.zoomeye.hk/searchResult?q=%22%3Ctitle%3ENode.js+upload+multiple+files%3C%2Ftitle%3E%22&page=1&pageSize=50"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-04-12",
      "indicators": {
        "domain": [
          "vervoe.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-04-10",
      "indicators": {
        "ipv4": [
          "147.124.202.225:3000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?find=Node.js%20upload%20multiple%20files&type=raw&ref_id=02496d38d39#tab=host_pairs (# 2025-08-02)",
        "https://app.validin.com/detail?find=VScode&type=raw&ref_id=689da69896f#tab=host_pairs (# 2026-04-10)"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 5,
        "url": 1
      },
      "first_seen": "2026-04-04",
      "indicators": {
        "ipv4": [
          "138.201.223.115:4801",
          "216.126.237.71:4801",
          "216.126.237.71:4806",
          "216.126.237.71:4809",
          "216.126.237.71:4899"
        ],
        "url": [
          "jsonkeeper.com/b/YY8VI"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/abh1sek/status/2039637787742507381"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-04-04",
      "indicators": {
        "domain": [
          "vscode-css-sort-website.vercel.app",
          "vscode-marketplace-badge.vercel.app",
          "vscode-theme-lesser.vercel.app",
          "vscode-themes-community.vercel.app",
          "vscodeweb.vercel.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://opensourcemalware.com/blog/tasksjacker-blog-post"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2026-04-03",
      "indicators": {
        "domain": [
          "260120.vercel.app",
          "alanservice.vercel.app",
          "default-configuration.vercel.app",
          "felixpools.vercel.app",
          "georgeservice77.vercel.app",
          "jameslack.vercel.app",
          "vscode-settings-tasks-json.vercel.app",
          "vscodesetting-task.vercel.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://opensourcemalware.com/blog/tasksjacker-blog-post"
      ],
      "total": 8
    },
    {
      "counts": {
        "ipv4": 7
      },
      "first_seen": "2026-04-02",
      "indicators": {
        "ipv4": [
          "116.202.208.125:8086",
          "116.202.208.125:8087",
          "116.202.208.125:8089",
          "116.202.208.125:8181",
          "116.202.208.125:8443",
          "116.202.208.125:8888",
          "116.202.208.125:9999"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/Fact_Finder03/status/2039577095664525728",
        "https://www.virustotal.com/gui/ip-address/116.202.208.125/community",
        "https://jp.security.ntt/tech_blog/en-waterplum-ottercookie"
      ],
      "total": 7
    },
    {
      "counts": {
        "ipv4": 12
      },
      "first_seen": "2026-04-01",
      "indicators": {
        "ipv4": [
          "104.168.151.116:443",
          "104.168.198.145:443",
          "142.11.209.109:443",
          "192.119.116.231:443",
          "192.236.146.20:443",
          "192.236.146.22:443",
          "192.236.176.164:443",
          "192.236.233.162:443",
          "192.236.233.165:443",
          "192.236.236.100:443",
          "23.254.128.114:443",
          "23.254.164.50:443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://hunt.io/blog/dprk-lazarus-kimsuky-infrastructure-uncovered"
      ],
      "total": 12
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-03-30",
      "indicators": {
        "ipv4": [
          "45.59.160.215:1244"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/80vul/status/1844345021627236578",
        "https://www.zoomeye.hk/searchResult?q=%22%3Ctitle%3ENode.js+upload+multiple+files%3C%2Ftitle%3E%22&page=1&pageSize=50"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 2
      },
      "first_seen": "2026-03-28",
      "indicators": {
        "ipv4": [
          "216.250.248.200:1224",
          "216.250.249.176:1224"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-03-26",
      "indicators": {
        "domain": [
          "us10web-zoom-usj72134381229pwdbnyi1fscht4pswnd37hhluqrkq5yjd.starspirit.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/0x6rss/status/2036819936232763746"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 2,
        "url_path": 2
      },
      "first_seen": "2026-03-23",
      "indicators": {
        "domain": [
          "onchainmodeltraining.com"
        ],
        "ipv4": [
          "138.201.248.205:49498",
          "138.201.248.205:49499"
        ],
        "url_path": [
          "/Z7vD3kT0Q5a9N1bW8LxYc4E2rF6pJHsUm_gettext",
          "/Z7vD3kT0Q5a9N1bW8LxYc4E2rF6pJHsUm_upload"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2036098821059461256",
        "https://x.com/L0Psec/status/2049158325372125450",
        "https://www.virustotal.com/gui/file/4291da6d5461c51ff0f852ca40a557739e955667df66c359cb0952542bb796b2/detection",
        "https://www.virustotal.com/gui/file/c2fe5b1d2c4cef27ab22fa8bc960a78264418e02ab3787bf0053c8f3a37c95ca/detection",
        "https://www.virustotal.com/gui/file/a6d2f0c3892b443d022d4c77835a85efb1131b0a12d3464b01cec3563194c73c/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-03-22",
      "indicators": {
        "domain": [
          "deoft.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2034002954949128237",
        "https://x.com/L0Psec/status/2034002958946337065",
        "https://www.virustotal.com/gui/file/1540cbb8eac28dab396cbd95445bc936d4114a0c2bcc48ffe9630896df09a8a1/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-03-22",
      "indicators": {
        "domain": [
          "menchro.pro"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-03-21",
      "indicators": {
        "domain": [
          "modelatelier.club"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-03-20",
      "indicators": {
        "ipv4": [
          "45.59.160.200:1244"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/80vul/status/1844345021627236578",
        "https://www.zoomeye.hk/searchResult?q=%22%3Ctitle%3ENode.js+upload+multiple+files%3C%2Ftitle%3E%22&page=1&pageSize=50"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-03-20",
      "indicators": {
        "domain": [
          "tasksettingsnew.vercel.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://jp.security.ntt/insights_resources/tech_blog/stoatwaffle_malware_en/"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1,
        "url": 1
      },
      "first_seen": "2026-03-19",
      "indicators": {
        "ipv4": [
          "217.69.3.152:10000"
        ],
        "url": [
          "http://217.69.3.152"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.aikido.dev/blog/glassworm-chrome-extension-rat"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-03-19",
      "indicators": {
        "domain": [
          "blocktechtalent.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/r3dactt/status/2026525340135469486",
        "https://www.virustotal.com/gui/file/0a716920017fba0b70b7295c6d7a06710df38c0d6158a12d3723343919da7fd2/detection",
        "https://www.virustotal.com/gui/file/6c5d9aa7c498b89fceb2197f2544a3a403763c021b20d7f0ee39d3c6409e5c6e/detection",
        "https://www.virustotal.com/gui/file/ba90a3f1b6b4fd1a5c8606c7ab097a871bd26061418e65e94214a4f46575867a/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-03-19",
      "indicators": {
        "domain": [
          "vereoy.pages.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-03-19",
      "indicators": {
        "ipv4": [
          "45.59.160.211:1244"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?find=Node.js%20upload%20multiple%20files&type=raw&ref_id=02496d38d39#tab=host_pairs (# 2025-08-02)",
        "https://app.validin.com/detail?find=VScode&type=raw&ref_id=689da69896f#tab=host_pairs (# 2026-04-10)"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 9
      },
      "first_seen": "2026-03-18",
      "indicators": {
        "domain": [
          "selfhonda.com"
        ],
        "ipv4": [
          "100.51.175.254:8080",
          "146.103.99.12:8080",
          "167.88.63.91:8080",
          "185.177.127.27:8080",
          "185.213.22.215:8080",
          "3.125.137.101:8080",
          "31.57.35.114:8080",
          "45.81.243.71:8080",
          "52.58.193.70:8080"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2034002954949128237",
        "https://x.com/L0Psec/status/2034002958946337065",
        "https://www.virustotal.com/gui/file/1540cbb8eac28dab396cbd95445bc936d4114a0c2bcc48ffe9630896df09a8a1/detection"
      ],
      "total": 10
    },
    {
      "counts": {
        "ipv4": 3
      },
      "first_seen": "2026-03-18",
      "indicators": {
        "ipv4": [
          "216.250.252.103:1244",
          "45.59.160.199:1244",
          "45.59.160.210:1244"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?find=Node.js%20upload%20multiple%20files&type=raw&ref_id=02496d38d39#tab=host_pairs (# 2025-08-02)",
        "https://app.validin.com/detail?find=VScode&type=raw&ref_id=689da69896f#tab=host_pairs (# 2026-04-10)"
      ],
      "total": 3
    },
    {
      "counts": {
        "ipv4": 2
      },
      "first_seen": "2026-03-18",
      "indicators": {
        "ipv4": [
          "67.207.166.173:1224",
          "88.99.241.111:1224"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-03-18",
      "indicators": {
        "domain": [
          "coachzenblog.biz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 7,
        "url": 5
      },
      "first_seen": "2026-03-17",
      "indicators": {
        "ipv4": [
          "217.69.0.159:10000",
          "217.69.0.159:5000",
          "217.69.0.159:8080",
          "217.69.11.60:5000",
          "217.69.11.60:8080",
          "217.69.11.99:5000",
          "45.32.150.97:5000"
        ],
        "url": [
          "http://217.69.0.159",
          "http://217.69.11.60",
          "http://217.69.11.99",
          "http://45.32.150.97",
          "http://45.76.44.240"
        ]
      },
      "precision": "exact",
      "references": [
        "https://intel.breakglass.tech/post/lazarus-group-is-using-the-solana-blockchain-as-a-dead-drop-c2-channel-and-nobody-noticed-for-4-months",
        "https://www.virustotal.com/gui/file/1e6487b7fbb9a0ff4c1d7032bfecd153fa6b9cc3c523243e8183588a98168267/detection"
      ],
      "total": 12
    },
    {
      "counts": {
        "domain": 25
      },
      "first_seen": "2026-03-16",
      "indicators": {
        "domain": [
          "aionedev.best",
          "alltaxlab.com",
          "corjus.top",
          "crownx-academy.com",
          "eastvalex-peak.com",
          "finorabsns.com",
          "heritage-netwk.com",
          "homemaxair.pro",
          "ledgernowone.com",
          "limmatcampus.com",
          "maxbookpro.com",
          "mindfulbiz.link",
          "mopquanta.pro",
          "neugrenz.com",
          "onebalancelab.com",
          "reuss-works.com",
          "robonowlife.com",
          "saasbrief.vip",
          "shieldlabit.vip",
          "sicherdigitx.com",
          "signot.digital",
          "sihlquaiinst.com",
          "silserhafen.com",
          "tecsol.top",
          "vector-foundry.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 25
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 4
      },
      "first_seen": "2026-03-16",
      "indicators": {
        "domain": [
          "malicanbur.pro"
        ],
        "ipv4": [
          "173.211.40.14:8080",
          "173.211.40.24:8080",
          "173.211.40.28:8080",
          "173.211.46.22:8080"
        ]
      },
      "precision": "exact",
      "references": [
        "https://kmsec.uk/blog/pylangghost-npm/",
        "https://www.virustotal.com/gui/file/0be2375362227f846c56c4de2db4d3113e197f0c605c297a7e0e0c154e94464e/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-03-13",
      "indicators": {
        "domain": [
          "vscode-extension.vercel.app",
          "vscode-portfolio.vercel.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/KfishNFT/status/2014379828787494923",
        "https://x.com/g0njxa/status/2014800328105894004",
        "https://radar.securityalliance.org/vs-code-tasks-abuse-by-contagious-interview-dprk/",
        "https://www.abstract.security/blog/contagious-interview-tracking-the-vs-code-tasks-infection-vector",
        "https://www.virustotal.com/gui/file/60914b8df5b5d64070f71ef13817499b3a85de98433ae5c01bd235abec9464f6/detection",
        "https://www.virustotal.com/gui/file/6be45e165de60b61e9b7cb9e1f9b72c652c388a04c02d2068de6188cc88fc3fe/detection",
        "https://www.virustotal.com/gui/file/c226eb59cf696a85ed7134b57f12d82cb392d42b908dd6a463cd4d8c980ee5e8/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-03-13",
      "indicators": {
        "domain": [
          "location-request-api.short.gy"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/",
        "https://www.virustotal.com/gui/ip-address/91.197.243.143/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-03-12",
      "indicators": {
        "domain": [
          "app.highmatch.cloud",
          "app.jumpshare.online",
          "highmatch.cloud",
          "jumpshare.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-03-12",
      "indicators": {
        "domain": [
          "socket.decentralizeddataexchangeinferencelayer.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/r3dactt/status/2026525340135469486",
        "https://www.virustotal.com/gui/file/0a716920017fba0b70b7295c6d7a06710df38c0d6158a12d3723343919da7fd2/detection",
        "https://www.virustotal.com/gui/file/6c5d9aa7c498b89fceb2197f2544a3a403763c021b20d7f0ee39d3c6409e5c6e/detection",
        "https://www.virustotal.com/gui/file/ba90a3f1b6b4fd1a5c8606c7ab097a871bd26061418e65e94214a4f46575867a/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-03-11",
      "indicators": {
        "domain": [
          "decentralizeddataexchangeinferencelayer.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/r3dactt/status/2026525340135469486",
        "https://www.virustotal.com/gui/file/0a716920017fba0b70b7295c6d7a06710df38c0d6158a12d3723343919da7fd2/detection",
        "https://www.virustotal.com/gui/file/6c5d9aa7c498b89fceb2197f2544a3a403763c021b20d7f0ee39d3c6409e5c6e/detection",
        "https://www.virustotal.com/gui/file/ba90a3f1b6b4fd1a5c8606c7ab097a871bd26061418e65e94214a4f46575867a/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 3
      },
      "first_seen": "2026-03-09",
      "indicators": {
        "ipv4": [
          "77.42.1.210:1224",
          "77.42.1.210:1245",
          "77.42.1.210:7777"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/zoomeye_team/status/1901822378348568825",
        "https://x.com/blackorbird/status/1993135605623218560",
        "https://socket.dev/blog/lazarus-strikes-npm-again-with-a-new-wave-of-malicious-packages",
        "https://www.gendigital.com/blog/insights/research/apt-cyber-alliances-2025",
        "https://app.validin.com/detail?find=L-Administrator&type=raw&ref_id=7c876e7935a#tab=host_pairs",
        "https://www.virustotal.com/gui/file/c6edbb0d733798e5e8168a9df2bccaad7834e40f3c30d09816cc9a8ecc431376/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "ipv4": 2
      },
      "first_seen": "2026-03-09",
      "indicators": {
        "ipv4": [
          "176.31.205.16:1244",
          "45.59.160.166:1244"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/80vul/status/1844345021627236578",
        "https://www.zoomeye.hk/searchResult?q=%22%3Ctitle%3ENode.js+upload+multiple+files%3C%2Ftitle%3E%22&page=1&pageSize=50"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-03-08",
      "indicators": {
        "domain": [
          "app.highmatch.pro",
          "highmatch.pro"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-03-07",
      "indicators": {
        "ipv4": [
          "88.99.212.230:3000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 3
      },
      "first_seen": "2026-03-05",
      "indicators": {
        "ipv4": [
          "104.192.42.117:3000",
          "185.163.125.196:3000",
          "185.163.125.196:5000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/"
      ],
      "total": 3
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-03-05",
      "indicators": {
        "ipv4": [
          "45.83.140.55:1244"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/RedDrip7/status/2029459268626465203",
        "https://www.virustotal.com/gui/file/a897fb39d3e62c760d998511913785e30bfb703caf89af13a80cb1b18e83dfd9/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-03-02",
      "indicators": {
        "domain": [
          "grace-ayodele.workers.dev",
          "main-8i4.pages.dev",
          "questionic.com",
          "shrill-breeze-e0f.grace-ayodele.workers.dev",
          "wild-mud-21fa.grace-ayodele.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?type=raw&find=Just+a+moment...#tab=reputation (# 2026-02-25)"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 30,
        "ipv4": 3
      },
      "first_seen": "2026-02-28",
      "indicators": {
        "domain": [
          "atlasnode-app204.vercel.app",
          "atlasnode-ext957.vercel.app",
          "brightlaunch-app615.vercel.app",
          "brightlaunch-ext742.vercel.app",
          "cleverstack-app998.vercel.app",
          "cleverstack-ext301.vercel.app",
          "cloudharbor-app239.vercel.app",
          "cloudharbor-ext664.vercel.app",
          "fusionlayer-app463.vercel.app",
          "fusionlayer-ext807.vercel.app",
          "logicfield-app681.vercel.app",
          "logicfield-ext432.vercel.app",
          "neuraldock-app734.vercel.app",
          "neuraldock-ext126.vercel.app",
          "openmatrix-app882.vercel.app",
          "openmatrix-ext539.vercel.app",
          "orbitstack-app318.vercel.app",
          "orbitstack-ext592.vercel.app",
          "primevector-app920.vercel.app",
          "primevector-ext483.vercel.app",
          "quantapath-app914.vercel.app",
          "quantapath-ext275.vercel.app",
          "signalbase-app845.vercel.app",
          "signalbase-ext369.vercel.app",
          "sparkforge-app790.vercel.app",
          "sparkforge-ext518.vercel.app",
          "visiondock-app157.vercel.app",
          "visiondock-ext648.vercel.app",
          "zenithflow-app877.vercel.app",
          "zenithflow-ext156.vercel.app"
        ],
        "ipv4": [
          "103.106.67.63:1244",
          "103.106.67.63:1245",
          "103.106.67.63:1247"
        ]
      },
      "precision": "exact",
      "references": [
        "https://socket.dev/blog/stegabin-26-malicious-npm-packages-use-pastebin-steganography"
      ],
      "total": 33
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-02-27",
      "indicators": {
        "domain": [
          "me-c0h.pages.dev",
          "online.zitlex.com",
          "zitlex.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-02-27",
      "indicators": {
        "domain": [
          "vscodesettings03kui.vercel.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.enki.co.kr/en/media-center/blog/contagious-interview-campaign-abusing-vscode-distributed-on-github"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 13,
        "ipv4": 4
      },
      "first_seen": "2026-02-25",
      "indicators": {
        "domain": [
          "api-web3-auth.vercel.app",
          "coredeal2.vercel.app",
          "ip-check-notification-03.vercel.app",
          "ip-check-notification-firebase.vercel.app",
          "ip-check-notification-firebase03.vercel.app",
          "ip-check-notification-rkb.vercel.app",
          "ip-check-wh.vercel.app",
          "ip-checking-notification-firebase111.vercel.app",
          "ip-checking-notification-kgm.vercel.app",
          "monobyte-code.vercel.app",
          "oracle-v1-beta.vercel.app",
          "price-oracle-v2.vercel.app",
          "vscodesettingtask.vercel.app"
        ],
        "ipv4": [
          "147.124.202.208:3000",
          "163.245.194.216:3000",
          "174.138.188.80:3000",
          "66.235.168.136:3000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/"
      ],
      "total": 17
    },
    {
      "counts": {
        "domain": 6,
        "url_path": 4
      },
      "first_seen": "2026-02-25",
      "indicators": {
        "domain": [
          "cosmoplanets.net",
          "hentaikawaiiuwu.com",
          "josehub88.vercel.app",
          "postprocesser.com",
          "readonlymemory.xyz",
          "rewarded.fi"
        ],
        "url_path": [
          "/.well-known/pki-validation/go/akgo.php",
          "/.well-known/pki-validation/go/boing",
          "/well-known/pki-validation/go/akgo.php",
          "/well-known/pki-validation/go/boing"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/malwrhunterteam/status/1917538786478538829",
        "https://x.com/bluish_red_/status/1960735923743678648",
        "https://x.com/elasticseclabs/status/1960730276834775158",
        "https://x.com/elasticseclabs/status/1960730309487395314",
        "https://www.abstract.security/blog/contagious-interview-evolution-of-vscode-and-cursor-tasks-infection-chains",
        "https://app.validin.com/detail?find=c87d57c84529f76a1212c0050d434162c729617c#tab=host_pairs (# 2025-08-26)",
        "https://app.validin.com/detail?find=%20Solar%20Explorer&type=raw&ref_id=2c9cf18cb5d#tab=host_pairs (# 2025-08-26)",
        "https://www.virustotal.com/gui/file/6b3c6a4c07f77016ef05a5994bcc4e228cbfc474733cd091b0edc6493fe8465a/detection"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 4,
        "ipv4": 4
      },
      "first_seen": "2026-02-25",
      "indicators": {
        "domain": [
          "auto-loader.org",
          "autonomousconsensuspipelines.cloud",
          "jenn.shop",
          "kit-haus.net"
        ],
        "ipv4": [
          "144.172.93.88:8080",
          "144.172.93.88:8088",
          "157.250.195.237:3000",
          "157.250.202.237:3000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/r3dactt/status/2026525340135469486",
        "https://www.virustotal.com/gui/file/0a716920017fba0b70b7295c6d7a06710df38c0d6158a12d3723343919da7fd2/detection",
        "https://www.virustotal.com/gui/file/6c5d9aa7c498b89fceb2197f2544a3a403763c021b20d7f0ee39d3c6409e5c6e/detection",
        "https://www.virustotal.com/gui/file/ba90a3f1b6b4fd1a5c8606c7ab097a871bd26061418e65e94214a4f46575867a/detection"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-02-25",
      "indicators": {
        "domain": [
          "app.breezyhr.us",
          "breezyhr.us"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-02-25",
      "indicators": {
        "domain": [
          "hopehobo.com",
          "survelis.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?type=raw&find=Just+a+moment...#tab=reputation (# 2026-02-25)"
      ],
      "total": 2
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-02-25",
      "indicators": {
        "ipv4": [
          "147.124.214.235:1244"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?find=Node.js%20upload%20multiple%20files&type=raw&ref_id=02496d38d39#tab=host_pairs (# 2025-08-02)",
        "https://app.validin.com/detail?find=VScode&type=raw&ref_id=689da69896f#tab=host_pairs (# 2026-04-10)"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2026-02-24",
      "indicators": {
        "domain": [
          "amazonfiso.com",
          "human-check.com",
          "illycafe.my",
          "illycoffee.my",
          "markethubuk.com",
          "sictradingc.com",
          "trustpdfs.com",
          "zypras.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.security.com/blog-post/lazarus-medusa-ransomware"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2026-02-23",
      "indicators": {
        "domain": [
          "jzus0ve6iq-staging.onrocket.site",
          "plugksa.com",
          "test.theplugmag.com",
          "theplugc.com",
          "theplugny.com",
          "visittheplug.com",
          "zedplug.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/banthisguy9349/status/2025523138641965532"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2026-02-21",
      "indicators": {
        "domain": [
          "app.weboardtals.com",
          "jamesbillion.com",
          "online.weboink.com",
          "softechsoftwares.co.ke",
          "update.koover.org",
          "weboardtals.com",
          "weboink.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 152,
        "ipv4": 3
      },
      "first_seen": "2026-02-20",
      "indicators": {
        "domain": [
          "admin-8jy8o7jbg.vercel.sh",
          "analytics-script-git-main.vercel.sh",
          "api-agent-2pqjsxiut.vercel.sh",
          "api-git-main.vercel.sh",
          "api-www-avatar-25fcc9rbk.vercel.sh",
          "astraluck-vercel.vercel.app",
          "barjobslasvegas-2f0akudpg-superbwebsolutions-e260a2eb.vercel.app",
          "beta-reactjs-org-1c98ufhjb-fbopensource.vercel.app",
          "binshtok-cowan-test-pwjs2ggdx.vercel.sh",
          "bot-protection-3bhbcw8wm.vercel.sh",
          "catalog-editorial-qdoii4smx-clg.vercel.app",
          "conf-2025-fcwpato0v.vercel.sh",
          "control-plane-default-ehybkouwd.vercel.sh",
          "coop-shop-next-jld7wvrxk-co-op-food-customer-experience.vercel.app",
          "coop-shop-next-philwolstenholme-co-op-food-customer-experience.vercel.app",
          "copper-fv73l6e9m.vercel.sh",
          "crawl-analysis-git-main.vercel.sh",
          "crawled-sitemap-git-main.vercel.sh",
          "curiosity-works-opschudding.vercel.app",
          "cv-8zz57gksb-simons-projects-486531f7.vercel.app",
          "dawiteewnetu-uxgr-ig97x97wa-dawite-ewnetus-projects.vercel.app",
          "dawiteewnetu-uxgr-l5fvt75j7-dawite-ewnetus-projects.vercel.app",
          "deng-labs-6ts0pz3vm.vercel.sh",
          "derek-site-2026-6g03r9taz-derek-martins-projects.vercel.app",
          "docs-git-fix-issue-330-driveclub.vercel.app",
          "docs-payload-dgwy6heek.vercel.sh",
          "edge-runtime-git-main.vercel.sh",
          "examples-basic-web.vercel.sh",
          "expert-mode-1c2u0v83b-chainlinklabs.vercel.app",
          "expert-mode-1ruzfeq6x-chainlinklabs.vercel.app",
          "expert-mode-iebahb8mh-chainlinklabs.vercel.app",
          "expert-mode-ifa37strm-chainlinklabs.vercel.app",
          "expert-mode-ilj8udtti-chainlinklabs.vercel.app",
          "expert-mode-j12s18yqd-chainlinklabs.vercel.app",
          "expert-mode-kpwcznf9q-chainlinklabs.vercel.app",
          "expert-mode-n0lcsjlju-chainlinklabs.vercel.app",
          "expert-mode-omc4wsgd7-chainlinklabs.vercel.app",
          "expert-mode-otcucejsn-chainlinklabs.vercel.app",
          "expert-mode-retiqr6xk-chainlinklabs.vercel.app",
          "expert-mode-rr4zcmoka-chainlinklabs.vercel.app",
          "flag-git-main.vercel.sh",
          "geist-docs-n03iy9wgb.vercel.sh",
          "geist-storybook-kbjruqxe3.vercel.sh",
          "geist-storybook-nyf9kazrs.vercel.sh",
          "getapilatency.onrender.com",
          "getpngdata.vercel.app",
          "githero-dev7uf163-gimenetes-projects.vercel.app",
          "googlezauthtoken.vercel.app",
          "instant-preview-site-9w675nmgg.vercel.sh",
          "internal-engineering-documentation-site-mrj1hhs06.vercel.sh",
          "ip-api-test.vercel.app",
          "jwt-alpha-woad.vercel.app",
          "marketplace-neut52jgl.vercel.sh",
          "maverick-njkr6h6me-sohybes-projects.vercel.app",
          "metric-analytics.vercel.app",
          "metrics-dashboard-7lgdhdfot-peter1.vercel.app",
          "my-3d-portfolio-1o6x-j8oobuufq-hadi-arabis-projects.vercel.app",
          "my-3d-portfolio-598x-c8nb68kta-hadi-arabis-projects.vercel.app",
          "my-3d-portfolio-598x-git-main-hadi-arabis-projects.vercel.app",
          "next-master-pwg93975l-now-examples.vercel.app",
          "nextjs-conf-2024-jwokq4e6s.vercel.sh",
          "nextjs-stripe-template.vercel.sh",
          "now-examples-3ok9tvp04.zeit.sh",
          "now-examples-5onkajpkx.zeit.sh",
          "now-examples-6pn2lr1ir.zeit.sh",
          "now-examples-7v52p79xj.zeit.sh",
          "now-examples-7voymifaz.zeit.sh",
          "now-examples-7xu2100yl.zeit.sh",
          "now-examples-9zv8bcocf.zeit.sh",
          "now-examples-bd1jwqxdf.zeit.sh",
          "now-examples-crsku8zyd.zeit.sh",
          "now-examples-d8gbron9h.zeit.sh",
          "now-examples-dge5dpeg6.zeit.sh",
          "now-examples-dhev9x619.zeit.sh",
          "now-examples-enprlx5lm.zeit.sh",
          "now-examples-j447nc3bq.zeit.sh",
          "now-examples-nqk5yw2f2.zeit.sh",
          "now-examples-oiceysajh.zeit.sh",
          "now-examples-rnwbzp2r8.zeit.sh",
          "now-tgxhacluff.now.sh",
          "og-examples-4gnvoge9a.vercel.sh",
          "oidc-issuer-8pba9g3rc.vercel.sh",
          "openmodules.org",
          "peninsulaparking-5ubyvdtqb-om-sanghvis-projects.vercel.app",
          "picolink-jorisjgriffioen.vercel.app",
          "playingwithcodex-git-codex-implement-en-954ce6-shnurps-projects.vercel.app",
          "pngconvert-p0kl4fodi-jhones-projects-f8ddbcbe.vercel.app",
          "portfolio-naylinmyats-projects.vercel.app",
          "pronoia-kkeeland-4878s-projects.vercel.app",
          "pyra-docs-git-main.vercel.sh",
          "pyra-docs.vercel.sh",
          "rocket-resume.vercel.app",
          "sakuramedia-git-cognito-sakura-media.vercel.app",
          "ship-ai-2025-gguq0jdwo.vercel.sh",
          "site-git-fix-issue-330-driveclub.vercel.app",
          "solutions-subdomains-auth.vercel.sh",
          "testserver-l0hpvjw5b.vercel.sh",
          "upstash-docs-upstash.vercel.app",
          "v0-frame-render-engine-4vo9x0236.vercel.sh",
          "v0-frame-render-engine-ayk1sm54x.vercel.sh",
          "v0-frame-render-engine-git-iansbrash-promo-page.vercel.sh",
          "v0-frame-render-engine-git-ido-01-16-xwol1.vercel.sh",
          "v0-frame-render-engine-git-ma-fix-integration-layout.vercel.sh",
          "v0-frame-render-engine-git-max-01-15-update.vercel.sh",
          "v0-frame-render-engine-git-tz-chatzipupload0115.vercel.sh",
          "v0-frame.vercel.sh",
          "v0-vercel-webhook-automation-fp90rr464.vercel.sh",
          "vercel-academy-lhaqud9fg.vercel.sh",
          "vercel-agent-bvszyn2w5.vercel.sh",
          "vercel-agent-code-review-2l2w1466s.vercel.sh",
          "vercel-agent-code-review-f2jv6t9a5.vercel.sh",
          "vercel-alerts-n4q8h9gnw.vercel.sh",
          "vercel-dash-3cr0qiedg.vercel.sh",
          "vercel-dash-hw9r7f35s.vercel.sh",
          "vercel-dash-keh9xf79l.vercel.sh",
          "vercel-dashboard-7epa04yyk.vercel.sh",
          "vercel-dashboard-nc6g2xtna.vercel.sh",
          "vercel-dashboard-q42jpk16z.vercel.sh",
          "vercel-docs-proxy-5ovwbe3iw.vercel.sh",
          "vercel-docs-proxy-5xb0awnoq.vercel.sh",
          "vercel-marketing-gkaxe8vec.vercel.sh",
          "vercel-marketing-n6pm8fju2.vercel.sh",
          "vercel-marketing-obv54w0jf.vercel.sh",
          "vercel-ship-f9ny6po6t.vercel.sh",
          "vercel-site-1ddnejsfa.vercel.sh",
          "vercel-site-33i0im1gu.vercel.sh",
          "vercel-site-git-main.vercel.sh",
          "vercel-site-gow03hmpw.vercel.sh",
          "vercel-site-ivfjv5dp5.vercel.sh",
          "vercel-site-r50pzdsjo.vercel.sh",
          "vercel-site.vercel.sh",
          "vercel-tmdb-wangsy1007s-projects.vercel.app",
          "vscode-load.vercel.app",
          "wealth-94t6wfs93-wealthcom.vercel.app",
          "wealth-lm7yyddh8-wealthcom.vercel.app",
          "wealth-web-courtneyoconnell-wealth-wealthcom.vercel.app",
          "wealth-web-git-apfot-612-implement-unique-urls-5bb992-wealthcom.vercel.app",
          "wealth-web-git-auth0-poc-wealthcom.vercel.app",
          "wealth-web-git-decouple-extraction-loading-states-wealthcom.vercel.app",
          "wealth-web-git-dev-vito-docx-wealthcom.vercel.app",
          "wealth-web-git-feature-advyzon-fe-update-wealthcom.vercel.app",
          "wealth-web-git-feature-tp-baseline-stretch-wealthcom.vercel.app",
          "wealth-web-git-fos-463-cetera-fix-wealthcom.vercel.app",
          "wealth-web-git-niece-nephew-parent-save-fix-wealthcom.vercel.app",
          "wealth-web-git-quickactionsmodal2-wealthcom.vercel.app",
          "web3-metric-analytics.vercel.app",
          "wedding-fkdp77wwj-gianclaudiocarellas-projects.vercel.app",
          "wot-design-qn1zw7qfc-moonofweisheng.vercel.app",
          "zksync-blog-git-adding-to-prividium-the-tm-matter-labs-651a8986.vercel.app",
          "zksync-enterprise-df1wkzlnd-matter-labs-651a8986.vercel.app",
          "zksync-enterprise-pxn6m30gh-matter-labs-651a8986.vercel.app",
          "zone-api-navy.vercel.app"
        ],
        "ipv4": [
          "185.92.220.208:5000",
          "185.92.220.208:5173",
          "185.92.220.208:8080"
        ]
      },
      "precision": "exact",
      "references": [
        "https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/"
      ],
      "total": 155
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-02-19",
      "indicators": {
        "domain": [
          "koover.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 11
      },
      "first_seen": "2026-02-17",
      "indicators": {
        "domain": [
          "app.hirvexo.com",
          "app.pancakeswap.studio",
          "app.recroya.com",
          "atlas.small-forest-2b0b.workers.dev",
          "fix.measureaptitudes.com",
          "hirvexo.com",
          "measureaptitudes.com",
          "new.hirvexo.com",
          "pancakeswap.studio",
          "recroya.com",
          "small-forest-2b0b.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 11
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-02-17",
      "indicators": {
        "domain": [
          "energydonate.com",
          "m.energydonate.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/8ff100ca86cb62117f1290e71d5f9c0519661d6c955d9fcfb71f0bbdf75b51b3/detection",
        "https://www.virustotal.com/gui/file/972b598d709b66b35900dc21c5225e5f0d474f241fefa890b381089afd7d44ee/detection",
        "https://www.virustotal.com/gui/file/d4c7dba741ee2eb888de9e3117fb2b1a759586b84e67b176d891c6811754ef3f/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-02-16",
      "indicators": {
        "domain": [
          "app.evaliuminsights.com",
          "evaliuminsights.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-02-15",
      "indicators": {
        "domain": [
          "my-c0m.pages.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 38
      },
      "first_seen": "2026-02-14",
      "indicators": {
        "domain": [
          "1winfans.com",
          "adnoc.sbs",
          "app.cammio.org",
          "aviamastersnetwork.com",
          "belgiumchickenroad.com",
          "cammio.org",
          "chickenbaloonsgame.com",
          "chickenfrroad.com",
          "chickenroad.chickenbaloonsgame.com",
          "chickenroad.chickenkitchengame.org",
          "chickenroad.eggfactorygame.es",
          "chickenroad.greatchickenescape.com",
          "chickenroad.happychickenmrs.com",
          "chickenroad.playskatepark.com",
          "chickenroad.plushtoytumama.com",
          "chickenroad.toadegged.com",
          "chickenroadbike.com",
          "chickenroadblast.com",
          "chickenroadcase.com",
          "chickenroadde.org",
          "chickenroadjump.org",
          "chickenroadjumping.com",
          "chickenroadpixel.com",
          "chickenroadrecipe.com",
          "chickenroadrocky.com",
          "chickenroadshow.com",
          "chickenroadsquad.com",
          "chickenroadstack.com",
          "chickenroadventures.com",
          "copia.vin",
          "dev.copia.vin",
          "happychickenmrs.com",
          "medincahub.com",
          "playskatepark.com",
          "plushtoytumama.com",
          "srv833039.hstgr.cloud",
          "toadegged.com",
          "trappuzzle.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 38
    },
    {
      "counts": {
        "ipv4": 7
      },
      "first_seen": "2026-02-14",
      "indicators": {
        "ipv4": [
          "145.59.1.45:1244",
          "147.124.202.163:1243",
          "202.163.147.124:1248",
          "45.43.11.200:1244",
          "45.43.11.248:1244",
          "66.235.28.238:1244",
          "66.235.28.238:1249"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/unpacker/status/2022669422411043001",
        "https://sp4rk.medium.com/beyond-the-backdoor-how-contagious-interview-is-surgically-tampering-with-metamask-wallets-0314ae901d85"
      ],
      "total": 7
    },
    {
      "counts": {
        "ipv4": 3
      },
      "first_seen": "2026-02-14",
      "indicators": {
        "ipv4": [
          "147.124.215.131:1244",
          "173.211.106.164:1244",
          "216.250.252.163:1244"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?find=Node.js%20upload%20multiple%20files&type=raw&ref_id=02496d38d39#tab=host_pairs (# 2025-08-02)",
        "https://app.validin.com/detail?find=VScode&type=raw&ref_id=689da69896f#tab=host_pairs (# 2026-04-10)"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-02-13",
      "indicators": {
        "domain": [
          "api.medincahub.com",
          "app.rolevia.us",
          "rolevia.us"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2026-02-12",
      "indicators": {
        "domain": [
          "animoca.finance",
          "api.talentacq.pro",
          "app.animoca.finance",
          "front-bzi.pages.dev",
          "talentacq.pro",
          "techaipactch.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-02-12",
      "indicators": {
        "domain": [
          "angeldrop.cloud",
          "aurevian.cloud",
          "codepool.cloud"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.reversinglabs.com/blog/fake-recruiter-campaign-crypto-devs",
        "https://www.virustotal.com/gui/file/2aaf4c62372fb1c84178d258576561d35d2a437341905db0c7c7a3d75219333f/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-02-12",
      "indicators": {
        "ipv4": [
          "147.124.212.234:1244"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?find=Node.js%20upload%20multiple%20files&type=raw&ref_id=02496d38d39#tab=host_pairs (# 2025-08-02)",
        "https://app.validin.com/detail?find=VScode&type=raw&ref_id=689da69896f#tab=host_pairs (# 2026-04-10)"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 97,
        "ipv4": 1
      },
      "first_seen": "2026-02-10",
      "indicators": {
        "domain": [
          "advisor-ecareerflare.pages.dev",
          "advisornetic.com",
          "agafilime.com",
          "api.betterevaluation.us",
          "api.equisphire.com",
          "api.evalium-expertises.us",
          "api.info-job.org",
          "api.jobecam.org",
          "api.jobecam.us",
          "api.keenest.org",
          "api.pre-screen.net",
          "api.pre-screen.online",
          "api.quant-screen.com",
          "api.viasto.us",
          "app.advisornetic.com",
          "app.aptitudespro.com",
          "app.avasup.com",
          "app.betterevaluation.us",
          "app.ecareerflare.com",
          "app.evalium-expertises.us",
          "app.getevalor.com",
          "app.keenest.org",
          "app.poweem.com",
          "app.powerwize.org",
          "app.pre-screen.net",
          "app.prontoquiz.org",
          "app.quick-view.org",
          "app.rev-prot.org",
          "app.spiralboard.com",
          "app.viasto.us",
          "app.visionaryte.org",
          "apply.ecareerflare.com",
          "aptitudespro.com",
          "askillo.online",
          "avasup.com",
          "backend.pre-screen.net",
          "betterevaluation.us",
          "ccuk.edu.ng",
          "download.factrina.com",
          "download.getevalor.com",
          "download.kooverly.org",
          "download.prontoquiz.org",
          "ecareerflare.com",
          "ecareerflare.pages.dev",
          "equisphire.com",
          "evalium-expertise1.pages.dev",
          "evalium-expertise360.com",
          "evalium-expertises.us",
          "factrina.com",
          "fastwise.org",
          "frontend-5e7.pages.dev",
          "ftp.ccuk.edu.ng",
          "getevalor.com",
          "info-job.org",
          "jobecam.org",
          "jobecam.us",
          "keenest.org",
          "kooverly.org",
          "mail.ccuk.edu.ng",
          "mail.kooverly.org",
          "main-aptitudespro.pages.dev",
          "main-az8.pages.dev",
          "memo.ccuk.edu.ng",
          "mlischagori.pro",
          "moxtern.com",
          "mypatchauto.com",
          "mypatchfree.com",
          "myproject-f8d.pages.dev",
          "online.advisornetic.com",
          "online.betterevaluation.us",
          "online.evalium-expertises.us",
          "online.prontoquiz.org",
          "online.rev-prot.org",
          "online.spiralboard.com",
          "portal.ccuk.edu.ng",
          "poweem.com",
          "powerwize.org",
          "powerwize.pages.dev",
          "pre-screen.net",
          "pre-screen.online",
          "prontoquiz.org",
          "quant-screen.com",
          "quick-view.org",
          "rev-prot.org",
          "server.pre-screen.net",
          "sightalent.pages.dev",
          "spiralboard.com",
          "srv1283254.hstgr.cloud",
          "staff.ccuk.edu.ng",
          "stn.equisphire.com",
          "test.ccuk.edu.ng",
          "us.evalium-expertises.us",
          "veeki.org",
          "vek.equisphire.com",
          "viasto.us",
          "vifort.org",
          "visionaryte.org"
        ],
        "ipv4": [
          "109.205.195.98:3000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 98
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-02-10",
      "indicators": {
        "domain": [
          "app.speedvice.com",
          "speedvice.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1971206871076991302",
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 79,
        "ipv4": 2,
        "url_path": 1
      },
      "first_seen": "2026-02-09",
      "indicators": {
        "domain": [
          "1-73g.pages.dev",
          "129react.pages.dev",
          "api.cincopa.org",
          "api.elemize.us",
          "api.entergenix.com",
          "api.evaluateproficiency.com",
          "api.gappeo.us",
          "api.softechsoftwares.co.ke",
          "api.tailora.org",
          "app.askillo.online",
          "app.ehiremeasure.com",
          "app.eskillion.com",
          "app.evalcrew.com",
          "app.evalsuit.com",
          "app.gappeo.us",
          "app.gumlet.us",
          "app.harqen.us",
          "app.insighboard.com",
          "app.scoret.net",
          "app.survicate.us",
          "app.toptiercrew.com",
          "app.vervoe.org",
          "app.vervoe.us",
          "app.vidcruiter.us",
          "app.wonderlic.net",
          "apps.gappeo.us",
          "bapi.evalsuit.com",
          "camdriver.pro",
          "cincopa.org",
          "coinme.hiring-one.com",
          "dataxo.net",
          "download.inspach.com",
          "ehiremeasure.com",
          "elemize.us",
          "entergenix.com",
          "eskillion.com",
          "evalcrew.com",
          "evalsuit.com",
          "evaluateproficiency.com",
          "file-secure-sharing.com",
          "filehosting.store",
          "ftp.dataxo.net",
          "ftp.kaltura.studio",
          "gappeo.us",
          "gumlet.us",
          "harqen.us",
          "hiring-one.com",
          "hiring-you.com",
          "insighboard.com",
          "inspach.com",
          "kaltura.studio",
          "mx.hiring-you.com",
          "ns1.dataxo.net",
          "ns2.dataxo.net",
          "paxos-video-interviews.com",
          "paxos-video-recording.com",
          "paxos.video-hiring.com",
          "pop.dataxo.net",
          "recruit.vervoe.us",
          "scoret.net",
          "sightalent.org",
          "stake.trueskilltest.com",
          "survicate.us",
          "tailora.org",
          "tailora.pages.dev",
          "talentestpro.com",
          "tazmim.com",
          "tether.trueskilltest.com",
          "toptiercrew.com",
          "tracking.toptiercrew.com",
          "trueskilltest.com",
          "venceos.pages.dev",
          "vervoe.org",
          "vervoe.us",
          "vidcruiter.us",
          "video-hiring.com",
          "videointerviewrecording.com",
          "wonderlic.net",
          "zoom.vervoe.us"
        ],
        "ipv4": [
          "144.172.115.189:8080",
          "95.169.180.198:8080"
        ],
        "url_path": [
          "/realtekwin.update"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/ip-address/95.169.180.198/relations",
        "https://www.virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0c45afad114eb1c9bc6b49a69afc549d574/detection",
        "https://www.virustotal.com/gui/file/867dd37ad635536cd9396c15944b9bca4b1fa9a9858171e164e73b9fc6be0d55/detection",
        "https://www.virustotal.com/gui/file/cf33cc4237492b0660698f25548d6738ed1ff24d485dda9654a7fa0b476a953e/detection"
      ],
      "total": 82
    },
    {
      "counts": {
        "domain": 2,
        "ipv4": 1
      },
      "first_seen": "2026-02-09",
      "indicators": {
        "domain": [
          "api.cleverbiz.us",
          "cleverbiz.us"
        ],
        "ipv4": [
          "173.211.46.37:8080"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/banthisguy9349/status/1873338361928466759",
        "https://x.com/dimitribest/status/1873367811822903765",
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/file/d05f805d172583f1436eac2cfddcc5413ef6be0b37eda98ebca0cb0cfae8ad9e/detection",
        "https://www.virustotal.com/gui/file/bdad5b5e2f92a70036958b9ba27705231c0d22f2dc0b7ffcf1bc1006902b791c/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "url_path": 2
      },
      "first_seen": "2026-02-06",
      "indicators": {
        "url_path": [
          "/michalcaladanxyz/",
          "/michalcaladanxyz/caladanecomvp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-02-04-IOCs-for-December-2025-Contagious-Interview-activity.txt"
      ],
      "total": 2
    },
    {
      "counts": {
        "ipv4": 5
      },
      "first_seen": "2026-02-03",
      "indicators": {
        "ipv4": [
          "172.86.105.40:5918",
          "216.250.251.87:1247",
          "66.235.168.238:22411",
          "66.235.168.238:22413",
          "86.106.85.234:4558"
        ]
      },
      "precision": "exact",
      "references": [
        "https://redasgard.com/blog/hunting-lazarus-part4-real-blood-on-the-wire"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 2
      },
      "first_seen": "2026-02-02",
      "indicators": {
        "domain": [
          "tsukan.online"
        ],
        "ipv4": [
          "147.124.202.194:1244",
          "147.124.202.194:3000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/KfishNFT/status/2014379828787494923",
        "https://x.com/g0njxa/status/2014800328105894004",
        "https://radar.securityalliance.org/vs-code-tasks-abuse-by-contagious-interview-dprk/",
        "https://www.abstract.security/blog/contagious-interview-tracking-the-vs-code-tasks-infection-vector",
        "https://www.virustotal.com/gui/file/60914b8df5b5d64070f71ef13817499b3a85de98433ae5c01bd235abec9464f6/detection",
        "https://www.virustotal.com/gui/file/6be45e165de60b61e9b7cb9e1f9b72c652c388a04c02d2068de6188cc88fc3fe/detection",
        "https://www.virustotal.com/gui/file/c226eb59cf696a85ed7134b57f12d82cb392d42b908dd6a463cd4d8c980ee5e8/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-02-02",
      "indicators": {
        "domain": [
          "system.updatecheck.store"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1701155845608964391"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-02-02",
      "indicators": {
        "ipv4": [
          "87.236.177.9:3000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://redasgard.com/blog/hunting-lazarus-part2-blockchain-dead-drop"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 14
      },
      "first_seen": "2026-01-26",
      "indicators": {
        "url": [
          "anvil.org.ph/list/images/index.php",
          "bandarpowder.com/public/assets/buttons/bootstrap.php",
          "coralsunmarine.com/wp-content/themes/flatsome/inc/functions/function-hand.php",
          "ecudecode.mx/redsocial/wp-content/themes/buddyx/inc/Customizer/usercomp.php",
          "galaterrace.com/wp-content/themes/hello-elementor/includes/functions.php",
          "kazitradebd.com/wp-content/themes/hello-elementor/includes/customizer/customizer-hand.php",
          "mediostresbarbas.com.ar/php_scrip/banahosting/index.php",
          "mnmathleague.org/ckeditor/adapters/index.php",
          "oldlinewoodwork.com/wp-content/themes/zubin/inc/index.php",
          "partnerls.pl/wp-content/themes/public/index.php",
          "pierregems.com/wp-content/themes/woodmart/inc/configs/js-hand.php",
          "scgestor.com.br/wp-content/themes/vantage/inc/template-headers.php",
          "spaincaramoon.com/realestate/wp-content/plugins/gravityforms/forward.php",
          "trainingpharmacist.co.uk/bootstrap/bootstrap.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.welivesecurity.com/en/eset-research/gotta-fly-lazarus-targets-uav-sector/",
        "https://www.virustotal.com/gui/file/aefc12b500b58fbc09ebbf34fe64b34cb32a27513478f4769447280ad23af4d2/detection"
      ],
      "total": 14
    },
    {
      "counts": {
        "domain": 27,
        "ipv4": 3
      },
      "first_seen": "2026-01-23",
      "indicators": {
        "domain": [
          "api-server-mocha.vercel.app",
          "codeviewer-fawn.vercel.app",
          "codeviewer-three.vercel.app",
          "coreviewer.vercel.app",
          "editorsettings.vercel.app",
          "isvalid-region.vercel.app",
          "isvalid-regions.vercel.app",
          "jerryfox-platform.vercel.app",
          "regioncheck.xyz",
          "tailwind-version-four.vercel.app",
          "thopywork.vercel.app",
          "vscode-bootstrapper.vercel.app",
          "vscode-config-setting.vercel.app",
          "vscode-config-settings.vercel.app",
          "vscode-config.vercel.app",
          "vscode-helper-132.vercel.app",
          "vscode-helper171-ruby.vercel.app",
          "vscode-helper171.vercel.app",
          "vscode-lnc.vercel.app",
          "vscode-load-config.vercel.app",
          "vscode-load.onrender.com",
          "vscode-project-setting.vercel.app",
          "vscode-settings-bootstrap.vercel.app",
          "vscode-settings-config.vercel.app",
          "vscode-toolkit-bootstrap.vercel.app",
          "vscodeconfig.com",
          "vscodesettingstask.vercel.app"
        ],
        "ipv4": [
          "144.172.116.80:8085",
          "144.172.116.80:8086",
          "144.172.116.80:8087"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/KfishNFT/status/2014379828787494923",
        "https://x.com/g0njxa/status/2014800328105894004",
        "https://radar.securityalliance.org/vs-code-tasks-abuse-by-contagious-interview-dprk/",
        "https://www.abstract.security/blog/contagious-interview-tracking-the-vs-code-tasks-infection-vector",
        "https://www.virustotal.com/gui/file/60914b8df5b5d64070f71ef13817499b3a85de98433ae5c01bd235abec9464f6/detection",
        "https://www.virustotal.com/gui/file/6be45e165de60b61e9b7cb9e1f9b72c652c388a04c02d2068de6188cc88fc3fe/detection",
        "https://www.virustotal.com/gui/file/c226eb59cf696a85ed7134b57f12d82cb392d42b908dd6a463cd4d8c980ee5e8/detection"
      ],
      "total": 30
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-23",
      "indicators": {
        "domain": [
          "brantwork.vercel.app",
          "task-hrec.vercel.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/blackorbird/status/2011064658212634920",
        "https://redasgard.com/blog/hunting-lazarus-contagious-interview-c2-infrastructure",
        "https://x.com/KfishNFT/status/2014379828787494923",
        "https://x.com/g0njxa/status/2014800328105894004",
        "https://radar.securityalliance.org/vs-code-tasks-abuse-by-contagious-interview-dprk/",
        "https://www.abstract.security/blog/contagious-interview-tracking-the-vs-code-tasks-infection-vector",
        "https://www.virustotal.com/gui/file/60914b8df5b5d64070f71ef13817499b3a85de98433ae5c01bd235abec9464f6/detection",
        "https://www.virustotal.com/gui/file/6be45e165de60b61e9b7cb9e1f9b72c652c388a04c02d2068de6188cc88fc3fe/detection",
        "https://www.virustotal.com/gui/file/c226eb59cf696a85ed7134b57f12d82cb392d42b908dd6a463cd4d8c980ee5e8/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-01-23",
      "indicators": {
        "ipv4": [
          "172.86.116.178:3000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://kl4r10n.tech/blog/dprk-new-malware"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 16
      },
      "first_seen": "2026-01-22",
      "indicators": {
        "ipv4": [
          "14.37.47.13:1244",
          "14.37.47.13:1245",
          "165.140.85.105:1244",
          "165.140.86.181:1244",
          "165.140.86.181:1245",
          "176.222.52.77:1244",
          "176.222.52.77:1245",
          "206.206.127.135:8080",
          "206.206.127.80:8080",
          "31.57.243.55:8080",
          "38.146.28.177:8080",
          "38.92.47.118:1244",
          "38.92.47.155:1244",
          "63.176.219.134:8080",
          "66.235.168.17:1244",
          "66.235.168.17:1245"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.recordedfuture.com/research/purplebravos-targeting-it-software-supply-chain"
      ],
      "total": 16
    },
    {
      "counts": {
        "url_path": 1
      },
      "first_seen": "2026-01-16",
      "indicators": {
        "url_path": [
          "/payload/99/root"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/zoomeye_team/status/1901822378348568825",
        "https://x.com/blackorbird/status/1993135605623218560",
        "https://socket.dev/blog/lazarus-strikes-npm-again-with-a-new-wave-of-malicious-packages",
        "https://www.gendigital.com/blog/insights/research/apt-cyber-alliances-2025",
        "https://app.validin.com/detail?find=L-Administrator&type=raw&ref_id=7c876e7935a#tab=host_pairs",
        "https://www.virustotal.com/gui/file/c6edbb0d733798e5e8168a9df2bccaad7834e40f3c30d09816cc9a8ecc431376/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 10,
        "url_path": 1
      },
      "first_seen": "2026-01-13",
      "indicators": {
        "domain": [
          "kb102531x.vercel.app"
        ],
        "ipv4": [
          "216.250.251.87:1244",
          "216.250.251.87:1245",
          "216.250.251.87:1249",
          "216.250.251.87:3389",
          "45.43.11.199:1244",
          "45.43.11.199:1249",
          "45.43.11.199:3389",
          "66.235.63.55:1244",
          "66.235.63.55:1249",
          "66.235.63.55:3389"
        ],
        "url_path": [
          "/DAhkMrMq7/"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/blackorbird/status/2011064658212634920",
        "https://redasgard.com/blog/hunting-lazarus-contagious-interview-c2-infrastructure"
      ],
      "total": 12
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-01-12",
      "indicators": {
        "ipv4": [
          "103.65.230.100:1244"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?find=Node.js%20upload%20multiple%20files&type=raw&ref_id=02496d38d39#tab=host_pairs (# 2025-08-02)",
        "https://app.validin.com/detail?find=VScode&type=raw&ref_id=689da69896f#tab=host_pairs (# 2026-04-10)"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-01-09",
      "indicators": {
        "ipv4": [
          "216.250.251.211:1244"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?find=Node.js%20upload%20multiple%20files&type=raw&ref_id=02496d38d39#tab=host_pairs (# 2025-08-02)",
        "https://app.validin.com/detail?find=VScode&type=raw&ref_id=689da69896f#tab=host_pairs (# 2026-04-10)"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 3
      },
      "first_seen": "2026-01-07",
      "indicators": {
        "ipv4": [
          "144.172.105.122:8085",
          "144.172.105.122:8086",
          "144.172.105.122:8087"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/malwrhunterteam/status/2008866701707038749",
        "https://www.virustotal.com/gui/file/ede27865d869f073d2bcafd7c633eee87e3fbfb6dcf115a9a8f39be9840fa6cd/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 182
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "118274-zoomid.com",
          "ae-zoom.us",
          "ae-zooom-hegne-meetingsfromf6758s.pages.dev",
          "alejandro.uefa-meeting.com",
          "api-zoom.com",
          "api.zoom-sdk.us",
          "app-center.download",
          "app-zoom.website",
          "as-zoom.us",
          "baincapitalcrypto.zm-meeting.com",
          "biz-zoom.us",
          "bizmeet.online",
          "bizmeet.org",
          "bizmeet.pro",
          "bizmeeting.org",
          "bizmeeting.video",
          "boolnetwork.xyz",
          "bu-zoom.us",
          "business-zoom.us",
          "businessmeet.xyz",
          "calystiabusiness.com",
          "capitalviabtc.com",
          "capitalviabtc.comhollow-jordan-narrow.on-fleek.app",
          "communicationhub.us",
          "cr-zoom.us",
          "downloadcenter.website",
          "dunamu.jp-zoom.com",
          "ecosystem.openfort.video",
          "en-zoom.us",
          "er-zoom.us",
          "extrazoom.us",
          "fronterixbusiness.com",
          "gcp.webzoom.video",
          "globiscapitals.com",
          "group.superstatefund.co",
          "hanagroup.live",
          "hartmanmcapital.com",
          "hk05web.us",
          "hwsrv-1275416.hostwindsdns.com",
          "ignite.bizmeeting.org",
          "ignite.bizmeeting.video",
          "innerteams.us",
          "interzoom.us",
          "jp-zoom.com",
          "justbuiltprojects.com.au",
          "kourosh.uefa-meeting.com",
          "krakenmeetings.com",
          "lido.web05zoom.us",
          "lostdungeon.openfort.xyz",
          "luc.uefa-meeting.com",
          "mail.web021zoom.us",
          "matias.uefa-meeting.com",
          "mediaprime.team",
          "meet.capitalviabtc.com",
          "meet.capitalviabtc.comhollow-jordan-narrow.on-fleek.app",
          "meet.globiscapital.co",
          "meet.globiscapitals.com",
          "meet.mythicaigames.foundation",
          "meet.mythicalgames.foundation",
          "meet.openfort-team.xyz",
          "meet.picwe-team.com",
          "meet.re7.network",
          "meet.rwa-team.video",
          "meet.str8fire-team.network",
          "meet.superstatefund.co",
          "meet.synternetlab.com",
          "meet.twosigma-vc.com",
          "meeting-zoom-witcam-tests-meet-id-5u83-82f3-8h39-83h9-d9e3.pages.dev",
          "meeting-zoom-witcam-tests-meet-id-5u83-82f3-8h39-83h9-n9e3.pages.dev",
          "meetwithhealthyh2o.com",
          "mythicaigames.foundation",
          "mythicalgames.foundation",
          "mzweb3.bu-zoom.us",
          "mzweb3.er-zoom.us",
          "mzweb3.jp-zoom.com",
          "officezoom.us",
          "openfort-team.xyz",
          "openfort.businessmeet.xyz",
          "openfort.video",
          "openfort.xyz",
          "partner.hartmanmcapital.com",
          "partners.boolnetwork.xyz",
          "picwe-team.com",
          "pre-zoom.us",
          "re7.network",
          "republic.biz-zoom.us",
          "republic.bu-zoom.us",
          "republic.cr-zoom.us",
          "republic.er-zoom.us",
          "republic.extrazoom.us",
          "republic.innerteams.us",
          "republic.officezoom.us",
          "republic.pre-zoom.us",
          "republic.usweb-zoom.us",
          "republic.web021zoom.us",
          "riccardo.uefa-meeting.com",
          "rwa-team.video",
          "rwa.business-zoom.us",
          "rwa.businessmeet.xyz",
          "sammy.uefa-meeting.com",
          "silencio.webzoom.video",
          "silvermine.web05zoom.us",
          "skalelabs.as-zoom.us",
          "skalelabs.bu-zoom.us",
          "skalelabs.cr-zoom.us",
          "skalelabs.en-zoom.us",
          "skalelabs.mediaprime.team",
          "skalelabs.pre-zoom.us",
          "skalelabs.usweb-zoom.us",
          "stage.bizmeet.online",
          "stage.bizmeet.org",
          "stage.bizmeet.pro",
          "str8fire-team.network",
          "str8fire.businessmeet.xyz",
          "su05web.us",
          "superstatefund.co",
          "synternetlab.com",
          "tom.uefa-meeting.com",
          "twosigma-vc.com",
          "uefa-meeting.com",
          "uk03web.us",
          "uk06web.us",
          "uk07web.us",
          "ukweb05.us",
          "ukweb06.us",
          "ukweb07.us",
          "us04office.us",
          "us04we.us",
          "usweb-zoom.us",
          "usweb02.us",
          "viabtc.webmeet.video",
          "viabtc.webmeet.vip",
          "web.interzoom.us",
          "web.zoomhub.us",
          "web001-zoom.us",
          "web001zoom.us",
          "web011zoom.us",
          "web021zoom.us",
          "web05zoom.us",
          "web3fund.as-zoom.us",
          "web3fund.en-zoom.us",
          "web3fund.io",
          "webmeet.icu",
          "webmeet.video",
          "webmeet.vip",
          "webus02.us",
          "webus07.us",
          "webus08.us",
          "webus09.us",
          "webzoom.video",
          "xn--rxamia.com",
          "zach.uefa-meeting.com",
          "zm-meeting.com",
          "zoom-sdk.us",
          "zoom.app-center.download",
          "zoom.communicationhub.us",
          "zoom.downloadcenter.website",
          "zoom.hanagroup.live",
          "zoom.hk05web.us",
          "zoom.personifyio.com",
          "zoom.su05web.us",
          "zoom.uk03web.us",
          "zoom.uk06web.us",
          "zoom.uk07web.us",
          "zoom.ukweb05.us",
          "zoom.ukweb06.us",
          "zoom.ukweb07.us",
          "zoom.us04office.us",
          "zoom.us04we.us",
          "zoom.usweb02.us",
          "zoom.webus02.us",
          "zoom.webus07.us",
          "zoom.webus08.us",
          "zoom.webus09.us",
          "zoomapp.downloadcenter.website",
          "zoomhub.us",
          "zoommeetspace.com",
          "zoomtomeet.pposbc.org",
          "zoomzipdrop.pages.dev",
          "zooom.in",
          "zooom.pages.dev",
          "zooommeeting.pages.dev"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/dazhengzhang/status/1899776299725680975",
        "https://x.com/tayvano_/status/1899896814536712334",
        "https://www.virustotal.com/gui/ip-address/5.230.252.157/relations",
        "https://app.validin.com/detail?find=528ab116aa10f63a5156ed906744fcc9&type=hash#tab=host_pairs (# 2025-03-24)",
        "https://app.validin.com/detail?find=Zoom%20Meeting&type=raw&ref_id=af1604aa97f#tab=host_pairs"
      ],
      "total": 182
    },
    {
      "counts": {
        "ipv4": 111,
        "url": 1,
        "url_path": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "ipv4": [
          "104.194.133.88:1224",
          "104.194.133.88:1245",
          "107.189.16.122:1224",
          "107.189.16.122:1245",
          "107.189.16.176:1224",
          "107.189.16.176:1245",
          "107.189.20.152:1224",
          "107.189.20.152:1245",
          "107.189.24.80:1224",
          "107.189.24.80:1245",
          "107.189.25.109:1224",
          "107.189.25.109:1245",
          "144.172.100.124:1224",
          "144.172.100.124:1245",
          "144.172.100.142:1224",
          "144.172.100.142:1245",
          "144.172.101.45:1224",
          "144.172.101.45:1245",
          "144.172.102.148:1224",
          "144.172.102.148:1245",
          "144.172.102.21:1224",
          "144.172.102.21:1245",
          "144.172.103.97:1224",
          "144.172.103.97:1245",
          "144.172.104.10:1224",
          "144.172.104.10:1245",
          "144.172.104.113:1224",
          "144.172.104.113:1245",
          "144.172.105.189:1224",
          "144.172.105.189:1245",
          "144.172.105.235:1224",
          "144.172.105.235:1245",
          "144.172.106.133:1224",
          "144.172.106.133:1245",
          "144.172.106.7:1224",
          "144.172.106.7:1245",
          "144.172.109.98:1224",
          "144.172.109.98:1245",
          "144.172.112.106:1224",
          "144.172.112.106:1245",
          "144.172.86.27:1224",
          "144.172.86.27:1245",
          "144.172.95.226:1224",
          "144.172.95.226:1245",
          "144.172.96.80:1224",
          "144.172.96.80:1245",
          "144.172.97.7:1224",
          "144.172.97.7:1245",
          "146.70.253.107:1224",
          "146.70.253.107:1245",
          "146.70.41.188:1224",
          "146.70.41.188:1245",
          "172.86.113.115:1244",
          "172.86.113.115:1245",
          "172.86.113.18:1224",
          "172.86.113.18:1245",
          "172.86.116.90:1224",
          "172.86.116.90:1245",
          "172.86.123.55:1224",
          "172.86.123.55:1245",
          "172.86.73.198:1224",
          "172.86.73.198:1245",
          "172.86.84.38:1224",
          "172.86.84.38:1245",
          "185.153.182.251:1224",
          "185.153.182.251:1245",
          "214.75.112.56:1224",
          "214.75.112.56:1244",
          "214.75.112.56:1245",
          "216.126.229.166:1224",
          "216.126.229.166:1245",
          "217.148.142.113:1224",
          "217.148.142.113:1245",
          "23.227.202.244:1224",
          "23.227.202.244:1245",
          "23.227.202.51:1224",
          "23.227.202.51:1245",
          "23.227.202.52:1224",
          "23.227.202.52:1245",
          "23.227.203.18:1224",
          "23.227.203.18:1245",
          "23.227.203.192:1224",
          "23.227.203.192:1245",
          "23.227.203.204:1224",
          "23.227.203.204:1245",
          "45.61.128.110:1224",
          "45.61.128.110:1245",
          "45.61.128.61:1224",
          "45.61.128.61:1245",
          "45.61.133.110:1224",
          "45.61.133.110:1245",
          "45.61.135.4:1224",
          "45.61.135.4:1245",
          "45.61.149.222:1224",
          "45.61.149.222:1245",
          "45.61.150.30:1224",
          "45.61.150.30:1245",
          "45.61.150.31:1224",
          "45.61.150.31:1245",
          "45.61.150.67:1224",
          "45.61.150.67:1245",
          "45.61.151.71:1244",
          "45.61.151.71:1245",
          "45.61.160.28:1224",
          "45.61.160.28:1245",
          "45.61.165.45:1224",
          "45.61.165.45:1245",
          "88.218.0.78:1224",
          "88.218.0.78:1245",
          "94.131.97.195:1224",
          "94.131.97.195:1245"
        ],
        "url": [
          "http://144.172.112.106"
        ],
        "url_path": [
          "/payload/99/81"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/zoomeye_team/status/1901822378348568825",
        "https://x.com/blackorbird/status/1993135605623218560",
        "https://socket.dev/blog/lazarus-strikes-npm-again-with-a-new-wave-of-malicious-packages",
        "https://www.gendigital.com/blog/insights/research/apt-cyber-alliances-2025",
        "https://app.validin.com/detail?find=L-Administrator&type=raw&ref_id=7c876e7935a#tab=host_pairs",
        "https://www.virustotal.com/gui/file/c6edbb0d733798e5e8168a9df2bccaad7834e40f3c30d09816cc9a8ecc431376/detection"
      ],
      "total": 113
    },
    {
      "counts": {
        "domain": 105
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "africamall.chat",
          "api.africamall.chat",
          "api.auto-fixer.online",
          "api.autodriverfix.online",
          "api.autofixer.online",
          "api.camallupdate.cloud",
          "api.camdriverhelp.club",
          "api.camdriverhub.cloud",
          "api.camdrivers.cloud",
          "api.camdriverstore.cloud",
          "api.camtuneup.online",
          "api.deepdriverupdate.online",
          "api.devicefixer.online",
          "api.drivercamhub.cloud",
          "api.driversnap.cloud",
          "api.driversofthub.online",
          "api.driverstream.cloud",
          "api.drivfixer.online",
          "api.drivhost.store",
          "api.drvfixer.online",
          "api.fix-drivers.online",
          "api.fixdiskpro.online",
          "api.olaestudiocreativo.com",
          "api.provideodrivers.cloud",
          "api.quickdriverupdate.online",
          "api.rapiddrivers.cloud",
          "api.release-driver.online",
          "api.release-drivers.online",
          "api.retailpackagingpartner.xyz",
          "api.smartchecker.online",
          "api.smartdriverfix.cloud",
          "api.smartdrvupdate.online",
          "api.updatecall.live",
          "api.updatewebcamnow.live",
          "api.vblimitedgroup.com",
          "api.vcamdriverupdate.cloud",
          "api.vcamfixer.online",
          "api.vcamsupport.cloud",
          "api.videocarddrivers.cloud",
          "api.videodriverzone.cloud",
          "api.videotechdrivers.cloud",
          "api.vidtechdrivers.com",
          "api.vidtechdrv.online",
          "api.vidtechhub.cloud",
          "api.web-cam.cloud",
          "api.webcamdrivers.cloud",
          "api.webcamfix.cloud",
          "api.webcamfixer.cloud",
          "api.webcamfixer.online",
          "api.webcamwizard.cloud",
          "api.wikahmart.com",
          "api.yourdomainhost.store",
          "auto-fixer.online",
          "autodriverfix.online",
          "autofixer.online",
          "camallupdate.cloud",
          "camdriverhelp.club",
          "camdriverhub.cloud",
          "camdrivers.cloud",
          "camdriverstore.cloud",
          "camtuneup.online",
          "deepdriverupdate.online",
          "devicefixer.online",
          "drivercamhub.cloud",
          "driversnap.cloud",
          "driversofthub.online",
          "driverstream.cloud",
          "drivfixer.online",
          "drivhost.store",
          "drvfixer.online",
          "fix-drivers.online",
          "fix.soft-dev.online",
          "fixdiskpro.online",
          "olaestudiocreativo.com",
          "provideodrivers.cloud",
          "quickdriverupdate.online",
          "rapiddrivers.cloud",
          "release-driver.online",
          "release-drivers.online",
          "retailpackagingpartner.xyz",
          "smartchecker.online",
          "smartdriverfix.cloud",
          "smartdrvupdate.online",
          "soft-dev.online",
          "updatecall.live",
          "updatewebcamnow.live",
          "vblimitedgroup.com",
          "vcamdriverupdate.cloud",
          "vcamfixer.online",
          "vcamsupport.cloud",
          "videocarddrivers.cloud",
          "videodriverzone.cloud",
          "videotechdrivers.cloud",
          "vidtechdrivers.com",
          "vidtechdrv.online",
          "vidtechhub.cloud",
          "web-cam.cloud",
          "webcamdrivers.cloud",
          "webcamfix.cloud",
          "webcamfixer.cloud",
          "webcamfixer.online",
          "webcamwizard.cloud",
          "west-app.online",
          "wikahmart.com",
          "yourdomainhost.store"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/lontze7/status/1895044097129496782",
        "https://x.com/lontze7/status/1896131895223841044",
        "https://x.com/lontze7/status/1897214445107175780",
        "https://app.validin.com/detail?find=66.29.141.73&type=ip4&ref_id=5db4210a5c4#tab=resolutions",
        "https://app.validin.com/detail?find=f002a88cbb7b49e66036&type=hash&ref_id=a4d0e878c1e#tab=host_pairs (# 2025-06-05)",
        "https://www.virustotal.com/gui/file/ff1d5ee6dbf77b79eec7e7405d864eb2445213aa0f5b5b665d322c4565d5b6a5/detection"
      ],
      "total": 105
    },
    {
      "counts": {
        "domain": 56
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "ai.coinhouse360.com",
          "alchemy.onchainhiringtool.com",
          "api.smartdriverfixer.com",
          "app.coinhouse360.com",
          "app.expertssavingai.com",
          "archblock.careerscreeners.com",
          "assessbay.com",
          "bitgo.talentelevate360.com",
          "bofhintl.com",
          "careerscreeners.com",
          "coinbase.onchainhiringtool.com",
          "coinbase.talentelevate360.com",
          "coinhouse360.com",
          "crosstheages.talentelevate360.com",
          "crypto-briefings.com",
          "diamondhilllaw.com",
          "eskillfolio.com",
          "eskillpilot.com",
          "expertssavingai.com",
          "greendottb.com",
          "greendtb.com",
          "heritagetbk.com",
          "hireqora.com",
          "hireskillhub.com",
          "insight-hire.com",
          "job-career-portal.com",
          "jobskillmatch360.com",
          "kraken.livehiringpro.com",
          "krakenhire.com",
          "livehiringhub.com",
          "livehiringpro.com",
          "mail.archblock.careerscreeners.com",
          "mail.careerscreeners.com",
          "onchainhiringtool.com",
          "online.stdheritb.com",
          "onlinesearchlic.com",
          "quiz-nest.com",
          "robinhood.eskillfolio.com",
          "robinhood.eskillpilot.com",
          "secure.greendottb.com",
          "secure.greendtb.com",
          "skill.vidassessmentmaster.com",
          "smartdriverfixer.com",
          "smartvideoassess.com",
          "smartvideohire.com",
          "stdheritb.com",
          "sunflowbikes.com",
          "talentelevate360.com",
          "talentvidintro.com",
          "ugethired360.com",
          "unionminerscorp.com",
          "vidassess360.com",
          "vidassessmentmaster.com",
          "video.coinhouse360.com",
          "vidinterviewmaster.com",
          "web3neptune.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://app.validin.com/detail?find=0a4bb3c47c527ff1cd8b53fbe0dcd159&type=hash#tab=host_pairs (# 2025-03-05)",
        "https://app.validin.com/detail?find=51.210.235.36&type=ip4&ref_id=9c0bb8dc123#tab=host_pairs (# 2025-04-13)",
        "https://app.validin.com/detail?find=51.210.235.45&type=ip4&ref_id=d5055d61a61#tab=resolutions (# 2025-03-07)",
        "https://app.validin.com/detail?find=rockhoster.gmail.com&type=dom&ref_id=b801936350f#tab=dns (# 2025-05-29)"
      ],
      "total": 56
    },
    {
      "counts": {
        "domain": 44
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "aiagentnow.online",
          "biomedsurgcial.com",
          "carandcclasic.com",
          "citce-group.com",
          "competency-core.com",
          "digitaltalent.review",
          "evalvideo.com",
          "febintllc.com",
          "ftutech.store",
          "gamesmasterbb.com",
          "grainituae.com",
          "j-rl.com",
          "jumping-mechellen.com",
          "kirschneigroup.com",
          "livehirepro.com",
          "livesnotnumbers.org",
          "livetalentpro.com",
          "lucas-gaming.com",
          "mail.massmedia24.com",
          "massmedia24.com",
          "medcialbiotop.com",
          "notaiospuglisi.com",
          "online-globaleurope.com",
          "panelcvedata.com",
          "paxosvideointerviewassesment.com",
          "phubauto.space",
          "prohirevideo.com",
          "quickassessio.com",
          "skill-bridges.com",
          "skill.vidcruitermaster.com",
          "smartvirtual-assessment.com",
          "smartwalletfinder.com",
          "stratosshipping.com",
          "talent-hiring-step.com",
          "talent-hiringstep.com",
          "thelightstower.com",
          "treelifeups.com",
          "vidcruitermaster.com",
          "videomaxgreece.com",
          "videoplayermaxgr.com",
          "vidhirehub.com",
          "vidintermaster.com",
          "web3remotework.com",
          "xchangetrump.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://app.validin.com/detail?find=78.110.166.82&type=ip4&ref_id=3862e914a67#tab=resolutions (# 2025-03-01)"
      ],
      "total": 44
    },
    {
      "counts": {
        "domain": 42
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "apply-camera.com",
          "assessalign.com",
          "assessdome.com",
          "aveva.roleassessor.com",
          "axieinfinity.assessalign.com",
          "axieinfinity.hirelytics360.com",
          "blog.evalonboard.com",
          "carrervision.com",
          "cex.apply-camera.com",
          "crosstheages.eskillence.com",
          "crosstheages.hirehatch360.com",
          "crosstheages.hirelytics360.com",
          "doodles.carrervision.com",
          "doodles.hirequestion.com",
          "doodles.interviews360.com",
          "doodles.skillquestion.com",
          "doodles.workquestion.com",
          "eliteshire.com",
          "eskillence.com",
          "evalonboard.com",
          "finnt.evalonboard.com",
          "hirehatch360.com",
          "hirelytics360.com",
          "hirequestion.com",
          "interviews360.com",
          "ixcareer.com",
          "jobinterviews360.com",
          "mat-techcore.org",
          "roleassessor.com",
          "rolematches.com",
          "skillquestion.com",
          "tellus.evalonboard.com",
          "theta.apply-camera.com",
          "theta.evalonboard.com",
          "thorequities.eskillence.com",
          "wintermute.workquestion.com",
          "workiva.roleassessor.com",
          "workquestion.com",
          "yuga.hirequestion.com",
          "yuga.ixcareer.com",
          "yuga.jobinterviews360.com",
          "yuga.workquestion.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://app.validin.com/detail?find=%3A%3A%3A%22keywords%22%3A%22hiring%2C%20recruitment%2C%20assessment%2C%20talent%20evaluation%2C%20interview%20platform%2C%20employee%20skills%22&type=raw&ref_id=b6a09e2884b#tab=host_pairs (# 2025-07-16)"
      ],
      "total": 42
    },
    {
      "counts": {
        "domain": 38
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "api.bitzone.io",
          "api.coinhar.io",
          "api.coinpricehub.io",
          "api.ethzone.io",
          "api.fivebit.io",
          "api.jquery-release.com",
          "api.thaibit.io",
          "bitzone.io",
          "blockprices.io",
          "cdn.clublogos.io",
          "cdn.jqueryversion.net",
          "cdn.leaguehub.net",
          "cdn.logoeye.net",
          "cdn.logosports.net",
          "cdn.soccerlab.io",
          "chainanalyser.com",
          "clublogos.io",
          "coinhar.io",
          "coinpricehub.io",
          "en.stocksindex.org",
          "en.stockslab.org",
          "en.wfinance.org",
          "ethzone.io",
          "fivebit.io",
          "indobit.io",
          "jquery-release.com",
          "jquerycloud.io",
          "jqueryversion.net",
          "leaguehub.net",
          "logoeye.net",
          "logosports.net",
          "mavenradar.com",
          "skypredict.org",
          "soccerlab.io",
          "stockslab.org",
          "thaibit.io",
          "update.jquerycloud.io",
          "weatherdatahub.org"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/jamieantisocial/status/1911968062062166078",
        "https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/"
      ],
      "total": 38
    },
    {
      "counts": {
        "domain": 28,
        "ipv4": 3,
        "url_path": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "alchemy.talentscreeningtool.com",
          "api.autocamfixer.online",
          "api.quickcamfix.online",
          "assesstrack.com",
          "autocamfixer.online",
          "coinbase.talenthiringtool.com",
          "coinbase.talentmonitoringtool.com",
          "coinbase.talentscreeningtool.com",
          "crosstheages.skillence360.com",
          "doodles.skillquestions.com",
          "drivertools.org",
          "eskillora.com",
          "eskillprov.com",
          "evalswift.com",
          "fast-video-recording.com",
          "hireviavideo.com",
          "mail.hireviavideo.com",
          "parallel.eskillora.com",
          "parallel.eskillprov.com",
          "quickcamfix.online",
          "skillence360.com",
          "skillquestions.com",
          "talent-hiringtalk.com",
          "talenthiringtool.com",
          "talentmonitoringtool.com",
          "talentscreeningtool.com",
          "thorequities.skillence360.com",
          "yuga.skillquestions.com"
        ],
        "ipv4": [
          "154.58.204.15:8080",
          "31.57.243.190:8080",
          "31.57.243.29:8080"
        ],
        "url_path": [
          "/cam-v-ri69.fix",
          "/mac-v-ri69.fixer"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/lazarusholic/status/1935329204020855066",
        "https://blog.talosintelligence.com/python-version-of-golangghost-rat/ (# pychollima)",
        "https://app.validin.com/detail?find=91.90.121.28&type=ip4&ref_id=8c1f7873b55#tab=resolutions"
      ],
      "total": 33
    },
    {
      "counts": {
        "domain": 30
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "conferenceauth.coffeebrain.co",
          "demo.techsaeein.com",
          "document-content.online",
          "emeetings.zoominvites.com",
          "gbmaudiologininstructions.esdinfra.com",
          "getdonald.xyz",
          "hollow-jordan-narrow.on-fleek.app",
          "hysf6-baaaa-aaaag-algfa-cai.icp0.io",
          "joinustoday.online",
          "ksrtcaudiologininstructions.esdinfra.com",
          "ksrtceccsgbmaudiologininstructions.esdinfra.com",
          "live.bankdost.in",
          "live.econceptual.com",
          "meeting.document-content.online",
          "register-meeting.pages.dev",
          "stagging-apiresources.caspiansr.kz",
          "tdlgzoom.com",
          "us.meeting.document-content.online",
          "v2ray.gelithagithmal.workers.dev",
          "z8048w4.caspiansr.kz",
          "zoom-meeting-web-static.eventx.com.cn",
          "zoom.2vanx.com",
          "zoom.eventx.io",
          "zoom.eventxtra.com",
          "zoom.petersen.ai",
          "zoom.qa.retrocubedev.com",
          "zoomfiledrop.pages.dev",
          "zoominvites.com",
          "zoommetting.dev.retrocubedevs.com",
          "zoomworkspace.us.meeting.document-content.online"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://app.validin.com/detail?find=Zoom%20Meeting&type=raw#tab=host_pairs (# 2025-06-19)"
      ],
      "total": 30
    },
    {
      "counts": {
        "domain": 28
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "advisoryfit.com",
          "advisoryfit.pages.dev",
          "api.introon.com",
          "api.ixcareer.video",
          "api.onchainassess.com",
          "api.skilllens360.com",
          "api.snap-screening.com",
          "app.axionara.com",
          "app.eboardcareer.com",
          "app.evalixhub.com",
          "app.ixcareer.video",
          "axionara.com",
          "candidatesnap.com",
          "eboardcareer.com",
          "eboardcareer.pages.dev",
          "evalixhub.com",
          "ftp.skillview360.com",
          "introon.com",
          "ixcareer-video.pages.dev",
          "ixcareer.video",
          "onchainassess.com",
          "parallel.skillview360.com",
          "proficientmint.com",
          "proficientmint.pages.dev",
          "skilllens360.com",
          "skillview360.com",
          "snap-screening.com",
          "speedvice.pages.dev"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/tayvano_/status/1971206871076991302"
      ],
      "total": 28
    },
    {
      "counts": {
        "domain": 25
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "360share.pro",
          "api.drivercamsupport.com",
          "applylens.com",
          "assessmentbay.com",
          "assesstoday.com",
          "backupwizard.net",
          "digitaltalentassess.com",
          "drivercamsupport.com",
          "eskillforge.com",
          "eskillmetric.com",
          "glitchmedic.com",
          "hiresyncer.us",
          "hiretestzone.com",
          "kryptoneer.com",
          "meetingjoin.us",
          "patchpal.pro",
          "paxosinterview.com",
          "prehighiq.com",
          "quizpathway.com",
          "rolltojoin.com",
          "skillsquestions.com",
          "smrtassess.com",
          "softdebugnest.pro",
          "talenttracker.us",
          "web3talentreview.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/193.242.184.2/relations"
      ],
      "total": 25
    },
    {
      "counts": {
        "domain": 22
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "abilityscan360.com",
          "alchemy.motionassess.com",
          "chaoslabs.abilityscan360.com",
          "chaoslabs.motionassess.com",
          "chaoslabs.professionalsnapshot.com",
          "circle.talentmonitoringtool.com",
          "coinbase.abilityscan360.com",
          "coinbase.motionassess.com",
          "coinbase.professionalsnapshot.com",
          "defianceanalytics.abilityscan360.com",
          "defianceanalytics.easyhiringtool.com",
          "easyhiringtool.com",
          "joblitic.com",
          "motionassess.com",
          "professionalsnapshot.com",
          "shimacapital.abilityscan360.com",
          "shimacapital.easyhiringtool.com",
          "skillvisions.com",
          "talentcatchingtool360.com",
          "talenthireflow.com",
          "talentmatchingtools.com",
          "talentmatchingtools.net"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://app.validin.com/detail?find=Talent%20Hire%20Flow&type=raw&ref_id=060cb05f4b2#tab=host_pairs (# 2025-07-15)",
        "https://app.validin.com/detail?find=%3A%3A%3A%22twitter%3Acard%22%3A%22MotionAssess%20Card%22&type=raw&ref_id=060cb05f4b2#tab=host_pairs (# 2025-07-16)",
        "https://app.validin.com/detail?find=%3A%3A%3A%22twitter%3Acreator%22%3A%22%40skillvisions%22&type=raw&ref_id=91cf464b398#tab=host_pairs (# 2025-07-16)"
      ],
      "total": 22
    },
    {
      "counts": {
        "domain": 14,
        "ipv4": 6
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "api.zynoracreative.com",
          "app.limesurvey.us",
          "app.merreo.org",
          "app.qwary.org",
          "app.sloneek.us",
          "app.zynoracreative.com",
          "levinpros.com",
          "limesurvey.us",
          "merreo.org",
          "patch.levinpros.com",
          "patch.zynoracreative.com",
          "qwary.org",
          "sloneek.us",
          "zynoracreative.com"
        ],
        "ipv4": [
          "147.93.40.224:3000",
          "217.15.168.86:3000",
          "31.220.62.190:3000",
          "31.97.211.52:3000",
          "72.60.174.178:3000",
          "95.169.180.140:8080"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/L0Psec/status/1992348070101791152",
        "https://x.com/__pberba__/status/1992762008069161317",
        "https://www.virustotal.com/gui/file/0048b92365f3ab21540b20a00a306c20ad016b334bce1dbb4fd85999278d5b54/detection"
      ],
      "total": 20
    },
    {
      "counts": {
        "domain": 19,
        "ipv4": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "aes-secure.net",
          "arcashop.org",
          "azuredeploypackages.net",
          "azureglobalaccelerator.com",
          "calendly.live",
          "dpkgrepo.com",
          "ftxstock.com",
          "go.oncehub.co",
          "keondigital.com",
          "latamics.org",
          "lmaxtrd.com",
          "nansenpro.org",
          "natefi.org",
          "oncehub.co",
          "paxosfuture.com",
          "picktime.live",
          "plexisco.com",
          "pypilibrary.com",
          "pypistorage.com"
        ],
        "ipv4": [
          "144.172.74.120:3389"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://blog.fox-it.com/2025/09/01/three-lazarus-rats-coming-for-your-cheese/",
        "https://blog.fox-it.com/2026/05/22/remotepe-the-lazarus-rat-that-lives-in-memory/",
        "https://www.virustotal.com/gui/file/d8de31bcaf5b9ebb99bef36244b0ab3c21367821947a789dff69c33d49aaffc9/detection"
      ],
      "total": 20
    },
    {
      "counts": {
        "domain": 19
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "answerpanel.org",
          "avalabs-digital.online",
          "avalabs-digital.space",
          "avalabs-network.live",
          "avalabs-network.online",
          "avalabs-talent.site",
          "base-cei.pages.dev",
          "career-8hp.pages.dev",
          "elitehireaxis360.com",
          "free-loader.org",
          "queryyard.com",
          "recruitboard-base.pages.dev",
          "recruitboard.video",
          "skillstandard360.com",
          "softcaredesk.pro",
          "stage-framework.recruitboard.video",
          "stage-yuga.recruitboard.video",
          "standard-ai.org",
          "sub-recruitboard.pages.dev"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/82.29.157.117/relations",
        "https://app.validin.com/detail?find=%3A%3A%3A%22keywords%22%3A%22hiring%20platform%2C%20recruitment%20software%2C%20candidate%20screening%2C%20talent%20evaluation%2C%20skills-based%20hiring%2C%20interview%20tools%2C%20tech%20hiring%2C%20remote%20hiring%2C%20hiring%20automation%2C%20team%20building%22&type=raw#tab=host_pairs (# 2025-09-08)"
      ],
      "total": 19
    },
    {
      "counts": {
        "domain": 18
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "aduresi.com",
          "api.crm.koliinfotech.company",
          "api.digipairx.com",
          "api.growzy.tech",
          "api.macamhelp.online",
          "api.unimeta.biz",
          "api.updatemycam.online",
          "cpromoter.com",
          "dabacof.com",
          "development-server.aduresi.com",
          "digipairx.com",
          "elitedrivva-app.dabacof.com",
          "gatuga-api.cpromoter.com",
          "growzy.tech",
          "koliinfotech.company",
          "macamhelp.online",
          "unimeta.biz",
          "updatemycam.online"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/malwrhunterteam/status/1910818212834353408",
        "https://app.validin.com/detail?find=dd5bd7746a6f5cbc843f54ecfc7ed780&type=hash&ref_id=056495bef48#tab=host_pairs (# 2025-06-24)"
      ],
      "total": 18
    },
    {
      "counts": {
        "domain": 17
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "avalabs-digital.store",
          "avalabs-hiring.online",
          "avalabs-hiring.site",
          "avalabs-hiring.space",
          "avalabs-hiring.store",
          "avalabs-hiring.world",
          "avalabs-io.online",
          "avalabs-io.space",
          "avalabs-io.store",
          "avalabs-network.space",
          "avalabs-org.online",
          "avalabs-talent.online",
          "avalabs-talent.space",
          "avalabs-talent.store",
          "avalabs-tech.online",
          "avalabs-tech.space",
          "avalabs-tech.store"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1965126588745613721",
        "https://www.virustotal.com/gui/file/15e2d1390aff1c4b83607152cb75ecf5c9b5a20cb732780379265a7b8df80f6b/detection"
      ],
      "total": 17
    },
    {
      "counts": {
        "domain": 5,
        "ipv4": 9,
        "url": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "bujey.store",
          "cdn-static-server.vercel.app",
          "coinlenddefi.com",
          "coinlendefi.com",
          "fashdefi.store"
        ],
        "ipv4": [
          "135.181.123.177:8080",
          "135.181.123.177:8081",
          "135.181.123.177:9000",
          "135.181.123.177:9001",
          "144.172.96.35:3000",
          "144.172.96.35:8000",
          "144.172.96.35:8080",
          "31.97.218.133:6168",
          "77.37.74.86:6168"
        ],
        "url": [
          "http://135.181.123.177",
          "http://144.172.96.35"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/malwrhunterteam/status/1925298281329901682",
        "https://gbhackers.com/lazarus-group-malware-with-ottercookie/",
        "https://app.validin.com/detail?find=Coinlend%20DeFi&type=raw&ref_id=af6318fa6e3#tab=host_pairs (# 2025-05-22)",
        "https://www.virustotal.com/gui/file/b2a203b9391987049ad60c826e6d7a76554f38dfc8b9ce88fea083ca1b106800/detection"
      ],
      "total": 16
    },
    {
      "counts": {
        "domain": 12,
        "ipv4": 2,
        "url": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "acoustickoala.com",
          "acroadovw.com",
          "app-solaxy.world",
          "binancestransfers.com",
          "boofparadise.com",
          "carllamb4judge.com",
          "cdpll-couk.top",
          "nadlan-dubai.com",
          "pitisalot.site",
          "reliableservers.org",
          "sumy.fun",
          "turkishmob.com"
        ],
        "ipv4": [
          "152.89.61.240:443",
          "152.89.61.96:443"
        ],
        "url": [
          "http://152.89.61.240",
          "http://152.89.61.96"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/CreateFileInt_/status/1894741888743223449"
      ],
      "total": 16
    },
    {
      "counts": {
        "domain": 4,
        "url": 11
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "api.zoomsdk.us",
          "zmwebsdk.com",
          "zoomsdk.us",
          "zoomwebapi.com"
        ],
        "url": [
          "http://144.76.201.229",
          "http://216.107.137.53",
          "http://23.254.164.232",
          "http://23.254.204.184",
          "http://38.110.228.112",
          "http://45.42.40.200",
          "http://45.42.40.208",
          "http://45.84.226.239",
          "http://5.230.251.49",
          "http://5.230.252.157",
          "http://5.230.44.79"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/TLP_R3D/status/1900528743732367865",
        "https://www.validin.com/blog/zooming_through_bluenoroff_pivots/",
        "https://app.validin.com/detail?find=%2Fzoom%2Fjoin&type=raw&ref_id=cca7f8289eb#tab=host_pairs (# 2025-03-14)",
        "https://app.validin.com/detail?find=%2Fzoom%2Ferror&type=raw&ref_id=cca7f8289eb#tab=host_pairs (# 2025-03-14)",
        "https://app.validin.com/detail?find=38.110.228.112&type=ip4&ref_id=7b554bab928#tab=resolutions (# 2025-03-14)"
      ],
      "total": 15
    },
    {
      "counts": {
        "domain": 15
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "0xraiseup.com",
          "ascendrix.us",
          "ballroller.fun",
          "corebiz.fun",
          "donmuzzi.site",
          "funnyboy0719.fun",
          "greenservice.tech",
          "gsoftcompany.com",
          "innovateinc.fun",
          "limitlesstechltd.com",
          "litslink.online",
          "memecoinmania.net",
          "pay.resumegenie.us",
          "resumegenie.us",
          "thediversityandinclusionteam.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/SttyK/status/1956180410104471917"
      ],
      "total": 15
    },
    {
      "counts": {
        "domain": 15
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "admin.echelonfnd.io",
          "anifintech.xyz",
          "apply.echelonfnd.io",
          "authnsecuresystems.com",
          "echelonfnd.io",
          "finovec.co.ke",
          "ipv6.srv755058.hstgr.cloud",
          "mail.anifintech.xyz",
          "mediajourney.digital",
          "precisioncoderss.com",
          "srv755058.hstgr.cloud",
          "support.echelonfnd.io",
          "tenspick.shop",
          "thehubservice.cloud",
          "vern.thehubservice.cloud"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://app.validin.com/detail?find=IT%20Company%20Website&type=raw#tab=host_pairs (# 2025-08-26)"
      ],
      "total": 15
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 13
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "worldenterprise-beta.com"
        ],
        "ipv4": [
          "167.88.39.141:5000",
          "171.22.127.221:8000",
          "188.43.33.250:3389",
          "188.43.33.250:5000",
          "188.43.33.250:8080",
          "188.43.33.251:12323",
          "188.43.33.251:12324",
          "188.43.33.251:5000",
          "188.43.33.251:8000",
          "188.43.33.251:8080",
          "37.221.126.117:3011",
          "37.221.126.117:4000",
          "86.104.74.169:27017"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/teamcymru_S2/status/1915827990774063179"
      ],
      "total": 14
    },
    {
      "counts": {
        "domain": 7,
        "ipv4": 3,
        "url": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "bonusdali.com",
          "btcblender.live",
          "chipmixer.live",
          "ido-epargne.com",
          "safefinanceltd.com",
          "stream-football.org",
          "vngpubgm.com"
        ],
        "ipv4": [
          "91.222.173.110:443",
          "91.222.173.138:443",
          "91.222.173.168:443"
        ],
        "url": [
          "http://91.222.173.110",
          "http://91.222.173.138",
          "http://91.222.173.168"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/CreateFileInt_/status/1894739132678599091"
      ],
      "total": 13
    },
    {
      "counts": {
        "domain": 13
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "angeloper.com",
          "angeloperonline.online",
          "apply-blocknovas.site",
          "apply.blocknovas.com",
          "attisscmo.com",
          "bigrocks918.com",
          "blocknovas.com",
          "chat.blocknovas.com",
          "easydriver.cloud",
          "insomnianwin.site",
          "softglide.co",
          "wonthegame.site",
          "xn--12c5eglc5bd7i.site"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.silentpush.com/blog/contagious-interview-front-companies/"
      ],
      "total": 13
    },
    {
      "counts": {
        "domain": 9,
        "ipv4": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "app.compassidea.org",
          "app.evaluino.com",
          "app.evaluza.com",
          "app.proficiencycert.com",
          "compassidea.org",
          "evaluino.com",
          "evaluza.com",
          "my-n8n-76.duckdns.org",
          "proficiencycert.com"
        ],
        "ipv4": [
          "185.164.111.104:3000",
          "31.220.48.106:3000",
          "72.60.117.70:3000",
          "72.60.173.32:3000"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.jamf.com/blog/flexibleferret-malware-continues-to-adapt/"
      ],
      "total": 13
    },
    {
      "counts": {
        "domain": 9,
        "ipv4": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "172-86-114-170.dal.priv.octovpn.net",
          "alpcoin.anomgaming.online",
          "anomgaming.online",
          "apply.blocknovasllc.com",
          "blocknovasllc.com",
          "dprk-it.pages.dev",
          "easyvps.net",
          "facial.anomgaming.online",
          "srv587993.hstgr.cloud"
        ],
        "ipv4": [
          "167.88.39.55:3000",
          "167.88.39.55:4000",
          "172.86.114.170:4000",
          "172.86.114.170:5000"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://app.validin.com/detail?type=raw&find=BlockNovas+LLC#tab=host_pairs (# 2025-04-25)",
        "https://app.validin.com/detail?find=Alphanomics%20Racer&type=raw&ref_id=48da85c573d#tab=host_responses (# 2025-04-26)",
        "https://app.validin.com/detail?find=Team%20Monitor&type=raw&ref_id=48da85c573d#tab=host_responses (# 2025-04-26)",
        "https://app.validin.com/detail?find=2e8498a098fd04d28ee900521de053b3&type=hash&ref_id=4d03061f4ff#tab=host_pairs (# 2025-04-27)"
      ],
      "total": 13
    },
    {
      "counts": {
        "domain": 10,
        "ipv4": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "blocknovas.talenthiringexpert.com",
          "effectiveengineeringleader.com",
          "lunoxbet77--yes.site",
          "lunoxbet77rain.baby",
          "lunoxbet77rain.online",
          "lunoxbet77rain.store",
          "lunoxbet77speed.site",
          "sadborgroup.site",
          "talenthiringexpert.com",
          "theeffectiveengineeringleader.com"
        ],
        "ipv4": [
          "203.161.52.90:3000",
          "203.161.52.90:4000",
          "203.161.52.90:8090"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://app.validin.com/detail?type=raw&find=BlockNovas#tab=host_pairs (# 2025-04-26)",
        "https://app.validin.com/detail?find=b68075c8f2aaef80fa70d7c562804f25&type=hash&ref_id=799956bbc73#tab=host_pairs (# 2025-04-26)",
        "https://app.validin.com/detail?find=b99acd5a518e05c1adbb592ad4192334&type=hash&ref_id=05f30f00222#tab=host_pairs (# 2025-04-26)",
        "https://app.validin.com/detail?type=hash&find=b68075c8f2aaef80fa70d7c562804f25#tab=host_pairs (# 2025-04-27)"
      ],
      "total": 13
    },
    {
      "counts": {
        "domain": 13
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "app.vid-crypto-assess.com",
          "inter.quickskill-review.com",
          "inter.vid-crypto-assess.com",
          "intro.quickskill-review.com",
          "intro.vid-crypto-assess.com",
          "livehirehub.com",
          "quickskill-review.com",
          "rec.vid-crypto-assess.com",
          "robinhood.quickskill-review.com",
          "skill.vidcruiterinterview.com",
          "test-wolf.com",
          "vid-crypto-assess.com",
          "vidcruiterinterview.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://app.validin.com/detail?find=8452ce8ad04afa240e1e8b65d4b3343a&type=hash&ref_id=e867567f0d8#tab=host_pairs (# 2025-02-24)",
        "https://app.validin.com/detail?find=Video%20Recruting%20-%20Find%2C%20Interview&type=raw&ref_id=6b735d3d78d#tab=host_pairs (# 2025-02-24)",
        "https://app.validin.com/detail?find=3934696b4640069f357c788ff3508f4f&type=hash&ref_id=029fac138c3#tab=host_pairs (# 2025-02-27)"
      ],
      "total": 13
    },
    {
      "counts": {
        "domain": 12
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "anglerstatic.com",
          "api.financecap.io",
          "blockfi-krollra.com",
          "electoralvictory.site",
          "en.stocksitem.org",
          "financecap.io",
          "getstockprice.com",
          "goingladies.com",
          "stocksitem.org",
          "trashcrease.com",
          "truthwillsetyoufree.online",
          "verification-blockfi.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/safe/status/1897663514975649938",
        "https://x.com/0xKoda/status/1897787501592617160",
        "https://x.com/MichalKoczwara/status/1898074044274294948",
        "https://www.validin.com/blog/crawl_history_artifact_upgrade/",
        "https://app.validin.com/detail?find=f4407a84d90c5ecc1025&type=hash&ref_id=297005cc469#tab=host_pairs (# 2025-07-22)"
      ],
      "total": 12
    },
    {
      "counts": {
        "domain": 11,
        "ipv4": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "api.camdriversupport.com",
          "api.cameradriverx.cloud",
          "api.camtechdrivers.com",
          "api.drivercams.cloud",
          "api.releasedrive.live",
          "api.stockdata.tech",
          "cameradriverx.cloud",
          "camtechdrivers.com",
          "drivercams.cloud",
          "releasedrive.live",
          "stockdata.tech"
        ],
        "ipv4": [
          "72.5.42.93:8080"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/malwrhunterteam/status/1894301990286471388",
        "https://app.validin.com/detail?find=954d80b823db3724aa3936475f9a7505&type=hash&ref_id=8ae40870ea8#tab=host_pairs",
        "https://www.virustotal.com/gui/file/bf1986ecd37dbc9917b31077615c48fb5d64b904b95e789f9e73be47b1573c0d/detection"
      ],
      "total": 12
    },
    {
      "counts": {
        "domain": 12
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "assesscrew.com",
          "bitmart.hiremodozone.com",
          "hiremodozone.com",
          "mythicalgames.hiremodozone.com",
          "paradigm.hiremodozone.com",
          "solulab.hiremodozone.com",
          "staffingedges.com",
          "stake.assesscrew.com",
          "stake.hiremodozone.com",
          "stake.staffingedges.com",
          "stake.talentedstarmodo.com",
          "talentedstarmodo.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/82.25.87.27/relations"
      ],
      "total": 12
    },
    {
      "counts": {
        "domain": 12
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "auto-ai.online",
          "auto-patch.tech",
          "insighthire360.com",
          "talentgauge360.com",
          "talentpreview360.com",
          "talentradar360.com",
          "talentverge360.com",
          "web3elitesmint.com",
          "web3elitesmint.pages.dev",
          "web3globalmint.com",
          "web3globalmint.pages.dev",
          "web3talentmint.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/157.173.209.152/relations"
      ],
      "total": 12
    },
    {
      "counts": {
        "domain": 11
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "businesshire.cv",
          "ehireflex.com",
          "ehireflix.com",
          "hirebest.cv",
          "hirefiix.pro",
          "hireflix.pro",
          "hireflix360.com",
          "hireone.top",
          "hireproflix.online",
          "hirevision360.com",
          "onehire.pro"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/216.24.57.1/relations"
      ],
      "total": 11
    },
    {
      "counts": {
        "domain": 11
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "advisorflux.com",
          "advisorflux.pages.dev",
          "app.carrerlilla.com",
          "app.lenvny.com",
          "assureeval.com",
          "carrerlilla.com",
          "consulturbo.com",
          "consulturbo.pages.dev",
          "lenvny.com",
          "pathsummitx.com",
          "pathsummitx.pages.dev"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.validin.com/blog/inside_dprk_fake_job_platform/"
      ],
      "total": 11
    },
    {
      "counts": {
        "ipv4": 11
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "ipv4": [
          "118.123.54.71:9999",
          "119.6.121.143:9999",
          "119.6.56.194:9999",
          "125.65.88.195:9999",
          "125.67.171.158:9999",
          "149.28.139.62:8080",
          "154.216.177.215:8080",
          "182.136.120.52:9999",
          "182.136.123.102:9999",
          "207.254.22.248:8800",
          "61.139.89.11:9999"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://hunt.io/blog/dprk-lazarus-kimsuky-infrastructure-uncovered"
      ],
      "total": 11
    },
    {
      "counts": {
        "domain": 7,
        "ipv4": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "apply.waventic.com",
          "contract.waventic.com",
          "crostox.com",
          "hiring.crostox.com",
          "hiring.waventic.com",
          "support.waventic.com",
          "waventic.com"
        ],
        "ipv4": [
          "103.35.189.107:3000",
          "103.35.189.107:4000",
          "74.119.194.205:3000",
          "74.119.194.205:4000"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://app.validin.com/detail?find=BlockOvas&type=raw#tab=host_pairs (# 2025-07-21)"
      ],
      "total": 11
    },
    {
      "counts": {
        "domain": 10
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "careerboard.video",
          "framework.careerboard.video",
          "frameworkvc.icareerc.com",
          "frameworkvc.ixscreen.com",
          "icareerc.com",
          "ixscreen.com",
          "sfdfsdf.icareerc.com",
          "yugalabs.careerboard.video",
          "yugalabs.icareerc.com",
          "yugalabs.ixscreen.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/84.32.84.32/relations"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 10
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "blockassess.com",
          "careerquestion.com",
          "doodles.careerquestion.com",
          "driverpool.online",
          "etoro.careerquestion.com",
          "rastreojerezexpress.com",
          "skillcheck.pro",
          "talentcheck.pro",
          "testwolf-assessment.com",
          "testwolfpro.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/168.231.70.177/relations",
        "https://app.validin.com/detail?find=195.35.38.215&type=ip4&ref_id=25087bf71b4#tab=resolutions (# 2025-03-01)",
        "https://app.validin.com/detail?find=6c38526ceb115206329131fc840bb881&type=hash&ref_id=04d59776778#tab=host_pairs",
        "https://app.validin.com/detail?find=TalentCheck&type=raw#tab=host_pairs",
        "https://app.validin.com/detail?find=c35874ba204e503c8e96bd275956e0cb&type=hash&ref_id=f5e249222ea#tab=host_pairs (# 2025-07-22)"
      ],
      "total": 10
    },
    {
      "counts": {
        "ipv4": 2,
        "url": 8
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "ipv4": [
          "45.8.146.93:443",
          "86.104.72.247:443"
        ],
        "url": [
          "http://103.35.190.170",
          "http://135.181.242.24",
          "http://191.96.31.38",
          "http://45.12.134.206",
          "http://45.8.146.93",
          "http://86.104.72.247",
          "royalsevres.com/bbs/bbs_img/btn_list.psd",
          "royalsevres.com/javascript/activex_patch.hwp"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://asec.ahnlab.com/en/87299/",
        "https://www.virustotal.com/gui/file/e967097a02185995ae58cded08f57e8984152124a3a34adc9543bd4ca1569e5e/detection",
        "https://www.virustotal.com/gui/file/cdadeb1e8358a00ea6f74a42a2f536acc53981762aa1c01b53c62f8b4e278fb7/detection",
        "https://www.virustotal.com/gui/file/b5ed9eb0073ba18e5aee28ff3bc41923ed7e9dbc14c9175c8f2d9bfc58f47402/detection",
        "https://www.virustotal.com/gui/file/1fd921159de8ccf3c33c7ad3d52a4186c2695b858435e8e327c4d95a8d1b048a/detection"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 10
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "assessforhire.com",
          "mail.testforhire.com",
          "quizterview.com",
          "ripple.quizterview.com",
          "ripple.speakure.com",
          "speakure.com",
          "testforhire.com",
          "uniswap.assessforhire.com",
          "uniswap.quizterview.com",
          "uniswap.speakure.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://app.validin.com/detail?find=contato.impreza.email&type=dom&ref_id=63a84babf20#tab=dns (# 2025-06-13)",
        "https://app.validin.com/detail?find=d7434f80ddd2395783c6f935cab65a6c&type=hash&ref_id=85f9a34e59c#tab=host_pairs (# 2025-06-16)"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 1,
        "url": 8
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "smartmanagerex.com"
        ],
        "url": [
          "bluekostec.com/eng/community/write.asp",
          "builsf.com/inc/left.php",
          "dream.bluit.gethompy.com/mobile/skin/board/gallery/index.skin.php",
          "htns.com/eng/skin/member/basic/skin.php",
          "kadsm.org/skin/board/basic/write_comment_skin.php",
          "rsdf.kr/wp-content/uploads/2024/01/index.php",
          "shcpump.com/admin/form/skin/formBasic/style.php",
          "thek-portal.com/eng/career/index.asp"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://securelist.com/operation-synchole-watering-hole-attacks-by-lazarus/116326/"
      ],
      "total": 9
    },
    {
      "counts": {
        "ipv4": 9
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "ipv4": [
          "147.124.202.225:1244",
          "147.124.213.19:1244",
          "147.124.213.232:1244",
          "165.140.86.154:1244",
          "165.140.86.160:1244",
          "207.189.164.137:1244",
          "38.92.47.152:1244",
          "66.235.175.117:1244",
          "93.88.74.112:1244"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://app.validin.com/detail?find=Node.js%20upload%20multiple%20files&type=raw&ref_id=02496d38d39#tab=host_pairs (# 2025-08-02)",
        "https://app.validin.com/detail?find=VScode&type=raw&ref_id=689da69896f#tab=host_pairs (# 2026-04-10)"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "frontend-dev-bnp.pages.dev",
          "frontend-eu1.pages.dev",
          "frontend-staging-egw.pages.dev",
          "frontend-us1.pages.dev",
          "holi.intervu-talent.pro",
          "quickskillup.us",
          "screenquestions.com",
          "skilluplifestylehub.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/MichalKoczwara/status/1878451947734204660",
        "https://app.validin.com/detail?find=190.97.166.164&type=ip4&ref_id=ce0a2dc7d44#tab=resolutions",
        "https://www.virustotal.com/gui/ip-address/193.242.184.2/relations",
        "https://www.virustotal.com/gui/ip-address/91.222.173.30/relations",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Adescription%22%3A%22description%22%3A%22Willo%20is%20a%20platform%20for%20structured%2C%20asynchronous%2C%20video%20creation%20and%20sharing.%20We%20help%20organisations%20everywhere%20discover%20and%20connect%20with%20more%20people.%22&type=raw&ref_id=a33de82ac6e#tab=host_pairs (# 2024-12-28)"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "cdn.clubinfo.io",
          "clubinfo.io",
          "coreladao.com",
          "eclairdomain.com",
          "getstockprice.info",
          "gossipsnare.com",
          "replaydreary.com",
          "showmanroast.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/lazarusholic/status/1893684791406715003",
        "https://slowmist.medium.com/cryptocurrency-apt-intelligence-unveiling-lazarus-groups-intrusion-techniques-a1a6efda7d34",
        "https://www.virustotal.com/gui/ip-address/131.226.2.120/relations",
        "https://www.virustotal.com/gui/ip-address/5.206.227.51/relations",
        "https://www.virustotal.com/gui/file/b9f6a9d4f837f5b8a5dc9987a91ba44bc7ae7f39aa692b5b21dba460f935a0ae/detection"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "archblock.quickproassess.com",
          "archblock.rolefit360.com",
          "hirefeedbacker.com",
          "hiringtestpro.com",
          "quickproassess.com",
          "rolefit360.com",
          "zora.quickproassess.com",
          "zora.rolefit360.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/82.29.199.129/relations"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "bsc-dash.us",
          "callapp.us",
          "infuy.us",
          "linkedinservice.us",
          "versus-dash.us",
          "versus-x.us",
          "versusx.us",
          "zoom.callapp.us"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.sentinelone.com/blog/macos-flexibleferret-further-variants-of-dprk-malware-family-unearthed/",
        "https://www.virustotal.com/gui/file/cd6e548b085eaaee31b260489c932088f1ea58390bccce54b546cba9e8dca228/detection"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "ecareerscan.com",
          "evalvidz.com",
          "gethiring360.com",
          "hotstreamx.stream",
          "intervwolf.com",
          "paxosassessments.com",
          "robinhood.evalvidz.com",
          "robinhood.intervwolf.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://app.validin.com/detail?find=45.89.245.88&type=ip4&ref_id=49b32a66a80#tab=resolutions (# 2025-02-26)"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "advisorygrid.com",
          "answerpart.com",
          "answerpart.pages.dev",
          "app.answerpart.com",
          "equisphirep.com",
          "skillroar.com",
          "stafnex.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/ValidinLLC/status/1994006209284788529"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "anchoragedigitalhireflow.com",
          "anchoragehireflow.com",
          "anchoragehiring.com",
          "fireblocks-assessment.com",
          "fireblockshireflow.com",
          "fireblockshiring.com",
          "ftp.anchoragehireflow.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/82.29.87.223/relations"
      ],
      "total": 7
    },
    {
      "counts": {
        "ipv4": 3,
        "url": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "ipv4": [
          "138.201.50.5:5961",
          "172.86.88.188:1418",
          "172.86.88.188:1476"
        ],
        "url": [
          "http://144.172.112.50",
          "http://172.86.113.12",
          "http://172.86.73.46",
          "http://172.86.88.188"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://blog.talosintelligence.com/beavertail-and-ottercookie/"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "api.stockinfo.io",
          "firexch.com",
          "getcoinprice.info",
          "stockinfo.io",
          "stocksindex.org",
          "wfinance.org"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/ValidinLLC/status/1899512759965868072",
        "https://www.validin.com/blog/bybit_hack_infrastructure_hunt/"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 2,
        "url": 2,
        "url_path": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "json-project-hazel.vercel.app",
          "process-log.vercel.app"
        ],
        "url": [
          "http://138.201.50.5",
          "http://23.127.202.249"
        ],
        "url_path": [
          "/QWERTYU890T12HML",
          "/apikey/QWERTYU890T12HML"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://socket.dev/blog/north-korea-contagious-interview-campaign-338-malicious-npm-packages"
      ],
      "total": 6
    },
    {
      "counts": {
        "ipv4": 4,
        "url": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "ipv4": [
          "172.86.64.67:4181",
          "172.86.64.67:4186",
          "172.86.64.67:4187",
          "172.86.64.67:4188"
        ],
        "url": [
          "api.npoint.io/96979650f5739bcbaebb",
          "http://172.86.64.67"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://slowmist.medium.com/threat-intelligence-uncovering-a-web3-interview-scam-bb366694b7f3"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "blockchainjobhub.com",
          "bybit-assessment.com",
          "evalassesso.com",
          "skillprops.com",
          "talentsnaptest.com",
          "vidassesspro.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://app.validin.com/detail?find=91.222.173.30&type=ip4&ref_id=8b2f0b868b7#tab=resolutions (# 2025-02-24)"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 1,
        "url": 1,
        "url_path": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "pepeartly-foundry.net"
        ],
        "ipv4": [
          "45.59.163.23:1244"
        ],
        "url": [
          "http://172.86.109.49"
        ],
        "url_path": [
          "/bro/ahNjWa2",
          "/payl/ahNjWa2"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/morimolymoly2/status/1889722965459181881",
        "https://app.validin.com/detail?find=Node.js%20upload%20multiple%20files&type=raw&ref_id=02496d38d39#tab=host_pairs (# 2025-04-30)",
        "https://www.virustotal.com/gui/file/c4399052e5801f4947edf3bf634c43a77870ca46ec0c27ded50062f8219aef28/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1,
        "url": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "n34kr3z26f3jzp4ckmwuv5ipqyatumdxhgjgsmucc65jac56khdy5zqd.onion"
        ],
        "url": [
          "http://146.70.253.10",
          "http://23.227.202.242",
          "http://23.254.164.156",
          "http://45.76.160.53"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/lazarusholic/status/1988962619659886724",
        "https://blog.nviso.eu/2025/11/13/contagious-interview-actors-now-utilize-json-storage-services-for-malware-delivery/"
      ],
      "total": 5
    },
    {
      "counts": {
        "ipv4": 5
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "ipv4": [
          "165.140.85.106:1243",
          "165.140.85.106:1244",
          "165.140.85.106:1245",
          "165.140.85.106:1248",
          "165.140.85.106:3389"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/RedDrip7/status/1970391207051436538",
        "https://www.virustotal.com/gui/file/24326e187f082c73f1aa8952696dc1b0b47f8cf205c518194c2c4bb20d8e36b7/detection",
        "https://www.virustotal.com/gui/file/914ebde62460fa8daf6dd57fa91f88000314c8aeb48e2de41576d3c15899cf98/detection",
        "https://www.virustotal.com/gui/file/a3bb64de9782d000a1fb50401a8c26a65ea99cb2698cccbb3916dc546761587f/detection",
        "https://www.virustotal.com/gui/file/cba0189ba9f6ef80ce03948c07a8e85fffb41a835d90502903a6f306927f5653/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "ayrshire360.com",
          "elitetalent360.com",
          "fetchtalent360.com",
          "findhelptalent360.com",
          "inst.fetchtalent360.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/13.248.213.45/relations",
        "https://www.virustotal.com/gui/ip-address/3.33.130.190/relations",
        "https://www.virustotal.com/gui/ip-address/91.195.240.123/relations"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 3,
        "ipv4": 1,
        "url": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "ip-api-server.vercel.app",
          "ip-check-api.vercel.app",
          "m21gk.wiremockapi.cloud"
        ],
        "ipv4": [
          "144.172.87.27:1224"
        ],
        "url": [
          "mocki.io/v1/32f16c80-602a-4c80-80af-32a9b8220a6b"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 4,
        "url": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "1215.vercel.app",
          "log-writter.vercel.app",
          "process-log-update.vercel.app",
          "soc-log.vercel.app"
        ],
        "url": [
          "api.npoint.io/1f901a22daea7694face"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages (# hexeval loader, xorindex loader)"
      ],
      "total": 5
    },
    {
      "counts": {
        "ipv4": 5
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "ipv4": [
          "139.60.163.206:4000",
          "172.86.114.31:3000",
          "54.146.239.83:8080",
          "80.209.243.85:4000",
          "80.209.243.85:5000"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://jp.security.ntt/insights_resources/tech_blog/ottercandy_malware_e/"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "candidateinsightinfo.com",
          "eskillprof.com",
          "robinhood.eskillprof.com",
          "skillprooflab.com",
          "toptalentassess.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://app.validin.com/detail?find=a142257525e31628ead74927c88695f8&type=hash#tab=host_pairs (# 2025-03-08)"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "customizetions.com",
          "endesway.life",
          "microsoft.customizetions.com",
          "office.microsoft.customizetions.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/moonlock_lab/status/1980683916571996312",
        "https://x.com/moonlock_lab/status/1980685980895236162",
        "https://www.virustotal.com/gui/file/6149bacfb02eb3db6f95947bc57d89bfb92b90f16f92a61266ea6fbec81d10b7/detection",
        "https://www.virustotal.com/gui/file/5db4182efcfd449078b1b9e96b68cf3be05bbc42543a0b11ed6d50ed951cb576/detection",
        "https://www.virustotal.com/gui/file/cf2e793eac702b70865c79d550cea3f2e1c43966565aa05f2a82d0d19b5873eb/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 2,
        "url": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "0927.vercel.app"
        ],
        "ipv4": [
          "144.172.94.226:5961",
          "144.172.94.226:5974"
        ],
        "url": [
          "http://144.172.94.226"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/lazarusholic/status/1950911891498488244",
        "https://www.sonatype.com/hubfs/White_Papers/How-North-Korea-Backed-Lazarus-Group-is-Weaponizing-Open-Source-Whitepaper.pdf"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "enrollcrux.com",
          "postedviral.com",
          "speeduneasy.com",
          "viperpager.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/im23pds/status/1895284359911088358"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "ignite.onlinemeet.pro",
          "onlinemeet.pro",
          "zincnetwork.tk",
          "zoom-client.xyz"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/TLP_R3D/status/1900511506518970638"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "hiringinterview360.com",
          "okx.hiringinterview360.com",
          "okx.talenthiring360.com",
          "talenthiring360.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/Cybercyberbp04/status/1892039442157666815",
        "https://app.validin.com/detail?find=Interview&type=raw&ref_id=64a8ed2f563#tab=host_pairs"
      ],
      "total": 4
    },
    {
      "counts": {
        "ipv4": 3,
        "url": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "ipv4": [
          "173.211.70.210:8080",
          "173.211.70.246:8080",
          "212.81.47.217:8080"
        ],
        "url": [
          "http://159.100.18.177"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/BaoshengbinCumt/status/1914881621226033430",
        "https://x.com/malwrhunterteam/status/1915157662733394036",
        "https://www.virustotal.com/gui/file/75699cc6d3cfc2e4d0f2fe920e45f559f084acc65f2df48c117016d2642b154b/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "geocollab.wegrowup.us",
          "silverrabbit.wegrowup.us",
          "wegrowup.us",
          "younginvest.wegrowup.us"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/145.223.77.219/relations"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 2,
        "ipv4": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "loopsoft.tech",
          "top-king.store"
        ],
        "ipv4": [
          "172.86.89.10:4382",
          "88.218.0.78:2243"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://medium.com/deriv-tech/how-a-fake-ai-recruiter-delivers-five-staged-malware-disguised-as-a-dream-job-64cc68fec263",
        "https://www.virustotal.com/gui/ip-address/31.97.218.133/relations"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 2,
        "url": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "chainlink-api-v3.com"
        ],
        "ipv4": [
          "172.86.116.178:5918",
          "172.86.116.178:5976"
        ],
        "url": [
          "http://172.86.116.178"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://kl4r10n.tech/blog/dprk-new-malware"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "businessgoogledoc.com",
          "mircosoftclouddocment.com",
          "sharefilesdocment.com",
          "superstate-team.xyz"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://github.com/motuariki/IOCs/blob/main/DPRK%20Tracking/04-12-2025-DPRK-Fake-Meeting-Infrastructure"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 2,
        "ipv4": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "coinbase-walet.biz",
          "coinbase-walet.me"
        ],
        "ipv4": [
          "154.62.226.22:8080",
          "38.134.148.218:8080"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/",
        "https://app.validin.com/detail?find=Coinbase%20-%20Buy%20and%20Sell%20Bitcoin%2C%20Ethereum%2C%20and%20more%20with%20trust&type=raw&ref_id=c888fcffa16#tab=host_pairs (# 2025-03-31)",
        "https://www.virustotal.com/gui/file/e79e28865cfa4b31030133b62d26367ceb06a49b3f449fdd85e136d4f6443edf/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "deepmindschematic.com",
          "devchallengehq.com",
          "skillmasteryhub.us",
          "zenspiretech.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://app.validin.com/detail?find=SkillMaster&type=raw&ref_id=04a9609e38c#tab=host_pairs (# 2025-03-05)"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "phantom-phantomwallet.us",
          "phantomwallet-us.us",
          "rabbywallet-app.us",
          "wallet-trustwallet.us"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://app.validin.com/detail?find=23.254.253.148&type=ip4&ref_id=5af70a4c3a0#tab=resolutions (# 2025-04-17)"
      ],
      "total": 4
    },
    {
      "counts": {
        "ipv4": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "ipv4": [
          "144.172.114.238:8085",
          "144.172.114.238:8086",
          "144.172.114.238:8087"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/smica83/status/2007012261744030069",
        "https://www.virustotal.com/gui/file/5f9c4af7ac12197fb8df152d27f9aa6cc1add0613eb3ecfd7699807b0d35e577/detection",
        "https://www.virustotal.com/gui/file/adeeff8fc41d1ba4922e92a5907f430122b9edc3b6dbe51f3d104fbee464b8ae/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2,
        "ipv4": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "ip-check-server.vercel.app",
          "log-server-lovat.vercel.app"
        ],
        "ipv4": [
          "172.86.80.145:1224"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/lazarusholic/status/1937865917289168970",
        "https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 1,
        "url": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "driverservices.store"
        ],
        "ipv4": [
          "103.231.75.101:8888"
        ],
        "url": [
          "http://45.159.248.110"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/RedDrip7/status/1954801591938170935",
        "https://www.virustotal.com/gui/file/93f11750014fa65066ffa7f7896c3a5b127ef8e68a4062a38610931057fe3dae/detection",
        "https://www.virustotal.com/gui/file/c67e8f51c086ce3c7f6fbd3e0d6d29212def08c321197449afbaecdd799173f1/detection",
        "https://www.virustotal.com/gui/file/259e8845176a665765f488e136931b2aca27be30eb27eb1074606213473d0446/detection",
        "https://www.virustotal.com/gui/file/bc229eca6d7a46acd195a7364c1caa97db96ea8c6c1f0bec10d3929930e89457/detection",
        "https://www.virustotal.com/gui/file/d39f0e201762e5eb4c335371abf29b3192367808f95815123bb58a4f59436476/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "ipv4": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "ipv4": [
          "185.53.46.38:1244",
          "185.53.46.38:3000",
          "185.53.46.38:3389"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/0xmh1/status/1894951955333865918",
        "https://search.censys.io/hosts/185.53.46.38",
        "https://www.virustotal.com/gui/file/a1171ffade3d147e54fab021bc4d56f30645aeb401a88517e9df93d852b78c73/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "archblock.candidatescope.com",
          "candidatescope.com",
          "deadfellaz.candidatescope.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/82.29.81.1/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "agora.assessintel.com",
          "assessintel.com",
          "axieinfinity.assessintel.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/82.198.232.148/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "frameworkvc.ixcareers.com",
          "ixcareers.com",
          "yugalabs.ixcareers.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/82.197.83.216/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "block-digital.fit",
          "block-digital.site",
          "block-digital.store"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/76.76.21.21/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2,
        "ipv4": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "knightsbridge-dex.vercel.app",
          "tetrismic.vercel.app"
        ],
        "ipv4": [
          "144.172.104.117:5918"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://socket.dev/blog/north-korea-contagious-interview-npm-attacks"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2,
        "ipv4": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "businesshire.top",
          "nvidiasdk.fly.dev"
        ],
        "ipv4": [
          "172.86.93.139:3000"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://gitlab-com.gitlab.io/gl-security/security-tech-notes/threat-intelligence-tech-notes/north-korean-malware-sept-2025/"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "bs-production.up.railway.app"
        ],
        "ipv4": [
          "144.172.109.155:1224"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/morimolymoly2/status/1926877622350279117"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "360scanner.store"
        ],
        "ipv4": [
          "151.243.101.229:8080"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/lazarusholic/status/1953086237193150753",
        "https://any.run/cybersecurity-blog/pylangghost-malware-analysis/"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "provevidskillcheck.com",
          "quantumnodespro.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/capodieci/status/1903075585414533144",
        "https://x.com/lontze7/status/1903091260216189306",
        "https://app.validin.com/detail?find=31.220.40.22&type=ip4&ref_id=e4480ae66af#tab=resolutions"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "bizzyclub.org",
          "unmannedsystemstechnology.org"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/byrne_emmy12099/status/1945890954604605497",
        "https://x.com/byrne_emmy12099/status/1946062275183575474",
        "https://www.virustotal.com/gui/file/760bbec57ef20807abebecfbc6fa345b5ac83483de0cb26dcf0306806e98f317/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "mayonestore.online",
          "ofo-home.top"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/blackorbird/status/1924832471621030031"
      ],
      "total": 2
    },
    {
      "counts": {
        "ipv4": 1,
        "url": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "ipv4": [
          "23.27.177.183:443"
        ],
        "url": [
          "http://23.27.177.183"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/TuringAlex/status/1986746682084839459"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "hiremployee.com",
          "office-theme.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/ThreatBookLabs/status/1935542389793341808"
      ],
      "total": 2
    },
    {
      "counts": {
        "ipv4": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "ipv4": [
          "171.22.127.221:5000",
          "88.119.169.226:5000"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/TLP_R3D/status/1915851139301708283",
        "https://app.validin.com/detail?find=1da7c4f8368cdc8cf054e3f3ef560ec8&type=hash&ref_id=c4a2719f1ec#tab=host_pairs (# 2025-04-25)"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "url": [
          "http://141.98.168.79",
          "http://69.10.53.86"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/RedDrip7/status/1968500301377458222",
        "https://www.virustotal.com/gui/file/c105f8c14f3903af3051ae1811ea4ba8898c49b45687f20e22e13a40685c7521/detection",
        "https://www.virustotal.com/gui/file/0c78a1c0809a6a8bcd9e857272817ceafd20c49051fbb8540c4bc1777c7356e6/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "prehireiq.com",
          "uniswap.prehireiq.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/AlvieriD/status/1933822421007847594"
      ],
      "total": 2
    },
    {
      "counts": {
        "ipv4": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "ipv4": [
          "91.198.66.112:3000",
          "91.198.66.158:3000"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/0xmh1/status/1907245404766531772",
        "https://platform.censys.io/search?q=b86140ad75113e930e40228d3e1d7ba1f9e48abb0e02ee293bdd40d6cde8c061"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "ftp.talentevaluate.com",
          "talentevaluate.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/82.29.199.206/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "api.softshare.online",
          "softshare.online"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/52.223.13.41/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "fireblocksinsight.com",
          "superstarscanner.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/51.210.235.45/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "gladneyocivpsdedinvme4.com",
          "mail.gladneyocivpsdedinvme4.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/50.6.4.97/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "assesspro360.com",
          "parallel.assesspro360.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/212.85.29.150/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "axieinfinity.certifyedge360.com",
          "certifyedge360.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/194.164.64.193/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "paxos-video-interview.com",
          "paxos-video-talk.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/104.243.33.214/relations",
        "https://www.virustotal.com/gui/ip-address/198.251.84.129/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "url": [
          "api.npoint.io/e5a5e32cdf9bfe7d2386",
          "http://95.216.46.218"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.veracode.com/blog/north-korean-crypto-stealing-campaign-again/"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1,
        "url": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "block-digital.online"
        ],
        "url": [
          "http://45.89.53.54"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.ctfiot.com/267223.html"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "solana.validator.blog",
          "validator.blog"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://socket.dev/blog/npm-malware-targets-telegram-bot-developers"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "blastapi.org",
          "ethereum.blastapi.org"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://jp.security.ntt/tech_blog/contagious-interview-ottercookie",
        "https://app.validin.com/detail?find=135.181.163.182&type=ip4&ref_id=9058ba7500b#tab=resolutions",
        "https://app.validin.com/detail?find=65.21.19.33&type=ip4&ref_id=9058ba7500b#tab=resolutions"
      ],
      "total": 2
    },
    {
      "counts": {
        "ipv4": 1,
        "url": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "ipv4": [
          "41.208.185.235:443"
        ],
        "url": [
          "http://41.208.185.235"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://cybersecuritynews.com/lazarus-group-infostealer-malwares-attacking-developers/"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "cyptoconnections.com",
          "easywalletconnect.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://app.validin.com/detail?find=185.100.87.82&type=ip4&ref_id=2c13cb80e43#tab=resolutions"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "cryptomn.vercel.app"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/malwrhunterteam/status/1910604983201902976",
        "https://www.virustotal.com/gui/file/c0682c72db57aae7c05d08e79f2d82825be2c2cdcb162c19e4c8bf5a737dcb20/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "ipv4": [
          "158.62.198.177:8080"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/malwrhunterteam/status/1908069353796292714",
        "https://www.virustotal.com/gui/file/a45b34c97e45d73fd60b683e8543a1bb50d73eb30823b9e933fe2436edc35f2b/detection",
        "https://www.virustotal.com/gui/file/d78fe3bd46a1fddddaee98634a4fb082dd47d84bf6a24c3d9b422efef1a01a03/detection",
        "https://www.virustotal.com/gui/file/f5a24d157881801fd13c5e6b6e870dea2873010e75765c231c1437b42fa82dd2/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "camdriversupport.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/malwrhunterteam/status/1894301990286471388",
        "https://app.validin.com/detail?find=954d80b823db3724aa3936475f9a7505&type=hash&ref_id=8ae40870ea8#tab=host_pairs",
        "https://www.virustotal.com/gui/file/bf1986ecd37dbc9917b31077615c48fb5d64b904b95e789f9e73be47b1573c0d/detection",
        "https://www.silentpush.com/blog/contagious-interview-front-companies/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "situsslotdepo10k.org"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/malwrhunterteam/status/1860965771242864867",
        "https://app.validin.com/detail?find=51.79.133.76&type=ip4&ref_id=e843c726398#tab=resolutions",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Atitle%22%3A%3A%22SITUS%20SLOT%20DEPO%2010K%20%F0%9F%92%8E%20Situs%20Viral%20Minimal%20DP%2010.000%20Gampang%20Menang%22&type=raw&ref_id=92eff97ba42#tab=host_pairs",
        "https://www.virustotal.com/gui/file/2727e1775588fee0f9e6d69460338cb526a8d0bb34c5d9df6e4609d1b3d56386/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "blockchainjobassessment.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/lontze7/status/1894676242349048110"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "url": [
          "mnmathleague.com/ckeditor/adapters/index.php"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/lazarusholic/status/1990925548269568447",
        "https://0x0d4y.blog/arsenal-analysis-of-a-nation-state-actor-an-in-depth-look-at-lazarus-scoringmathtea/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "assessiohq.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/RakeshKrish12/status/1894626162061840605"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "greennovadigital.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/82.29.80.153/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "globalskillconnect360.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/82.25.83.175/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "interviewskillmaster.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/78.110.166.82/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "softsquashers.pro"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/72.60.71.89/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "toolshare.cloud"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/72.60.32.153/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "softmedic.pro"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/72.60.28.66/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "skillpilothq.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/212.85.29.40/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "evaluateiq.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/212.85.28.229/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "fix-driver.online"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/198.54.116.86/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "vidfastinterviewmaster.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/198.251.81.14/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "globalelitehire.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/194.164.64.90/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "radarsync.pro"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/191.101.15.48/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "open-src.org"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/148.230.98.183/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "edividy.pro"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/147.93.44.252/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "wavelyhire.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/104.21.32.1/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "url": [
          "http://74.119.194.244"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.aikido.dev/blog/malicious-package-web3"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "videohirepro.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://urlscan.io/result/019ae9c9-3021-722e-a3db-20cc2005fc0f/"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "url": [
          "http://144.217.86.88"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "ipv4": [
          "173.211.106.101:1244"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://mp.weixin.qq.com/s/84lUaNSGo4lhQlpnCVUHfQ",
        "https://www.cert.si/tz016/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "alchemy-api-v3.cloud"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://community.emergingthreats.net/t/ruleset-update-summary-2025-03-05-v10872/2497"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "skillhiretrack.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://app.validin.com/detail?find=138.128.165.91&type=ip4&ref_id=d07daaf12d1#tab=resolutions (# 2025-02-27)"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "chainlink-api-v3.cloud"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://any.run/cybersecurity-blog/ottercookie-malware-analysis/",
        "https://www.virustotal.com/gui/ip-address/135.181.123.177/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2025-02-18",
      "indicators": {
        "url": [
          "http://144.172.98.23"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/morimolymoly2/status/1889722965459181881",
        "https://app.validin.com/detail?find=Node.js%20upload%20multiple%20files&type=raw&ref_id=02496d38d39#tab=host_pairs (# 2025-04-30)",
        "https://www.virustotal.com/gui/file/c4399052e5801f4947edf3bf634c43a77870ca46ec0c27ded50062f8219aef28/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 4,
        "url_path": 3
      },
      "first_seen": "2025-02-17",
      "indicators": {
        "ipv4": [
          "74.119.194.129:3000",
          "74.119.194.129:3001",
          "95.164.45.239:3000",
          "95.164.45.239:3001"
        ],
        "url_path": [
          "/client/marstech1",
          "/j/marstech1",
          "/marstech1"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securityscorecard.com/wp-content/uploads/2025/02/Operation-Marstech-Mayhem-Report_021025_03.pdf",
        "https://search.censys.io/hosts/74.119.194.129/",
        "https://search.censys.io/hosts/95.164.45.239/"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2025-02-16",
      "indicators": {
        "domain": [
          "checknewversion.com",
          "hwsrv-1091010.hostwindsdns.com",
          "runningcloudx.com",
          "wallpaper-flare.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/abuse_ch/status/1889398273376424103",
        "https://app.validin.com/detail?find=d590539b3bdf826ec5f7ce7be46d7dcb&type=hash&ref_id=8e7c052fd41#tab=host_pairs (# 2025-02-11)"
      ],
      "total": 4
    },
    {
      "counts": {
        "ipv4": 3
      },
      "first_seen": "2025-02-14",
      "indicators": {
        "ipv4": [
          "95.169.180.146:3389",
          "95.169.180.146:4444",
          "95.169.180.146:8080"
        ]
      },
      "precision": "exact",
      "references": [
        "https://hackernoon.com/cybercrooks-are-using-fake-job-listings-to-steal-crypto",
        "https://search.censys.io/hosts/95.169.180.146"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2025-02-14",
      "indicators": {
        "domain": [
          "insight-interview.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/MichalKoczwara/status/1878451947734204660",
        "https://app.validin.com/detail?find=190.97.166.164&type=ip4&ref_id=ce0a2dc7d44#tab=resolutions",
        "https://www.virustotal.com/gui/ip-address/193.242.184.2/relations",
        "https://www.virustotal.com/gui/ip-address/91.222.173.30/relations",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Adescription%22%3A%22description%22%3A%22Willo%20is%20a%20platform%20for%20structured%2C%20asynchronous%2C%20video%20creation%20and%20sharing.%20We%20help%20organisations%20everywhere%20discover%20and%20connect%20with%20more%20people.%22&type=raw&ref_id=a33de82ac6e#tab=host_pairs (# 2024-12-28)"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2025-02-13",
      "indicators": {
        "domain": [
          "talentview360.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/MichalKoczwara/status/1878451947734204660",
        "https://app.validin.com/detail?find=190.97.166.164&type=ip4&ref_id=ce0a2dc7d44#tab=resolutions",
        "https://www.virustotal.com/gui/ip-address/193.242.184.2/relations",
        "https://www.virustotal.com/gui/ip-address/91.222.173.30/relations",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Adescription%22%3A%22description%22%3A%22Willo%20is%20a%20platform%20for%20structured%2C%20asynchronous%2C%20video%20creation%20and%20sharing.%20We%20help%20organisations%20everywhere%20discover%20and%20connect%20with%20more%20people.%22&type=raw&ref_id=a33de82ac6e#tab=host_pairs (# 2024-12-28)"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3,
        "url": 3
      },
      "first_seen": "2025-02-12",
      "indicators": {
        "domain": [
          "172-86-114-141.dal.priv.octovpn.net",
          "ns1.coponde.com",
          "redirect-smartwallet.com"
        ],
        "url": [
          "http://172.86.114.141",
          "http://172.86.70.173",
          "http://185.231.205.75"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/morimolymoly2/status/1889722965459181881",
        "https://app.validin.com/detail?find=Node.js%20upload%20multiple%20files&type=raw&ref_id=02496d38d39#tab=host_pairs (# 2025-04-30)",
        "https://www.virustotal.com/gui/file/c4399052e5801f4947edf3bf634c43a77870ca46ec0c27ded50062f8219aef28/detection"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2025-02-12",
      "indicators": {
        "domain": [
          "test29292.com",
          "wholecryptoloom.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/MichalKoczwara/status/1878451947734204660",
        "https://app.validin.com/detail?find=190.97.166.164&type=ip4&ref_id=ce0a2dc7d44#tab=resolutions",
        "https://www.virustotal.com/gui/ip-address/193.242.184.2/relations",
        "https://www.virustotal.com/gui/ip-address/91.222.173.30/relations",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Adescription%22%3A%22description%22%3A%22Willo%20is%20a%20platform%20for%20structured%2C%20asynchronous%2C%20video%20creation%20and%20sharing.%20We%20help%20organisations%20everywhere%20discover%20and%20connect%20with%20more%20people.%22&type=raw&ref_id=a33de82ac6e#tab=host_pairs (# 2024-12-28)"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2025-02-11",
      "indicators": {
        "domain": [
          "express--vpn.com",
          "meetingzoom.org",
          "nv-onlines.info",
          "secfilecert.com",
          "sunbutterfly.meme"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/abuse_ch/status/1889398273376424103",
        "https://app.validin.com/detail?find=d590539b3bdf826ec5f7ce7be46d7dcb&type=hash&ref_id=8e7c052fd41#tab=host_pairs (# 2025-02-11)"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2025-02-11",
      "indicators": {
        "domain": [
          "candy-pdf.com",
          "myqr-generator.com",
          "pdf-candy.com",
          "pdftool25.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/solostalking/status/1889307324453625988",
        "https://www.virustotal.com/gui/ip-address/147.45.167.128/relations"
      ],
      "total": 4
    },
    {
      "counts": {
        "ipv4": 2
      },
      "first_seen": "2025-02-10",
      "indicators": {
        "ipv4": [
          "45.59.163.55:1244",
          "67.203.7.205:1244"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/_notdodo_/status/1888867769006850395",
        "https://www.virustotal.com/gui/file/1cd0ce9ce247b8cabe491515dcd70f5b23209ec08c1a7f80ee9663c946e6365c/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2025-02-09",
      "indicators": {
        "domain": [
          "insightquestion.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/MichalKoczwara/status/1878451947734204660",
        "https://app.validin.com/detail?find=190.97.166.164&type=ip4&ref_id=ce0a2dc7d44#tab=resolutions",
        "https://www.virustotal.com/gui/ip-address/193.242.184.2/relations",
        "https://www.virustotal.com/gui/ip-address/91.222.173.30/relations",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Adescription%22%3A%22description%22%3A%22Willo%20is%20a%20platform%20for%20structured%2C%20asynchronous%2C%20video%20creation%20and%20sharing.%20We%20help%20organisations%20everywhere%20discover%20and%20connect%20with%20more%20people.%22&type=raw&ref_id=a33de82ac6e#tab=host_pairs (# 2024-12-28)"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2025-02-07",
      "indicators": {
        "domain": [
          "talentvideopro.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/MichalKoczwara/status/1878451947734204660",
        "https://app.validin.com/detail?find=190.97.166.164&type=ip4&ref_id=ce0a2dc7d44#tab=resolutions",
        "https://www.virustotal.com/gui/ip-address/193.242.184.2/relations",
        "https://www.virustotal.com/gui/ip-address/91.222.173.30/relations",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Adescription%22%3A%22description%22%3A%22Willo%20is%20a%20platform%20for%20structured%2C%20asynchronous%2C%20video%20creation%20and%20sharing.%20We%20help%20organisations%20everywhere%20discover%20and%20connect%20with%20more%20people.%22&type=raw&ref_id=a33de82ac6e#tab=host_pairs (# 2024-12-28)"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2025-02-06",
      "indicators": {
        "domain": [
          "skillmasteryhub.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/MichalKoczwara/status/1878451947734204660",
        "https://app.validin.com/detail?find=190.97.166.164&type=ip4&ref_id=ce0a2dc7d44#tab=resolutions",
        "https://www.virustotal.com/gui/ip-address/193.242.184.2/relations",
        "https://www.virustotal.com/gui/ip-address/91.222.173.30/relations",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Adescription%22%3A%22description%22%3A%22Willo%20is%20a%20platform%20for%20structured%2C%20asynchronous%2C%20video%20creation%20and%20sharing.%20We%20help%20organisations%20everywhere%20discover%20and%20connect%20with%20more%20people.%22&type=raw&ref_id=a33de82ac6e#tab=host_pairs (# 2024-12-28)"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2025-02-05",
      "indicators": {
        "domain": [
          "elitewholetalent.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/MichalKoczwara/status/1878451947734204660",
        "https://app.validin.com/detail?find=190.97.166.164&type=ip4&ref_id=ce0a2dc7d44#tab=resolutions",
        "https://www.virustotal.com/gui/ip-address/193.242.184.2/relations",
        "https://www.virustotal.com/gui/ip-address/91.222.173.30/relations",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Adescription%22%3A%22description%22%3A%22Willo%20is%20a%20platform%20for%20structured%2C%20asynchronous%2C%20video%20creation%20and%20sharing.%20We%20help%20organisations%20everywhere%20discover%20and%20connect%20with%20more%20people.%22&type=raw&ref_id=a33de82ac6e#tab=host_pairs (# 2024-12-28)"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2025-02-04",
      "indicators": {
        "domain": [
          "callservice.us",
          "zoom.callservice.us"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.sentinelone.com/blog/macos-flexibleferret-further-variants-of-dprk-malware-family-unearthed/",
        "https://www.virustotal.com/gui/file/cd6e548b085eaaee31b260489c932088f1ea58390bccce54b546cba9e8dca228/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2025-02-03",
      "indicators": {
        "domain": [
          "smarthiretop.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/MichalKoczwara/status/1878451947734204660",
        "https://app.validin.com/detail?find=190.97.166.164&type=ip4&ref_id=ce0a2dc7d44#tab=resolutions",
        "https://www.virustotal.com/gui/ip-address/193.242.184.2/relations",
        "https://www.virustotal.com/gui/ip-address/91.222.173.30/relations",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Adescription%22%3A%22description%22%3A%22Willo%20is%20a%20platform%20for%20structured%2C%20asynchronous%2C%20video%20creation%20and%20sharing.%20We%20help%20organisations%20everywhere%20discover%20and%20connect%20with%20more%20people.%22&type=raw&ref_id=a33de82ac6e#tab=host_pairs (# 2024-12-28)"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2025-02-02",
      "indicators": {
        "domain": [
          "blockchainrecruitment360.com",
          "workwizards.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/MichalKoczwara/status/1878451947734204660",
        "https://app.validin.com/detail?find=190.97.166.164&type=ip4&ref_id=ce0a2dc7d44#tab=resolutions",
        "https://www.virustotal.com/gui/ip-address/193.242.184.2/relations",
        "https://www.virustotal.com/gui/ip-address/91.222.173.30/relations",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Adescription%22%3A%22description%22%3A%22Willo%20is%20a%20platform%20for%20structured%2C%20asynchronous%2C%20video%20creation%20and%20sharing.%20We%20help%20organisations%20everywhere%20discover%20and%20connect%20with%20more%20people.%22&type=raw&ref_id=a33de82ac6e#tab=host_pairs (# 2024-12-28)"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2025-01-31",
      "indicators": {
        "url": [
          "http://91.92.120.132"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/lazarusholic/status/1885289504401142011",
        "https://socket.dev/blog/north-korean-apt-lazarus-targets-developers-with-malicious-npm-package"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 3,
        "url_path": 6
      },
      "first_seen": "2025-01-29",
      "indicators": {
        "ipv4": [
          "45.59.163.56:1244",
          "5.135.5.48:1244",
          "95.179.135.133:1245"
        ],
        "url_path": [
          "/bro/ZU1RIOk9",
          "/bro/ZU1WJVq1",
          "/bro/ugDtMe1",
          "/payl/ZU1RIOk9",
          "/payl/ZU1WJVq1",
          "/payl/ugDtMe1"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/eastside_nci/status/1884354415387365458",
        "https://www.virustotal.com/gui/file/efd555e779a25e1be16e594866d4cb758b078ae336b589421c3b9f676cd2ef5d/detection",
        "https://www.virustotal.com/gui/file/c4b8ac6b919c61315a3ed47ee5e2839813a6e87888e4bb518f916d4582bbf6b4/detection",
        "https://www.virustotal.com/gui/file/4b2b157041e8bbeace43320ec93a4206daa9818a6406279999636b2fbc3d08c9/detection",
        "https://www.virustotal.com/gui/file/4a6b7409d79e51113e88c1e62c7f5bad55e5c27a19d0b986b9347c4869233893/detection",
        "https://www.virustotal.com/gui/file/3fb46ed9876d5f3a0aaa57a3726a574fa7e3626f16c86dea685cbf63d721f3ce/detection",
        "https://www.virustotal.com/gui/file/05d7113cd17ee12b26c772716d3370dc0f0fa3c7f996d25d516d22b45b68a43e/detection",
        "https://www.virustotal.com/gui/file/0e3b1ad900604f0f27bcf718592beb50a7ace9af6b7d9c1439a416647e47dd7b/detection"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2025-01-29",
      "indicators": {
        "domain": [
          "primestacks.org",
          "quickinterview360.com",
          "screenquestion.com",
          "videorecruitpro.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/MichalKoczwara/status/1878451947734204660",
        "https://app.validin.com/detail?find=190.97.166.164&type=ip4&ref_id=ce0a2dc7d44#tab=resolutions",
        "https://www.virustotal.com/gui/ip-address/193.242.184.2/relations",
        "https://www.virustotal.com/gui/ip-address/91.222.173.30/relations",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Adescription%22%3A%22description%22%3A%22Willo%20is%20a%20platform%20for%20structured%2C%20asynchronous%2C%20video%20creation%20and%20sharing.%20We%20help%20organisations%20everywhere%20discover%20and%20connect%20with%20more%20people.%22&type=raw&ref_id=a33de82ac6e#tab=host_pairs (# 2024-12-28)"
      ],
      "total": 4
    },
    {
      "counts": {
        "ipv4": 2,
        "url": 1
      },
      "first_seen": "2025-01-29",
      "indicators": {
        "ipv4": [
          "195.250.29.94:1337",
          "195.250.29.94:3001"
        ],
        "url": [
          "http://195.250.29.94"
        ]
      },
      "precision": "exact",
      "references": [
        "https://sourcecodered.com/malicious-arcus-npm-package/",
        "https://www.linkedin.com/feed/update/urn:li:activity:7290126497732837378/",
        "https://www.virustotal.com/gui/ip-address/195.250.29.94/relations",
        "https://tria.ge/250124-1k3bxs1paj/behavioral2",
        "https://www.virustotal.com/gui/file/d390d23d6d96f105de24e85ecd4d2d2d2379bb565ca7cc3923c604518b6a97fa/detection",
        "https://www.virustotal.com/gui/file/9efd70e4bbf658dc374594d8c1251810a954ffa7ccc7155abc1a831c77f9fb6b/detection",
        "https://www.virustotal.com/gui/file/7b5843c32b8ee8ac3a54b6c09bff6d67140e74e548b4b31e7c3c5e35ba4341dc/detection",
        "https://www.virustotal.com/gui/file/6a0ed1976dd871000ab3dad9228e7e8df01df77d17ba4f50fa210d409200d437/detection",
        "https://www.virustotal.com/gui/file/56655ea5ba27f14b860bac62c37e4c45940908e8a45d7c2a6117ce9951baf10d/detection",
        "https://www.virustotal.com/gui/file/0463351dc7858ac1f9038c4c2bf27a1977f462ac0e4a494b7c51f1c8005e0587/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2025-01-28",
      "indicators": {
        "domain": [
          "blockchain-talent-search.com",
          "careerinterview360.com",
          "topinnomastertech.com",
          "winyourrole.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/MichalKoczwara/status/1878451947734204660",
        "https://app.validin.com/detail?find=190.97.166.164&type=ip4&ref_id=ce0a2dc7d44#tab=resolutions",
        "https://www.virustotal.com/gui/ip-address/193.242.184.2/relations",
        "https://www.virustotal.com/gui/ip-address/91.222.173.30/relations",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Adescription%22%3A%22description%22%3A%22Willo%20is%20a%20platform%20for%20structured%2C%20asynchronous%2C%20video%20creation%20and%20sharing.%20We%20help%20organisations%20everywhere%20discover%20and%20connect%20with%20more%20people.%22&type=raw&ref_id=a33de82ac6e#tab=host_pairs (# 2024-12-28)"
      ],
      "total": 4
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2025-01-27",
      "indicators": {
        "url": [
          "addfriend.kr/board/userfiles/temp/index.html"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/smica83/status/1883855708963442892",
        "https://www.virustotal.com/gui/file/6744ca5d49833c9b90aee0f3be39d28dec94579b028b05c647354ec5e1ab53e1/detection",
        "https://www.virustotal.com/gui/file/875b0cbad25e04a255b13f86ba361b58453b6f3c5cc11aca2db573c656e64e24/detection",
        "https://www.virustotal.com/gui/file/d0a41dfe8f5b5c8ba6a5d0bdc3754543210ec2d36290564d9a774e9d22e3ad97/detection",
        "https://www.virustotal.com/gui/file/dd9607913e9c422d6dcf2e8d11be71afbc76f761c8208f76f6ed80a0efa75255/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2025-01-24",
      "indicators": {
        "domain": [
          "winterviews.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/MichalKoczwara/status/1878451947734204660",
        "https://app.validin.com/detail?find=190.97.166.164&type=ip4&ref_id=ce0a2dc7d44#tab=resolutions",
        "https://www.virustotal.com/gui/ip-address/193.242.184.2/relations",
        "https://www.virustotal.com/gui/ip-address/91.222.173.30/relations",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Adescription%22%3A%22description%22%3A%22Willo%20is%20a%20platform%20for%20structured%2C%20asynchronous%2C%20video%20creation%20and%20sharing.%20We%20help%20organisations%20everywhere%20discover%20and%20connect%20with%20more%20people.%22&type=raw&ref_id=a33de82ac6e#tab=host_pairs (# 2024-12-28)"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2025-01-23",
      "indicators": {
        "domain": [
          "decentscrippts.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/MichalKoczwara/status/1878451947734204660",
        "https://app.validin.com/detail?find=190.97.166.164&type=ip4&ref_id=ce0a2dc7d44#tab=resolutions",
        "https://www.virustotal.com/gui/ip-address/193.242.184.2/relations",
        "https://www.virustotal.com/gui/ip-address/91.222.173.30/relations",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Adescription%22%3A%22description%22%3A%22Willo%20is%20a%20platform%20for%20structured%2C%20asynchronous%2C%20video%20creation%20and%20sharing.%20We%20help%20organisations%20everywhere%20discover%20and%20connect%20with%20more%20people.%22&type=raw&ref_id=a33de82ac6e#tab=host_pairs (# 2024-12-28)"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 2
      },
      "first_seen": "2025-01-22",
      "indicators": {
        "ipv4": [
          "94.131.9.32:1224",
          "94.232.247.192:1224"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/dyingbreeds_/status/1881986240020709401"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2025-01-22",
      "indicators": {
        "domain": [
          "quickhire360.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/MichalKoczwara/status/1878451947734204660",
        "https://app.validin.com/detail?find=190.97.166.164&type=ip4&ref_id=ce0a2dc7d44#tab=resolutions",
        "https://www.virustotal.com/gui/ip-address/193.242.184.2/relations",
        "https://www.virustotal.com/gui/ip-address/91.222.173.30/relations",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Adescription%22%3A%22description%22%3A%22Willo%20is%20a%20platform%20for%20structured%2C%20asynchronous%2C%20video%20creation%20and%20sharing.%20We%20help%20organisations%20everywhere%20discover%20and%20connect%20with%20more%20people.%22&type=raw&ref_id=a33de82ac6e#tab=host_pairs (# 2024-12-28)"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2025-01-22",
      "indicators": {
        "ipv4": [
          "138.201.199.46:1224"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/RexorVc0/status/1881973724712452577",
        "https://mp.weixin.qq.com/s?__biz=MzUyMjk4NzExMA==&mid=2247505519&idx=1&sn=594229f2c0123673d1fa9c6cf729858b&chksm=f9c1e566ceb66c701d875de8481fe02d89654d4b56cfc51088de6e421cb701437cdab52a0851&scene=178&cur_album_id=1955835290309230595"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2025-01-20",
      "indicators": {
        "domain": [
          "ledgemail.net",
          "ledgep.net",
          "mail.support-ledger.net",
          "support-ledger.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/TLP_R3D/status/1881385663897231704",
        "https://www.virustotal.com/gui/ip-address/91.222.173.108/relations",
        "https://app.validin.com/detail?find=Crypto%20Ledger&type=raw&ref_id=fb1de658046#tab=host_pairs (# 2025-01-20)"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2025-01-17",
      "indicators": {
        "domain": [
          "api.drive-release.cloud",
          "drive-release.cloud"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1880368325047521678",
        "https://www.virustotal.com/gui/ip-address/199.188.200.35/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2025-01-16",
      "indicators": {
        "domain": [
          "app.skill-share.org",
          "quickhiretest.com",
          "skill-share.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/MichalKoczwara/status/1878451947734204660",
        "https://app.validin.com/detail?find=190.97.166.164&type=ip4&ref_id=ce0a2dc7d44#tab=resolutions",
        "https://www.virustotal.com/gui/ip-address/193.242.184.2/relations",
        "https://www.virustotal.com/gui/ip-address/91.222.173.30/relations",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Adescription%22%3A%22description%22%3A%22Willo%20is%20a%20platform%20for%20structured%2C%20asynchronous%2C%20video%20creation%20and%20sharing.%20We%20help%20organisations%20everywhere%20discover%20and%20connect%20with%20more%20people.%22&type=raw&ref_id=a33de82ac6e#tab=host_pairs (# 2024-12-28)"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2025-01-16",
      "indicators": {
        "domain": [
          "willocandidates.com",
          "willovideorec.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/ValidinLLC/status/1879884999652229588",
        "https://www.validin.com/blog/inoculating_contagious_interview_with_validin/",
        "https://app.validin.com/detail?find=23.254.244.74&type=ip4&ref_id=263630d721d#tab=resolutions"
      ],
      "total": 2
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2025-01-16",
      "indicators": {
        "ipv4": [
          "185.153.182.241:1224"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/cyber__sloth/status/1879848914230374457",
        "https://search.censys.io/hosts/185.153.182.241/data/table#1224-TCP-HTTP"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2025-01-15",
      "indicators": {
        "domain": [
          "crypto-assess.com",
          "gethirednow.org",
          "jobinterview360.com",
          "mail.crypto-assess.com",
          "mail.gethirednow.org",
          "questionnairehq.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/MichalKoczwara/status/1878451947734204660",
        "https://app.validin.com/detail?find=190.97.166.164&type=ip4&ref_id=ce0a2dc7d44#tab=resolutions",
        "https://www.virustotal.com/gui/ip-address/193.242.184.2/relations",
        "https://www.virustotal.com/gui/ip-address/91.222.173.30/relations",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Adescription%22%3A%22description%22%3A%22Willo%20is%20a%20platform%20for%20structured%2C%20asynchronous%2C%20video%20creation%20and%20sharing.%20We%20help%20organisations%20everywhere%20discover%20and%20connect%20with%20more%20people.%22&type=raw&ref_id=a33de82ac6e#tab=host_pairs (# 2024-12-28)"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2025-01-14",
      "indicators": {
        "domain": [
          "app.quickvidintro.com",
          "easyinterview360.com",
          "quickvidintro.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/MichalKoczwara/status/1878451947734204660",
        "https://app.validin.com/detail?find=190.97.166.164&type=ip4&ref_id=ce0a2dc7d44#tab=resolutions",
        "https://www.virustotal.com/gui/ip-address/193.242.184.2/relations",
        "https://www.virustotal.com/gui/ip-address/91.222.173.30/relations",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Adescription%22%3A%22description%22%3A%22Willo%20is%20a%20platform%20for%20structured%2C%20asynchronous%2C%20video%20creation%20and%20sharing.%20We%20help%20organisations%20everywhere%20discover%20and%20connect%20with%20more%20people.%22&type=raw&ref_id=a33de82ac6e#tab=host_pairs (# 2024-12-28)"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2025-01-13",
      "indicators": {
        "domain": [
          "api.camera-drive.org",
          "camera-drive.org",
          "digitptalent.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1878822875081372108",
        "https://www.virustotal.com/gui/ip-address/54.39.128.125/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2025-01-12",
      "indicators": {
        "domain": [
          "app.vidintroexam.com",
          "robinhood.interview.org",
          "robinhood.intro-crypto-assess.com",
          "vidintroexam.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/MichalKoczwara/status/1878451947734204660",
        "https://app.validin.com/detail?find=190.97.166.164&type=ip4&ref_id=ce0a2dc7d44#tab=resolutions",
        "https://www.virustotal.com/gui/ip-address/193.242.184.2/relations",
        "https://www.virustotal.com/gui/ip-address/91.222.173.30/relations",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Adescription%22%3A%22description%22%3A%22Willo%20is%20a%20platform%20for%20structured%2C%20asynchronous%2C%20video%20creation%20and%20sharing.%20We%20help%20organisations%20everywhere%20discover%20and%20connect%20with%20more%20people.%22&type=raw&ref_id=a33de82ac6e#tab=host_pairs (# 2024-12-28)"
      ],
      "total": 4
    },
    {
      "counts": {
        "url_path": 1
      },
      "first_seen": "2025-01-12",
      "indicators": {
        "url_path": [
          "/video-questions/create/531fbaedf67046d6904478f15d3e7142"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/banthisguy9349/status/1873358841053949966",
        "https://urlscan.io/search/#hash%3A6b7038bab8c410aeb6714e1d98d609a61b6dc3e418a6b5c74a17f2d6d6cb4aaf"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2025-01-12",
      "indicators": {
        "ipv4": [
          "95.179.135.133:1244"
        ]
      },
      "precision": "exact",
      "references": [
        "https://search.censys.io/hosts/95.179.135.133"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2025-01-12",
      "indicators": {
        "ipv4": [
          "216.173.115.200:1244"
        ]
      },
      "precision": "exact",
      "references": [
        "https://search.censys.io/hosts/216.173.115.200/data/table#1244-TCP-UNKNOWN"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2025-01-11",
      "indicators": {
        "domain": [
          "wtalents.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/MichalKoczwara/status/1878451947734204660",
        "https://app.validin.com/detail?find=190.97.166.164&type=ip4&ref_id=ce0a2dc7d44#tab=resolutions",
        "https://www.virustotal.com/gui/ip-address/193.242.184.2/relations",
        "https://www.virustotal.com/gui/ip-address/91.222.173.30/relations",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Adescription%22%3A%22description%22%3A%22Willo%20is%20a%20platform%20for%20structured%2C%20asynchronous%2C%20video%20creation%20and%20sharing.%20We%20help%20organisations%20everywhere%20discover%20and%20connect%20with%20more%20people.%22&type=raw&ref_id=a33de82ac6e#tab=host_pairs (# 2024-12-28)"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 13
      },
      "first_seen": "2025-01-10",
      "indicators": {
        "domain": [
          "app.hiring-interview.com",
          "atdfinancial.com",
          "complexassessment.com",
          "digitpotalent.com",
          "distscrippts.com",
          "helpdeskassistance.org",
          "hiring-interview.com",
          "interview-talent.com",
          "interviewhub.org",
          "jobinterviewguide.org",
          "mail.digitpotalent.com",
          "mail.interviewhub.org",
          "wtalents.in"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/MichalKoczwara/status/1878451947734204660",
        "https://app.validin.com/detail?find=190.97.166.164&type=ip4&ref_id=ce0a2dc7d44#tab=resolutions",
        "https://www.virustotal.com/gui/ip-address/193.242.184.2/relations",
        "https://www.virustotal.com/gui/ip-address/91.222.173.30/relations",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Adescription%22%3A%22description%22%3A%22Willo%20is%20a%20platform%20for%20structured%2C%20asynchronous%2C%20video%20creation%20and%20sharing.%20We%20help%20organisations%20everywhere%20discover%20and%20connect%20with%20more%20people.%22&type=raw&ref_id=a33de82ac6e#tab=host_pairs (# 2024-12-28)"
      ],
      "total": 13
    },
    {
      "counts": {
        "domain": 13
      },
      "first_seen": "2025-01-07",
      "indicators": {
        "domain": [
          "app.blockchain-checkup.com",
          "app.videoforrecruitment.com",
          "app.vinterview.org",
          "app.wilo-talent.com",
          "blockchain-checkup.com",
          "complexassess.com",
          "intervu-talent.pro",
          "intro-crypto-assess.com",
          "talentassesspro.com",
          "vid.intro-crypto-assess.com",
          "videoforrecruitment.com",
          "vinterview.org",
          "wilo-talent.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/MichalKoczwara/status/1878451947734204660",
        "https://app.validin.com/detail?find=190.97.166.164&type=ip4&ref_id=ce0a2dc7d44#tab=resolutions",
        "https://www.virustotal.com/gui/ip-address/193.242.184.2/relations",
        "https://www.virustotal.com/gui/ip-address/91.222.173.30/relations",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Adescription%22%3A%22description%22%3A%22Willo%20is%20a%20platform%20for%20structured%2C%20asynchronous%2C%20video%20creation%20and%20sharing.%20We%20help%20organisations%20everywhere%20discover%20and%20connect%20with%20more%20people.%22&type=raw&ref_id=a33de82ac6e#tab=host_pairs (# 2024-12-28)"
      ],
      "total": 13
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2025-01-06",
      "indicators": {
        "domain": [
          "api.imoda.site",
          "api.nvidia-cloud.online",
          "api.nvidia-release.cloud",
          "imoda.site",
          "nvidia-cloud.online",
          "nvidia-drive.cloud",
          "nvidia-release.cloud"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/dimitribest/status/1873024742690857009",
        "https://x.com/StrikeReadyLabs/status/1873182889128673422",
        "https://x.com/StrikeReadyLabs/status/1873388149566747069",
        "https://x.com/banthisguy9349/status/1873329177312875005",
        "https://x.com/G60930953/status/1876050261023875128",
        "https://dmpdump.github.io/posts/NorthKorea_Backdoor_Stealer/",
        "https://www.virustotal.com/gui/ip-address/162.254.39.9/relations",
        "https://www.virustotal.com/gui/file/a803c043e12a5dac467fae092b75aa08b461b8e9dd4c769cea375ff87287a361/detection"
      ],
      "total": 7
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2025-01-03",
      "indicators": {
        "url": [
          "http://45.61.148.153"
        ]
      },
      "precision": "exact",
      "references": [
        "https://asec.ahnlab.com/en/85400/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 1
      },
      "first_seen": "2025-01-02",
      "indicators": {
        "domain": [
          "lianxinxiao.com"
        ],
        "ipv4": [
          "37.221.126.117:5000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/78b845050c78daf92ed44f7928d8755cc6b4773bd774409a21b09b5a4dd7ddf1/detection",
        "https://www.virustotal.com/gui/file/76cb3de448bdbd761beb917eed0d71c058db643fca6a37f7bbf00afbcec9d22d/detection",
        "https://www.virustotal.com/gui/file/68725d4cbc05d8e344addd27c3d831a62faa7860042ed5dbef55b12ad6fbe4b8/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 14
      },
      "first_seen": "2024-12-29",
      "indicators": {
        "domain": [
          "app.willohiringtalent.org",
          "cpanel.wtalents.us",
          "d12rlkj8v5mwse.cloudfront.net",
          "d1yzmjg018adwf.cloudfront.net",
          "d20zx0lguyxj2p.cloudfront.net",
          "d3o9p0hkd7eul5.cloudfront.net",
          "dal-shared-22.hostwindsdns.com",
          "dal-shared-25.hostwindsdns.com",
          "dal-shared-37.hostwindsdns.com",
          "gemini.willohiringtalent.org",
          "mail.willomexcvip.us",
          "mail.wtalents.us",
          "sea-shared-10.hostwindsdns.com",
          "willohiringtalent.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/banthisguy9349/status/1873358841053949966",
        "https://urlscan.io/search/#hash%3A6b7038bab8c410aeb6714e1d98d609a61b6dc3e418a6b5c74a17f2d6d6cb4aaf"
      ],
      "total": 14
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2024-12-29",
      "indicators": {
        "domain": [
          "api.camera-drive.cloud",
          "api.nvidia-drive.cloud",
          "api.nvidia-release.us",
          "camera-drive.cloud",
          "nvidia-release.us"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/dimitribest/status/1873024742690857009",
        "https://x.com/StrikeReadyLabs/status/1873182889128673422",
        "https://x.com/StrikeReadyLabs/status/1873388149566747069",
        "https://x.com/banthisguy9349/status/1873329177312875005",
        "https://x.com/G60930953/status/1876050261023875128",
        "https://dmpdump.github.io/posts/NorthKorea_Backdoor_Stealer/",
        "https://www.virustotal.com/gui/ip-address/162.254.39.9/relations",
        "https://www.virustotal.com/gui/file/a803c043e12a5dac467fae092b75aa08b461b8e9dd4c769cea375ff87287a361/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 2,
        "ipv4": 3
      },
      "first_seen": "2024-12-29",
      "indicators": {
        "domain": [
          "api.jz-aws.info",
          "jz-aws.info"
        ],
        "ipv4": [
          "216.74.123.191:22",
          "216.74.123.191:3001",
          "216.74.123.191:8080"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/banthisguy9349/status/1873338361928466759",
        "https://x.com/dimitribest/status/1873367811822903765",
        "https://x.com/L0Psec/status/2020850377801781319",
        "https://www.virustotal.com/gui/file/d05f805d172583f1436eac2cfddcc5413ef6be0b37eda98ebca0cb0cfae8ad9e/detection",
        "https://www.virustotal.com/gui/file/bdad5b5e2f92a70036958b9ba27705231c0d22f2dc0b7ffcf1bc1006902b791c/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-12-29",
      "indicators": {
        "domain": [
          "cryptocopedia.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/lazarusholic/status/1873360845939621945",
        "https://mp.weixin.qq.com/s?__biz=MzUyMjk4NzExMA==&mid=2247505438&idx=1&sn=cf1947c7af6581f4a66460ae6d14dc2f",
        "https://www.virustotal.com/gui/file/33be1a646e5ed46aa707455637e2116715592d1ef63feafb0fd2f66c872a634d/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-12-29",
      "indicators": {
        "domain": [
          "hyphen-connect.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/banthisguy9349/status/1873348678540493273"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 62
      },
      "first_seen": "2024-12-28",
      "indicators": {
        "domain": [
          "api.willoassessment.com",
          "app.blockchain-assess.com",
          "app.crypto-assessment.com",
          "app.hiringinterview.org",
          "app.hiringtalent.pro",
          "app.interviewnest.org",
          "app.videoscreening.org",
          "app.willo-interview.us",
          "app.willoassess.com",
          "app.willoassessment.com",
          "app.willocandidate.com",
          "app.willohiring.com",
          "app.willomexcvip.us",
          "app.willorecruit.com",
          "app.willotalant.com",
          "app.willotalent.pro",
          "app.willotalent.us",
          "app.willotalent.xyz",
          "app.willotalentes.com",
          "app.willotalents.org",
          "app.wtalents.us",
          "blockchain-assess.com",
          "consensys.willoassessment.com",
          "crypto-assessment.com",
          "final.hiringtalent.pro",
          "fundcandidates.com",
          "gemini.crypto-assessment.com",
          "gemini.willoassess.com",
          "gemini.willohiring.com",
          "geminiskill.willoassessment.com",
          "hiring.willoassessment.com",
          "hiringinterview.org",
          "hiringtalent.pro",
          "interviewnest.org",
          "talent.willo-interview.us",
          "talentcompetency.com",
          "vid.blockchain-assess.com",
          "vid.willoassess.com",
          "videoscreening.org",
          "web.videoscreening.org",
          "werhiring.willomexcvip.us",
          "wiilotalent.com",
          "wilio-talent.net",
          "willo-interview.us",
          "willo-video.com",
          "willoassess.com",
          "willoassess.net",
          "willoassess.org",
          "willoassessment.com",
          "willocandidate.com",
          "willohire.com",
          "willohiring.com",
          "willointerview.com",
          "willomexcvip.us",
          "willorecruit.com",
          "willotalant.com",
          "willotalent.pro",
          "willotalent.us",
          "willotalent.xyz",
          "willotalentes.com",
          "willotalents.org",
          "wtalents.us"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/MichalKoczwara/status/1878451947734204660",
        "https://app.validin.com/detail?find=190.97.166.164&type=ip4&ref_id=ce0a2dc7d44#tab=resolutions",
        "https://www.virustotal.com/gui/ip-address/193.242.184.2/relations",
        "https://www.virustotal.com/gui/ip-address/91.222.173.30/relations",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Adescription%22%3A%22description%22%3A%22Willo%20is%20a%20platform%20for%20structured%2C%20asynchronous%2C%20video%20creation%20and%20sharing.%20We%20help%20organisations%20everywhere%20discover%20and%20connect%20with%20more%20people.%22&type=raw&ref_id=a33de82ac6e#tab=host_pairs (# 2024-12-28)"
      ],
      "total": 62
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-12-28",
      "indicators": {
        "domain": [
          "api.nvidia-release.org",
          "nvidia-release.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/tayvano_/status/1872980013542457802",
        "https://x.com/dimitribest/status/1873024742690857009",
        "https://x.com/StrikeReadyLabs/status/1873182889128673422",
        "https://x.com/StrikeReadyLabs/status/1873388149566747069",
        "https://x.com/banthisguy9349/status/1873329177312875005",
        "https://x.com/G60930953/status/1876050261023875128",
        "https://dmpdump.github.io/posts/NorthKorea_Backdoor_Stealer/",
        "https://www.virustotal.com/gui/ip-address/162.254.39.9/relations",
        "https://www.virustotal.com/gui/file/a803c043e12a5dac467fae092b75aa08b461b8e9dd4c769cea375ff87287a361/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "ipv4": 2
      },
      "first_seen": "2024-12-28",
      "indicators": {
        "ipv4": [
          "5.253.43.122:5346",
          "95.164.17.24:5346"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/dimitribest/status/1872743641166606737",
        "https://x.com/dimitribest/status/1873003988536230241",
        "https://www.virustotal.com/gui/file/1fa62f29313e55ee1bca18820d2f1ca3aaecf438a137a67106d413c655004f0e/detection",
        "https://www.virustotal.com/gui/file/aee26c1ac2cbb598bd2ed4747e58efe68de20cb4c6cf5863c1a9dcf33dc6aae9/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 1
      },
      "first_seen": "2024-12-27",
      "indicators": {
        "domain": [
          "zkservice.cloud"
        ],
        "ipv4": [
          "45.128.52.14:1224"
        ]
      },
      "precision": "exact",
      "references": [
        "https://jp.security.ntt/tech_blog/contagious-interview-ottercookie",
        "https://app.validin.com/detail?find=135.181.163.182&type=ip4&ref_id=9058ba7500b#tab=resolutions",
        "https://app.validin.com/detail?find=65.21.19.33&type=ip4&ref_id=9058ba7500b#tab=resolutions"
      ],
      "total": 2
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2024-12-27",
      "indicators": {
        "ipv4": [
          "5.253.43.122:1224"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/dimitribest/status/1872743641166606737",
        "https://x.com/dimitribest/status/1873003988536230241",
        "https://www.virustotal.com/gui/file/1fa62f29313e55ee1bca18820d2f1ca3aaecf438a137a67106d413c655004f0e/detection",
        "https://www.virustotal.com/gui/file/aee26c1ac2cbb598bd2ed4747e58efe68de20cb4c6cf5863c1a9dcf33dc6aae9/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 3,
        "url": 1,
        "url_path": 2
      },
      "first_seen": "2024-12-25",
      "indicators": {
        "ipv4": [
          "108.181.185.2:23",
          "108.181.185.2:443",
          "108.181.185.2:5001"
        ],
        "url": [
          "http://108.181.185.2"
        ],
        "url_path": [
          "/adc/empOQO",
          "/payload/empOQO"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/AzakaSekai_/status/1871960523698545069",
        "https://www.virustotal.com/gui/file/672757d8ead192ea797570b0bc25a07cd0e6424af7819bd6bab33f49a304f6bf/detection",
        "https://www.virustotal.com/gui/file/8637fb723054087f42c0ba93b4528588adc4954a077dc0860912bbfbcbdd8013/detection"
      ],
      "total": 6
    },
    {
      "counts": {
        "ipv4": 4,
        "url_path": 3
      },
      "first_seen": "2024-12-23",
      "indicators": {
        "ipv4": [
          "147.124.212.125:1244",
          "66.235.175.109:1244",
          "67.203.7.200:1244",
          "67.203.7.209:1244"
        ],
        "url_path": [
          "/bro/gbNsNg6",
          "/gbNsNg6",
          "/payl/gbNsNg6"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/AzakaSekai_/status/1871118429501128863",
        "https://search.censys.io/hosts/67.203.7.209/data/table#1244-TCP-HTTP",
        "https://search.censys.io/search?q=services.http.response.html_title%3D%22Node.js+upload+multiple+files%22&resource=hosts (# 2024-12-23)"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-12-19",
      "indicators": {
        "domain": [
          "atokyonews.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/dimitribest/status/1869572308178010492",
        "https://www.virustotal.com/gui/file/56a666601e66a01cc8dcb53a470d9ea092633c76197cd13919c7749e51ebccbc/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2024-12-12",
      "indicators": {
        "ipv4": [
          "66.235.168.238:1244"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/P4nd3m1cb0y/status/1856123619417428061",
        "https://x.com/P4nd3m1cb0y/status/1856520422583353696",
        "https://x.com/DaveLikesMalwre/status/1866981595111895209"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 23
      },
      "first_seen": "2024-12-10",
      "indicators": {
        "domain": [
          "avillionrabbitry.com",
          "bizsupport365.com",
          "bobshields.com",
          "contentverge.com",
          "etoffcoinbase.com",
          "gnxcepro.com",
          "gwmspacegpt.com",
          "haifeizhang.com",
          "luosongs.shop",
          "marketplacepcai.com",
          "momentumspace.top",
          "nd6u0.asia",
          "ns2.bizsupport365.com",
          "ns2.contentverge.com",
          "quonexa.com",
          "reddish-dawn.store",
          "sandwich-factory.buzz",
          "sdhsdfhsd.com",
          "serversnoti.com",
          "soar.vip",
          "sssaaaafdafa.top",
          "wassmestaazh.pro",
          "yayun88.one"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?find=wassmestaazh.pro&type=raw&ref_id=22540801568#tab=host_pairs (# 2024-12-10)"
      ],
      "total": 23
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2024-11-27",
      "indicators": {
        "domain": [
          "247l.net",
          "dldoc.net",
          "fmi-link.info",
          "greenroad.top",
          "greenways.shop",
          "racksuphde.xyz",
          "rtupdates.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?type=ip&find=94.247.42.70#tab=resolutions"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2024-11-27",
      "indicators": {
        "domain": [
          "ns1.salessgroupss.live",
          "ns2.salessgroupss.live",
          "salessgroupss.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?type=ip&find=67.43.234.98#tab=resolutions"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2024-11-27",
      "indicators": {
        "domain": [
          "m-omeets.online",
          "m-teams.live",
          "mo-events.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?type=ip&find=45.11.181.47#tab=resolutions"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-11-26",
      "indicators": {
        "domain": [
          "leavetecs.online",
          "room-meeting.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/lontze7/status/1856611739166470347",
        "https://x.com/MichalKoczwara/status/1856633769668616614",
        "https://x.com/LPX_404/status/1860977091690615172",
        "https://x.com/_eremit4/status/1856707514936492089",
        "https://x.com/ValidinLLC/status/1861021649522348124",
        "https://search.censys.io/search?resource=hosts&sort=RELEVANCE&per_page=25&virtual_hosts=EXCLUDE&q=services.jarm.fingerprint%3A+2ad2ad0002ad2ad00042d42d00000000f78d2dc0ce6e5bbc5b8149a4872356+AND+%22hwc-hwp-7982830%22"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-11-26",
      "indicators": {
        "domain": [
          "essendantdock.online",
          "h34fdfbm.store"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?find=195.133.88.31&type=ip4&ref_id=24685dca12a#tab=resolutions"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2024-11-25",
      "indicators": {
        "domain": [
          "conference-go.online",
          "insights.online-meets.pro",
          "online-meets.online",
          "online-meets.pro",
          "web-meet.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/lontze7/status/1856611739166470347",
        "https://x.com/MichalKoczwara/status/1856633769668616614",
        "https://x.com/LPX_404/status/1860977091690615172",
        "https://x.com/_eremit4/status/1856707514936492089",
        "https://x.com/ValidinLLC/status/1861021649522348124",
        "https://search.censys.io/search?resource=hosts&sort=RELEVANCE&per_page=25&virtual_hosts=EXCLUDE&q=services.jarm.fingerprint%3A+2ad2ad0002ad2ad00042d42d00000000f78d2dc0ce6e5bbc5b8149a4872356+AND+%22hwc-hwp-7982830%22"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-11-25",
      "indicators": {
        "domain": [
          "internal-meeting.cyou",
          "safe-meeting.site"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/malwrhunterteam/status/1860965771242864867",
        "https://app.validin.com/detail?find=51.79.133.76&type=ip4&ref_id=e843c726398#tab=resolutions",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Atitle%22%3A%3A%22SITUS%20SLOT%20DEPO%2010K%20%F0%9F%92%8E%20Situs%20Viral%20Minimal%20DP%2010.000%20Gampang%20Menang%22&type=raw&ref_id=92eff97ba42#tab=host_pairs",
        "https://www.virustotal.com/gui/file/2727e1775588fee0f9e6d69460338cb526a8d0bb34c5d9df6e4609d1b3d56386/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2024-11-25",
      "indicators": {
        "ipv4": [
          "86.104.74.51:1224"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/P4nd3m1cb0y/status/1856123619417428061",
        "https://x.com/P4nd3m1cb0y/status/1856520422583353696",
        "https://x.com/DaveLikesMalwre/status/1866981595111895209"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2024-11-21",
      "indicators": {
        "domain": [
          "hopanatech.com",
          "huguotechltd.com",
          "inditechlab.com",
          "tonywangtech.com",
          "wkjllc.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.sentinelone.com/labs/dprk-it-workers-a-network-of-active-front-companies-and-their-links-to-china/"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1,
        "url": 2
      },
      "first_seen": "2024-11-21",
      "indicators": {
        "domain": [
          "global-job.org"
        ],
        "url": [
          "ics-kr.com/video/player.php",
          "manhotline.or.kr/data/member/search.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/asdasd13asbz/status/1859467358013895092",
        "https://x.com/asdasd13asbz/status/1859512243471446165",
        "https://www.nccgroup.com/es/research-blog/north-korea-s-lazarus-their-initial-access-trade-craft-using-social-media-and-social-engineering/"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-11-21",
      "indicators": {
        "domain": [
          "sunlotustech.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/TomHegel/status/1859663831510942204"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2024-11-15",
      "indicators": {
        "domain": [
          "a.videotalks.site",
          "b.videotalks.site",
          "comma3.videotalks.online",
          "emv1.videotalks.online",
          "ns2.videotalks.online",
          "ollie.videotalks.online",
          "support.videotalks.online",
          "videotalks.site"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/lontze7/status/1856611739166470347",
        "https://x.com/MichalKoczwara/status/1856633769668616614",
        "https://x.com/LPX_404/status/1860977091690615172",
        "https://x.com/_eremit4/status/1856707514936492089",
        "https://x.com/ValidinLLC/status/1861021649522348124",
        "https://search.censys.io/search?resource=hosts&sort=RELEVANCE&per_page=25&virtual_hosts=EXCLUDE&q=services.jarm.fingerprint%3A+2ad2ad0002ad2ad00042d42d00000000f78d2dc0ce6e5bbc5b8149a4872356+AND+%22hwc-hwp-7982830%22"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2024-11-14",
      "indicators": {
        "domain": [
          "castleisland.sky-meeting.com",
          "comma3.biz-meeting.site",
          "dragonfly.cloudstore.business"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/1ZRR4H/status/1856985633153053060"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-11-14",
      "indicators": {
        "domain": [
          "support.cloudstore.business"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/KseProso/status/1788114018722595188",
        "https://twitter.com/ValidinLLC/status/1788128803698450591",
        "https://x.com/tayvano_/status/1848785112101691511",
        "https://www.virustotal.com/gui/ip-address/104.168.157.45/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 8,
        "ipv4": 16
      },
      "first_seen": "2024-11-13",
      "indicators": {
        "domain": [
          "admin.drop-box.store",
          "app.drop-box.store",
          "backend.drop-box.store",
          "demo.drop-box.store",
          "drop-box.info",
          "drop-box.store",
          "meet-client.online",
          "videotalks.online"
        ],
        "ipv4": [
          "104.168.157.45:3389",
          "104.168.157.45:443",
          "104.168.165.165:3389",
          "104.168.165.165:443",
          "104.168.165.173:3389",
          "104.168.165.173:443",
          "104.168.165.203:3389",
          "104.168.165.203:443",
          "104.168.203.159:3389",
          "104.168.203.159:443",
          "23.254.244.248:3389",
          "23.254.244.248:443",
          "23.254.247.32:3389",
          "23.254.247.32:443",
          "23.254.247.53:3389",
          "23.254.247.53:443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/lontze7/status/1856611739166470347",
        "https://x.com/MichalKoczwara/status/1856633769668616614",
        "https://x.com/LPX_404/status/1860977091690615172",
        "https://x.com/_eremit4/status/1856707514936492089",
        "https://x.com/ValidinLLC/status/1861021649522348124",
        "https://search.censys.io/search?resource=hosts&sort=RELEVANCE&per_page=25&virtual_hosts=EXCLUDE&q=services.jarm.fingerprint%3A+2ad2ad0002ad2ad00042d42d00000000f78d2dc0ce6e5bbc5b8149a4872356+AND+%22hwc-hwp-7982830%22"
      ],
      "total": 24
    },
    {
      "counts": {
        "domain": 17
      },
      "first_seen": "2024-11-13",
      "indicators": {
        "domain": [
          "big-typl.online",
          "civ.team-meeting.net",
          "dun.wndlwndmfe.xyz",
          "eosszzc.hateoo.space",
          "hateoo.space",
          "internal-meeting.site",
          "mail.big-typl.online",
          "mouradvps43hostwin.online",
          "ns1.big-typl.online",
          "paycount.webbs-information.login.udaviemayas.com",
          "private-meeting.site",
          "ryzelabs.private-meeting.site",
          "secure.paycount.webbs-information.login.udaviemayas.com",
          "suntcijm.mouradvps43hostwin.online",
          "support.internal-meeting.site",
          "udaviemayas.com",
          "webbs-information.login.udaviemayas.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/TLP_R3D/status/1856645765185110265",
        "https://x.com/TLP_R3D/status/1856648392295797009",
        "https://www.group-ib.com/blog/stealthy-attributes-of-apt-lazarus/",
        "https://hunt.io/blog/suspected-north-korean-hackers-target-blockchain-community-via-telegram"
      ],
      "total": 17
    },
    {
      "counts": {
        "ipv4": 8
      },
      "first_seen": "2024-11-12",
      "indicators": {
        "ipv4": [
          "147.124.197.138:1244",
          "147.124.197.149:1244",
          "165.140.86.227:1244",
          "38.92.47.151:1244",
          "38.92.47.85:1244",
          "38.92.47.91:1244",
          "45.43.11.201:1244",
          "66.235.168.232:1244"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/P4nd3m1cb0y/status/1856123619417428061",
        "https://x.com/P4nd3m1cb0y/status/1856520422583353696",
        "https://x.com/DaveLikesMalwre/status/1866981595111895209"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-11-11",
      "indicators": {
        "domain": [
          "hanagroup.video",
          "meet.hanagroup.video"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/dazhengzhang/status/1899776299725680975",
        "https://x.com/tayvano_/status/1899896814536712334",
        "https://www.virustotal.com/gui/ip-address/5.230.252.157/relations",
        "https://app.validin.com/detail?find=528ab116aa10f63a5156ed906744fcc9&type=hash#tab=host_pairs (# 2025-03-24)",
        "https://app.validin.com/detail?find=Zoom%20Meeting&type=raw&ref_id=af1604aa97f#tab=host_pairs"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 11
      },
      "first_seen": "2024-11-05",
      "indicators": {
        "domain": [
          "hack-vc.video-meets.site",
          "hack-vc.video-meets.xyz",
          "invoicez.xyz",
          "newfromjune.xyz",
          "online-meets.site",
          "online-meets.xyz",
          "support.video-meets.site",
          "video-meets.pro",
          "video-meets.site",
          "video-meets.team",
          "video-meets.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/MichalKoczwara/status/1833241777374900497",
        "https://x.com/MichalKoczwara/status/1853481507848908950",
        "https://www.virustotal.com/gui/ip-address/104.168.165.165/relations"
      ],
      "total": 11
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-11-05",
      "indicators": {
        "domain": [
          "payloadrpc.com",
          "w3capi.marketing"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/blackorbird/status/1853724721520775677",
        "https://github.com/ThreatLabz/iocs/blob/main/contagiousinterview/c2s.txt"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2024-10-28",
      "indicators": {
        "domain": [
          "api.detankzone.com",
          "app.detankzone.com",
          "detankzone.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/lazarus-apt-steals-crypto-with-a-tank-game/114282/",
        "https://www.virustotal.com/gui/ip-address/45.61.132.114/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2024-10-22",
      "indicators": {
        "domain": [
          "biz-meeting.site",
          "casteisland.sky-meeting.com",
          "casteisland.team-meeting.net",
          "sky-meeting.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/KseProso/status/1788114018722595188",
        "https://twitter.com/ValidinLLC/status/1788128803698450591",
        "https://x.com/tayvano_/status/1848785112101691511",
        "https://www.virustotal.com/gui/ip-address/104.168.157.45/relations"
      ],
      "total": 4
    },
    {
      "counts": {
        "ipv4": 3
      },
      "first_seen": "2024-10-22",
      "indicators": {
        "ipv4": [
          "167.88.168.152:1224",
          "69.43.130.141:3000",
          "69.43.130.153:3000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/blackorbird/status/1848563899064586701",
        "https://www.esentire.com/blog/bored-beavertail-yacht-club-a-lazarus-lure",
        "https://github.com/eSentire/iocs/blob/main/Lazarus/lazarus_iocs_10-15-2024.txt"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2,
        "ipv4": 4
      },
      "first_seen": "2024-10-21",
      "indicators": {
        "domain": [
          "ba5827bf4e00.privatepool.store",
          "privatepool.store"
        ],
        "ipv4": [
          "95.164.17.24:2249",
          "95.164.7.171:1244",
          "95.164.7.171:2249",
          "95.164.7.171:445"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/blackorbird/status/1848262847689887757",
        "https://github.com/blackorbird/APT_REPORT/blob/master/lazarus/2024-10-14%20Lazarus%20InvisibleFerret.pdf",
        "https://search.censys.io/hosts/95.164.7.171https://search.censys.io/hosts/95.164.7.171"
      ],
      "total": 6
    },
    {
      "counts": {
        "ipv4": 15
      },
      "first_seen": "2024-10-10",
      "indicators": {
        "ipv4": [
          "123.21.4.30:3000",
          "13.126.148.192:3000",
          "13.76.169.115:3000",
          "142.11.210.175:3000",
          "149.28.137.173:7001",
          "149.40.62.82:3000",
          "159.93.36.174:8444",
          "159.93.36.84:8444",
          "195.154.173.4:3000",
          "23.106.253.209:1244",
          "35.188.212.32:3000",
          "35.219.62.75:3001",
          "45.61.169.99:3000",
          "45.76.154.181:3000",
          "52.187.130.188:3000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/80vul/status/1844345021627236578",
        "https://www.zoomeye.hk/searchResult?q=%22%3Ctitle%3ENode.js+upload+multiple+files%3C%2Ftitle%3E%22&page=1&pageSize=50"
      ],
      "total": 15
    },
    {
      "counts": {
        "ipv4": 6
      },
      "first_seen": "2024-10-10",
      "indicators": {
        "ipv4": [
          "185.235.241.208:1224",
          "23.106.253.215:1244",
          "23.106.253.221:1244",
          "23.106.253.242:1244",
          "23.106.70.154:1244",
          "45.137.213.30:1224"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/MichalKoczwara/status/1844302222911476079",
        "https://x.com/ishivtripathi/status/1844313316241645886"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 131
      },
      "first_seen": "2024-10-09",
      "indicators": {
        "domain": [
          "2daojnjnp666jla6.dropfile.online",
          "8190ocvswfyd57v5.docsend.online",
          "ade.dropfile.online",
          "admin.chrome-browser.cloud",
          "admin.docsend.online",
          "admin.docsend.site",
          "admin.dropfile.online",
          "analytic.dropfile.online",
          "api.chrome-browser.cloud",
          "api.docsend.site",
          "api.docsend.store",
          "api.dropfile.cloud",
          "api.dropfile.online",
          "app.docsend.site",
          "app.dropfile.cloud",
          "app.dropfile.online",
          "argoworkflow.chrome-browser.cloud",
          "asl.dropfile.online",
          "auth.dropfile.online",
          "authsmtp.dropfile.online",
          "ayr.dropfile.online",
          "bac.dropfile.online",
          "backed.docsend.site",
          "backend.chrome-browser.cloud",
          "backend.docsend.site",
          "backend.dropfile.cloud",
          "backend.dropfile.online",
          "blo.dropfile.online",
          "bon.dropfile.online",
          "bot.dropfile.online",
          "bqersape.dropfile.online",
          "chrome-browser.cloud",
          "coz.dropfile.online",
          "cro.dropfile.online",
          "dag.dropfile.online",
          "day.dropfile.online",
          "dc-aeea9bdbc87b.dropfile.online",
          "demo.chrome-browser.cloud",
          "demo.docsend.site",
          "demo.docsend.store",
          "demo.dropfile.online",
          "dev.chrome-browser.cloud",
          "dev.docsend.site",
          "dev.docsend.store",
          "dev.dropfile.online",
          "dip.dropfile.online",
          "drive.chrome-browser.cloud",
          "eli.dropfile.online",
          "elm.dropfile.online",
          "email.dropfile.online",
          "emv1.chrome-browser.cloud",
          "emv1.dropfile.cloud",
          "emv1.dropfile.online",
          "eon.dropfile.online",
          "exchange.dropfile.online",
          "flow.dropfile.online",
          "fob.dropfile.online",
          "fog.dropfile.online",
          "ftp.dropfile.online",
          "fw.docsend.online",
          "gen.dropfile.online",
          "iao.dropfile.online",
          "iba.dropfile.online",
          "ice.dropfile.online",
          "ich.dropfile.online",
          "imap.dropfile.online",
          "imap1.dropfile.online",
          "kuadyhfnejh.meeting-hub.online",
          "lad.dropfile.online",
          "lam.dropfile.online",
          "lei.dropfile.online",
          "liymgdc-aeea9bdbc87b.dropfile.online",
          "liz.dropfile.online",
          "llm.docsend.online",
          "login.docsend.online",
          "m.docsend.online",
          "m.dropfile.online",
          "mail.dropfile.online",
          "mail1.dropfile.online",
          "mail2.dropfile.online",
          "mailer.dropfile.online",
          "mailgate.dropfile.online",
          "mailgw.dropfile.online",
          "mailhost.dropfile.online",
          "mailin.dropfile.online",
          "mailout.dropfile.online",
          "mailserver.dropfile.online",
          "mailx.dropfile.online",
          "mx.dropfile.online",
          "mx2.dropfile.online",
          "ns.dropfile.online",
          "ns1.dropfile.online",
          "ns2.dropfile.online",
          "pop.dropfile.online",
          "pop3.dropfile.online",
          "post.dropfile.online",
          "postmaster.dropfile.online",
          "qeiukdemo.docsend.store",
          "relay.dropfile.online",
          "remote.dropfile.online",
          "secure.dropfile.online",
          "server.dropfile.online",
          "smtp.dropfile.online",
          "smtp1.dropfile.online",
          "smtp2.dropfile.online",
          "smtpauth.dropfile.online",
          "smtps.dropfile.online",
          "spam.dropfile.online",
          "staging.chrome-browser.cloud",
          "staging.docsend.site",
          "staging.docsend.store",
          "staging.dropfile.online",
          "support.docsend.site",
          "upport.docsend.site",
          "web-conference.xyz",
          "webmail.dropfile.online",
          "ww25.ann.dropfile.online",
          "ww25.dit.dropfile.online",
          "ww25.dropfile.online",
          "ww25.eli.dropfile.online",
          "ww25.lad.dropfile.online",
          "ww38.asl.dropfile.online",
          "ww38.bed.dropfile.online",
          "ww38.dropfile.online",
          "ww38.gen.dropfile.online",
          "ww38.lei.dropfile.online",
          "www1.docsend.online",
          "www1.dropfile.online",
          "www2.dropfile.online",
          "xyy.dropfile.online",
          "ygpsabacked.docsend.site"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/MichalKoczwara/status/1843725315664912877",
        "https://www.virustotal.com/gui/ip-address/104.168.165.203/relations"
      ],
      "total": 131
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2024-10-03",
      "indicators": {
        "ipv4": [
          "23.106.253.221:1224"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/P4nd3m1cb0y/status/1841829124404343223"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-09-24",
      "indicators": {
        "domain": [
          "daniel-ayala.netlify.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://cloud.google.com/blog/topics/threat-intelligence/mitigating-dprk-it-worker-threat"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2024-09-21",
      "indicators": {
        "domain": [
          "caladangroup.xyz",
          "meet.caladangroup.xyz",
          "meet.selinicapital.online",
          "meet.selinicapital.xyz",
          "meeting.sellinicapital.com",
          "selinicapital.online",
          "selinicapital.xyz",
          "sellinicapital.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/eastside_nci/status/1836605224020033548",
        "https://search.censys.io/hosts/45.61.128.122"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-09-19",
      "indicators": {
        "domain": [
          "rgedist.com",
          "talesseries.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://unit42.paloaltonetworks.com/gleaming-pisces-applejeus-poolrat-and-pondrat/",
        "https://www.virustotal.com/gui/file/f3b0da965a4050ab00fce727bb31e0f889a9c05d68d777a8068cfc15a71d3703/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 14
      },
      "first_seen": "2024-09-18",
      "indicators": {
        "domain": [
          "cicoinbase.com",
          "cobinase.com",
          "cobinbase.com",
          "coinbalse.com",
          "coinibrase.com",
          "coininbase.com",
          "eoinbase.com",
          "login.cicoinbase.com",
          "login.cobinase.com",
          "login.cobinbase.com",
          "login.coinbalse.com",
          "login.coinibrase.com",
          "login.coininbase.com",
          "mail.eoinbase.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?find=45.32.90.176&type=ip4&ref_id=d162d0bbffd#tab=resolutions"
      ],
      "total": 14
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2024-09-18",
      "indicators": {
        "domain": [
          "ceionbase.com",
          "cienbase.com",
          "login.ceionbase.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.elastic.co/security-labs/dprk-code-of-conduct",
        "https://app.validin.com/detail?find=92e6a5d3a7f7f2cf909fa50522b44b4d33719202db005383be611a2e68a3d5b3&type=hash&ref_id=77a108e8213#tab=host_pairs_v2",
        "https://www.virustotal.com/gui/file/6779f9b40beaf172950372303d89452358403189d236c5856d305ded2e82a15f/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 10
      },
      "first_seen": "2024-09-17",
      "indicators": {
        "domain": [
          "accounts.ceinbase.com",
          "akamaitechnologies.online",
          "ceinbase.com",
          "coinblase.com",
          "coinbrase.com",
          "links.ceinbase.com",
          "loading-coinbase.com",
          "login.ceinbase.com",
          "login.coinblase.com",
          "login.coinbrase.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.elastic.co/security-labs/dprk-code-of-conduct",
        "https://app.validin.com/detail?find=92e6a5d3a7f7f2cf909fa50522b44b4d33719202db005383be611a2e68a3d5b3&type=hash&ref_id=77a108e8213#tab=host_pairs_v2",
        "https://www.virustotal.com/gui/file/6779f9b40beaf172950372303d89452358403189d236c5856d305ded2e82a15f/detection"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 44
      },
      "first_seen": "2024-09-10",
      "indicators": {
        "domain": [
          "7xvc.meeting-central.online",
          "7xvc.meeting-zone.online",
          "abc.meeting-central.online",
          "abc.meeting-zone.online",
          "access.support.general-meet.site",
          "admin.alwayswelcome.online",
          "admin.general-meet.site",
          "admin.meeting-central.online",
          "admin.meeting-zone.online",
          "admin.support.general-meet.site",
          "affiliate.support.general-meet.site",
          "ann.support.general-meet.site",
          "api.alwayswelcome.online",
          "api.general-meet.site",
          "api.meeting-zone.online",
          "apollo.support.general-meet.site",
          "app.alwayswelcome.online",
          "app.meeting-zone.online",
          "backed.general-meet.site",
          "backend.alwayswelcome.online",
          "backend.meeting-zone.online",
          "demo.alwayswelcome.online",
          "dev.alwayswelcome.online",
          "dev.general-meet.site",
          "dev.meeting-zone.online",
          "emv1.alwayswelcome.online",
          "emv1.group-meet.online",
          "emv1.group-meet.site",
          "foundationcap.regular-meet.team",
          "longhash.general-meet.site",
          "longhash.video-meets.online",
          "mail1.fuchuangonline.com",
          "meeting-zone.online",
          "metaschool.video-meets.online",
          "ngc.regular-meet.site",
          "staging.alwayswelcome.online",
          "staging.meeting-zone.online",
          "support.general-meet.site",
          "support.meeting-zone.online",
          "support.regular-meet.online",
          "support.regular-meet.team",
          "support.video-meet.site",
          "support.video-meets.online",
          "video-meets.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/MichalKoczwara/status/1833241777374900497",
        "https://x.com/MichalKoczwara/status/1853481507848908950",
        "https://www.virustotal.com/gui/ip-address/104.168.165.165/relations"
      ],
      "total": 44
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 1,
        "url_path": 3
      },
      "first_seen": "2024-09-06",
      "indicators": {
        "domain": [
          "freeconference.io"
        ],
        "ipv4": [
          "23.106.253.194:1244"
        ],
        "url_path": [
          "/N3RFYU07",
          "/brow/N3RFYU07",
          "/payload/N3RFYU07"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.group-ib.com/blog/apt-lazarus-python-scripts/",
        "https://www.virustotal.com/gui/file/7165aa2157b7cb4e20a0ed68b26a2b9c6957ae370d6bcb58918efb47b595744f/detection",
        "https://www.virustotal.com/gui/file/1ef484513c027ccc747a88777559f96018e2b5cad830025911f0786e24d491f3/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2024-09-02",
      "indicators": {
        "domain": [
          "11stnft.click",
          "starbucks-greenapron.rest",
          "starbucks-greenaprons.cfd",
          "starbucks-newtech.bond",
          "starbucks-newtech.cfd",
          "starbucksgoodsnft.click",
          "starbucksgreenapron.bond",
          "starbucksnftservice.homes"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?find=45.86.230.189&type=ip4&ref_id=2dd37ed5db5#tab=resolutions"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2024-09-02",
      "indicators": {
        "domain": [
          "starbucks-goodsitem.cfd",
          "starbucks-greenapron.lol",
          "starbucks-greenapronnft.click",
          "starbucks-odyssey.shop",
          "starbucks-support.store",
          "starbucksnft-service.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?type=ip&find=194.59.183.241#tab=resolutions"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-08-31",
      "indicators": {
        "domain": [
          "voyagorclub.space",
          "weinsteinfrog.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/",
        "https://app.validin.com/detail?find=185.135.84.58&type=ip4&ref_id=5a6b4dd9f9e#tab=resolutions"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2024-08-30",
      "indicators": {
        "domain": [
          "ipcheck.cloud",
          "regioncheck.net",
          "repohost.online",
          "support-pishgam.site"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.phylum.io/north-korea-still-attacking-developers-via-npm/",
        "https://app.validin.com/detail?find=167.88.36.13&type=ip4&ref_id=545b0c93f1c#tab=resolutions",
        "https://app.validin.com/detail?type=ip&find=45.61.158.14#tab=resolutions"
      ],
      "total": 4
    },
    {
      "counts": {
        "ipv4": 2,
        "url": 1
      },
      "first_seen": "2024-08-22",
      "indicators": {
        "ipv4": [
          "45.140.147.208:53421",
          "45.140.147.208:53422"
        ],
        "url": [
          "http://45.140.147.208"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/Merlax_/status/1826417594766651777",
        "https://www.virustotal.com/gui/file/8a23dd86da0aff9b460b8ebc9dd3e891d44ea0183ace4f5d28a7e4ddab47664a/detection",
        "https://www.virustotal.com/gui/file/a87b6664b718a9985267f9670e10339372419b320aa3d3da350f9f71dff35dd1/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2024-08-22",
      "indicators": {
        "ipv4": [
          "185.235.241.208:1244"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1826432976894189825",
        "https://www.virustotal.com/gui/file/b8e69d6a766b9088d650e850a638d7ab7c9f59f4e24e2bc8eac41c380876b0d8/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2024-08-21",
      "indicators": {
        "domain": [
          "7xvc.virtual-collab.online",
          "cloud-storage.world",
          "dragonfly.virtual-collab.online",
          "meet.ryzelabs.net",
          "ryzelabs.net",
          "support.virtual-collab.online",
          "technical-support.virtual-collab.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/MichalKoczwara/status/1826162083332829323",
        "https://www.virustotal.com/gui/ip-address/104.168.165.173/relations"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2024-08-21",
      "indicators": {
        "domain": [
          "cloudstore.business",
          "team-meeting.net",
          "voov-meeting.site"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/KseProso/status/1788114018722595188",
        "https://twitter.com/ValidinLLC/status/1788128803698450591",
        "https://x.com/tayvano_/status/1848785112101691511",
        "https://www.virustotal.com/gui/ip-address/104.168.157.45/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2024-08-05",
      "indicators": {
        "domain": [
          "cestlaviewellnessretreat.com",
          "file.cestlaviewellnessretreat.com",
          "files.cestlaviewellnessretreat.com",
          "usconsultinghub.blog",
          "usconsultinghub.cloud"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/malwrhunterteam/status/1820385406002872541",
        "https://www.virustotal.com/gui/ip-address/82.197.80.64/relations",
        "https://www.virustotal.com/gui/file/456b3100d6e0364c036a33ca2d1c68f9e237520ab26da2b78d9dd55f1a2eec09/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2024-08-05",
      "indicators": {
        "ipv4": [
          "185.208.158.203:8080"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/malwrhunterteam/status/1820375076312604830",
        "https://www.virustotal.com/gui/file/1ab4af3bb2a343e9bc29e177aebe7d175a6b8af317ee3a8527271ed41148212e/detection",
        "https://www.virustotal.com/gui/file/3ac93cd715dc191464703b988ba1d72d4bd97836bcddea9a653232fd57facf00/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2024-08-05",
      "indicators": {
        "ipv4": [
          "185.208.158.203:5555"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/e90cedfce785b0f1ed30661914a0c169edf8ccb039cd722fec7fd5a85a3e99ad/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2,
        "ipv4": 3
      },
      "first_seen": "2024-08-01",
      "indicators": {
        "domain": [
          "de.ztec.store",
          "ztec.store"
        ],
        "ipv4": [
          "166.88.132.114:8000",
          "77.37.37.81:1244",
          "77.37.37.81:8000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/JangPr0/status/1818787100130787428",
        "https://www.securonix.com/blog/research-update-threat-actors-behind-the-devpopper-campaign-have-retooled-and-are-continuing-to-target-software-developers-via-social-engineering/"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-07-31",
      "indicators": {
        "domain": [
          "honehsn.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/h2jazi/status/1818715043800006982",
        "https://www.virustotal.com/gui/file/f7559f6d4346f412c2c4ea18363efba3075345b7533af9964298803ffe75f919/detection",
        "https://www.virustotal.com/gui/file/dd038040283793c67cd50252fb9ef20eb07e2f36d284f70cb2340e501dcb99d7/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 2,
        "url": 1
      },
      "first_seen": "2024-07-26",
      "indicators": {
        "ipv4": [
          "143.198.48.95:22",
          "143.198.48.95:443"
        ],
        "url": [
          "http://143.198.48.95"
        ]
      },
      "precision": "exact",
      "references": [
        "https://search.censys.io/search?q=services.http.response.html_tags%3D%22%3Ctitle%3ENode.js+upload+multiple+files%3C%2Ftitle%3E%22&resource=hosts"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3,
        "ipv4": 1
      },
      "first_seen": "2024-07-24",
      "indicators": {
        "domain": [
          "coupang-marketing.rest",
          "coupang-sales.rest",
          "starbucks-services.cyou"
        ],
        "ipv4": [
          "23.254.244.242:3000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/23.254.244.242/relations",
        "https://search.censys.io/search?q=services.http.response.headers%3A+%28key%3A+%60ETag%60+and+value.headers%3A+%60W%2F%22841-18e75d61ccb%22%60%29&resource=hosts"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-07-24",
      "indicators": {
        "domain": [
          "starbucksservice.homes",
          "yourstabrucks.monster"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/192.236.233.51/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-07-24",
      "indicators": {
        "domain": [
          "coca-cola.bond",
          "starbucks-corp.art"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/104.168.237.182/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-07-24",
      "indicators": {
        "domain": [
          "starbucksfirst.icu"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/192.119.81.146/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2024-07-23",
      "indicators": {
        "ipv4": [
          "67.203.7.163:1244"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/dimitribest/status/1815789250656301211",
        "https://search.censys.io/search?q=services.http.response.headers%3A+%28key%3A+%60ETag%60+and+value.headers%3A+%60W%2F%2286b-1886de13223%22%60%29&resource=hosts"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-07-20",
      "indicators": {
        "domain": [
          "files.hirog.io",
          "hirog.io"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/1ZRR4H/status/1814476691911090466",
        "https://www.virustotal.com/gui/ip-address/77.37.37.81/relations",
        "https://www.virustotal.com/gui/file/6156127355d8016c8e741de98ee4ef2a4cb5cb02cd44f22fd3c8fef033b69830/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-07-20",
      "indicators": {
        "domain": [
          "greenhouselc.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/500mk500/status/1814696344272986483",
        "https://www.virustotal.com/gui/ip-address/206.206.123.151/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 27
      },
      "first_seen": "2024-07-16",
      "indicators": {
        "domain": [
          "alwayswelcome.online",
          "docsend.online",
          "docsend.site",
          "docsend.store",
          "dropfile.cloud",
          "dropfile.online",
          "general-meet.online",
          "general-meet.site",
          "general-meet.team",
          "group-meet.online",
          "group-meet.site",
          "group-meet.team",
          "internal-meet.online",
          "internal-meet.team",
          "internal-meet.xyz",
          "live-meeting.world",
          "meeting-central.online",
          "meeting-hub.online",
          "meeting-pro.online",
          "online-meeting.community",
          "online-meeting.social",
          "regular-meet.online",
          "regular-meet.site",
          "regular-meet.team",
          "room-connect.online",
          "video-meet.site",
          "virtual-collab.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/MichalKoczwara/status/1812580245645766928",
        "https://www.validin.com/blog/hunting-lazarus-dns-history-host-responses/",
        "https://www.virustotal.com/gui/ip-address/104.168.157.45/relations"
      ],
      "total": 27
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-07-16",
      "indicators": {
        "domain": [
          "mirotalk.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/malwrhunterteam/status/1812792291876119034",
        "https://objective-see.org/blog/blog_0x7A.html",
        "https://www.virustotal.com/gui/file/9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 9
      },
      "first_seen": "2024-07-15",
      "indicators": {
        "domain": [
          "7xvc.roomconnect.online",
          "abc.roomconnect.online",
          "beta.preconnection.online",
          "http-qjhndbrw.roomconnect.online",
          "https-qjhndbrw.roomconnect.online",
          "meet-safe.online",
          "meetup-zone.online",
          "roomconnect.online",
          "xkbaaalpha.preconnection.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/MichalKoczwara/status/1812580245645766928",
        "https://www.validin.com/blog/hunting-lazarus-dns-history-host-responses/",
        "https://www.virustotal.com/gui/ip-address/104.168.157.45/relations"
      ],
      "total": 9
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2024-07-15",
      "indicators": {
        "ipv4": [
          "95.164.17.24:1224"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/malwrhunterteam/status/1812792291876119034",
        "https://objective-see.org/blog/blog_0x7A.html",
        "https://www.virustotal.com/gui/file/9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-06-14",
      "indicators": {
        "domain": [
          "cryptopriceoffer.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://checkmarx.com/blog/a-new-north-korean-group-emerges-disrupting-the-open-source-ecosystem/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2024-06-08",
      "indicators": {
        "domain": [
          "ld-digitaal.com",
          "long.waitingfor.cfd",
          "tiktoks.bio",
          "us13.yayachuhai.top",
          "yayachuhai.top"
        ]
      },
      "precision": "exact",
      "references": [
        "https://raw.githubusercontent.com/0xKoda/ioc-public/main/ioc.json"
      ],
      "total": 5
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2024-05-30",
      "indicators": {
        "ipv4": [
          "172.86.98.240:1224"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/dimitribest/status/1796191215626440908",
        "https://www.virustotal.com/gui/file/6a104f07ab6c5711b6bc8bf6ff956ab8cd597a388002a966e980c5ec9678b5b0/detection",
        "https://www.virustotal.com/gui/file/01611aa9fe649335a7d813fa1693b9421d8585155351f3a696e8bfdcf45440d3/detection",
        "https://www.virustotal.com/gui/file/70db987e2545cbc3e22bac0503f89f46a441cc9f206d0aa41d66b54f511638d6/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2024-05-28",
      "indicators": {
        "domain": [
          "bestonlinefilmstudio.org",
          "ccwaterfall.com",
          "defitankzone.com",
          "detankwar.com",
          "freenet-zhilly.org",
          "matrixane.com",
          "pointdnt.com",
          "starglowventures.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/banthisguy9349/status/1795545335164490137",
        "https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"
      ],
      "total": 8
    },
    {
      "counts": {
        "ipv4": 8
      },
      "first_seen": "2024-05-10",
      "indicators": {
        "ipv4": [
          "147.124.212.146:1244",
          "147.124.213.11:1244",
          "147.124.213.29:1244",
          "172.86.123.35:1244",
          "172.86.97.80:1224",
          "173.211.106.101:1245",
          "45.61.131.218:1245",
          "91.92.120.135:3000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://mp.weixin.qq.com/s/84lUaNSGo4lhQlpnCVUHfQ",
        "https://www.cert.si/tz016/"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2024-05-10",
      "indicators": {
        "domain": [
          "ngc.regular-meeting.site",
          "regular-meeting.site",
          "regular-meeting.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/MichalKoczwara/status/1788980517812994267",
        "https://app.validin.com/detail?type=ip&find=104.168.203.161"
      ],
      "total": 3
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2024-05-10",
      "indicators": {
        "ipv4": [
          "67.203.7.245:21"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/asdasd13asbz/status/1788848468947296398"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-05-10",
      "indicators": {
        "domain": [
          "regular-meeting.pro"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?find=regular-meeting.pro&type=dom#tab=resolutions"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-05-10",
      "indicators": {
        "domain": [
          "regular-meeting.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?find=regular-meeting.online&type=dom#tab=resolutions"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 20
      },
      "first_seen": "2024-05-08",
      "indicators": {
        "domain": [
          "abc.preconnection.online",
          "alpha.preconnection.online",
          "email.instant-patch.online",
          "emv1.group-meeting.pro",
          "emv1.preconnection.online",
          "emv1.private-meet.online",
          "group-meeting.pro",
          "hashkey.online-meet.team",
          "hashkey.online-meet.xyz",
          "instant-patch.online",
          "liwoeson.online-meet.team",
          "ok.preconnection.online",
          "online-meet.team",
          "online-meet.xyz",
          "online-meeting.co",
          "preconnection.online",
          "signum.group-meeting.pro",
          "support.group-meeting.pro",
          "support.online-meet.xyz",
          "waterdrip.group-meeting.pro"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/KseProso/status/1788114018722595188",
        "https://twitter.com/ValidinLLC/status/1788128803698450591",
        "https://x.com/tayvano_/status/1848785112101691511",
        "https://www.virustotal.com/gui/ip-address/104.168.157.45/relations"
      ],
      "total": 20
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2024-05-08",
      "indicators": {
        "domain": [
          "emv1.general-meeting.team",
          "fenbushi.general-meeting.team",
          "fenbushi.private-meet.team",
          "general-meeting.team",
          "ngc.private-meet.xyz",
          "private-meet.team",
          "private-meet.xyz",
          "support.general-meeting.team"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ValidinLLC/status/1788134423273034033",
        "https://www.virustotal.com/gui/ip-address/104.168.203.159/relations"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2024-05-07",
      "indicators": {
        "domain": [
          "fenbushi.regular-meeting.team",
          "letsmeetnow.site",
          "ngc.regular-meeting.team",
          "regular-meeting.team"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/MichalKoczwara/status/1787783113742885332"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-04-30",
      "indicators": {
        "domain": [
          "fenbushi.private-meet.online",
          "private-meet.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/MichalKoczwara/status/1785379113517154732"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 88
      },
      "first_seen": "2024-04-28",
      "indicators": {
        "domain": [
          "star-bucks.autos",
          "star-bucks.beauty",
          "star-bucks.boats",
          "star-bucks.bond",
          "star-bucks.cam",
          "star-bucks.cfd",
          "star-bucks.click",
          "star-bucks.com",
          "star-bucks.fun",
          "star-bucks.gay",
          "star-bucks.guru",
          "star-bucks.homes",
          "star-bucks.lol",
          "star-bucks.makeup",
          "star-bucks.mom",
          "star-bucks.motorcycles",
          "star-bucks.net",
          "star-bucks.pics",
          "star-bucks.quest",
          "star-bucks.rest",
          "star-bucks.sbs",
          "star-bucks.shop",
          "star-bucks.skin",
          "star-bucks.store",
          "star-bucks.tattoo",
          "star-bucks.today",
          "star-bucks.top",
          "star-bucks.xyz",
          "star-bucks.yachts",
          "starbuckscenter.autos",
          "starbuckscenter.beauty",
          "starbuckscenter.boats",
          "starbuckscenter.bond",
          "starbuckscenter.cam",
          "starbuckscenter.cfd",
          "starbuckscenter.click",
          "starbuckscenter.com",
          "starbuckscenter.fun",
          "starbuckscenter.gay",
          "starbuckscenter.guru",
          "starbuckscenter.homes",
          "starbuckscenter.life",
          "starbuckscenter.lol",
          "starbuckscenter.makeup",
          "starbuckscenter.mom",
          "starbuckscenter.motorcycles",
          "starbuckscenter.net",
          "starbuckscenter.pics",
          "starbuckscenter.quest",
          "starbuckscenter.rest",
          "starbuckscenter.sbs",
          "starbuckscenter.shop",
          "starbuckscenter.skin",
          "starbuckscenter.store",
          "starbuckscenter.tattoo",
          "starbuckscenter.today",
          "starbuckscenter.top",
          "starbuckscenter.xyz",
          "starbuckscenter.yachts",
          "starbucksevent.autos",
          "starbucksevent.beauty",
          "starbucksevent.boats",
          "starbucksevent.bond",
          "starbucksevent.cam",
          "starbucksevent.cfd",
          "starbucksevent.click",
          "starbucksevent.com",
          "starbucksevent.fun",
          "starbucksevent.gay",
          "starbucksevent.guru",
          "starbucksevent.homes",
          "starbucksevent.life",
          "starbucksevent.lol",
          "starbucksevent.makeup",
          "starbucksevent.mom",
          "starbucksevent.motorcycles",
          "starbucksevent.net",
          "starbucksevent.quest",
          "starbucksevent.rest",
          "starbucksevent.sbs",
          "starbucksevent.shop",
          "starbucksevent.skin",
          "starbucksevent.store",
          "starbucksevent.tattoo",
          "starbucksevent.today",
          "starbucksevent.top",
          "starbucksevent.xyz",
          "starbucksevent.yachts"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1784118099278741797"
      ],
      "total": 88
    },
    {
      "counts": {
        "ipv4": 5
      },
      "first_seen": "2024-04-24",
      "indicators": {
        "ipv4": [
          "147.124.212.89:1244",
          "147.124.214.129:1244",
          "147.124.214.131:1244",
          "67.203.7.171:1244",
          "67.203.7.245:1244"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/dimitribest/status/1782609281897902426",
        "https://twitter.com/Cyberteam008/status/1782983614701162993"
      ],
      "total": 5
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2024-04-23",
      "indicators": {
        "ipv4": [
          "147.124.214.237:1244"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/dimitribest/status/1782609281897902426",
        "https://twitter.com/Cyberteam008/status/1782983614701162993"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1,
        "url": 2
      },
      "first_seen": "2024-03-24",
      "indicators": {
        "ipv4": [
          "91.92.248.50:445"
        ],
        "url": [
          "http://91.92.248.50",
          "the.earth.li/~sgtatham/putty/0.80/w64/"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/1ZRR4H/status/1771912721031663841",
        "https://www.virustotal.com/gui/file/02d55193310ea19a4ce4c8a7f095c84b0511946d11a647e12758569292014882/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 4,
        "ipv4": 2
      },
      "first_seen": "2024-03-21",
      "indicators": {
        "domain": [
          "mssrv.kro.kr",
          "ourhome.o-r.kr",
          "panda.ourhome.o-r.kr",
          "privacy.hopto.org"
        ],
        "ipv4": [
          "84.38.129.21:2222",
          "84.38.129.21:5443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://asec.ahnlab.com/en/63192/"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-03-19",
      "indicators": {
        "domain": [
          "mingeloem.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/malwrhunterteam/status/1769840338745659896",
        "https://www.virustotal.com/gui/file/09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-03-02",
      "indicators": {
        "domain": [
          "jdkgradle.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/malwrhunterteam/status/1764037492812943550",
        "https://www.virustotal.com/gui/file/0b5db31e47b0dccfdec46e74c0e70c6a1684768dbacc9eacbb4fd2ef851994c7/detection",
        "https://www.virustotal.com/gui/file/bfd74b4a1b413fa785a49ca4a9c0594441a3e01983fc7f86125376fdbd4acf6b/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 2
      },
      "first_seen": "2024-02-15",
      "indicators": {
        "url": [
          "elshaik.com/wp-content/plugins/elementor/core/editor/editor-ui.php",
          "ssoc.cl/wp-content/plugins/webmention/libraries/emoji-detector/src/Detector.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/asdasd13asbz/status/1758054481957450034",
        "https://www.virustotal.com/gui/ip-address/35.167.150.110/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2024-02-14",
      "indicators": {
        "url": [
          "franksweeklycall.com/wp-includes/html-api/class-wp-html-user.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1757798585611997236",
        "https://www.virustotal.com/gui/file/b557fa6a92e1ecd768aa723258cb453beb6597c583dbe76d8e82ffdf392f5932/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2024-02-07",
      "indicators": {
        "domain": [
          "continue-meeting.site",
          "drive-access.site",
          "home-continue.online",
          "home-proceed.online",
          "join-room.meeting-online.site",
          "pannel-get-data.us",
          "ushrt.us"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1755176085610721337",
        "https://www.virustotal.com/gui/ip-address/217.20.117.39/relations"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-01-25",
      "indicators": {
        "domain": [
          "fasttet.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/malwrhunterteam/status/1750492037936222291",
        "https://twitter.com/greglesnewich/status/1750500025346445609",
        "https://www.virustotal.com/gui/file/e05142f8375070d1ea25ed3a31404ca37b4e1ac88c26832682d8d2f9f4f6d0ae/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2024-01-22",
      "indicators": {
        "url": [
          "http://173.249.5.112"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/karol_paciorek/status/1749376208477786172"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2,
        "ipv4": 2
      },
      "first_seen": "2024-01-04",
      "indicators": {
        "domain": [
          "commoncome.online",
          "web.commoncome.online"
        ],
        "ipv4": [
          "104.168.136.24:8080",
          "104.168.172.20:8080"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/k3yp0d/status/1709851707427975382",
        "https://twitter.com/greglesnewich/status/1742926817827422712",
        "https://g-les.github.io/yara/2024/01/04/100DaysofYARA-CosmicRust.html",
        "https://www.virustotal.com/gui/file/979ef0f43f25a6707fd98f6f0cb6e8452c24f41216ff53486781f487803d69c4/detection",
        "https://www.virustotal.com/gui/file/dbe48dc08216850e93082b4d27868a7ca51656d9e55366f2642fc5106e3af980/detection",
        "https://www.virustotal.com/gui/file/a8cc70bcd0ef98e3eea54f953166f518a2cf1d898e4eb9e85cf70861f8ec7578/detection",
        "https://www.virustotal.com/gui/file/5f4063e3a5583e62ddec2f84ca88eb97fbcfbee31d9269742ab438f441f0cd58/detection",
        "https://www.virustotal.com/gui/file/576d1688f744a9f6ae4c1fb4cec1cda3daecabf3a13cb3bafabf083c54d1fcb6/detection",
        "https://www.virustotal.com/gui/file/5115be816d0cd579915d079573bfa384d78ac0bd33cc845b7a83a488b0fc1b99/detection",
        "https://www.virustotal.com/gui/file/3315e5a4590e430550a4d85d0caf5f521d421a2966b23416fcfc275a5fd2629a/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2024-01-04",
      "indicators": {
        "domain": [
          "commoncome.site",
          "good.commoncome.site",
          "wideocean.run.place"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/23.254.129.6/relations",
        "https://app.validin.com/axon?source=DNS&type=ip&find=23.254.129.6"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3,
        "ipv4": 1,
        "url": 3
      },
      "first_seen": "2023-12-12",
      "indicators": {
        "domain": [
          "micrsofts.tech",
          "tech.micrsofts.com",
          "tech.micrsofts.tech"
        ],
        "ipv4": [
          "201.77.179.66:8082"
        ],
        "url": [
          "http://155.94.208.209",
          "http://185.29.8.53",
          "http://27.102.113.93"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.talosintelligence.com/lazarus_new_rats_dlang_and_telegram/",
        "https://www.virustotal.com/gui/file/000752074544950ae9020a35ccd77de277f1cd5026b4b9559279dc3b86965eee/detection",
        "https://www.virustotal.com/gui/file/0e416e3cc1673d8fc3e7b2469e491c005152b9328515ea9bbd7cf96f1d23a99f/detection",
        "https://www.virustotal.com/gui/file/e615ea30dd37644526060689544c1a1d263b6bb77fe3084aa7883669c1fde12f/detection",
        "https://www.virustotal.com/gui/file/9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a/detection",
        "https://www.virustotal.com/gui/file/534f5612954db99c86baa67ef51a3ad88bc21735bce7bb591afa8a4317c35433/detection",
        "https://www.virustotal.com/gui/file/ba8cd92cc059232203bcadee260ddbae273fc4c89b18424974955607476982c4/detection",
        "https://www.virustotal.com/gui/file/47e017b40d418374c0889e4d22aa48633b1d41b16b61b1f2897a39112a435d30/detection",
        "https://www.virustotal.com/gui/file/f91188d23b14526676706a5c9ead05c1a91ea0b9d6ac902623bc565e1c200a59/detection",
        "https://www.virustotal.com/gui/file/5b02fc3cfb5d74c09cab724b5b54c53a7c07e5766bffe5b1adf782c9e86a8541/detection",
        "https://www.virustotal.com/gui/file/82d4a0fef550af4f01a07041c16d851f262d859a3352475c62630e2c16a21def/detection"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2023-12-12",
      "indicators": {
        "domain": [
          "archax.team-meeting.xyz",
          "archax.videomeethub.online",
          "emv1.group-meeting.team",
          "emv1.team-meet.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://slowmist.medium.com/analysis-of-north-korean-hackers-targeted-phishing-scams-on-telegram-872db3f7392b",
        "https://otx.alienvault.com/pulse/65773dc2466c7161e66b3d07"
      ],
      "total": 4
    },
    {
      "counts": {
        "url_path": 5
      },
      "first_seen": "2023-12-09",
      "indicators": {
        "url_path": [
          "/Jy5S7hSx0K/",
          "/OJITWH2WFx/",
          "/Of56cYsfVV8/",
          "/Of56cYsfVV8/OJITWH2WFx/Jy5S7hSx0K/fP7saoiPBc/",
          "/fP7saoiPBc/"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/KseProso/status/2084984281785389166"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1,
        "url": 2
      },
      "first_seen": "2023-12-08",
      "indicators": {
        "domain": [
          "chaingrown.com"
        ],
        "url": [
          "http://103.179.142.171",
          "http://156.236.76.9"
        ]
      },
      "precision": "exact",
      "references": [
        "https://mp.weixin.qq.com/s/f5YE12w3x3wad5EO0EB53Q"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-12-08",
      "indicators": {
        "domain": [
          "manchestercity.work.gd",
          "myself.hopto.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://community.emergingthreats.net/t/ruleset-update-summary-2023-12-06-v10480/1183"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-12-08",
      "indicators": {
        "domain": [
          "wndlwndmfe.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1733020053426282778"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2023-12-05",
      "indicators": {
        "domain": [
          "additional.work.gd",
          "additionalpublic.work.gd",
          "arbor.companydetail.online",
          "companydetail.online",
          "cryptofundsresearch.com",
          "doc-send.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/104.168.214.151/relations"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2023-12-05",
      "indicators": {
        "domain": [
          "dropbx-doc.online",
          "previewaccess-doc.online",
          "thefifodoc.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1675803174551314432",
        "https://www.elastic.co/cn/security-labs/DPRK-strikes-using-a-new-variant-of-rustbucket",
        "https://www.virustotal.com/gui/ip-address/64.44.141.15/relations",
        "https://www.virustotal.com/gui/ip-address/91.195.240.123/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2023-12-04",
      "indicators": {
        "domain": [
          "archax.meetingverse.app",
          "archax.team-meeting.pro",
          "hashkey.team-meeting.pro",
          "lrakkiqr.team-meeting.pro",
          "mail.privymeet.com",
          "team-meet.xyz",
          "team-meeting.pro",
          "technical-support.safe-meeting.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1731600500259524993"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2023-12-01",
      "indicators": {
        "domain": [
          "einei.line.pm",
          "onelao.line.pm",
          "tiena.einei.line.pm"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1730114476786229304"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 76
      },
      "first_seen": "2023-11-29",
      "indicators": {
        "domain": [
          "archax.privymeet.com",
          "archax.skyboxdrive.cloud",
          "archax.trustmeeting.live",
          "bitfinex.internal-meeting.online",
          "bitfinex.video-meet.online",
          "cryptowave.internal-meeting.online",
          "cryptowave.video-meet.online",
          "d1.skyboxdrive.cloud",
          "drop.skyboxdrive.cloud",
          "dun.auditprovidre.online",
          "email.alwayswait.online",
          "emv1.meetingverse.app",
          "emv1.ubi-safemeeting.live",
          "gumi-cryptos.group-meeting.online",
          "gumi-cryptos.group-meeting.team",
          "gumi-cryptos.team-meet.online",
          "gumi-cryptos.team-meeting.xyz",
          "gumi-cryptos.video-meet.team",
          "hashkey.group-meeting.online",
          "hashkey.group-meeting.team",
          "hashkey.internal-meeting.online",
          "hashkey.online-meeting.team",
          "hashkey.team-meet.online",
          "hashkey.team-meeting.xyz",
          "hashkey.video-meet.online",
          "hashkey.video-meet.team",
          "hashkey.video-meeting.team",
          "help.group-meeting.online",
          "help.team-meet.online",
          "help.video-meet.team",
          "help.video-meeting.team",
          "hwsrv-1093408.hostwindsdns.com",
          "ihsgpnsj.meetingverse.app",
          "kkvps.buzz",
          "kraken.group-meeting.online",
          "kraken.group-meeting.team",
          "kraken.team-meet.online",
          "kraken.video-meeting.team",
          "meet.cryptowave.capital",
          "meetcentralhub.online",
          "meetingverse.app",
          "mta-sts.meetingverse.app",
          "mta-sts.ubi-safemeeting.live",
          "okx.internal-meeting.online",
          "okx.video-meet.online",
          "okx.video-meeting.team",
          "ryze.privymeet.com",
          "skyboxdrive.cloud",
          "support.cryptowave.capital",
          "support.group-meeting.online",
          "support.group-meeting.team",
          "support.internal-meeting.online",
          "support.meetcentralhub.online",
          "support.privymeet.com",
          "support.safe-meeting.online",
          "support.skyboxdrive.cloud",
          "support.syncmeet.online",
          "support.team-meet.online",
          "support.team-meeting.xyz",
          "support.trustmeeting.live",
          "support.ubi-safemeeting.online",
          "support.video-meet.online",
          "support.video-meet.team",
          "support.video-meet.xyz",
          "support.video-meeting.team",
          "technical-support.group-meeting.team",
          "technical-support.internal-meeting.online",
          "technical-support.team-meet.online",
          "technical-support.video-meet.online",
          "troubleshoot.group-meeting.team",
          "troubleshoot.internal-meeting.online",
          "troubleshoot.team-meeting.xyz",
          "ubisoft.group-meeting.online",
          "ubisoft.internal-meeting.online",
          "ubisoft.safe-meeting.online",
          "ubisoft.trustmeeting.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1729754195903844484",
        "https://www.virustotal.com/gui/ip-address/104.168.137.21/relations"
      ],
      "total": 76
    },
    {
      "counts": {
        "domain": 2,
        "ipv4": 1
      },
      "first_seen": "2023-11-29",
      "indicators": {
        "domain": [
          "autoupdate.xyz",
          "botsc.autoupdate.xyz"
        ],
        "ipv4": [
          "104.168.151.34:8080"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/60674602836323647634016774ea123232160c1b4dfcf3fcd2d2c28c652aa00e/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-11-29",
      "indicators": {
        "domain": [
          "audiocheck.store",
          "dun.audiocheck.store"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1729754195903844484",
        "https://www.virustotal.com/gui/ip-address/104.168.137.21/relations",
        "https://www.virustotal.com/gui/file/60674602836323647634016774ea123232160c1b4dfcf3fcd2d2c28c652aa00e/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2023-11-28",
      "indicators": {
        "domain": [
          "france24.live",
          "meeting-online.site",
          "online-processing.online",
          "ovcloud.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1729392929612218731"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-11-28",
      "indicators": {
        "domain": [
          "video-meeting.team"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1721811568814624831",
        "https://app.validin.com/axon?find=62.133.61.204&type=ip",
        "https://twitter.com/tiresearch1/status/1729754195903844484",
        "https://www.virustotal.com/gui/ip-address/104.168.137.21/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2,
        "ipv4": 5
      },
      "first_seen": "2023-11-25",
      "indicators": {
        "domain": [
          "primez.online",
          "song.th"
        ],
        "ipv4": [
          "109.248.150.147:8585",
          "185.29.8.108:8585",
          "27.102.118.204:6099",
          "27.102.128.152:8098",
          "84.38.132.67:9479"
        ]
      },
      "precision": "exact",
      "references": [
        "https://asec.ahnlab.com/en/59073/",
        "https://otx.alienvault.com/pulse/655e254bda9c2bd236bc188f"
      ],
      "total": 7
    },
    {
      "counts": {
        "url": 2
      },
      "first_seen": "2023-11-25",
      "indicators": {
        "url": [
          "mantis.jancom.pl/bluemantis/image/addon/addin.php",
          "zeduzeventos.busqueabuse.com/wpadmin/js/widgets/sub/wids.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/",
        "https://www.microsoft.com/en-us/security/blog/2023/11/22/diamond-sleet-supply-chain-compromise-distributes-a-modified-cyberlink-installer/",
        "https://otx.alienvault.com/pulse/65534130052d1800f62e7ba2",
        "https://otx.alienvault.com/pulse/655f0ab585a20bff0cac8b7c"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-11-25",
      "indicators": {
        "domain": [
          "blocktestingto.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/",
        "https://otx.alienvault.com/pulse/655dd802326b4dba522c9d84"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-11-24",
      "indicators": {
        "domain": [
          "group-meeting.online",
          "group-meeting.team"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1727956853794250850",
        "https://twitter.com/tiresearch1/status/1729754195903844484",
        "https://www.virustotal.com/gui/ip-address/104.168.137.21/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-11-24",
      "indicators": {
        "domain": [
          "privymeet.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1727306536522043677",
        "https://twitter.com/tiresearch1/status/1729754195903844484",
        "https://www.virustotal.com/gui/ip-address/104.168.137.21/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2023-11-16",
      "indicators": {
        "domain": [
          "bitscrunch.myvnc.com",
          "blackleopard.myvnc.com",
          "naverk.myvnc.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1725052270910538103",
        "https://www.virustotal.com/gui/ip-address/216.107.136.10/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "url": 8
      },
      "first_seen": "2023-11-15",
      "indicators": {
        "url": [
          "aeon-petro.com/wcms/plugins/addition_contents/cfg.png",
          "aeon-petro.com/wcms/plugins/addition_contents/user64.png",
          "bandarpowder.com/public/assets/img/cfg.png",
          "bandarpowder.com/public/assets/img/user64.png",
          "commune-fraita.ma/wp-content/plugins/wp-contact/contact.php",
          "mge.sn/themes/classic/modules/ps_rssfeed/feed.zip",
          "mge.sn/themes/classic/modules/ps_rssfeed/feedmd.zip",
          "vadtalmandir.org/admin/ckeditor/plugins/icontact/about.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/",
        "https://www.microsoft.com/en-us/security/blog/2023/11/22/diamond-sleet-supply-chain-compromise-distributes-a-modified-cyberlink-installer/",
        "https://otx.alienvault.com/pulse/65534130052d1800f62e7ba2",
        "https://otx.alienvault.com/pulse/655f0ab585a20bff0cac8b7c"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-11-10",
      "indicators": {
        "domain": [
          "syncmeet.online",
          "team-meeting.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1722534103751540999",
        "https://twitter.com/tiresearch1/status/1729754195903844484",
        "https://www.virustotal.com/gui/ip-address/104.168.137.21/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "url_path": 3
      },
      "first_seen": "2023-11-08",
      "indicators": {
        "url_path": [
          "/asdfghjkl",
          "/qwertyuiop",
          "/qwertyuiop/asdfghjkl"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/KseProso/status/2084984281785389166"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2023-11-07",
      "indicators": {
        "domain": [
          "online-meeting.team",
          "safemeeting.online",
          "team-meet.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1721811568814624831",
        "https://app.validin.com/axon?find=62.133.61.204&type=ip",
        "https://twitter.com/tiresearch1/status/1729754195903844484",
        "https://www.virustotal.com/gui/ip-address/104.168.137.21/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-11-07",
      "indicators": {
        "domain": [
          "videomeethub.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1721811568814624831",
        "https://app.validin.com/axon?find=62.133.61.204&type=ip"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2023-11-02",
      "indicators": {
        "domain": [
          "cloud.doc-shared.linkpc.net",
          "doc-shared.linkpc.net",
          "dubai.network.cloud.doc-shared.linkpc.net",
          "group.evalaskatours.com",
          "internal.bounceme.net",
          "mclearoptical.com",
          "network.cloud.doc-shared.linkpc.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1719979579170009130"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-11-01",
      "indicators": {
        "domain": [
          "coupang-networks.pics",
          "ronaldo-nftprojects.shop"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/192.236.194.152/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 12
      },
      "first_seen": "2023-10-31",
      "indicators": {
        "domain": [
          "bitscrunch.ddns.net",
          "bitscrunch.serveirc.com",
          "bitscrunch.tech.linkpc.net",
          "bitscrunch.zapto.org",
          "bitscrunchtech.linkpc.net",
          "document.shared-link.line.pm",
          "indaddy.xyz",
          "internalpdfviewer.ddns.net",
          "nor-health.xyz",
          "shared-link.line.pm",
          "tech.linkpc.net",
          "voldemort.myvnc.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://community.emergingthreats.net/t/ruleset-update-summary-2023-10-30-v10452/1080"
      ],
      "total": 12
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-10-31",
      "indicators": {
        "domain": [
          "pdf.cisco-webex.online",
          "support.cisco-webex.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1718902558922834192",
        "https://twitter.com/tiresearch1/status/1729754195903844484",
        "https://www.virustotal.com/gui/ip-address/104.168.137.21/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-10-31",
      "indicators": {
        "domain": [
          "cisco-webex.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1718902558922834192"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 38
      },
      "first_seen": "2023-10-28",
      "indicators": {
        "url": [
          "admin.esangedu.kr/XPaySample/submit.php",
          "api.shw.kr/login_admin/member/login_fail.php",
          "blastedlevels.com/levels4SqR8/measure.asp",
          "droof.kr/Board/htmlEdit/PopupWin/Editor.asp",
          "friendmc.com/upload/board/asp20062107.asp",
          "hankooktop.com/ko/company/info.asp",
          "hanlasangjo.com/editor/pages/page.asp",
          "happinesscc.com/mobile/include/func.asp",
          "healthpro.or.kr/upload/naver_editor/subview/view.inc",
          "hicar.kalo.kr/data/rental/Coupon/include/inc.asp",
          "hspje.com/menu6/teacher_qna.asp",
          "ictm.or.kr/UPLOAD_file/board/free/edit/index.php",
          "khmcpharm.com/Lib/Modules/HtmlEditor/Util/read.cer",
          "kscmfs.or.kr/member/handle/log_proc.php",
          "kstr.radiology.or.kr/upload/schedule/29431_1687715624.inc",
          "little-pet.com/web/board/skin/default/read.php",
          "mainbiz.or.kr/SmartEditor2/photo_uploader/popup/edit.asp",
          "mainbiz.or.kr/include/common.asp",
          "medric.or.kr/Controls/Board/certificate.cer",
          "muijae.com/daumeditor/pages/template/",
          "muijae.com/daumeditor/pages/template/simple.asp",
          "muijae.com/daumeditor/pages/template/template.asp",
          "new-q-cells.com/upload/newsletter/cn/frame.php",
          "nonstopexpress.com/community/include/index.asp",
          "pediatrics.or.kr/PubReader/build_css.php",
          "pms.nninc.co.kr/app/content/board/inc_list.asp",
          "safemotors.co.kr/daumeditor/pages/template/template.asp",
          "samwoosystem.co.kr/board/list/write.asp",
          "seoulanesthesia.or.kr/mail/mail_211230.html",
          "seouldementia.or.kr/_manage/inc/bbs/jiyeuk1_ok.asp",
          "siriuskorea.co.kr/mall/community/bbs_read.asp",
          "swt-keystonevalve.com/data/editor/index.php",
          "theorigin.co.kr:443/admin/management/index.php",
          "ucware.net/skins/PHPMailer-master/index.php",
          "vietjetairkorea.com/INFO/info.asp",
          "vnfmal2022.com/niabbs5/upload/gongji/index.php",
          "warevalley.com/en/common/include/page_tab.asp",
          "yoohannet.kr/min/tmp/process/proc.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/unveiling-lazarus-new-campaign/110888/",
        "https://otx.alienvault.com/pulse/653c0681ae38ba0d7d84e538"
      ],
      "total": 38
    },
    {
      "counts": {
        "url_path": 9
      },
      "first_seen": "2023-10-28",
      "indicators": {
        "url_path": [
          "/_manage/inc/bbs/jiyeuk1_ok.asp",
          "/daumeditor/pages/template/",
          "/daumeditor/pages/template/simple.asp",
          "/daumeditor/pages/template/template.asp",
          "/inc/bbs/jiyeuk1_ok.asp",
          "/levels4SqR8/measure.asp",
          "/mall/community/bbs_read.asp",
          "/niabbs5/upload/gongji/",
          "/niabbs5/upload/gongji/index.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/KseProso/status/2084984281785389166"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2023-10-27",
      "indicators": {
        "domain": [
          "bitscrunch.pd.linkpc.net",
          "bitscrunch.presentations.life",
          "col-link.linkpc.net",
          "docshared.col-link.linkpc.net",
          "pd.linkpc.net",
          "presentations.life"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1717922111749288043"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2023-10-26",
      "indicators": {
        "domain": [
          "co.intneral-document-he-gr-me.run.place",
          "group.link-net.publicvm.com",
          "internal.group.link-net.publicvm.com",
          "intneral-document-he-gr-me.run.place",
          "j-ic.co.intneral-document-he-gr-me.run.place",
          "link-net.publicvm.com",
          "on-global.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1717554754023526564",
        "https://twitter.com/KSeznec/status/1717542794942660771",
        "https://www.virustotal.com/gui/file/47b8b4d55d75505d617e53afcb6c32dd817024be209116f98cbbc3d88e57b4d1/detection"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2023-10-26",
      "indicators": {
        "domain": [
          "bitscrunch.co",
          "bitscrunch.deck.linkpc.net",
          "bitscrunch.im.linkpc.net",
          "deck.linkpc.net",
          "doc.global-link.run.place",
          "global-link.run.place"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1717496437985128862"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-10-20",
      "indicators": {
        "domain": [
          "coingecko.bond"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/malwrhunterteam/status/1715075131175751740",
        "https://www.virustotal.com/gui/ip-address/68.170.2.240/relations",
        "https://www.virustotal.com/gui/file/5e523ba395d7b92001d14d0d0e607410af9acb61d724a4a7651c3d80a79fb532/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2023-10-18",
      "indicators": {
        "domain": [
          "beeztrend.com",
          "icimp.swarkul.com",
          "mbafleet.com",
          "prajeshpatel.com",
          "zawajonly.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/updated-mata-attacks-industrial-companies-in-eastern-europe/110829/",
        "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/18092216/Updated-MATA-attacks-Eastern-Europe_full-report_ENG.pdf"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 12
      },
      "first_seen": "2023-10-17",
      "indicators": {
        "domain": [
          "book.tomming.us",
          "cloud.bdcc.bio",
          "enimvzud.mouradvps8hostwin.online",
          "floriventuresend.linkpc.net",
          "forservercon.run.place",
          "jobintro.linkpc.net",
          "mouradvps8hostwin.online",
          "protectli.online",
          "web3.auditprovidre.store",
          "xjba.linkpc.net",
          "xjbb.linkpc.net",
          "xjbd.linkpc.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1713828674750017852",
        "https://twitter.com/tiresearch1/status/1714149818753507596"
      ],
      "total": 12
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2023-10-17",
      "indicators": {
        "domain": [
          "crtypk.run.place",
          "cryptykhost.work.gd",
          "share.prosec.ink",
          "singlelink.work.gd"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1714283158588600641"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 14
      },
      "first_seen": "2023-10-13",
      "indicators": {
        "domain": [
          "15248636.site",
          "activity-179384736.site",
          "activity-permission.online",
          "allow-permission.online",
          "book-download.shop",
          "chat-services.online",
          "files-archive.online",
          "mail-roundcube.site",
          "online-meeting.site",
          "online-video-services.site",
          "share-meeting.online",
          "un-call.services",
          "videocallservice.live",
          "webmailaccount.cloud"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1712839519366795733"
      ],
      "total": 14
    },
    {
      "counts": {
        "domain": 11
      },
      "first_seen": "2023-10-11",
      "indicators": {
        "domain": [
          "azure.docs-protection.cloud",
          "azure.docs-protection.online",
          "azure.docs-protection.top",
          "docs-protection.cloud",
          "docs-protection.online",
          "docs-protection.top",
          "docs.smbc-vc.com",
          "meeting.work.gd",
          "orangecake.work.gd",
          "transactions.publicvm.com",
          "updatecheck.publicvm.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1712004829978190112"
      ],
      "total": 11
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2023-10-11",
      "indicators": {
        "url": [
          "chiark.greenend.org.uk/~sgtatham/putty/"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/malwrhunterteam/status/1710379117869150506",
        "https://twitter.com/h2jazi/status/1712115378933977444",
        "https://www.virustotal.com/gui/file/f59035192098e44b86c4648a0de4078edbe80352260276f4755d15d354f5fc58/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-10-10",
      "indicators": {
        "domain": [
          "blockchain-newtech.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/asdasd13asbz/status/1711617213944492293",
        "https://www.virustotal.com/gui/ip-address/103.179.142.171/relations",
        "https://www.virustotal.com/gui/file/f59035192098e44b86c4648a0de4078edbe80352260276f4755d15d354f5fc58/detection",
        "https://www.virustotal.com/gui/file/00433ebf3b21c1c055d4ab8a599d3e84f03b328496236b54e56042cef2146b1c/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 9
      },
      "first_seen": "2023-10-05",
      "indicators": {
        "domain": [
          "automatic.antifirmware.store",
          "autoserverupdate.line.pm",
          "huanying.remoteproweb.cfd",
          "real.unbelievableresult.store",
          "stress.antiviruscheck.site",
          "successfulconnection.linkpc.net",
          "sys.antiviruscheck.store",
          "sys.updatecheck.site",
          "web.auditprovidre.site"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1709900227241758810"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-10-05",
      "indicators": {
        "domain": [
          "welcome.newcoming.cfd"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/k3yp0d/status/1709851707427975382",
        "https://twitter.com/greglesnewich/status/1742926817827422712",
        "https://g-les.github.io/yara/2024/01/04/100DaysofYARA-CosmicRust.html",
        "https://www.virustotal.com/gui/file/979ef0f43f25a6707fd98f6f0cb6e8452c24f41216ff53486781f487803d69c4/detection",
        "https://www.virustotal.com/gui/file/dbe48dc08216850e93082b4d27868a7ca51656d9e55366f2642fc5106e3af980/detection",
        "https://www.virustotal.com/gui/file/a8cc70bcd0ef98e3eea54f953166f518a2cf1d898e4eb9e85cf70861f8ec7578/detection",
        "https://www.virustotal.com/gui/file/5f4063e3a5583e62ddec2f84ca88eb97fbcfbee31d9269742ab438f441f0cd58/detection",
        "https://www.virustotal.com/gui/file/576d1688f744a9f6ae4c1fb4cec1cda3daecabf3a13cb3bafabf083c54d1fcb6/detection",
        "https://www.virustotal.com/gui/file/5115be816d0cd579915d079573bfa384d78ac0bd33cc845b7a83a488b0fc1b99/detection",
        "https://www.virustotal.com/gui/file/3315e5a4590e430550a4d85d0caf5f521d421a2966b23416fcfc275a5fd2629a/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2023-10-01",
      "indicators": {
        "domain": [
          "starbocks.shop",
          "starbuck-coffee.cfd",
          "starbuckex.beauty",
          "starbucls.top"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1708539447908958382"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-10-01",
      "indicators": {
        "domain": [
          "kingstar.publicvm.com",
          "sabrpartner.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/64.44.141.13/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2023-09-30",
      "indicators": {
        "domain": [
          "bitscrunch.linkpc.net",
          "bitscrunch.publicvm.com",
          "bitscrunnch.linkpc.net",
          "bitscrunnch.run.place",
          "coupang-network.pics",
          "exodus.linkpc.net",
          "jobdescription.linkpc.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1708141542261809360"
      ],
      "total": 7
    },
    {
      "counts": {
        "url": 7
      },
      "first_seen": "2023-09-29",
      "indicators": {
        "url": [
          "barsaji.com.mx/src/recaptcha/index.php",
          "bug.restoroad.com/admin/view_status.php",
          "kapata-arkeologi.kemdikbud.go.id/pages/payment/payment.php",
          "kerstpakketten.horesca-meppel.nl/wp-content/plugins/woocommerce/lib.php",
          "kittimasszazs.hu/images/virag.php",
          "nrfm.lk/wp-includes/simplepie/content.php",
          "radiographers.org/aboutus/aboutus.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.welivesecurity.com/en/eset-research/lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company/"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2023-09-25",
      "indicators": {
        "domain": [
          "datasend.linkpc.net",
          "docsenddata.linkpc.net",
          "docsendinfo.linkpc.net",
          "open-sc.xyz",
          "opensend.linkpc.net",
          "opensend.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1706312971054412039"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-09-25",
      "indicators": {
        "domain": [
          "video-meet.team"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1706312971054412039",
        "https://twitter.com/tiresearch1/status/1729754195903844484",
        "https://www.virustotal.com/gui/ip-address/104.168.137.21/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2023-09-22",
      "indicators": {
        "url": [
          "http://91.206.178.125"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/asdasd13asbz/status/1705140120222105777"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1,
        "url_path": 1
      },
      "first_seen": "2023-09-15",
      "indicators": {
        "domain": [
          "brianrep.com"
        ],
        "url_path": [
          "/dnquery.phpinteger"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1702726275012382747",
        "https://www.virustotal.com/gui/file/c83c7b000a955f2b8cb92bb112ed606ffd9fbebbe3422f80d90d06b167f2f37b/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 17
      },
      "first_seen": "2023-09-11",
      "indicators": {
        "domain": [
          "alwayswait.site",
          "antifirmware.online",
          "antifirmware.site",
          "antifirmware.store",
          "antiviruscheck.site",
          "antiviruscheck.store",
          "auditprovidre.site",
          "auditprovidre.store",
          "newcoming.cfd",
          "remoteproweb.cfd",
          "systemupdate.site",
          "systemupdate.store",
          "unbelievableresult.site",
          "unbelievableresult.store",
          "updatecheck.site",
          "updatecheck.store",
          "waitingfor.cfd"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1701155845608964391"
      ],
      "total": 17
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-09-11",
      "indicators": {
        "domain": [
          "alwayswait.online",
          "auditprovidre.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1701155845608964391",
        "https://twitter.com/tiresearch1/status/1729754195903844484",
        "https://www.virustotal.com/gui/ip-address/104.168.137.21/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2023-09-07",
      "indicators": {
        "domain": [
          "hashkey.online-meeting.xyz",
          "recent.bico-news.blog",
          "support.private-meeting.online",
          "support.video-meeting.online",
          "support.video-meeting.xyz",
          "video-meeting.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/104.168.214.151/relations"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2023-09-07",
      "indicators": {
        "domain": [
          "bitsvertise.com",
          "blgbeach.com",
          "dbgsymbol.com",
          "ecordillos.com",
          "ismartrium.com",
          "rapisigns.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1700047882441908674",
        "https://twitter.com/felixaime/status/1699865970041348506",
        "https://blog.google/threat-analysis-group/active-north-korean-campaign-targeting-security-researchers/",
        "https://otx.alienvault.com/pulse/64fa0325f88b5109856801c8"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2023-09-07",
      "indicators": {
        "domain": [
          "meet.ubi-safemeeting.online",
          "support.trustmeeting.online",
          "support.ubi-safemeeting.live",
          "video-meet.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/104.168.214.151/relations",
        "https://twitter.com/tiresearch1/status/1729754195903844484",
        "https://www.virustotal.com/gui/ip-address/104.168.137.21/relations"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2023-09-06",
      "indicators": {
        "domain": [
          "cryptowave.capital",
          "internal-meeting.online",
          "video-meet.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1729754195903844484",
        "https://www.virustotal.com/gui/ip-address/104.168.137.21/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2023-09-03",
      "indicators": {
        "domain": [
          "bbs.topigsnorsvin.com.ec",
          "chinesekungfu.org",
          "ipservice.kro.kr",
          "privatemake.bounceme.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://asec.ahnlab.com/en/56405/",
        "https://otx.alienvault.com/pulse/64f0a87de1d155ccb31c3561"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-09-02",
      "indicators": {
        "domain": [
          "tableditermanaging.pro"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.reversinglabs.com/blog/vmconnect-supply-chain-campaign-continues",
        "https://www.virustotal.com/gui/ip-address/45.61.136.133/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2023-08-28",
      "indicators": {
        "domain": [
          "safe-meeting.online",
          "trustmeeting.live",
          "ubi-safemeeting.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1696067977463087376",
        "https://twitter.com/tiresearch1/status/1729754195903844484",
        "https://www.virustotal.com/gui/ip-address/104.168.137.21/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2023-08-26",
      "indicators": {
        "domain": [
          "online-meeting.pro",
          "private-meeting.xyz",
          "video-meeting.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1695342915281965409"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-08-26",
      "indicators": {
        "domain": [
          "trustmeeting.online",
          "ubi-safemeeting.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/tiresearch1/status/1695342915281965409",
        "https://twitter.com/tiresearch1/status/1729754195903844484",
        "https://www.virustotal.com/gui/ip-address/104.168.137.21/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2023-08-25",
      "indicators": {
        "domain": [
          "ajileuowl.dliklone.online",
          "dliklone.online",
          "huweisge.dliklone.online",
          "magmow.sourljsourhs.cfd",
          "sourljsourhs.cfd",
          "tales.dliklone.online",
          "tonses.dliklone.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/fr0s7_/status/1695001873604903348",
        "https://twitter.com/fr0s7_/status/1695012385705148748",
        "https://twitter.com/fr0s7_/status/1695012576600498679",
        "https://www.virustotal.com/gui/ip-address/144.202.17.28/relations",
        "https://www.virustotal.com/gui/ip-address/45.63.1.46/relations",
        "https://www.virustotal.com/gui/ip-address/66.42.86.109/detection",
        "https://www.virustotal.com/gui/file/8e271b07ad050b648321af5aa98ae9f9057342a6c4d3de40ee07a4fbec1ef2b9/detection",
        "https://www.virustotal.com/gui/file/7c2721b4beedcff6f8d7af585516af86287a9bab703e8050e97365aa9fd849cb/detection"
      ],
      "total": 7
    },
    {
      "counts": {
        "url": 2
      },
      "first_seen": "2023-08-24",
      "indicators": {
        "url": [
          "ec2-15-207-207-64.ap-south-1.compute.amazonaws.com/resource/main/rawmail.php",
          "http://146.4.21.94"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.talosintelligence.com/lazarus-collectionrat/",
        "https://www.virustotal.com/gui/file/ed8ec7a8dd089019cfd29143f008fa0951c56a35d73b2e1b274315152d0c0ee6/detection (# QietRAT)",
        "https://www.virustotal.com/gui/file/db6a9934570fa98a93a979e7e0e218e0c9710e5a787b18c6948f2eedd9338984/detection (# CollectionRAT)",
        "https://www.virustotal.com/gui/file/773760fd71d52457ba53a314f15dddb1a74e8b2f5a90e5e150dea48a21aa76df/detection (# CollectionRAT)",
        "https://www.virustotal.com/gui/file/e3027062e602c5d1812c039739e2f93fc78341a67b77692567a4690935123abe/detection (# Trojanized Plink)"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2023-08-24",
      "indicators": {
        "url": [
          "rowdensurname.org/slideshow/slides/show.asp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://mp.weixin.qq.com/s?__biz=MzUyMjk4NzExMA%3D%3D&mid=2247492789&idx=1&sn=a991e6c5ed7388515d75f02e9c33428f",
        "https://otx.alienvault.com/pulse/64a2f58febf38755c4240c34"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 8
      },
      "first_seen": "2023-08-20",
      "indicators": {
        "url": [
          "bcdm.or.kr/board/type3_D/edit.asp",
          "coupontreezero.com/include/bottom.asp",
          "daehang.com/member/logout.asp",
          "gongsilbox.com/board/bbs.asp",
          "hmedical.co.kr/include/edit.php",
          "ksmarathon.com/admin/excel2.asp",
          "materic.or.kr/files/board/equip/equip_ok.asp",
          "sinae.or.kr/sub01/index.asp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://asec.ahnlab.com/en/54195/",
        "https://otx.alienvault.com/pulse/6490761db8416aad20dd9404"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 24
      },
      "first_seen": "2023-08-09",
      "indicators": {
        "domain": [
          "asset.crypto-ecosystem.world",
          "bico-news.blog",
          "bico.tokentracking.info",
          "blockchainworld.info",
          "box-docsend.cloud",
          "box-docsend.online",
          "cnbc.crypto-ecosystem.world",
          "crypto-ecosystem.world",
          "crypto.blockchainworld.info",
          "docs-send.online",
          "docs.panteracapital.ventures",
          "docsend-host.cloud",
          "draper.online-meeting.xyz",
          "dropbox-docsend.cloud",
          "dropbox-docsend.online",
          "interview.private-meeting.online",
          "online-meeting.xyz",
          "panteracapital.ventures",
          "private-meeting.online",
          "shared.box-docsend.cloud",
          "shared.box-docsend.online",
          "shared.dropbox-docsend.cloud",
          "swissborg.blog",
          "tokentracking.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/104.168.214.151/relations"
      ],
      "total": 24
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-08-09",
      "indicators": {
        "domain": [
          "shared.dropbox-docsend.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/104.168.214.151/relations",
        "https://twitter.com/tiresearch1/status/1729754195903844484",
        "https://www.virustotal.com/gui/ip-address/104.168.137.21/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2023-07-20",
      "indicators": {
        "url": [
          "jkmusic.co.kr/shop/data/theme/"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1681426768597778440",
        "https://twitter.com/ShadowChasing1/status/1681947062471098368",
        "https://www.virustotal.com/gui/file/6f11c52f01e5696b1ac0faf6c19b0b439ba6f48f1f9851e34f0fa582b09dfa48/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2023-07-19",
      "indicators": {
        "domain": [
          "checkdevinc.com",
          "git-hub.me",
          "pkginstall.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blogs.jpcert.or.jp/en/2023/07/dangerouspassword_dev.html"
      ],
      "total": 3
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2023-07-19",
      "indicators": {
        "url": [
          "notebooksell.kr/mall/m_schema.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1681426768597778440",
        "https://twitter.com/ShadowChasing1/status/1681947062471098368",
        "https://www.virustotal.com/gui/file/6f11c52f01e5696b1ac0faf6c19b0b439ba6f48f1f9851e34f0fa582b09dfa48/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 20
      },
      "first_seen": "2023-07-03",
      "indicators": {
        "domain": [
          "blackleopard.world",
          "docsend.apple.linkpc.net",
          "docsend.apple.work.gd",
          "docsend.camdvr.org",
          "docsend.theworkpc.com",
          "floriventures.linkpc.net",
          "floriventures.publicvm.com",
          "floriventuresfund.com",
          "forest.groundwolf.sbs",
          "groundwolf.sbs",
          "info.floriventuresfund.com",
          "info.racondog.shop",
          "lightkingstar.com",
          "net.lightkingstar.com",
          "nomanstone.shop",
          "origin.blackleopard.world",
          "racondog.shop",
          "starbocks.yachts",
          "xyz.nomanstone.shop",
          "xyz.racondog.shop"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/64.44.141.13/relations"
      ],
      "total": 20
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2023-07-03",
      "indicators": {
        "domain": [
          "amazoncojp.one",
          "crypto.hondchain.com",
          "docsend.linkpc.net",
          "docsend.publicvm.com",
          "hondchain.com",
          "jaicvc.com",
          "starbucls.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1675803174551314432",
        "https://www.elastic.co/cn/security-labs/DPRK-strikes-using-a-new-variant-of-rustbucket",
        "https://www.virustotal.com/gui/ip-address/64.44.141.15/relations",
        "https://www.virustotal.com/gui/ip-address/91.195.240.123/relations"
      ],
      "total": 7
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2023-05-19",
      "indicators": {
        "ipv4": [
          "109.248.150.13:443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.talosintelligence.com/lazarus-collectionrat/",
        "https://www.virustotal.com/gui/file/ed8ec7a8dd089019cfd29143f008fa0951c56a35d73b2e1b274315152d0c0ee6/detection (# QietRAT)",
        "https://www.virustotal.com/gui/file/db6a9934570fa98a93a979e7e0e218e0c9710e5a787b18c6948f2eedd9338984/detection (# CollectionRAT)",
        "https://www.virustotal.com/gui/file/773760fd71d52457ba53a314f15dddb1a74e8b2f5a90e5e150dea48a21aa76df/detection (# CollectionRAT)",
        "https://www.virustotal.com/gui/file/e3027062e602c5d1812c039739e2f93fc78341a67b77692567a4690935123abe/detection (# Trojanized Plink)"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 6
      },
      "first_seen": "2023-05-17",
      "indicators": {
        "url": [
          "eflow.co.kr/member_image/about.php",
          "http://3.89.226.234",
          "http://40.121.90.194",
          "projectcell.niv.co.in/non_scientific/service.php",
          "sora.bz/xoops_root_path/templates_c/login.php",
          "sora.bz/xoops_root_path/uploads/information/about.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://medium.com/@DCSO_CyTec/andariels-jupiter-malware-and-the-case-of-the-curious-c2-dbfe29f57499"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 35
      },
      "first_seen": "2023-05-10",
      "indicators": {
        "domain": [
          "abs.twitter.expublic.linkpc.net",
          "azure-defender.cloud",
          "azuredefender.online",
          "blockfi.loans",
          "boa.azuredefender.online",
          "boa.job-description.online",
          "boa.jobdescription.online",
          "coinbase.expublic.linkpc.net",
          "daiwa.azure-defender.cloud",
          "defi.smart-contracts.blog",
          "doc-send.cloud",
          "doc-send.com",
          "docs-send.com",
          "drop-box.cloud",
          "dynamic.expublic.linkpc.net",
          "exceptions.coinbase.expublic.linkpc.net",
          "exceptions.expublic.linkpc.net",
          "expublic.linkpc.net",
          "github.expublic.linkpc.net",
          "google.coinbase.expublic.linkpc.net",
          "gumi-cryptos.loan",
          "hwsrv-1033810.hostwindsdns.com",
          "internal-server.nextera.capital",
          "internal.daiwa.ventures",
          "internal.usncet.org",
          "job-description.online",
          "jobdescription.online",
          "nextera.capital",
          "onedrive.azure-defender.cloud",
          "privatenetwork.online",
          "shared.doc-send.cloud",
          "shared.drop-box.cloud",
          "smart-contracts.blog",
          "usncet.org",
          "verifydocument.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/104.168.214.151/relations"
      ],
      "total": 35
    },
    {
      "counts": {
        "domain": 15
      },
      "first_seen": "2023-05-10",
      "indicators": {
        "domain": [
          "cloud.cryptyk.info",
          "coto.live",
          "cryptyk.cloud",
          "cryptyk.ddns.net",
          "cryptyk.hopto.org",
          "cryptyk.info",
          "cryptyk.sytes.net",
          "cryptyk.webredirect.org",
          "document.coto.live",
          "document.sharedrive.ink",
          "docusend.coto.live",
          "gumicryptos.com",
          "hostings.webredirect.org",
          "hyperchaincapital.online",
          "parallaxdigital.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ESETresearch/status/1656385173968019456",
        "https://twitter.com/ESETresearch/status/1656386549594857472",
        "https://www.virustotal.com/gui/ip-address/104.168.138.7/relations",
        "https://www.virustotal.com/gui/file/c28e4031129f3e6e5c6fbd7b1cebd8dd21b6f87a8564b0fb9ee741a9b8bc0197/detection",
        "https://www.virustotal.com/gui/file/5f00106f7f15e0ca00df4dbb0eeccd57930b4b81bc9aa3fca0c5af4eda339ab7/detection"
      ],
      "total": 15
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-05-04",
      "indicators": {
        "domain": [
          "share.googlefiledrive.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/souiten/status/1653999722477268992",
        "https://www.virustotal.com/gui/file/69ef7c4cb3849283c03eaa593b02ebbfd1d08d25ef9a58355d2a9909678d6c6d/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-04-03",
      "indicators": {
        "domain": [
          "wirexpro.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.malwarebytes.com/blog/news/2022/12/lazarus-group-uses-fake-cryptocurrency-apps-to-plant-applejeus-malware"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-03-09",
      "indicators": {
        "domain": [
          "cloud.daiwa.ventures",
          "daiwa.ventures"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/104.168.214.151/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2023-03-05",
      "indicators": {
        "domain": [
          "ctmnews.kr",
          "dalbinews.co.kr",
          "kfcjn.com",
          "lightingmart.co.kr",
          "studyholic.co.kr"
        ]
      },
      "precision": "exact",
      "references": [
        "https://asec.ahnlab.com/ko/48416/",
        "https://otx.alienvault.com/pulse/63ff76797371033cf70b2df3"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-02-09",
      "indicators": {
        "domain": [
          "autoprotect.com.se"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ESETresearch/status/1656385173968019456",
        "https://twitter.com/ESETresearch/status/1656386549594857472",
        "https://www.virustotal.com/gui/ip-address/104.168.138.7/relations",
        "https://www.virustotal.com/gui/file/c28e4031129f3e6e5c6fbd7b1cebd8dd21b6f87a8564b0fb9ee741a9b8bc0197/detection",
        "https://www.virustotal.com/gui/file/5f00106f7f15e0ca00df4dbb0eeccd57930b4b81bc9aa3fca0c5af4eda339ab7/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-02-08",
      "indicators": {
        "domain": [
          "doc-share.cloud",
          "safe.doc-share.cloud"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/jaydinbas/status/1623295609703636993",
        "https://www.virustotal.com/gui/file/3a4aed5b9ad0827696a1bb5f3497a6a2aa26b453d27bfacbe3c8c47673aac98d/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2023-01-26",
      "indicators": {
        "domain": [
          "blurbshop.com",
          "cloudfly.org",
          "dailynewsagent.com",
          "oneweb-host.com",
          "shopwebstudio.com",
          "turacodi.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1618630926891913217"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-01-25",
      "indicators": {
        "domain": [
          "globiscapital.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/dazhengzhang/status/1899776299725680975",
        "https://x.com/tayvano_/status/1899896814536712334",
        "https://www.virustotal.com/gui/ip-address/5.230.252.157/relations",
        "https://app.validin.com/detail?find=528ab116aa10f63a5156ed906744fcc9&type=hash#tab=host_pairs (# 2025-03-24)",
        "https://app.validin.com/detail?find=Zoom%20Meeting&type=raw&ref_id=af1604aa97f#tab=host_pairs"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-01-25",
      "indicators": {
        "domain": [
          "autoprotect.gb.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/104.168.214.151/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 1
      },
      "first_seen": "2023-01-17",
      "indicators": {
        "domain": [
          "filesspace.xyz"
        ],
        "ipv4": [
          "11.23.33.44:8050"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/500ae0f1ab40a254f81c73331c9848bada4c26adad613d53d339d14ca3599a32/detection",
        "https://www.virustotal.com/gui/file/442c2b7b8e7ec13306bfb6c1332bd87e4d9cac242fd86555df355a606b895c46/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 3
      },
      "first_seen": "2023-01-13",
      "indicators": {
        "url": [
          "easyview.kr/board/mb_admin.php",
          "mudeungsan.or.kr/gbbs/bbs/template/g_botton.php",
          "neohr.co.kr/bbs/data/notice/notice.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1613893230004965381",
        "https://www.virustotal.com/gui/file/9dc04153455d054d7e04d46bcd8c13dd1ca16ab2995e518ba9bf33b43008d592/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 27
      },
      "first_seen": "2023-01-04",
      "indicators": {
        "domain": [
          "auto-protection.cloud",
          "auto-protection.services",
          "auto-secure.cloud",
          "azure-protect.cloud",
          "azure-protection.online",
          "azure.auto-protection.cloud",
          "azure.auto-protection.services",
          "azure.auto-secure.cloud",
          "azure.doc-protection.cloud",
          "azure.doc-protection.online",
          "azure.docs-view.cloud",
          "azure.online-protection.cloud",
          "azure.protection-service.cloud",
          "beyondnextventures.us",
          "cloud.beyondnextventures.us",
          "cloud.mizuhogroup.uk",
          "cloud.smbcgroup.uk",
          "doc-protection.cloud",
          "docs-view.cloud",
          "docs.tptf.cloud",
          "mizuhogroup.uk",
          "online-protection.cloud",
          "protection-service.cloud",
          "secure.azure-protect.cloud",
          "secure.azure-protection.online",
          "smbcgroup.uk",
          "tptf.cloud"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1610535596262580230",
        "https://www.virustotal.com/gui/ip-address/172.86.121.130/relations",
        "https://www.virustotal.com/gui/ip-address/45.153.242.37/relations",
        "https://www.virustotal.com/gui/file/e04848c1e2908335975dd52793c94624d06a598fdd75d5d3eb6ea8c5d569b8bc/detection"
      ],
      "total": 27
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-12-30",
      "indicators": {
        "domain": [
          "offerings.cloud",
          "tptf.ltd"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1610535596262580230",
        "https://www.virustotal.com/gui/ip-address/172.86.121.130/relations",
        "https://www.virustotal.com/gui/ip-address/45.153.242.37/relations",
        "https://www.virustotal.com/gui/file/e04848c1e2908335975dd52793c94624d06a598fdd75d5d3eb6ea8c5d569b8bc/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-12-28",
      "indicators": {
        "domain": [
          "professiondesc.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/jaydinbas/status/1608077663532449792",
        "https://www.virustotal.com/gui/file/c52028b494c37505cbe073e3b0fcdeb6b7b48636c6fd00a41108e6dc1a66a4ce/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2022-12-20",
      "indicators": {
        "domain": [
          "cloud.prosec.ink",
          "cloudprotect.us.org",
          "prosec.ink"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ESETresearch/status/1656385173968019456",
        "https://twitter.com/ESETresearch/status/1656386549594857472",
        "https://www.virustotal.com/gui/ip-address/104.168.138.7/relations",
        "https://www.virustotal.com/gui/file/c28e4031129f3e6e5c6fbd7b1cebd8dd21b6f87a8564b0fb9ee741a9b8bc0197/detection",
        "https://www.virustotal.com/gui/file/5f00106f7f15e0ca00df4dbb0eeccd57930b4b81bc9aa3fca0c5af4eda339ab7/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-12-12",
      "indicators": {
        "domain": [
          "microshare.cloud",
          "one.microshare.cloud"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1602302208325947394",
        "https://www.virustotal.com/gui/file/69e5cc9d865301f7e8dd7d4dbf5624db2859c614112d339b2fc07ea6176c776d/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-12-12",
      "indicators": {
        "domain": [
          "thecloudnet.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1602314597926576131",
        "https://twitter.com/h2jazi/status/1602314600753598465",
        "https://www.virustotal.com/gui/file/bdd109cba8346548dd6fe5110180aa23eb9f5805c90733025344a5881c15c985/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2022-12-03",
      "indicators": {
        "domain": [
          "bloxholder.com",
          "oilycargo.com",
          "rebelthumb.net",
          "strainservice.com",
          "telloo.io"
        ]
      },
      "precision": "exact",
      "references": [
        "https://community.emergingthreats.net/t/ruleset-update-summary-2022-12-02-v10187/190"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-12-02",
      "indicators": {
        "domain": [
          "key.sharedrive.ink"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/jaydinbas/status/1598660262751604738",
        "https://www.virustotal.com/gui/file/f14c5bad5219b1ed5166eb02f5ff08a890a181cef2af565f3fe7bcea9c870e22/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-12-01",
      "indicators": {
        "domain": [
          "dsx-app.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/malwrhunterteam/status/1598405604317442048",
        "https://twitter.com/jaydinbas/status/1598722899556577280",
        "https://www.virustotal.com/gui/file/741be5e53a5dc7cebaa63d6ff624c5eff1a0e1817ede1e7fc0473a28b1ed7a33/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 6
      },
      "first_seen": "2022-11-25",
      "indicators": {
        "url": [
          "cats.runtimerec.com/db/dbconn.php",
          "elite4print.com/support/support.asp",
          "hurricanepub.com/include/include.php",
          "olidhealth.com/wp-includes/php-compat/compat.php",
          "recruitment.raystechserv.com/lib/artichow/BarPlotDashboard.object.php",
          "turnscor.com/wp-includes/contacts.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://explore.avertium.com/resource/an-in-depth-look-at-north-korean-threat-actor-zinc",
        "https://otx.alienvault.com/pulse/637f670d45a399f00e8aea3c"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-11-19",
      "indicators": {
        "domain": [
          "dmarc.onlineshares.cloud",
          "gdocshare.one"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/StopMalvertisin/status/1575055809104334848",
        "https://twitter.com/ScarletSharkSec/status/1575130042627244038",
        "https://twitter.com/malwrhunterteam/status/1593744606172168195",
        "https://www.virustotal.com/gui/ip-address/155.138.159.45/relations",
        "https://www.virustotal.com/gui/file/99eae95f3271fe7cd2b25aca9a2b69ca8f5cc034f3416b554a4af38903f14233/detection",
        "https://www.virustotal.com/gui/file/8f05021071c4bfd4cfce3d02bd30bf16f1322170515d796e13f75eb25b09d533/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-11-18",
      "indicators": {
        "domain": [
          "capmarketreport.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/souiten/status/1593449165349978113",
        "https://www.virustotal.com/gui/file/0937cbb980cb898eacd8458366fc4de3510266b8fbcd68010aa04e58bf72df28/detection",
        "https://www.virustotal.com/gui/file/a3f087c83453cde2bc845122c05ebeb60e8891e395b45823c192869ec1b72ea6/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-11-16",
      "indicators": {
        "domain": [
          "purplebear.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1377610488830291973",
        "https://twitter.com/ShadowChasing1/status/1377628563000594433",
        "https://securelist.com/dtrack-targeting-europe-latin-america/107798/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-11-11",
      "indicators": {
        "domain": [
          "dc-ba6f51b553e0.olidhealth.com",
          "olidhealth.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1590966132596695040"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2022-11-06",
      "indicators": {
        "url": [
          "leadsblue.com/wp-content/wp-utility/index.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/imp0rtp3/status/1589263364274155520",
        "https://twitter.com/imp0rtp3/status/1589263367650578434",
        "https://www.virustotal.com/gui/file/06ea41ee563f0ecb884d0640344a1e0006a9e8b1b3d4cda9a769a896f18c4b6d/detection",
        "https://www.virustotal.com/gui/file/e1ecf0f7bd90553baaa83dcdc177e1d2b20d6ee5520f5d9b44cdf59389432b10/detection",
        "https://www.virustotal.com/gui/file/dc20873b80f5cd3cf221ad5738f411323198fb83a608a8232504fd2567b14031/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2,
        "ipv4": 1
      },
      "first_seen": "2022-10-21",
      "indicators": {
        "domain": [
          "drivetools.xyz",
          "theboxart.xyz"
        ],
        "ipv4": [
          "66.85.157.67:8050"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/500ae0f1ab40a254f81c73331c9848bada4c26adad613d53d339d14ca3599a32/detection",
        "https://www.virustotal.com/gui/file/442c2b7b8e7ec13306bfb6c1332bd87e4d9cac242fd86555df355a606b895c46/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-10-20",
      "indicators": {
        "domain": [
          "bloombergnewsagency.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1582919568384663552"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-10-19",
      "indicators": {
        "domain": [
          "bbcnewsagency.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1582809597051826177",
        "https://twitter.com/h2jazi/status/1582809599023124481",
        "https://www.virustotal.com/gui/file/c114b73da17eb5c8aff5a7b5509ffe26b9770e28c7123f038e98d42f8a065632/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-10-12",
      "indicators": {
        "domain": [
          "propertys-shop.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1580021488433831936"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 4
      },
      "first_seen": "2022-10-06",
      "indicators": {
        "url": [
          "aquaprographix.com/patterns/Map/maps.php",
          "stracarrara.org/images/img.asp",
          "thetalkingcanvas.com/thetalking/globalcareers/us/5/careers/jobinfo.php",
          "turnscor.com/wp-includes/feedback.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.welivesecurity.com/2022/09/30/amazon-themed-campaigns-lazarus-netherlands-belgium/",
        "https://otx.alienvault.com/pulse/633c7f2703c1f6dec01555e5"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2022-09-30",
      "indicators": {
        "domain": [
          "contradecapital.com",
          "m.contradecapital.com",
          "market.contradecapital.com",
          "stage.contradecapital.com",
          "vpn.contradecapital.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.sentinelone.com/blog/lazarus-operation-interception-targets-macos-users-dreaming-of-jobs-in-crypto/",
        "https://otx.alienvault.com/pulse/6336cd77cbc019c475aa2034"
      ],
      "total": 5
    },
    {
      "counts": {
        "ipv4": 4
      },
      "first_seen": "2022-09-29",
      "indicators": {
        "ipv4": [
          "137.184.15.189:22",
          "172.93.201.253:22",
          "44.238.74.84:22",
          "44.238.74.84:5900"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.microsoft.com/security/blog/2022/09/29/zinc-weaponizing-open-source-software/"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2022-09-28",
      "indicators": {
        "domain": [
          "docuprivacy.com",
          "ms.msteam.biz",
          "msteam.biz",
          "onlinecloud.cloud",
          "open.onlinecloud.cloud",
          "privacysign.org",
          "team.msteam.biz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/StopMalvertisin/status/1575055809104334848",
        "https://twitter.com/ScarletSharkSec/status/1575130042627244038",
        "https://twitter.com/malwrhunterteam/status/1593744606172168195",
        "https://www.virustotal.com/gui/ip-address/155.138.159.45/relations",
        "https://www.virustotal.com/gui/file/99eae95f3271fe7cd2b25aca9a2b69ca8f5cc034f3416b554a4af38903f14233/detection",
        "https://www.virustotal.com/gui/file/8f05021071c4bfd4cfce3d02bd30bf16f1322170515d796e13f75eb25b09d533/detection"
      ],
      "total": 7
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2022-09-27",
      "indicators": {
        "url": [
          "sunlin.org/info/style?title="
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/StopMalvertisin/status/1574749887203143680",
        "https://www.virustotal.com/gui/file/f00fe4e6da3aaad25d1ac8b268ffeebc98bda184e3df224905626908be24d415/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-09-26",
      "indicators": {
        "domain": [
          "digiboxes.us",
          "fs.digiboxes.us"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/StopMalvertisin/status/1574329188793733120",
        "https://www.virustotal.com/gui/file/3b70c3ebffcfd6a97859f8d9e5a31f6902756e23fd6688ca7c7446d24ec76d9d/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2022-09-23",
      "indicators": {
        "domain": [
          "azure-protection.cloud",
          "docs.azure-protection.cloud",
          "secure.azure-protection.cloud"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/malwrhunterteam/status/1573305740252663809",
        "https://www.virustotal.com/gui/file/48bd1c5cf9ccc3d454ab80d7284abaf39028a228607d132bfa92ab2ceca47ca2/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-09-21",
      "indicators": {
        "domain": [
          "ms.onlineshares.cloud",
          "onlineshares.cloud"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/HaoZhixiang/status/1572434427942432772",
        "https://www.virustotal.com/gui/file/0b79e1194644431c2e28c48aa3654e658a2907e1003cd0484cd00a0796ebe6bb/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2022-09-16",
      "indicators": {
        "domain": [
          "cloud.jbic.us",
          "cloud.mufg.tokyo",
          "jbic.us",
          "mufg.tokyo",
          "salt1ending.com",
          "wpic.ink"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/BaoshengbinCumt/status/1570579732399558656"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-09-15",
      "indicators": {
        "domain": [
          "azure-protect.online",
          "verify.azure-protect.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1570501870954905600",
        "https://www.virustotal.com/gui/file/5816eb32cbaadfc3477c823293a8c49cdf690b443c8fa3c19f98399c143df2b3/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-09-12",
      "indicators": {
        "domain": [
          "techdesignshop.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1569331099305918465"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 2,
        "url": 5,
        "url_path": 1
      },
      "first_seen": "2022-09-07",
      "indicators": {
        "domain": [
          "gendoraduragonkgp126.com"
        ],
        "ipv4": [
          "151.106.2.139:8080",
          "151.106.2.139:8443"
        ],
        "url": [
          "http://151.106.2.139",
          "http://193.56.28.251",
          "http://52.202.193.124",
          "http://64.188.27.73",
          "http://66.154.102.91"
        ],
        "url_path": [
          "/adm_bord/login_new_check.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.talosintelligence.com/2022/09/lazarus-magicrat.html",
        "https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/102811/",
        "https://www.virustotal.com/gui/file/f6827dc5af661fbb4bf64bc625c78283ef836c6985bb2bfb836bd0c8d5397332/detection",
        "https://www.virustotal.com/gui/file/f78cabf7a0e7ed3ef2d1c976c1486281f56a6503354b87219b466f2f7a0b65c4/detection",
        "https://www.virustotal.com/gui/file/eb73c57c6f4ce8bf197ddc689b7e0afd3703a9bf9a78212c9cb838528441df7a/detection",
        "https://www.virustotal.com/gui/file/bffe910904efd1f69544daa9b72f2a70fb29f73c51070bde4ea563de862ce4b1/detection",
        "https://www.virustotal.com/gui/file/afb2d4d88f59e528f0e388705113ae54b7b97db4f03a35ae43cc386a48f263a0/detection",
        "https://www.virustotal.com/gui/file/196fb1b6eff4e7a049cea323459cfd6c0e3900d8d69e1d80bffbaabd24c06eba/detection"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-09-01",
      "indicators": {
        "domain": [
          "app.stablehouses.info",
          "stablehouses.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/f42c637db03edf83a08e944bc190265167ecea84d77508f37fc1269d267fe5a8/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2022-08-31",
      "indicators": {
        "domain": [
          "edit.wpsonline.co",
          "wps.wpsonline.co",
          "wpsonline.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1564980900785373185",
        "https://www.virustotal.com/gui/file/51d53ca36a662b4aad5878987548f0f22f2a53545790577d8043373b6bf7eb75/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-08-20",
      "indicators": {
        "domain": [
          "docs.drivegoogle.info",
          "drivegoogle.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/45.76.77.197/relations",
        "https://www.virustotal.com/gui/file/0f6b6c1596e38e840fb03420317db224739a18dbef0b98285637f5887e90a191/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2022-08-19",
      "indicators": {
        "domain": [
          "cooporatestock.com",
          "doc.cooporatestock.com",
          "docs.cooporatestock.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/malwrhunterteam/status/1560563222624710656",
        "https://www.virustotal.com/gui/file/c9b4893bdb85d67c13826814ef0cf392648089f416aed40078907054624fba72/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2022-08-17",
      "indicators": {
        "domain": [
          "1drvmicrosoft.com",
          "hare.1drvmicrosoft.com",
          "share.1drvmicrosoft.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1559259261665943553",
        "https://www.virustotal.com/gui/file/03f6c8f173413302d9c22a44a593fc9a5203fbb7652d3a36b3ace79f3cdc39a3/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-08-17",
      "indicators": {
        "domain": [
          "concrecapital.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ESETresearch/status/1559553324998955010",
        "https://www.virustotal.com/gui/file/49046dfeaefc59747e45e013f3ab5a2895b4245cfaa218dd2863d86451104506/detection",
        "https://www.virustotal.com/gui/file/8b427c47a43e6c357d8439fefa7f0ff34b72a2abdaf0461193fb9e6086807e17/detection",
        "https://www.virustotal.com/gui/file/94a669041ef572e3fb089179f5c29e2811e2e82613290e39a2ce1b6c273727c9/detection",
        "https://www.virustotal.com/gui/file/dae9f37ae5c2a030c0fb3f55d5731cdb37a4f68560a6f2ba38bb54c9533f8805/detection",
        "https://www.virustotal.com/gui/file/e29d0db8c013e7eb5820a6f40aae92a085d9550f2f0b2ebc10c8c2c08d14f6d5/detection",
        "https://www.virustotal.com/gui/file/fe336a032b564eef07afb2f8a478b0e0a37d9a1a6c4c1e7cd01e404cc5dd2853/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2022-08-10",
      "indicators": {
        "url": [
          "http://145.232.235.222"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/andariel-deploys-dtrack-and-maui-ransomware/107063/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3,
        "url_path": 1
      },
      "first_seen": "2022-08-09",
      "indicators": {
        "domain": [
          "doc.documentshare.info",
          "documentshare.info",
          "ww16.documentshare.info"
        ],
        "url_path": [
          "/DmJMFYpwLPP3ygS/"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1557034048345997312",
        "https://www.virustotal.com/gui/file/57959c2be2ac6349aa37edb73cd8a88fe8d3e69678cac4b38fac401bd3141fdf/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2022-08-09",
      "indicators": {
        "domain": [
          "cdn.wordonline.cloud",
          "gdoc.wordonline.cloud",
          "wordonline.cloud"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/malwrhunterteam/status/1557077792075829249",
        "https://www.virustotal.com/gui/file/f1ade73b9c61f2f4b774a1b5003a5d70d7a12e0872abe98c52fbf9e9e3a90fc5/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-08-05",
      "indicators": {
        "domain": [
          "docs.mktrending.com",
          "mktrending.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1555205042331947011",
        "https://www.virustotal.com/gui/file/a3ef9fd758bca1c94054a43995a99069abaef672495c1bd3ee831217c1f5e498/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2022-07-31",
      "indicators": {
        "url": [
          "http://52.79.92.249/bbs/bbs_post.asp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1546403794871001093"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2022-07-30",
      "indicators": {
        "domain": [
          "dps.shconstmarket.com",
          "inst.shconstmarket.com",
          "shconstmarket.com",
          "web.shconstmarket.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1553024107989635073",
        "https://www.virustotal.com/gui/file/0fe69e67286203ca2dcd080b4c25ab76fc4ca925e6207b193d47f02da1481843/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-07-22",
      "indicators": {
        "domain": [
          "googlesheet.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/cyberoverdrive/status/1550175620927299584",
        "https://www.virustotal.com/gui/file/1e154b2976cc00d457c0dc2b83ebe81911294c8276691617085c03a3304fd87f/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2022-07-20",
      "indicators": {
        "domain": [
          "cdn.documentworkspace.io",
          "documentworkspace.io",
          "fclouddown.co",
          "file.fclouddown.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1549780561551675393",
        "https://www.virustotal.com/gui/ip-address/155.138.219.140/relations",
        "https://www.virustotal.com/gui/file/f7170b70a89f4b5d196e3a09c1d6135d36320548f66cdc2c55bf725b0f8d4ab8/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "url": 3
      },
      "first_seen": "2022-07-15",
      "indicators": {
        "url": [
          "namchuncheon.co.kr/html/notice/list.asp",
          "stracarrara.org/public/photos/image/image.asp",
          "stracarrara.org/public/photos/image/image.xn--asp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://mp.weixin.qq.com/s/USitU4jAg9y2XkQxbwcAPQ",
        "https://otx.alienvault.com/pulse/62d153ef7d6fbe552403bc90"
      ],
      "total": 3
    },
    {
      "counts": {
        "url": 3,
        "url_path": 2
      },
      "first_seen": "2022-07-07",
      "indicators": {
        "url": [
          "http://213.180.180.154",
          "karin-store.com/recaptcha.php",
          "yoshinorihirano.net/wp-includes/feed-xml.php"
        ],
        "url_path": [
          "/aaa000/support.php",
          "/editor/session/aaa000/support.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blogs.jpcert.or.jp/en/2022/07/yamabot.html",
        "https://www.virustotal.com/gui/file/f226086b5959eb96bd30dec0ffcbf0f09186cd11721507f416f1c39901addafb/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "url": 8
      },
      "first_seen": "2022-07-05",
      "indicators": {
        "url": [
          "bluedragon.com/login",
          "crm.vncgroup.com/cats/scripts/sphinxview.php",
          "mantis.westlinks.net/api/soap/mc_enum.php",
          "ougreen.com/zone",
          "semiconductboard.com/xcror",
          "shipshorejob.com/ckeditor/samples/samples.php",
          "tecnojournals.com/general",
          "tecnojournals.com/prest"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blogs.jpcert.or.jp/en/2022/07/vsingle.html"
      ],
      "total": 8
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2022-06-25",
      "indicators": {
        "url": [
          "http://109.248.150.13"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.talosintelligence.com/lazarus-collectionrat/",
        "https://www.virustotal.com/gui/file/ed8ec7a8dd089019cfd29143f008fa0951c56a35d73b2e1b274315152d0c0ee6/detection (# QietRAT)",
        "https://www.virustotal.com/gui/file/db6a9934570fa98a93a979e7e0e218e0c9710e5a787b18c6948f2eedd9338984/detection (# CollectionRAT)",
        "https://www.virustotal.com/gui/file/773760fd71d52457ba53a314f15dddb1a74e8b2f5a90e5e150dea48a21aa76df/detection (# CollectionRAT)",
        "https://www.virustotal.com/gui/file/e3027062e602c5d1812c039739e2f93fc78341a67b77692567a4690935123abe/detection (# Trojanized Plink)"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2022-06-02",
      "indicators": {
        "ipv4": [
          "66.154.102.91:9090"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/5081f54761947bc9ce4aa2a259a0bd60b4ec03d32605f8e3635c4d4edaf48894/detection",
        "https://blog.talosintelligence.com/2022/09/lazarus-magicrat.html",
        "https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/102811/",
        "https://www.virustotal.com/gui/file/f6827dc5af661fbb4bf64bc625c78283ef836c6985bb2bfb836bd0c8d5397332/detection",
        "https://www.virustotal.com/gui/file/f78cabf7a0e7ed3ef2d1c976c1486281f56a6503354b87219b466f2f7a0b65c4/detection",
        "https://www.virustotal.com/gui/file/eb73c57c6f4ce8bf197ddc689b7e0afd3703a9bf9a78212c9cb838528441df7a/detection",
        "https://www.virustotal.com/gui/file/bffe910904efd1f69544daa9b72f2a70fb29f73c51070bde4ea563de862ce4b1/detection",
        "https://www.virustotal.com/gui/file/afb2d4d88f59e528f0e388705113ae54b7b97db4f03a35ae43cc386a48f263a0/detection",
        "https://www.virustotal.com/gui/file/196fb1b6eff4e7a049cea323459cfd6c0e3900d8d69e1d80bffbaabd24c06eba/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-05-04",
      "indicators": {
        "domain": [
          "onlinestockwatch.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ESETresearch/status/1521735320852643840",
        "https://twitter.com/ESETresearch/status/1521735343497695232",
        "https://www.virustotal.com/gui/file/55571ac52e1f02f18af77e2f3314382c982a37744b58732dfc15faac9d66619f/detection",
        "https://www.virustotal.com/gui/file/a0bf5af3f931a428b905fd14d43b61af47b7f272425ae4ff4d78b5cb139b8276/detection",
        "https://www.virustotal.com/gui/file/315503862cb7ebb0a731483827016015e355bad51f872db5c650a822de744937/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2,
        "ipv4": 3,
        "url": 4
      },
      "first_seen": "2022-04-30",
      "indicators": {
        "domain": [
          "mail.usengineergroup.com",
          "usengineergroup.com"
        ],
        "ipv4": [
          "109.248.144.136:8443",
          "109.248.144.155:8080",
          "109.248.144.155:8443"
        ],
        "url": [
          "http://109.248.144.155",
          "http://155.94.210.11",
          "http://193.56.28.32",
          "http://45.57.245.17"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1519504288849874944",
        "https://www.virustotal.com/gui/file/672ec8899b8ee513dbfc4590440a61023846ddc2ca94c88ae637144305c497e7/detection"
      ],
      "total": 9
    },
    {
      "counts": {
        "url": 7
      },
      "first_seen": "2022-04-19",
      "indicators": {
        "url": [
          "gaonwell.com/data/base/mail/login.asp",
          "h-cube.co.kr/main/image/gellery/gallery.asp",
          "materic.or.kr/include/main/main_top.asp",
          "materic.or.kr/include/main/main_top.xn--asp",
          "namchoncc.co.kr/include/?ind=",
          "okkids.kr/html/program/display/?re=",
          "shoppingbagsdirect.com/media/images/?ui="
        ]
      },
      "precision": "exact",
      "references": [
        "https://asec.ahnlab.com/ko/33706/",
        "https://otx.alienvault.com/pulse/625e688f46dbcbce7ac0668d"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2022-04-19",
      "indicators": {
        "domain": [
          "alticgo.com",
          "cryptais.com",
          "dafom.dev",
          "esilet.com",
          "tokenais.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.cisa.gov/uscert/ncas/alerts/aa22-108a",
        "https://otx.alienvault.com/pulse/625e65bf6aa1f7977a316d65"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2022-04-19",
      "indicators": {
        "domain": [
          "cloud.beenos.biz",
          "it.zvc.capital",
          "zvc.capital"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1516300076523548674",
        "https://mp.weixin.qq.com/s/Xs54_RDKU5MvkvsPPCGKEw (Chinese)"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2022-04-18",
      "indicators": {
        "domain": [
          "aumentarelevisite.com",
          "happy.nanoace.co.kr",
          "juneprint.com",
          "jungfrau.co.kr",
          "mariamchurch.com",
          "ric-camid.re.kr"
        ]
      },
      "precision": "exact",
      "references": [
        "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-dream-job-chemical",
        "https://otx.alienvault.com/pulse/625d3bb7b78be557e145d2c7"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-04-15",
      "indicators": {
        "domain": [
          "kashaccn4.naveicoiph.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/jaydinbas/status/1506970733997604867",
        "https://twitter.com/ShadowChasing1/status/1508637858927587328",
        "https://twitter.com/ShadowChasing1/status/1509520460974723072",
        "https://twitter.com/ShadowChasing1/status/1511144288830119941",
        "https://asec.ahnlab.com/ko/33034/ (Korean)",
        "https://www.virustotal.com/gui/ip-address/2.57.90.16/relations",
        "https://www.virustotal.com/gui/ip-address/209.126.83.186/relations",
        "https://www.virustotal.com/gui/file/2fc71184be22ed1b504b75d7bde6e46caac0bf63a913e7a74c3b65157f9bf1df/detection",
        "https://www.virustotal.com/gui/file/392aba0070375051d7bc3cc478c4bb66c5f55be87ad797800f50a338c3e2479b/detection",
        "https://www.virustotal.com/gui/file/a7c17e5fa55bcc60d4cff64dd37d0a1f0cc93f4f44b3cebd5633ca5af413e5cc/detection",
        "https://www.virustotal.com/gui/file/ae7275988753fffb29bdb254babdf46773daf935b2721006fe66a1747af3d1d4/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2022-04-15",
      "indicators": {
        "url": [
          "http://15.235.33.14"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1514899414367694851",
        "https://www.virustotal.com/gui/file/f78b85fc5c9a5f6c8d735f13180d318bf8f5639e71556e2ae0f2c6b9b4181a6c/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 153
      },
      "first_seen": "2022-04-11",
      "indicators": {
        "domain": [
          "help.navreplya.live",
          "logn.navermanagecorp.site",
          "logn.noreplya.website",
          "mail.naveradmina.tech",
          "mail.navercomf.link",
          "mailcontactteam.online",
          "mailcustomerservice.site",
          "mailhelp.online",
          "mailmanagecorp.online",
          "mailsecurity.email",
          "mailservicecorp.online",
          "mailserviceteam.email",
          "nav.cloudcentre.space",
          "nav.naveracom.link",
          "nav.naveradmin06.online",
          "nav.noreplyb.xyz",
          "nav.portalcorpteam.com",
          "navcopcenter.tech",
          "navcorpmanager.site",
          "naveeocorp.xyz",
          "navenida.live",
          "navenida.site",
          "navenidb.live",
          "navenidb.site",
          "navenidc.live",
          "navenidc.site",
          "navenidd.site",
          "navenide.site",
          "navenidf.site",
          "naveorseccorp.link",
          "naveracom.link",
          "naveradmin01.link",
          "naveranid.link",
          "naveranid.live",
          "naveranid.online",
          "naverbcom.link",
          "naverbnid.live",
          "naverbnid.online",
          "naverccom.link",
          "navercert.live",
          "navercert.online",
          "navercnid.link",
          "navercnid.online",
          "navercoa.store",
          "navercob.store",
          "navercoc.store",
          "navercod.store",
          "navercoe.store",
          "navercoma.link",
          "navercoma.online",
          "navercomb.link",
          "navercomb.online",
          "navercomb.tech",
          "navercomc.link",
          "navercomc.online",
          "navercomc.tech",
          "navercomd.link",
          "navercomd.online",
          "navercome.link",
          "navercome.online",
          "navercome.tech",
          "navercomf.link",
          "navercomf.online",
          "navercomg.link",
          "navercomh.link",
          "navercop.link",
          "navercop.online",
          "navercorp.email",
          "navercorp.live",
          "navercorpl.tech",
          "navercorpr.online",
          "navercorpteam.com",
          "navercscorp.com",
          "naverenid.online",
          "naverfnid.online",
          "navergnid.online",
          "naverhnid.online",
          "naverhost.live",
          "naverinid.com",
          "naverinid.online",
          "naverjnid.online",
          "naverlogn.live",
          "navermailcorp.com",
          "navermailmanage.com",
          "navermailservice.com",
          "navermailservice.online",
          "navermanage.com",
          "navermanage.live",
          "navermanage.space",
          "navermanageteam.com",
          "navermcorp.com",
          "navernida.link",
          "navernida.online",
          "navernida.tech",
          "navernidb.link",
          "navernidb.online",
          "navernidb.tech",
          "navernidc.link",
          "navernidc.online",
          "navernidc.tech",
          "navernidd.live",
          "navernidd.online",
          "navernide.online",
          "navernidlog.live",
          "navernidmail.com",
          "naverorteam.link",
          "naverreda.xyz",
          "naverredc.xyz",
          "naverredd.xyz",
          "naverrede.xyz",
          "naverredirect.live",
          "naversecurityservice.online",
          "naversecurityteam.com",
          "naverservice.email",
          "naverservice.host",
          "naverservice.link",
          "naverserviceteam.com",
          "naverserviceteam.email",
          "naverteam.live",
          "naverteamcorp.live",
          "navreplya.live",
          "navreplya.online",
          "navreplyb.live",
          "navreplyd.live",
          "navreplye.live",
          "navreplyf.site",
          "navreplyg.site",
          "navreplyh.site",
          "navreplyi.site",
          "navreplyj.site",
          "navreplyk.site",
          "navteamcorp.link",
          "nidbnaver.tech",
          "nidcnaver.tech",
          "niddnaver.tech",
          "nidnavera.online",
          "nidnavere.online",
          "nin.navercop.link",
          "nlog.noreplyb.space",
          "noreplya.xyz",
          "noreplyb.xyz",
          "nvrcopa.link",
          "nvrcopb.link",
          "nvrcopc.link",
          "nvrcope.site",
          "nvrcopf.site",
          "nvricop.online",
          "nvrjcop.online",
          "portalcorpteam.com",
          "red.naveradmin07.site",
          "red.nidnavere.online",
          "sec.naveralert.link",
          "sub.naverbcom.link"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/15.235.132.77/relations",
        "https://www.virustotal.com/gui/ip-address/23.81.246.131/relations",
        "https://www.virustotal.com/gui/ip-address/23.82.19.179/relations"
      ],
      "total": 153
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2022-04-11",
      "indicators": {
        "domain": [
          "6la0cwds.naveicoiph.online",
          "d4yp8bphj3.naveicoiph.online",
          "dtdgwgfvr.naveicoiph.online",
          "gkins2p3i.naveicoiph.online",
          "lkpiedozd.naveicoiph.online",
          "nredial.navermailteam.online",
          "rxpz7z2yi8.naveicoiph.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/jaydinbas/status/1506970733997604867",
        "https://twitter.com/ShadowChasing1/status/1508637858927587328",
        "https://twitter.com/ShadowChasing1/status/1509520460974723072",
        "https://twitter.com/ShadowChasing1/status/1511144288830119941",
        "https://asec.ahnlab.com/ko/33034/ (Korean)",
        "https://www.virustotal.com/gui/ip-address/2.57.90.16/relations",
        "https://www.virustotal.com/gui/ip-address/209.126.83.186/relations",
        "https://www.virustotal.com/gui/file/2fc71184be22ed1b504b75d7bde6e46caac0bf63a913e7a74c3b65157f9bf1df/detection",
        "https://www.virustotal.com/gui/file/392aba0070375051d7bc3cc478c4bb66c5f55be87ad797800f50a338c3e2479b/detection",
        "https://www.virustotal.com/gui/file/a7c17e5fa55bcc60d4cff64dd37d0a1f0cc93f4f44b3cebd5633ca5af413e5cc/detection",
        "https://www.virustotal.com/gui/file/ae7275988753fffb29bdb254babdf46773daf935b2721006fe66a1747af3d1d4/detection"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-04-11",
      "indicators": {
        "domain": [
          "navermailteam.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/jaydinbas/status/1506970733997604867",
        "https://twitter.com/ShadowChasing1/status/1508637858927587328",
        "https://twitter.com/ShadowChasing1/status/1509520460974723072",
        "https://twitter.com/ShadowChasing1/status/1511144288830119941",
        "https://asec.ahnlab.com/ko/33034/ (Korean)",
        "https://www.virustotal.com/gui/ip-address/2.57.90.16/relations",
        "https://www.virustotal.com/gui/ip-address/209.126.83.186/relations",
        "https://www.virustotal.com/gui/file/2fc71184be22ed1b504b75d7bde6e46caac0bf63a913e7a74c3b65157f9bf1df/detection",
        "https://www.virustotal.com/gui/file/392aba0070375051d7bc3cc478c4bb66c5f55be87ad797800f50a338c3e2479b/detection",
        "https://www.virustotal.com/gui/file/a7c17e5fa55bcc60d4cff64dd37d0a1f0cc93f4f44b3cebd5633ca5af413e5cc/detection",
        "https://www.virustotal.com/gui/file/ae7275988753fffb29bdb254babdf46773daf935b2721006fe66a1747af3d1d4/detection",
        "https://www.virustotal.com/gui/ip-address/15.235.132.77/relations",
        "https://www.virustotal.com/gui/ip-address/23.81.246.131/relations",
        "https://www.virustotal.com/gui/ip-address/23.82.19.179/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-04-08",
      "indicators": {
        "domain": [
          "9yxqida1b.naveicoiph.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/jaydinbas/status/1506970733997604867",
        "https://twitter.com/ShadowChasing1/status/1508637858927587328",
        "https://twitter.com/ShadowChasing1/status/1509520460974723072",
        "https://twitter.com/ShadowChasing1/status/1511144288830119941",
        "https://asec.ahnlab.com/ko/33034/ (Korean)",
        "https://www.virustotal.com/gui/ip-address/2.57.90.16/relations",
        "https://www.virustotal.com/gui/ip-address/209.126.83.186/relations",
        "https://www.virustotal.com/gui/file/2fc71184be22ed1b504b75d7bde6e46caac0bf63a913e7a74c3b65157f9bf1df/detection",
        "https://www.virustotal.com/gui/file/392aba0070375051d7bc3cc478c4bb66c5f55be87ad797800f50a338c3e2479b/detection",
        "https://www.virustotal.com/gui/file/a7c17e5fa55bcc60d4cff64dd37d0a1f0cc93f4f44b3cebd5633ca5af413e5cc/detection",
        "https://www.virustotal.com/gui/file/ae7275988753fffb29bdb254babdf46773daf935b2721006fe66a1747af3d1d4/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2022-04-07",
      "indicators": {
        "domain": [
          "123fisd.naveicoipg.online",
          "aat1pbil.naveicoipg.online",
          "l1tog1iv.naveicoipg.online",
          "tp0rw6ie.naveicoipg.online",
          "urm1o6h0.naveicoipg.online",
          "vkqrwl00.naveicoipe.tech"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/jaydinbas/status/1506970733997604867",
        "https://twitter.com/ShadowChasing1/status/1508637858927587328",
        "https://twitter.com/ShadowChasing1/status/1509520460974723072",
        "https://twitter.com/ShadowChasing1/status/1511144288830119941",
        "https://asec.ahnlab.com/ko/33034/ (Korean)",
        "https://www.virustotal.com/gui/ip-address/2.57.90.16/relations",
        "https://www.virustotal.com/gui/ip-address/209.126.83.186/relations",
        "https://www.virustotal.com/gui/file/2fc71184be22ed1b504b75d7bde6e46caac0bf63a913e7a74c3b65157f9bf1df/detection",
        "https://www.virustotal.com/gui/file/392aba0070375051d7bc3cc478c4bb66c5f55be87ad797800f50a338c3e2479b/detection",
        "https://www.virustotal.com/gui/file/a7c17e5fa55bcc60d4cff64dd37d0a1f0cc93f4f44b3cebd5633ca5af413e5cc/detection",
        "https://www.virustotal.com/gui/file/ae7275988753fffb29bdb254babdf46773daf935b2721006fe66a1747af3d1d4/detection"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 9
      },
      "first_seen": "2022-04-06",
      "indicators": {
        "domain": [
          "adzjvazj.naveicoipg.online",
          "aosm8cts.naveicoipg.online",
          "cecomtp3.naveicoipg.online",
          "gowelknx.naveicoipf.online",
          "hytrycnc.naveicoipg.online",
          "kdzdm1rq.naveicoipg.online",
          "pv5pnwlx.naveicoipg.online",
          "twlekqnwl.naveicoipg.online",
          "xuau0b2i.naveicoipf.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/jaydinbas/status/1506970733997604867",
        "https://twitter.com/ShadowChasing1/status/1508637858927587328",
        "https://twitter.com/ShadowChasing1/status/1509520460974723072",
        "https://twitter.com/ShadowChasing1/status/1511144288830119941",
        "https://asec.ahnlab.com/ko/33034/ (Korean)",
        "https://www.virustotal.com/gui/ip-address/2.57.90.16/relations",
        "https://www.virustotal.com/gui/ip-address/209.126.83.186/relations",
        "https://www.virustotal.com/gui/file/2fc71184be22ed1b504b75d7bde6e46caac0bf63a913e7a74c3b65157f9bf1df/detection",
        "https://www.virustotal.com/gui/file/392aba0070375051d7bc3cc478c4bb66c5f55be87ad797800f50a338c3e2479b/detection",
        "https://www.virustotal.com/gui/file/a7c17e5fa55bcc60d4cff64dd37d0a1f0cc93f4f44b3cebd5633ca5af413e5cc/detection",
        "https://www.virustotal.com/gui/file/ae7275988753fffb29bdb254babdf46773daf935b2721006fe66a1747af3d1d4/detection"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 12
      },
      "first_seen": "2022-04-05",
      "indicators": {
        "domain": [
          "buiweggajhqwj.naveicoipg.online",
          "edfeiyql.naveicoipg.online",
          "eoinlslsf.naveicoipg.online",
          "fwpoyktt.naveicoipg.online",
          "jbmnqpwp.naveicoipg.online",
          "jvnquetbon.naveicoipg.online",
          "kygfkdum.naveicoipg.online",
          "lbmwbnbieo.naveicoipg.online",
          "olsnvolqwe.naveicoipg.online",
          "qogngnslel.naveicoipg.online",
          "vm2rjonq.naveicoipg.online",
          "vnwoei.naveicoipg.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/jaydinbas/status/1506970733997604867",
        "https://twitter.com/ShadowChasing1/status/1508637858927587328",
        "https://twitter.com/ShadowChasing1/status/1509520460974723072",
        "https://twitter.com/ShadowChasing1/status/1511144288830119941",
        "https://asec.ahnlab.com/ko/33034/ (Korean)",
        "https://www.virustotal.com/gui/ip-address/2.57.90.16/relations",
        "https://www.virustotal.com/gui/ip-address/209.126.83.186/relations",
        "https://www.virustotal.com/gui/file/2fc71184be22ed1b504b75d7bde6e46caac0bf63a913e7a74c3b65157f9bf1df/detection",
        "https://www.virustotal.com/gui/file/392aba0070375051d7bc3cc478c4bb66c5f55be87ad797800f50a338c3e2479b/detection",
        "https://www.virustotal.com/gui/file/a7c17e5fa55bcc60d4cff64dd37d0a1f0cc93f4f44b3cebd5633ca5af413e5cc/detection",
        "https://www.virustotal.com/gui/file/ae7275988753fffb29bdb254babdf46773daf935b2721006fe66a1747af3d1d4/detection"
      ],
      "total": 12
    },
    {
      "counts": {
        "url": 10
      },
      "first_seen": "2022-04-01",
      "indicators": {
        "url": [
          "bn-cosmo.com/customer/board_replay.asp",
          "edujikim.com/pay_sample/INIstart.asp",
          "emsystec.com/include/inc.asp",
          "gyro3d.com/common/faq.asp",
          "gyro3d.com/mypage/faq.asp",
          "ilovesvc.com/HomePage1/Inquiry/privacy.asp",
          "newbusantour.co.kr/gallery/left.asp",
          "roit.co.kr/xyz/adminer/edit_fail_decoded.asp",
          "softapp.co.kr/sub/cscenter/privacy.asp",
          "syadplus.com/search/search_00.asp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/lazarus-trojanized-defi-app/106195/",
        "https://otx.alienvault.com/pulse/6246c2c9082f5d1a7c15ffba"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 10
      },
      "first_seen": "2022-03-31",
      "indicators": {
        "domain": [
          "bcvbert.naveicoipe.tech",
          "mhf8huuo.naveicoipe.tech",
          "msldkopw.naveicoipe.tech",
          "naveicoipf.online",
          "naveicoipg.online",
          "naveicoiph.online",
          "tyidrtu.naveicoipe.tech",
          "uktyukb.naveicoipe.tech",
          "wrhehdfg.naveicoipe.tech",
          "xjowihgnxcvb.naveicoipf.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/jaydinbas/status/1506970733997604867",
        "https://twitter.com/ShadowChasing1/status/1508637858927587328",
        "https://twitter.com/ShadowChasing1/status/1509520460974723072",
        "https://twitter.com/ShadowChasing1/status/1511144288830119941",
        "https://asec.ahnlab.com/ko/33034/ (Korean)",
        "https://www.virustotal.com/gui/ip-address/2.57.90.16/relations",
        "https://www.virustotal.com/gui/ip-address/209.126.83.186/relations",
        "https://www.virustotal.com/gui/file/2fc71184be22ed1b504b75d7bde6e46caac0bf63a913e7a74c3b65157f9bf1df/detection",
        "https://www.virustotal.com/gui/file/392aba0070375051d7bc3cc478c4bb66c5f55be87ad797800f50a338c3e2479b/detection",
        "https://www.virustotal.com/gui/file/a7c17e5fa55bcc60d4cff64dd37d0a1f0cc93f4f44b3cebd5633ca5af413e5cc/detection",
        "https://www.virustotal.com/gui/file/ae7275988753fffb29bdb254babdf46773daf935b2721006fe66a1747af3d1d4/detection"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2022-03-30",
      "indicators": {
        "domain": [
          "4w9h8ps9.naveicoipa.tech",
          "momls4ii.naveicoipa.tech",
          "tofysz6a.naveicoipa.tech",
          "uzzmuqwv.naveicoipa.tech",
          "zvc1ijau.naveicoipa.tech"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/jaydinbas/status/1506970733997604867",
        "https://twitter.com/ShadowChasing1/status/1508637858927587328",
        "https://twitter.com/ShadowChasing1/status/1509520460974723072",
        "https://twitter.com/ShadowChasing1/status/1511144288830119941",
        "https://asec.ahnlab.com/ko/33034/ (Korean)",
        "https://www.virustotal.com/gui/ip-address/2.57.90.16/relations",
        "https://www.virustotal.com/gui/ip-address/209.126.83.186/relations",
        "https://www.virustotal.com/gui/file/2fc71184be22ed1b504b75d7bde6e46caac0bf63a913e7a74c3b65157f9bf1df/detection",
        "https://www.virustotal.com/gui/file/392aba0070375051d7bc3cc478c4bb66c5f55be87ad797800f50a338c3e2479b/detection",
        "https://www.virustotal.com/gui/file/a7c17e5fa55bcc60d4cff64dd37d0a1f0cc93f4f44b3cebd5633ca5af413e5cc/detection",
        "https://www.virustotal.com/gui/file/ae7275988753fffb29bdb254babdf46773daf935b2721006fe66a1747af3d1d4/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-03-30",
      "indicators": {
        "domain": [
          "aixstore.info",
          "app.aixstore.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1509206625701220356",
        "https://www.virustotal.com/gui/file/e9894893a8a1f74d7d6a8768dda9ef5ddaf8aac18634a1110e9a79652c9f13ee/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 6,
        "url_path": 6
      },
      "first_seen": "2022-03-29",
      "indicators": {
        "domain": [
          "momls4ii.naveicoipc.tech",
          "naveicoipa.tech",
          "naveicoipd.tech",
          "naveicoipe.tech",
          "tofysz6a.naveicoipc.tech",
          "zvc1ijau.naveicoipc.tech"
        ],
        "url_path": [
          "/018ueCdS/",
          "/018ueCdS/018ueCdS32.acm",
          "/018ueCdS32.acm",
          "/0lvNAK1t/",
          "/0lvNAK1t/0lvNAK1t32.acm",
          "/0lvNAK1t32.acm"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/jaydinbas/status/1506970733997604867",
        "https://twitter.com/ShadowChasing1/status/1508637858927587328",
        "https://twitter.com/ShadowChasing1/status/1509520460974723072",
        "https://twitter.com/ShadowChasing1/status/1511144288830119941",
        "https://asec.ahnlab.com/ko/33034/ (Korean)",
        "https://www.virustotal.com/gui/ip-address/2.57.90.16/relations",
        "https://www.virustotal.com/gui/ip-address/209.126.83.186/relations",
        "https://www.virustotal.com/gui/file/2fc71184be22ed1b504b75d7bde6e46caac0bf63a913e7a74c3b65157f9bf1df/detection",
        "https://www.virustotal.com/gui/file/392aba0070375051d7bc3cc478c4bb66c5f55be87ad797800f50a338c3e2479b/detection",
        "https://www.virustotal.com/gui/file/a7c17e5fa55bcc60d4cff64dd37d0a1f0cc93f4f44b3cebd5633ca5af413e5cc/detection",
        "https://www.virustotal.com/gui/file/ae7275988753fffb29bdb254babdf46773daf935b2721006fe66a1747af3d1d4/detection"
      ],
      "total": 12
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2022-03-29",
      "indicators": {
        "domain": [
          "cdn.onlinedocview.biz",
          "cloudscare.xyz",
          "edit.onlinedocview.biz",
          "onlinedocview.biz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1508706298640052225",
        "https://www.virustotal.com/gui/ip-address/44.227.65.245/relations"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-03-29",
      "indicators": {
        "domain": [
          "diregame.live",
          "jom.diregame.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://ics-cert.kaspersky.com/publications/reports/2021/12/16/pseudomanuscrypt-a-mass-scale-spyware-attack-campaign/",
        "https://ics-cert.kaspersky.com/reports/2021/12/16/pseudomanuscrypt-a-mass-scale-spyware-attack-campaign/",
        "https://otx.alienvault.com/pulse/61bca21cf212a6842e17c00b"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 3,
        "url_path": 5
      },
      "first_seen": "2022-03-25",
      "indicators": {
        "domain": [
          "4w9h8ps9.naveicoipc.tech",
          "naveicoipc.tech",
          "uzzmuqwv.naveicoipc.tech"
        ],
        "url_path": [
          "/1uFnvppj/",
          "/1uFnvppj/1uFnvppj32.acm",
          "/1uFnvppj/1uFnvppj64.acm",
          "/1uFnvppj32.acm",
          "/1uFnvppj64.acm"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/jaydinbas/status/1506970733997604867",
        "https://twitter.com/ShadowChasing1/status/1508637858927587328",
        "https://twitter.com/ShadowChasing1/status/1509520460974723072",
        "https://twitter.com/ShadowChasing1/status/1511144288830119941",
        "https://asec.ahnlab.com/ko/33034/ (Korean)",
        "https://www.virustotal.com/gui/ip-address/2.57.90.16/relations",
        "https://www.virustotal.com/gui/ip-address/209.126.83.186/relations",
        "https://www.virustotal.com/gui/file/2fc71184be22ed1b504b75d7bde6e46caac0bf63a913e7a74c3b65157f9bf1df/detection",
        "https://www.virustotal.com/gui/file/392aba0070375051d7bc3cc478c4bb66c5f55be87ad797800f50a338c3e2479b/detection",
        "https://www.virustotal.com/gui/file/a7c17e5fa55bcc60d4cff64dd37d0a1f0cc93f4f44b3cebd5633ca5af413e5cc/detection",
        "https://www.virustotal.com/gui/file/ae7275988753fffb29bdb254babdf46773daf935b2721006fe66a1747af3d1d4/detection"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 15,
        "url": 6
      },
      "first_seen": "2022-03-24",
      "indicators": {
        "domain": [
          "blockchainnews.vip",
          "chainnews-star.com",
          "disneycareers.net",
          "financialtimes365.com",
          "find-dreamjob.com",
          "fireblocks.vip",
          "gatexpiring.com",
          "gbclabs.com",
          "giantblock.org",
          "humingbot.io",
          "indeedus.org",
          "onlynova.org",
          "teenbeanjs.com",
          "varietyjob.com",
          "ziprecruiters.org"
        ],
        "url": [
          "colasprint.com/about/about.asp",
          "financialtimes365.com/user/finance.asp",
          "gatexpiring.com/gate/index.asp",
          "humingbot.io/cdn/js.asp",
          "teenbeanjs.com/cloud/javascript.asp",
          "varietyjob.com/sitemap/sitemap.asp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1507040337097027584",
        "https://blog.google/threat-analysis-group/countering-threats-north-korea/"
      ],
      "total": 21
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-03-21",
      "indicators": {
        "domain": [
          "foxiebed.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/malwrhunterteam/status/1503640289810038786",
        "https://twitter.com/malwrhunterteam/status/1504573045750571010",
        "https://twitter.com/malwrhunterteam/status/1506008938197643266",
        "https://twitter.com/h2jazi/status/1503826030812925962",
        "https://twitter.com/h2jazi/status/1503826034923388929",
        "https://www.virustotal.com/gui/file/8672acfb06258f5b6dec3700cd7f91a0c013a70a9664dbc6cf33a4c6406756ed/detection",
        "https://www.virustotal.com/gui/file/e62a7d9184a841e2b53e41f2d85aa278b427e2e427dbfd8f4be072108e3089c1/detection",
        "https://www.virustotal.com/gui/file/689d5513ad52ad5e7a631a9147049c4cc494ad514b81cf41e841fb244c766b8b/detection",
        "https://www.virustotal.com/gui/file/a51cad94475e0af91d270146379574b5a8ae70a03098318ddf9912784ace3cba/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-03-21",
      "indicators": {
        "domain": [
          "webhosttech.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1505983796897894401",
        "https://www.virustotal.com/gui/file/d0cf9c1f87eac9b8879684a041dd6a2e1a0c15e185d4814a51adda19f9399a9b/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2022-03-21",
      "indicators": {
        "url": [
          "pvacek.cz/wp-content/plugins/akismet/control/en/en.jpg"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1505965580075114498",
        "https://www.virustotal.com/gui/file/e3a4e97e27bcfb6126ebfe92827cfb6b7e0c04eb7f5426bf17dd366e4723d1ef/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-03-17",
      "indicators": {
        "domain": [
          "hillokay.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/malwrhunterteam/status/1503640289810038786",
        "https://twitter.com/malwrhunterteam/status/1504573045750571010",
        "https://twitter.com/malwrhunterteam/status/1506008938197643266",
        "https://twitter.com/h2jazi/status/1503826030812925962",
        "https://twitter.com/h2jazi/status/1503826034923388929",
        "https://www.virustotal.com/gui/file/8672acfb06258f5b6dec3700cd7f91a0c013a70a9664dbc6cf33a4c6406756ed/detection",
        "https://www.virustotal.com/gui/file/e62a7d9184a841e2b53e41f2d85aa278b427e2e427dbfd8f4be072108e3089c1/detection",
        "https://www.virustotal.com/gui/file/689d5513ad52ad5e7a631a9147049c4cc494ad514b81cf41e841fb244c766b8b/detection",
        "https://www.virustotal.com/gui/file/a51cad94475e0af91d270146379574b5a8ae70a03098318ddf9912784ace3cba/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2022-03-16",
      "indicators": {
        "domain": [
          "encorpost.com",
          "nhn-games.com",
          "sktelecom.help",
          "want-helper.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/malwrhunterteam/status/1503640289810038786",
        "https://twitter.com/malwrhunterteam/status/1504573045750571010",
        "https://twitter.com/malwrhunterteam/status/1506008938197643266",
        "https://twitter.com/h2jazi/status/1503826030812925962",
        "https://twitter.com/h2jazi/status/1503826034923388929",
        "https://www.virustotal.com/gui/file/8672acfb06258f5b6dec3700cd7f91a0c013a70a9664dbc6cf33a4c6406756ed/detection",
        "https://www.virustotal.com/gui/file/e62a7d9184a841e2b53e41f2d85aa278b427e2e427dbfd8f4be072108e3089c1/detection",
        "https://www.virustotal.com/gui/file/689d5513ad52ad5e7a631a9147049c4cc494ad514b81cf41e841fb244c766b8b/detection",
        "https://www.virustotal.com/gui/file/a51cad94475e0af91d270146379574b5a8ae70a03098318ddf9912784ace3cba/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1,
        "url_path": 3
      },
      "first_seen": "2022-03-11",
      "indicators": {
        "domain": [
          "open.googlesheetpage.org"
        ],
        "url_path": [
          "/C0sHwcGMH2/",
          "/KcyRbGDJKRZoaLq8lHh8/",
          "/KcyRbGDJKRZoaLq8lHh8/C0sHwcGMH2/"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1502240130702065664"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2022-02-15",
      "indicators": {
        "domain": [
          "doc.filesaves.cloud",
          "docs.gsheetpage.com",
          "gsheetpage.com",
          "license.cloudplus.one",
          "pilotview.cloud",
          "sheet.tresordocs.com",
          "support.pilotview.cloud",
          "tresordocs.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://github.com/ti-research-io/ti/blob/main/ioc_extender/ET_Lazarus_APT_Related.json",
        "https://www.virustotal.com/gui/ip-address/149.28.162.113/relations"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-02-15",
      "indicators": {
        "domain": [
          "mantis-gewa.technisat-digital.de"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/jaydinbas/status/1468521246862233603",
        "https://www.virustotal.com/gui/file/ef2d3e488b781a7c6144afa8fc8ba2b6d085ca671100d04686097f3b4dd2ed42/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2022-02-08",
      "indicators": {
        "domain": [
          "bmanal.com",
          "canyonzcc.com",
          "industryinfostructure.com",
          "linkundlink.de",
          "mante.li",
          "shopandtravelusa.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/pkalnai/status/1489269982814949382",
        "http://report.threatbook.cn/LS.pdf (Chinese)",
        "https://www.virustotal.com/gui/file/8562f6b2a95963f076f7bc6ff00401d96656eafda1cfad3af53b3e3b99ae6452/detection"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-02-08",
      "indicators": {
        "domain": [
          "shopapppro.com",
          "shopapptech.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1490958579930517504",
        "https://www.virustotal.com/gui/file/91ba814a86ddedc7a9d546e26f912c541205b47a853d227756ab1334ade92c3f/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-02-08",
      "indicators": {
        "domain": [
          "datacentre.center"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/cyberoverdrive/status/1490839283803951106",
        "https://www.virustotal.com/gui/file/353f82475fcfad5b3f06ed85a931bda46ec34279793b5d70085aa8c603e8ebec/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-02-05",
      "indicators": {
        "domain": [
          "designautocad.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/s1ckb017/status/1489591023030448129",
        "https://www.virustotal.com/gui/file/29de2289a2b111a4873e49402c310b2ad0e3de51b5562ee1422a37c514910c71/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-02-05",
      "indicators": {
        "domain": [
          "sportsblogweb.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1490057626134192136",
        "https://www.virustotal.com/gui/file/08c3aaeec3da9a106536ad1beff4d2ed23d1e31c9481be60f5dbd5eb1a01d2e5/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1,
        "url_path": 1
      },
      "first_seen": "2022-01-28",
      "indicators": {
        "url": [
          "loneeaglerecords.com/wp-content/uploads/2020/01/images.tgz.001"
        ],
        "url_path": [
          "/update_coingotrade.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1487070198955978753"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-01-27",
      "indicators": {
        "domain": [
          "docusign.agency"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1486530954382348290",
        "https://www.virustotal.com/gui/file/ac7b6ca73207db6ec6d4af2632a7c842c32af6658e3214753e589b567d809125/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-01-26",
      "indicators": {
        "domain": [
          "allinfostudio.com",
          "yourblogcenter.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/s1ckb017/status/1484451637653614592",
        "https://twitter.com/h2jazi/status/1486448926081302536",
        "https://www.virustotal.com/gui/file/0160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-01-25",
      "indicators": {
        "domain": [
          "gfinanzen.net",
          "portal.gfinanzen.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/czy_1116/status/1485813878550597632",
        "https://www.virustotal.com/gui/file/3542078fd524e3cb141d5bebf96aea73467505a07ae72fc58395afa14f22e8a3/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-01-21",
      "indicators": {
        "domain": [
          "markettrendingcenter.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/s1ckb017/status/1484451637653614592",
        "https://twitter.com/h2jazi/status/1486448926081302536",
        "https://www.virustotal.com/gui/file/0160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-01-18",
      "indicators": {
        "domain": [
          "lm-career.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1483521532433473536",
        "https://twitter.com/h2jazi/status/1483521535268769793",
        "https://www.virustotal.com/gui/file/0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-01-17",
      "indicators": {
        "domain": [
          "bloomcloud.org",
          "share.bloomcloud.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/czy_1116/status/1498190652412203008",
        "https://www.virustotal.com/gui/file/4cbad835586faf1d91431d5421b58b4acda0bd280cfbaf8a5d4820aec486b0e6/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-01-17",
      "indicators": {
        "domain": [
          "beenos.biz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1516300076523548674",
        "https://mp.weixin.qq.com/s/Xs54_RDKU5MvkvsPPCGKEw (Chinese)"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2022-01-13",
      "indicators": {
        "domain": [
          "d.diragame.com",
          "google.diragame.com",
          "mygametoa.com",
          "toa.mygametoa.com",
          "tob.mygametoa.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://ics-cert.kaspersky.com/publications/reports/2021/12/16/pseudomanuscrypt-a-mass-scale-spyware-attack-campaign/",
        "https://ics-cert.kaspersky.com/reports/2021/12/16/pseudomanuscrypt-a-mass-scale-spyware-attack-campaign/",
        "https://otx.alienvault.com/pulse/61bca21cf212a6842e17c00b"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2022-01-07",
      "indicators": {
        "domain": [
          "dmarc.fsdriveshare.org",
          "file.fsdriveshare.org",
          "share.fsdriveshare.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/souiten/status/1468818352156020737",
        "https://www.virustotal.com/gui/file/b3646d8cbadc7620ca7782f2525cc019740a3088f32e2ea9a6c97cc1432537b0/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-01-07",
      "indicators": {
        "domain": [
          "cloudmgmt.org",
          "share.cloudmgmt.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/k3yp0d/status/1448552868907204612",
        "https://www.virustotal.com/gui/domain/cloudmgmt.org/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-01-07",
      "indicators": {
        "domain": [
          "share.stablemarket.org",
          "stablemarket.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ffforward/status/1456239300593524741",
        "https://www.virustotal.com/gui/file/0b8d7a851920d4584777505f9fb484b226a8457d4049885a87c847f7d3532d28/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 15
      },
      "first_seen": "2022-01-01",
      "indicators": {
        "domain": [
          "2ab9.watashinonegai.ru",
          "apkv3.clarionhpdu.top",
          "autodiscover.vin",
          "b.watashinonegai.ru",
          "banner-counter.com",
          "clarionhpdu.top",
          "cltpk.doomdns.org",
          "craptioerne.com",
          "d.watashinonegai.ru",
          "down.mykings.pw",
          "fhewkhwjehwekjfhwehfwe.com",
          "lif0.top",
          "smartscreenfilter.com",
          "statcounters.net",
          "vz206llb19o.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://github.com/ti-research-io/ti/blob/main/ioc_extender/ET_Lazarus.json"
      ],
      "total": 15
    },
    {
      "counts": {
        "domain": 10
      },
      "first_seen": "2022-01-01",
      "indicators": {
        "domain": [
          "database.retrots.net",
          "dubbedfinally.link",
          "filesaves.cloud",
          "googlesheetpage.org",
          "help-optus.com",
          "onedocshare.com",
          "onlinedoc.dev",
          "product.onlinedoc.dev",
          "retrots.net",
          "trollinguneaten.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://github.com/ti-research-io/ti/blob/main/ioc_extender/ET_Lazarus_APT_Related.json",
        "https://www.virustotal.com/gui/ip-address/149.28.162.113/relations"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-01-01",
      "indicators": {
        "domain": [
          "fsdriveshare.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://github.com/ti-research-io/ti/blob/main/ioc_extender/ET_Lazarus_APT_Related.json",
        "https://www.virustotal.com/gui/ip-address/149.28.162.113/relations",
        "https://twitter.com/souiten/status/1468818352156020737",
        "https://www.virustotal.com/gui/file/b3646d8cbadc7620ca7782f2525cc019740a3088f32e2ea9a6c97cc1432537b0/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2021-12-27",
      "indicators": {
        "url": [
          "aditijindal.com/wp-content/gallery/services/globalcareers/12849/jobs/gallery.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1462832390632583168",
        "https://www.virustotal.com/gui/file/c12a0565ea1c59d7c2b73e9c022604dbc827980df58ede7ce42d648f9dd4e096/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2021-12-08",
      "indicators": {
        "domain": [
          "cloudplus.one",
          "drive.cloudplus.one"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/k3yp0d/status/1468485748269662208",
        "https://app.any.run/tasks/ff306f89-64d4-4d30-8b72-7c0be0b1f9fb/"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2,
        "url": 1,
        "url_path": 1
      },
      "first_seen": "2021-12-01",
      "indicators": {
        "domain": [
          "ny.silvergatehr.com",
          "silvergatehr.com"
        ],
        "url": [
          "http://152.89.247.236"
        ],
        "url_path": [
          "/5Ek9724mz8oncul8Zx7E7CVDCdBNxuFFUO6pLk/"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1465998017836707840",
        "https://twitter.com/ShadowChasing1/status/1465998020734898176"
      ],
      "total": 4
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2021-11-22",
      "indicators": {
        "url": [
          "ditijindal.com/wp-content/gallery/services/globalcareers/12849/jobs/gallery.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1462832390632583168",
        "https://www.virustotal.com/gui/file/c12a0565ea1c59d7c2b73e9c022604dbc827980df58ede7ce42d648f9dd4e096"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2021-11-20",
      "indicators": {
        "url": [
          "thetalkingcanvas.com/jobs/en-gb/jobs/9/details.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1455489336850325519",
        "https://www.virustotal.com/gui/file/65b5709f67bb0fac31ec977f98cda6f89f4b38703ee5aeef0b633c33669ea88a/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-11-12",
      "indicators": {
        "domain": [
          "navercorpservice.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ESETresearch/status/1458438169502826508",
        "https://www.virustotal.com/gui/ip-address/45.147.231.213",
        "https://www.virustotal.com/gui/file/fe80e890689b0911d2cd1c29196c1dad92183c40949fe6f8c39deec8e745de7f/detection",
        "https://www.virustotal.com/gui/ip-address/15.235.132.77/relations",
        "https://www.virustotal.com/gui/ip-address/23.81.246.131/relations",
        "https://www.virustotal.com/gui/ip-address/23.82.19.179/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-11-12",
      "indicators": {
        "domain": [
          "devguardmap.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ESETresearch/status/1458438169502826508",
        "https://www.virustotal.com/gui/ip-address/45.147.231.213",
        "https://www.virustotal.com/gui/file/fe80e890689b0911d2cd1c29196c1dad92183c40949fe6f8c39deec8e745de7f/detection",
        "https://twitter.com/pkalnai/status/1489269982814949382",
        "http://report.threatbook.cn/LS.pdf (Chinese)",
        "https://www.virustotal.com/gui/file/8562f6b2a95963f076f7bc6ff00401d96656eafda1cfad3af53b3e3b99ae6452/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-11-04",
      "indicators": {
        "domain": [
          "mantis.linkundlink.de"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1455601350222417926",
        "https://www.virustotal.com/gui/file/8562f6b2a95963f076f7bc6ff00401d96656eafda1cfad3af53b3e3b99ae6452/detection",
        "https://twitter.com/pkalnai/status/1489269982814949382",
        "http://report.threatbook.cn/LS.pdf (Chinese)"
      ],
      "total": 1
    },
    {
      "counts": {
        "url_path": 1
      },
      "first_seen": "2021-11-04",
      "indicators": {
        "url_path": [
          "/logs/officetemplate.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1455601350222417926",
        "https://www.virustotal.com/gui/file/8562f6b2a95963f076f7bc6ff00401d96656eafda1cfad3af53b3e3b99ae6452/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-10-11",
      "indicators": {
        "domain": [
          "digitalguarder.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/s1ckb017/status/1447476954639347712",
        "https://www.virustotal.com/gui/file/cf10c1cad090ab31d9e579df3bd22f3d0653792cb010e1d6ac0e2cd1ced52076"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2021-10-08",
      "indicators": {
        "url": [
          "gozdeelektronik.net/wp-content/themes/0111/"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1445596955552272389"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-07-24",
      "indicators": {
        "domain": [
          "smartaudpor.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://mp.weixin.qq.com/s/y-SHoh9f5qwAwqml3uf8vw",
        "https://otx.alienvault.com/pulse/60f930c9c1a69acdb28adea6"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2,
        "url": 1
      },
      "first_seen": "2021-07-10",
      "indicators": {
        "domain": [
          "sharebusiness.xyz",
          "signverydn.sharebusiness.xyz"
        ],
        "url": [
          "http://95.179.235.55"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1412934665292316677",
        "https://twitter.com/ShadowChasing1/status/1412953330700062726"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2021-07-10",
      "indicators": {
        "domain": [
          "devprocloud.com",
          "share.devprocloud.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1412932935523573760",
        "https://www.virustotal.com/gui/file/8afdf8513a6e3bede16187004daccc95e193a29062415d9ba0c29b98a5a927d1/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-07-10",
      "indicators": {
        "domain": [
          "elwoodasset.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1407993219720224771"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 3
      },
      "first_seen": "2021-07-08",
      "indicators": {
        "url": [
          "grandgolf.co.kr/html/facilities/facilities_01_06.asp",
          "kdone.co.kr/Utils/EmailUtil.asp",
          "namchuncheon.co.kr/admin/BookAppl/Search_left.asp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://medium.com/s2wlab/analysis-of-lazarus-malware-abusing-non-activex-module-in-south-korea-7d52b9539c12",
        "https://otx.alienvault.com/pulse/60e6d2a6786d43397db19bc7"
      ],
      "total": 3
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2021-06-30",
      "indicators": {
        "ipv4": [
          "52.202.193.124:443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/360CoreSec/status/1410127120177635328"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-06-24",
      "indicators": {
        "domain": [
          "sharemanage.elwoodasset.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1407993219720224771"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1,
        "url_path": 1
      },
      "first_seen": "2021-06-20",
      "indicators": {
        "url": [
          "mail.neocyon.com/jsp/user/sms/sms_recv.jsp"
        ],
        "url_path": [
          "/jsp/user/sms/sms_recv.jsp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1406401709157629952",
        "https://twitter.com/ShadowChasing1/status/1406592585796177924",
        "https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/102811/",
        "https://www.virustotal.com/gui/file/5c2f339362d0cd8e5a8e3105c9c56971087bea2701ea3b7324771b0ea2c26c6c/detection",
        "https://threatray.com/blog/establishing-the-tigerrat-and-tigerdownloader-malware-families/",
        "https://otx.alienvault.com/pulse/61c9aff8d72c2a4731021bee"
      ],
      "total": 2
    },
    {
      "counts": {
        "ipv4": 2
      },
      "first_seen": "2021-06-19",
      "indicators": {
        "ipv4": [
          "185.208.158.204:443",
          "193.56.28.251:443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/360CoreSec/status/1405790277034418177",
        "https://www.virustotal.com/gui/file/35a39299c47bc701dbe7cb72fcb695d08eb2095d1a5b8b7942d3034d16435e89/detection",
        "https://www.virustotal.com/gui/file/382a209ce5745c85507b0bd80b87496ad92128e6870199d0c33d6ddedc542dd1/detection",
        "https://www.virustotal.com/gui/file/f78cabf7a0e7ed3ef2d1c976c1486281f56a6503354b87219b466f2f7a0b65c4/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-06-19",
      "indicators": {
        "domain": [
          "authenticate.azure-drive.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1405515076149284870",
        "https://www.virustotal.com/gui/file/4c4cc3abd3ddb15d5306fb647c6d779b18df5b949673bb3f3f87faa2c5f56a6a/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 3
      },
      "first_seen": "2021-06-16",
      "indicators": {
        "url": [
          "allamwith.com/home/mobile/list.php",
          "conkorea.com/cshop/banner/list.php",
          "mail.sisnet.co.kr/jsp/user/sms/sms_recv.jsp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1406401709157629952",
        "https://twitter.com/ShadowChasing1/status/1406592585796177924",
        "https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/102811/",
        "https://www.virustotal.com/gui/file/5c2f339362d0cd8e5a8e3105c9c56971087bea2701ea3b7324771b0ea2c26c6c/detection",
        "https://threatray.com/blog/establishing-the-tigerrat-and-tigerdownloader-malware-families/",
        "https://otx.alienvault.com/pulse/61c9aff8d72c2a4731021bee"
      ],
      "total": 3
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2021-06-16",
      "indicators": {
        "url": [
          "hivekorea.com/jdboard/member/list.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1406401709157629952",
        "https://twitter.com/ShadowChasing1/status/1406592585796177924",
        "https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/102811/",
        "https://www.virustotal.com/gui/file/5c2f339362d0cd8e5a8e3105c9c56971087bea2701ea3b7324771b0ea2c26c6c/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-06-10",
      "indicators": {
        "domain": [
          "shopweblive.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/360CoreSec/status/1402920149754155010",
        "https://www.virustotal.com/gui/file/294acafed42c6a4f546486636b4859c074e53d74be049df99932804be048f42c/detection",
        "https://www.virustotal.com/gui/file/3b33b0739107411b978c3cbafb312a44b7488bd7adabae3e7b02059240b6dc83/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2021-06-09",
      "indicators": {
        "domain": [
          "azure-drive.com",
          "download.azure-drive.com",
          "protect.azure-drive.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/fr0s7_/status/1402394083331559431",
        "https://twitter.com/Jup1a/status/1402470227292561412",
        "https://www.virustotal.com/gui/file/1939d9fdcf831dc4cac001ba193669c75a336258bc99a1775471554229e4a69b/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-05-31",
      "indicators": {
        "domain": [
          "amene.homepc.it"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1399369260577681426",
        "https://www.virustotal.com/gui/file/4059fea324e27cfbd4955f37dc7791709dbf35a800449373c6715bc53b88f7c5/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-05-30",
      "indicators": {
        "domain": [
          "ewha-ac.ml"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1398468263818928136"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2021-05-27",
      "indicators": {
        "domain": [
          "dev.sslsharecloud.net",
          "sslsharecloud.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1397768682776895491",
        "https://www.virustotal.com/gui/file/8d48a77e7a4b8c824d8c1b890dc3e2b904e6fa8fbe8dae1a22f5870916c01c20/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-05-15",
      "indicators": {
        "domain": [
          "allgraphicart.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1393356174506921985",
        "https://www.virustotal.com/gui/file/8e1746829851d28c555c143ce62283bc011bbd2acfa60909566339118c9c5c97/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1,
        "url": 1
      },
      "first_seen": "2021-05-11",
      "indicators": {
        "domain": [
          "googledocpage.com"
        ],
        "url": [
          "http://45.61.136.204"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1391981731394187266",
        "https://www.virustotal.com/gui/file/a0d070b66408654cdcb84784e77914dc355a23c81e3e6ef36362470619c4de96/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-05-06",
      "indicators": {
        "domain": [
          "mappo-on.life"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/610047be0b2360d609baa71be22ddc5814743868886f8d85ab9985d3f01229d6/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-05-06",
      "indicators": {
        "domain": [
          "octo-manage.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/27bfac11c1f9184b515fbf5fcd946e921c95506f89eb273e148fcf0068e50932/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-04-30",
      "indicators": {
        "domain": [
          "help.mappo-on.life"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/610047be0b2360d609baa71be22ddc5814743868886f8d85ab9985d3f01229d6/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-04-30",
      "indicators": {
        "domain": [
          "help.octo-manage.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/27bfac11c1f9184b515fbf5fcd946e921c95506f89eb273e148fcf0068e50932/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 4
      },
      "first_seen": "2021-04-29",
      "indicators": {
        "url": [
          "akramportal.org/delv/public/voice/voice.php",
          "hospitality-partners.co.jp/works/performance/consumer.php",
          "mail.clicktocareers.com/public/jobapplications/jdviewer.php",
          "vega.mh-tec.jp/.well-known/gallery/siteview.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/lazarus-recruitment/",
        "https://otx.alienvault.com/pulse/608af383c5be4591c5da02e5"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1,
        "url": 4,
        "url_path": 3
      },
      "first_seen": "2021-04-27",
      "indicators": {
        "domain": [
          "gbflatinamerica.com"
        ],
        "url": [
          "codibest.com/data/geditor/main_1.php",
          "http://121.146.68.233/fileserver/temp/platform.asp",
          "http://121.254.224.218/angkor.ylw.common.fileserviceserver/web/document/netframework.asp",
          "myungokhun.co.kr/_proc/member/member_bk.asp"
        ],
        "url_path": [
          "/angkor.ylw.common.fileserviceserver/web/document/netframework.asp",
          "/data/geditor/main_1.php",
          "/fileserver/temp/platform.asp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/6d2ecc3b0a43f0c377ea6d9a68aa5ac0d48635a04219264fb0702976efea8ef6/detection"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 2,
        "url": 4
      },
      "first_seen": "2021-04-27",
      "indicators": {
        "domain": [
          "bootcamp-coders.cnm.edu",
          "goldllama4.sakura.ne.jp"
        ],
        "url": [
          "apars-surgery.org/bbs/bbs_files/board_blog/write.php",
          "ctevt.org.np/ctevt/public/frontend/review.php",
          "gbflatinamerica.com/file/filelist.php",
          "propro.jp/wp-content/documents/docsmgmt.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/lazarus-recruitment/",
        "https://otx.alienvault.com/pulse/608af383c5be4591c5da02e5"
      ],
      "total": 6
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2021-04-27",
      "indicators": {
        "url": [
          "forecareer.com/gdcareer/officetemplate-20nab.asp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://otx.alienvault.com/pulse/5fd8dbfcfed23b6fa1393ea9",
        "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/lazarus-recruitment/",
        "https://otx.alienvault.com/pulse/608af383c5be4591c5da02e5"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2021-04-21",
      "indicators": {
        "url": [
          "ddjm.co.kr/bbs/icon/skin/skin.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1384016097494507521",
        "https://twitter.com/cyberwar_15/status/1384462513249546244",
        "https://www.virustotal.com/gui/file/79e15cc02c6359cdb84885f6b84facbf91f6df1254551750dd642ff96998db35/detection",
        "https://twitter.com/h2jazi/status/1406401709157629952",
        "https://twitter.com/ShadowChasing1/status/1406592585796177924",
        "https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/102811/",
        "https://www.virustotal.com/gui/file/5c2f339362d0cd8e5a8e3105c9c56971087bea2701ea3b7324771b0ea2c26c6c/detection",
        "https://threatray.com/blog/establishing-the-tigerrat-and-tigerdownloader-malware-families/",
        "https://otx.alienvault.com/pulse/61c9aff8d72c2a4731021bee"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2021-04-19",
      "indicators": {
        "url": [
          "snum.or.kr/skin_img/skin.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1384016097494507521",
        "https://twitter.com/cyberwar_15/status/1384462513249546244",
        "https://www.virustotal.com/gui/file/79e15cc02c6359cdb84885f6b84facbf91f6df1254551750dd642ff96998db35/detection",
        "https://twitter.com/h2jazi/status/1406401709157629952",
        "https://twitter.com/ShadowChasing1/status/1406592585796177924",
        "https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/102811/",
        "https://www.virustotal.com/gui/file/5c2f339362d0cd8e5a8e3105c9c56971087bea2701ea3b7324771b0ea2c26c6c/detection",
        "https://threatray.com/blog/establishing-the-tigerrat-and-tigerdownloader-malware-families/",
        "https://otx.alienvault.com/pulse/61c9aff8d72c2a4731021bee"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1,
        "url_path": 2
      },
      "first_seen": "2021-04-15",
      "indicators": {
        "url": [
          "luxmodelagency.com/wp-incluses/random_compat/zeus/wongs/wongs.php"
        ],
        "url_path": [
          "/random_compat/zeus/wongs/wongs.php",
          "/zeus/wongs/wongs.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.group-ib.com/blog/btc_changer"
      ],
      "total": 3
    },
    {
      "counts": {
        "url": 2
      },
      "first_seen": "2021-04-15",
      "indicators": {
        "url": [
          "jinjinpig.co.kr/Anyboard/skin/board.php",
          "mail.namusoft.kr/jsp/user/eam/board.jsp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1382514587589742597",
        "https://www.virustotal.com/gui/file/f1eed93e555a0a33c7fef74084a6f8d06a92079e9f57114f523353d877226d72/detection",
        "https://twitter.com/h2jazi/status/1406401709157629952",
        "https://twitter.com/ShadowChasing1/status/1406592585796177924",
        "https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/102811/",
        "https://www.virustotal.com/gui/file/5c2f339362d0cd8e5a8e3105c9c56971087bea2701ea3b7324771b0ea2c26c6c/detection",
        "https://threatray.com/blog/establishing-the-tigerrat-and-tigerdownloader-malware-families/",
        "https://otx.alienvault.com/pulse/61c9aff8d72c2a4731021bee"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-04-12",
      "indicators": {
        "domain": [
          "cwwpxpxuswo7b6tr.onion"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/darktracer_int/status/1380309710721622016",
        "https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/",
        "https://otx.alienvault.com/pulse/60739323ef1b2b3a187f0f15"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-04-11",
      "indicators": {
        "domain": [
          "protectoffice.club"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/fr0s7_/status/1381328726819020804",
        "https://www.virustotal.com/gui/file/e514d83d2aaa1357b34f5f11ecc35afe10b6240796e085977e9d4a56145bb8b3/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-04-11",
      "indicators": {
        "domain": [
          "diragame.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://ics-cert.kaspersky.com/publications/reports/2021/12/16/pseudomanuscrypt-a-mass-scale-spyware-attack-campaign/",
        "https://ics-cert.kaspersky.com/reports/2021/12/16/pseudomanuscrypt-a-mass-scale-spyware-attack-campaign/",
        "https://otx.alienvault.com/pulse/61bca21cf212a6842e17c00b"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-04-09",
      "indicators": {
        "domain": [
          "4bjt2rceijktwedi.onion"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/darktracer_int/status/1380309710721622016",
        "https://www.welivesecurity.com/2021/04/08/are-you-afreight-dark-watch-out-vyveva-new-lazarus-backdoor/",
        "https://otx.alienvault.com/pulse/60739323ef1b2b3a187f0f15"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2021-04-01",
      "indicators": {
        "domain": [
          "bluecow.com",
          "pinkgoat.com",
          "purewatertokyo.com",
          "salmonrabbit.com",
          "toysbagonline.com",
          "yellowlion.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1377610488830291973",
        "https://twitter.com/ShadowChasing1/status/1377628563000594433",
        "https://securelist.com/dtrack-targeting-europe-latin-america/107798/"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2021-03-26",
      "indicators": {
        "domain": [
          "chemistryworld.us",
          "coinbigex.com",
          "innoenergy.info",
          "mclland.com",
          "qooqle.download"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/DrN1ght/status/1374026917343543301"
      ],
      "total": 5
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2021-03-26",
      "indicators": {
        "url": [
          "sanlorenzoyacht.com/newsl/uploads/docs/"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1375528365587894272",
        "https://www.virustotal.com/gui/file/2fdba1e332203ca0d01992b137ebeaa1f21f7c3daec7230e6b8a4d36182caed4/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2021-03-23",
      "indicators": {
        "domain": [
          "antcapital.us",
          "document.antcapital.us",
          "protect.antcapital.us"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/HONKONE_K/status/1374178555634933762",
        "https://www.virustotal.com/gui/file/66e96fbd6e977ddef3f0a2924978d92e5d67bd96e68dc4832f5041dbd40bcfc9/detection",
        "https://www.virustotal.com/gui/file/e087d06c552aeef36c2ba9fdd14b06fca499f2d37dfea21e480a02a748b19bf1/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-03-22",
      "indicators": {
        "domain": [
          "cloudshare.jumpshare.vip"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1373985591814197250",
        "https://www.virustotal.com/gui/file/09b83a501b8f919fc4861735097dd50957f21e81209d362b4fa425bd3348a495/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2021-03-21",
      "indicators": {
        "domain": [
          "documentprotect.live",
          "documentprotect.pro"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1354880834092859395",
        "https://www.virustotal.com/gui/ip-address/104.168.158.103/relations",
        "https://www.virustotal.com/gui/file/aec3ced40a3451dc2c6b1704cc50b0e0c8e549faaa8ae42b6d6f421b4fc2ef8a/detection",
        "https://www.virustotal.com/gui/file/e7a4d8b80dc653a47440db2a8deaf782109bb710e5d4311bc3d7685dba715865/detection",
        "https://www.virustotal.com/gui/file/75d3d96033db529c9ae698ac6de8fba420c2daa5d97614d7118f49e03c2d83d3/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 11
      },
      "first_seen": "2021-03-12",
      "indicators": {
        "domain": [
          "docs.gdriveshare.top",
          "drop.trailads.net",
          "dsharefile.tech",
          "filehost.network",
          "mdown.showprice.xyz",
          "mse.theworkpc.com",
          "name.ownemail.me",
          "newsbtctech.com",
          "share.onedrvfile.site",
          "up.digifincx.com",
          "up.myemail.works"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1367368069618700291",
        "https://twitter.com/_re_fox/status/1260931809103101957",
        "https://twitter.com/_re_fox/status/1301564536575733760",
        "https://twitter.com/_re_fox/status/1301565785345863689",
        "https://twitter.com/mattnotmax/status/1370311682354941954",
        "https://twitter.com/cyber__sloth/status/1285510760303656960",
        "https://www.virustotal.com/gui/file/d287388e5ff978bf6f8af477460a9b76a74fdc33535e392b70e58176fc9ad805/detection",
        "https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_302_kodera_jp.pdf (Japanese)",
        "https://www.virustotal.com/gui/file/01184a5acb8b3ec56c9e90f2e6cd6673ae83b4fd6982e17329b33da2f77bcf5b/detection"
      ],
      "total": 11
    },
    {
      "counts": {
        "url": 2
      },
      "first_seen": "2021-03-11",
      "indicators": {
        "url": [
          "dronerc.it/shop_testbr/localization/dir_photoes/image.php",
          "dronerc.it/shop_testbr/localization/dir_photoes/logo.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1370024802791096320",
        "https://www.virustotal.com/gui/file/46fcbc170e84d8ad48434251421bd8f6fa49a7e741d2c24d31c170c607c60d51/detection",
        "https://www.virustotal.com/gui/file/c8a8d2caa429a8bbe885ef8d59d982b4bfd9c48f1255ff69e3b81c6bbd7b2925/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2021-03-09",
      "indicators": {
        "url": [
          "torgirf.ru/loginhome.css"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1369305004922855431",
        "https://twitter.com/h2jazi/status/1369307165807280135"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2021-03-04",
      "indicators": {
        "domain": [
          "doc.gsheetshare.org",
          "gsheetshare.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1367368069618700291",
        "https://twitter.com/_re_fox/status/1260931809103101957",
        "https://twitter.com/_re_fox/status/1301564536575733760",
        "https://twitter.com/_re_fox/status/1301565785345863689",
        "https://twitter.com/mattnotmax/status/1370311682354941954",
        "https://twitter.com/cyber__sloth/status/1285510760303656960",
        "https://www.virustotal.com/gui/file/d287388e5ff978bf6f8af477460a9b76a74fdc33535e392b70e58176fc9ad805/detection",
        "https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_302_kodera_jp.pdf (Japanese)",
        "https://www.virustotal.com/gui/file/01184a5acb8b3ec56c9e90f2e6cd6673ae83b4fd6982e17329b33da2f77bcf5b/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2021-03-03",
      "indicators": {
        "domain": [
          "dshellelink.gcloud-share.com",
          "gcloud-share.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/AnonySecAgency/status/1366971633458548738",
        "https://twitter.com/ShadowChasing1/status/1366988046294376450",
        "https://www.virustotal.com/gui/file/03cd4ec3defa490e68b1ca2efaf8daea6f89d3cceed51c91f4c4f9e2222d258d/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 37
      },
      "first_seen": "2021-02-25",
      "indicators": {
        "url": [
          "americanhotboats.com/forums/core/cache/index.php",
          "au-pair.org/admin/Newspaper.asp",
          "au-pair.org/admin/login.asp",
          "cloudarray.com/images/logo/videos/cache.jsp",
          "dellarocca.net/it/content/img/img.asp",
          "digitaldowns.us/artman/exec/upload.php",
          "djasw.or.kr/sub/popup/images/upfiles.asp",
          "docentfx.com/wp-admin/includes/upload.php",
          "edujikim.com/intro/blue/view.asp",
          "edujikim.com/pay/sample/INIstart.asp",
          "edujikim.com/smarteditor/img/upload.asp",
          "forum.iron-maiden.ru/core/cache/index.php",
          "forum.snowreport.gr/cache/template/upload.php",
          "fredrikarnell.com/marocko2014/index.php",
          "geeks-board.com/blog/wp-content/uploads/2017/cache.php",
          "gonnelli.it/uploads/catalogo/thumbs/thumb.asp",
          "http://156.245.16.55/admin/admin.asp",
          "juvillage.co.kr/img/upload.asp",
          "kannadagrahakarakoota.org/forums/admincp/upload.php",
          "kbcwainwrightchallenge.org.uk/connections/dbconn.asp",
          "kwwa.org/DR6001/FN6006LS.asp",
          "kwwa.org/popup/160307/popup_160308.asp",
          "lyzeum.com/board/bbs/bbs_read.asp",
          "lyzeum.com/images/board/upload.asp",
          "martiancartel.com/forum/customavatars/avatars.php",
          "mdim.in.ua/core/cache/index.php",
          "newidealupvc.com:443/img/prettyPhoto/jquery.max.php",
          "polyboatowners.com/2010/images/BOTM/upload.php",
          "polyboatowners.com/css/index.php",
          "prototypetrains.com:443/forums/core/cache/index.php",
          "raiestatesandbuilders.com/admin/installer/installer/index.php",
          "roit.co.kr/xyz/mainpage/view.asp",
          "sanatoliacare.com/include/index.asp",
          "shinwonbook.co.kr/basket/pay/open.asp",
          "shinwonbook.co.kr/board/editor/upload.asp",
          "theforceawakenstoys.com/vBulletin/core/cache/upload.php",
          "waterdoblog.com/uploads/index.asp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/lazarus-threatneedle/100803/",
        "https://otx.alienvault.com/pulse/6037c3cea83bb963f5be0d51/"
      ],
      "total": 37
    },
    {
      "counts": {
        "url": 2
      },
      "first_seen": "2021-02-18",
      "indicators": {
        "url": [
          "materialindia.in/wp/wp-main/gallery/profile2.php",
          "totalmateria.net/wp/profile2.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1362362744909930496"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1,
        "url": 1
      },
      "first_seen": "2021-02-17",
      "indicators": {
        "domain": [
          "levelframeblog.com"
        ],
        "url": [
          "dorusio.com/dorusio_update.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1362109944791764993",
        "https://www.virustotal.com/gui/file/0bc7517aa2f0c1820ced399bfd66b993f10ad77e8d72727b0f3dc1ca35cad7ba/detection",
        "https://www.virustotal.com/gui/file/91eaf215be336eae983d069de16630cc3580e222c427f785e0da312d0692d0fd/detection",
        "https://www.virustotal.com/gui/file/dcb232409c799f6ddfe4bc0566161c2d0b372db6095a0018e6059e34c2b79c61/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 2
      },
      "first_seen": "2021-01-27",
      "indicators": {
        "url": [
          "trophylab.com/design/trophy/product/lmages/logo.png",
          "worldspia.kr/upload_images/inc/LOG.PHP"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Dashowl/status/1354264740692942848"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-01-27",
      "indicators": {
        "domain": [
          "ctrac.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/mattyb1512/status/1354070629469872129"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 8,
        "url": 7
      },
      "first_seen": "2021-01-26",
      "indicators": {
        "domain": [
          "blog.br0vvnn.io",
          "codebiogblog.com",
          "codevexillium.org",
          "investbooking.de",
          "krakenfolio.com",
          "opsonew3org.sg",
          "transferwiser.io",
          "transplugin.io"
        ],
        "url": [
          "codevexillium.org/image/download/download.asp",
          "dronerc.it/shop_testbr/Core/upload.php",
          "dronerc.it/shop_testbr/upload/upload.php",
          "edujikim.com/intro/blue/insert.asp",
          "loonsaloon.com/wp-content/plugins/revslider/hello.php",
          "transplugin.io/upload/upload.asp",
          "trophylab.com/notice/images/renewal/upload.asp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/K_N1kolenko/status/1353975032104558592",
        "https://twitter.com/500mk500/status/1353992570519609344",
        "https://twitter.com/RedDrip7/status/1354038387603197952",
        "https://twitter.com/sS55752750/status/1354059524739653633",
        "https://twitter.com/vngkv123/status/1357247638228226053",
        "https://twitter.com/blackorbird/status/1357259907448229888",
        "https://mp.weixin.qq.com/s/2sV-DrleHiJMSpSCW0kAMg (Korean)",
        "https://enki.co.kr/blog/2021/02/04/ie_0day.html (Korean)",
        "https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/",
        "https://www.microsoft.com/security/blog/2021/01/28/zinc-attacks-against-security-researchers/",
        "https://otx.alienvault.com/pulse/60103a3268891c63b1f24d74",
        "https://www.virustotal.com/gui/file/a75886b016d84c3eaacaf01a3c61e04953a7a3adf38acf77a4a2e3a8f544f855/detection",
        "https://www.virustotal.com/gui/file/a08d24f74027256c6fd5c5a2fdb15b12889971fbdcfa7a28ffebbfe8b15aaefb/detection",
        "https://www.virustotal.com/gui/file/9c906c2f3bfb24883a8784a92515e6337e1767314816d5d9738f9ec182beaf44/detection",
        "https://www.virustotal.com/graph/embed/g4784ec032b3f4cb987a616f4b2dbc9aa9a982d9b20494f8980ae611a4ca3a1d8"
      ],
      "total": 15
    },
    {
      "counts": {
        "url": 10
      },
      "first_seen": "2021-01-26",
      "indicators": {
        "url": [
          "akramportal.org/public/voice/voice.php",
          "commodore.com.tr/mobiquo/appExtt/notdefteri/writenote.php",
          "fabianiarte.com/newsletter/arte/view.asp",
          "hirokawaunso.co.jp/wordpress/wp-includes/ID3/module.audio.mp4.php",
          "ja-fc.or.jp/shop/shopping.php",
          "kenpa.org/yokohama/main.php",
          "leemble.com/5mai-lyon/public/webconf.php",
          "mail.clicktocareers.com/dev_clicktocareers/public/mailview.php",
          "scimpex.com/admin/assets/backup/requisition/requisition.php",
          "tronslog.com/public/appstore.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blogs.jpcert.or.jp/en/2021/01/Lazarus_malware2.html",
        "https://otx.alienvault.com/pulse/601052e27a2c451b3ba5ed31"
      ],
      "total": 10
    },
    {
      "counts": {
        "url": 5
      },
      "first_seen": "2021-01-26",
      "indicators": {
        "url": [
          "colasprint.com/_vti_log/upload.asp",
          "dronerc.it/forum/uploads/index.php",
          "dronerc.it/shop_testbr/Adapter/Adapter_Config.php",
          "fabioluciani.com/ae/include/constant.asp",
          "fabioluciani.com/es/include/include.asp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/K_N1kolenko/status/1353975032104558592",
        "https://twitter.com/500mk500/status/1353992570519609344",
        "https://twitter.com/RedDrip7/status/1354038387603197952",
        "https://twitter.com/sS55752750/status/1354059524739653633",
        "https://twitter.com/vngkv123/status/1357247638228226053",
        "https://twitter.com/blackorbird/status/1357259907448229888",
        "https://mp.weixin.qq.com/s/2sV-DrleHiJMSpSCW0kAMg (Korean)",
        "https://enki.co.kr/blog/2021/02/04/ie_0day.html (Korean)",
        "https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/",
        "https://www.microsoft.com/security/blog/2021/01/28/zinc-attacks-against-security-researchers/",
        "https://otx.alienvault.com/pulse/60103a3268891c63b1f24d74",
        "https://www.virustotal.com/gui/file/a75886b016d84c3eaacaf01a3c61e04953a7a3adf38acf77a4a2e3a8f544f855/detection",
        "https://www.virustotal.com/gui/file/a08d24f74027256c6fd5c5a2fdb15b12889971fbdcfa7a28ffebbfe8b15aaefb/detection",
        "https://www.virustotal.com/gui/file/9c906c2f3bfb24883a8784a92515e6337e1767314816d5d9738f9ec182beaf44/detection",
        "https://www.virustotal.com/graph/embed/g4784ec032b3f4cb987a616f4b2dbc9aa9a982d9b20494f8980ae611a4ca3a1d8",
        "https://securelist.com/lazarus-threatneedle/100803/",
        "https://otx.alienvault.com/pulse/6037c3cea83bb963f5be0d51/"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-01-26",
      "indicators": {
        "domain": [
          "angeldonationblog.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1353972356759187456",
        "https://twitter.com/K_N1kolenko/status/1353975032104558592",
        "https://twitter.com/500mk500/status/1353992570519609344",
        "https://twitter.com/RedDrip7/status/1354038387603197952",
        "https://twitter.com/sS55752750/status/1354059524739653633",
        "https://twitter.com/vngkv123/status/1357247638228226053",
        "https://twitter.com/blackorbird/status/1357259907448229888",
        "https://mp.weixin.qq.com/s/2sV-DrleHiJMSpSCW0kAMg (Korean)",
        "https://enki.co.kr/blog/2021/02/04/ie_0day.html (Korean)",
        "https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/",
        "https://www.microsoft.com/security/blog/2021/01/28/zinc-attacks-against-security-researchers/",
        "https://otx.alienvault.com/pulse/60103a3268891c63b1f24d74",
        "https://www.virustotal.com/gui/file/a75886b016d84c3eaacaf01a3c61e04953a7a3adf38acf77a4a2e3a8f544f855/detection",
        "https://www.virustotal.com/gui/file/a08d24f74027256c6fd5c5a2fdb15b12889971fbdcfa7a28ffebbfe8b15aaefb/detection",
        "https://www.virustotal.com/gui/file/9c906c2f3bfb24883a8784a92515e6337e1767314816d5d9738f9ec182beaf44/detection",
        "https://www.virustotal.com/graph/embed/g4784ec032b3f4cb987a616f4b2dbc9aa9a982d9b20494f8980ae611a4ca3a1d8"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2021-01-26",
      "indicators": {
        "url": [
          "inovecommerce.com.br/public/pdf/view.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blogs.jpcert.or.jp/en/2021/01/Lazarus_malware2.html",
        "https://otx.alienvault.com/pulse/601052e27a2c451b3ba5ed31",
        "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/lazarus-recruitment/",
        "https://otx.alienvault.com/pulse/608af383c5be4591c5da02e5"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-01-25",
      "indicators": {
        "domain": [
          "advantims.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/BushidoToken/status/1353684625382641664",
        "https://www.virustotal.com/gui/ip-address/120.138.8.26/relations",
        "https://www.virustotal.com/gui/file/cabb45c99ffd8dd189e4e3ed5158fac1d0de4e2782dd704b2b595db5f63e2610/detection",
        "https://www.virustotal.com/gui/file/a9b3bc337043c04f529b2c19b3e33df1ad59bce27c074427e7b563db3a83c37b/detection",
        "https://www.virustotal.com/gui/file/bdf9fffe1c9ffbeec307c536a2369eefb2a2c5d70f33a1646a15d6d152c2a6fa/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 2
      },
      "first_seen": "2021-01-23",
      "indicators": {
        "url": [
          "hpc.kau.ac.kr/error2.php",
          "hpc.kau.ac.kr/rolling_banner/tmp4c5ae3.p3a"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/d09041e3d635ddb28540b11cf180a30a28fc04c2ee6e5d994aa0bacc9633e944/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2021-01-15",
      "indicators": {
        "url": [
          "creaideck.com/update/darwin64.bin"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1349927630183694339"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-01-15",
      "indicators": {
        "domain": [
          "aideck.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1349924271791882247",
        "https://www.virustotal.com/gui/file/867c8b49d29ae1f6e4a7cd31b6fe7e278753a1ba03d4be338ed11fd1efc7dd36/detection",
        "https://www.virustotal.com/gui/file/89b5e248c222ebf2cb3b525d3650259e01cf7d8fff5e4aa15ccd7512b1e63957/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 16
      },
      "first_seen": "2020-12-30",
      "indicators": {
        "domain": [
          "addrcheck.corecheckmailsrv.com",
          "cloud-sheet.net",
          "cloud.optvers.net",
          "corecheckmailsrv.com",
          "digitalcurencygroup.co",
          "down.privatework.buzz",
          "fidelitydigitalsassets.com",
          "goglestorage.com",
          "googleproduct.org",
          "gsuiteshare.com",
          "msftoffice.com",
          "myemail.works",
          "official.googleproduct.org",
          "presentonline.xyz",
          "privatework.buzz",
          "sharesvr.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/cyber__sloth/status/1344208175168368641 (# DangerousPassword)",
        "https://twitter.com/cyber__sloth/status/1344208380525752321 (# DangerousPassword)"
      ],
      "total": 16
    },
    {
      "counts": {
        "url": 10
      },
      "first_seen": "2020-12-23",
      "indicators": {
        "url": [
          "bytecortex.com.br/eletronicos/digital.jsp",
          "client.livesistemas.com/Live/posto/system.jsp",
          "cometnet.biz/framework/common/common.asp",
          "gongim.com/board/ajax_Write.asp",
          "iski.silogica.net/events/serial.jsp",
          "k-kiosk.com/bbs/notice_write.asp",
          "kne.co.kr/upload/Customer/BBS.asp",
          "locknlockmall.com/common/popup_left.asp",
          "sac.najatelecom.com.br/sac/Dados/ntlm.jsp",
          "sistema.celllab.com.br/webrun/Navbar/auth.jsp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/lazarus-covets-covid-19-related-intelligence/99906/",
        "https://otx.alienvault.com/pulse/5fe36c30dbe6a83c04783415"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-12-18",
      "indicators": {
        "domain": [
          "google-clouds.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1339933511973699584 (# DangerousPassword)",
        "https://www.virustotal.com/gui/file/c64e2993563345fd497cfc382de27c7791b4f172d2c50d79b6290c2f9c06102c/detection",
        "https://twitter.com/cyber__sloth/status/1344208175168368641 (# DangerousPassword)",
        "https://twitter.com/cyber__sloth/status/1344208380525752321 (# DangerousPassword)"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 3
      },
      "first_seen": "2020-12-17",
      "indicators": {
        "url": [
          "muzeyyengroup.com/wp-content/help.php",
          "puskesmas-terminal.com/wp-content/help.php",
          "zeandf.com/wp-content/help.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/BitsOfBinary/status/1339623925274296323"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-12-16",
      "indicators": {
        "domain": [
          "gdocshare.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1339195498519875585 (# DangerousPassword)",
        "https://twitter.com/cyber__sloth/status/1344208175168368641 (# DangerousPassword)",
        "https://twitter.com/cyber__sloth/status/1344208380525752321 (# DangerousPassword)"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 25
      },
      "first_seen": "2020-12-15",
      "indicators": {
        "url": [
          "acanicjquery.com/slides/style.php",
          "admin.shcpa.co.kr/_asapro2/formmail/lib.php",
          "anca-aste.it/uploads/form/02E319AF73A33547343B71D5CB1064BC.dotm",
          "anisweb.org/layout/site/style/preview.jsp",
          "apars-surgery.org/bbs/bbs_files/board_photo/menu.php",
          "arumdaunresort.com/admin/html/user/contact.asp",
          "calculadoras.mx/themes/pack/pilot.php",
          "emilypress.com/CMWorking/Static/service/center.asp",
          "fabianiarte.com/pdf/thumbs/thumb.asp",
          "fidesarte.it/thumb/multibox/style/common.asp",
          "genieaccount.com/images/common/common.asp",
          "hansolhope.or.kr/welfare/notice/view.jsp",
          "hirokawaunso.co.jp/wordpress/wp-includes/review.php",
          "http://125.206.177.152/old/viewer.php",
          "http://137.74.114.227/theveniaux/webliotheque/public/css/main.php",
          "indoweb.org/love/data/common/common.php",
          "lyzeum.com/popup/popup.asp",
          "mannpublicwhseltd.com/cservice.asp",
          "paghera.com/content/view/thumb/info.asp",
          "pennontraders.com/assets/slides/view.jsp",
          "prestigein-am.jp/akita/wp-includes/wp-rss1.php",
          "shikshakibaat.com/classes/detail.jsp",
          "support.medicalinthecloud.com/TechCenter/include/slide.asp",
          "turnscor.com/ACT/images/slide/view.jsp",
          "yakufreshperu.com/facturacion/public/css/main.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://otx.alienvault.com/pulse/5fd8dbfcfed23b6fa1393ea9"
      ],
      "total": 25
    },
    {
      "counts": {
        "url": 2
      },
      "first_seen": "2020-12-15",
      "indicators": {
        "url": [
          "index-consulting.jp/eng/news/index.php",
          "vega.mh-tec.jp/.well-known/index.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://otx.alienvault.com/pulse/5fd8dbfcfed23b6fa1393ea9",
        "https://blogs.jpcert.or.jp/en/2021/01/Lazarus_malware2.html",
        "https://otx.alienvault.com/pulse/601052e27a2c451b3ba5ed31"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2020-12-15",
      "indicators": {
        "url": [
          "astedams.it/photos/image/image.asp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://otx.alienvault.com/pulse/5fd8dbfcfed23b6fa1393ea9",
        "https://securelist.com/lazarus-threatneedle/100803/",
        "https://otx.alienvault.com/pulse/6037c3cea83bb963f5be0d51/"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 11
      },
      "first_seen": "2020-12-11",
      "indicators": {
        "url": [
          "admforte.com.br/wp-content/plugins/top.php",
          "dafnefonseca.com/wp-content/themes/top.php",
          "drei-schneeballen.de/wp-content/plugins/nextgen-gallery/view.php",
          "funny-pictures.picphotos.net/saint-louis-senior-photos-senior-pictures-seniors-st-louis-st-louis/upload.php",
          "greenvideo.nl/wp-content/themes/top.php",
          "haciendadeclarevot.com/wp-content/top.php",
          "justholdfast.com/doodle/wp-content/plugins/top.php",
          "qwerty.creativehonduras.com/wp-includes/class-wp-redirect.php",
          "shahrtdc.com/wp-content/plugins/top.php",
          "tag-cloud-photo.freeware.filetransit.com/login.php",
          "urbankizomba.se/wp-content/plugins/photo-gallery/filemanager/upload.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/BitsOfBinary/status/1321488299932983296",
        "https://twitter.com/BitsOfBinary/status/1337330286787518464",
        "https://twitter.com/mg2_tracy1/status/1337335098224508928",
        "https://x.threatbook.cn/nodev4/vb4/article?threatInfoID=3051"
      ],
      "total": 11
    },
    {
      "counts": {
        "url": 3
      },
      "first_seen": "2020-12-04",
      "indicators": {
        "url": [
          "annafalkenau.com/awstats/data/upload.php",
          "haciendasacchich.com/wp-content/plugins/photo-gallery/admin/views/404.php",
          "scertodisha.nic.in/wp-content/plugins/photo-gallery/admin/controllers/Photo.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/JAMESWT_MHT/status/1275396942139469824",
        "https://app.any.run/tasks/5ddb7e93-bfc8-49a9-bd52-6b70f57c3846/"
      ],
      "total": 3
    },
    {
      "counts": {
        "url": 3
      },
      "first_seen": "2020-12-03",
      "indicators": {
        "url": [
          "ilhak.co.kr/images/data/upload.asp",
          "ktri.or.kr/upload/mail/upload.asp",
          "warevalley.com/support/orange_open.asp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1334353120038678528",
        "https://www.virustotal.com/gui/file/c19064733f2a23f09c8b16b3847cceeac8f61488be57911cefceb75425501097/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "url": 15
      },
      "first_seen": "2020-11-17",
      "indicators": {
        "url": [
          "cowp.or.kr/html/board/main.asp",
          "erpmas.co.kr/Member/franchise_modify.asp",
          "fored.or.kr/home/board/view.php",
          "gncaf.or.kr/cafe/cafe_board.asp",
          "gongsinet.kr/comm/comm_gongsi.asp",
          "goojoo.net/board/banner01.asp",
          "hsbutton.co.kr/bbs/bbs_write.asp",
          "hstudymall.co.kr/easypay/web/bottom.asp",
          "ikrea.or.kr/main/main_board.asp",
          "pcdesk.co.kr/Freeboard/mn_board.asp",
          "pgak.net/service/engine/release.asp",
          "quecue.kr/okproj/ex_join.asp",
          "style1.co.kr/main/view.asp",
          "wowpress.co.kr/customer/refuse_05.asp",
          "zndance.com/shop/post.asp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.welivesecurity.com/2020/11/16/lazarus-supply-chain-attack-south-korea/",
        "https://otx.alienvault.com/pulse/5fb4044fd5f18831c24c6af6",
        "https://github.com/eset/malware-ioc/tree/master/nukesped_lazarus"
      ],
      "total": 15
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2020-11-16",
      "indicators": {
        "url": [
          "http://84.201.189.216"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/c3rb3ru5d3d53c/status/1225581378840006656 (# DangerousPasswords)",
        "https://pastebin.com/raw/cLWvyJ20",
        "https://twitter.com/Rmy_Reserve/status/1230881875767377920",
        "https://twitter.com/ShadowChasing1/status/1328208737933246464",
        "https://www.virustotal.com/gui/file/4c574c1a2b126c8a5ba1ef9560516d0ac9990c0253119f874eb084b57742e3d7/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 33
      },
      "first_seen": "2020-11-14",
      "indicators": {
        "url": [
          "3cuartos.com/wp-content/plugins/music-press-pro/templates/global/update.php",
          "Engpro.xyz/images/detail.php",
          "advertapp.me/user/invite.php",
          "afuocolento.it/wp-includes/process.php",
          "anyoneforum.cc/forum/list.php",
          "arar-musique.fr/wp-content/plugins/music-press-pro/includes/admin/upgrade.php",
          "bokkeriejesj.nl/wp-content/plugins/music-press-pro/upload.php",
          "calculactcal.org/wp-content/themes/twentysixteen/body.php",
          "copansrl.it/wp-admin/user/invite.php",
          "dimer-group.com/wp-content/plugins/ckeditor-for-wordpress/ckeditor/plugins/image/download.php",
          "dodoi.cc/photos/preview.php",
          "ecolerubanvert.com/wp-content/plugins/image-intense/know.php",
          "encontrosmaracatu.com.br/wp-content/plugins/music-press-pro/templates/global/topmenu.php",
          "erickeleo.com.br/wp-content/plugins/music-press-pro/go.php",
          "firstalliance.church/wp-content/plugins/music-press/templates/404.php",
          "freeforum.co/forum/list.php",
          "friendship.me/users/register.php",
          "goodfriend.pro/projects/list.php",
          "goodproject.xyz/projects/list.php",
          "hellofriend.pro/users/register.php",
          "infocop.me/products/list.php",
          "insideforum.me/forum/list.php",
          "kartacnictvi.cz/wp-content/plugins/ckeditor-for-wordpress/ckeditor/plugins/image/upload.php",
          "kingsvc.cc/index.php",
          "lwac.com/wp-content/plugins/gallery-plugin/includes/demo-data/images/music/photo.php",
          "moonge.cc/wp-content/plugins/google-sitemap-generator/sitemap-builder-embed.php",
          "publishapp.co/update/check.php",
          "sideforum.cc/forum/list.php",
          "teamspit.pro/adverts/follow.php",
          "theblackout.fr/wp-content/plugins/music-press-pro/music-pro.php",
          "threegood.cc/api/manage/customers",
          "tiramisu.it/wp-content/plugins/wp-comment-form.php",
          "worldfoodstory.co.uk/wp-includes/register.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.talosintelligence.com/2020/11/crat-and-plugins.html",
        "https://otx.alienvault.com/pulse/5faf04431c479940b422288b"
      ],
      "total": 33
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2020-10-01",
      "indicators": {
        "url": [
          "phukien2a.net/images/images.zip.000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1311644338812792833",
        "https://www.virustotal.com/gui/file/d2f1cccfe688c074c3d58ae8f7be7b10dbea5d7ae53320c3f7b6e48cd4f62955/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 3
      },
      "first_seen": "2020-09-29",
      "indicators": {
        "url": [
          "automercado.co.cr/empleo/css/main.jsp",
          "curiofirenze.com/include/inc-site.asp",
          "sanlorenzoyacht.com/newsl/include/inc-map.asp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blogs.jpcert.or.jp/en/2020/09/BLINDINGCAN.html",
        "https://otx.alienvault.com/pulse/5f7389601681e32d5bf045f6",
        "https://otx.alienvault.com/pulse/5fd8dbfcfed23b6fa1393ea9",
        "https://securelist.com/lazarus-threatneedle/100803/",
        "https://otx.alienvault.com/pulse/6037c3cea83bb963f5be0d51/"
      ],
      "total": 3
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2020-09-29",
      "indicators": {
        "url": [
          "ne-ba.org/files/news/thumbs/thumbs.asp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blogs.jpcert.or.jp/en/2020/09/BLINDINGCAN.html",
        "https://otx.alienvault.com/pulse/5f7389601681e32d5bf045f6"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2020-09-07",
      "indicators": {
        "url": [
          "fabianiarte.com/uploads/imgup/21it-23792.jpg"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1302180729174937600",
        "https://otx.alienvault.com/pulse/5fd8dbfcfed23b6fa1393ea9"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2020-09-04",
      "indicators": {
        "domain": [
          "docs.dsharefile.tech",
          "shop.newsbtctech.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1367368069618700291",
        "https://twitter.com/_re_fox/status/1260931809103101957",
        "https://twitter.com/_re_fox/status/1301564536575733760",
        "https://twitter.com/_re_fox/status/1301565785345863689",
        "https://twitter.com/mattnotmax/status/1370311682354941954",
        "https://twitter.com/cyber__sloth/status/1285510760303656960",
        "https://www.virustotal.com/gui/file/d287388e5ff978bf6f8af477460a9b76a74fdc33535e392b70e58176fc9ad805/detection",
        "https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_302_kodera_jp.pdf (Japanese)",
        "https://www.virustotal.com/gui/file/01184a5acb8b3ec56c9e90f2e6cd6673ae83b4fd6982e17329b33da2f77bcf5b/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "ipv4": 3
      },
      "first_seen": "2020-08-31",
      "indicators": {
        "ipv4": [
          "104.217.163.61:443",
          "107.175.172.129:443",
          "37.72.168.228:443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/IntezerLabs/status/1300403461809491969",
        "https://analyze.intezer.com/analyses/13d64c6e-6ac7-4888-a682-138a06cbaf16/",
        "https://www.virustotal.com/gui/file/390f9aae2dd5f0584106e3aa315bbd28a8c6479f126a4f13c7c3a62e19356634/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "url": 3
      },
      "first_seen": "2020-08-31",
      "indicators": {
        "url": [
          "gestao.simtelecomrs.com.br/sac/digital/client.jsp",
          "mk.bital.com.br/sac/Formule/Manager.jsp",
          "sac.onecenter.com.br/sac/masks/wfr_masks.jsp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blogs.jpcert.or.jp/en/2020/08/Lazarus-malware.html",
        "https://otx.alienvault.com/pulse/5f4d20e8d417f271a62e0aeb"
      ],
      "total": 3
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2020-08-12",
      "indicators": {
        "url": [
          "unsunozo.org/include/notes/notes.asp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/RedDrip7/status/1293462469214531584",
        "https://www.virustotal.com/gui/file/b0921142f8d3067c8253931977999a5092470ff3e562586d87af68c28ec66a99/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-08-03",
      "indicators": {
        "domain": [
          "publishapp.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/AnonySecAgency/status/1290115260116897792",
        "https://www.virustotal.com/gui/file/40273d18abc0d623a1798766e0d388f2f46bfa7ad535cad46098a5262382fa13/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2020-07-26",
      "indicators": {
        "url": [
          "nextlevelliving.pro/wp-content/uploads/js_composer/images/8c206b81-f5b1-4242-84d3-237ce728ff35.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/cyberwar_15/status/1287291019537473538"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 10
      },
      "first_seen": "2020-07-23",
      "indicators": {
        "ipv4": [
          "104.232.71.7:443",
          "108.170.31.81:443",
          "111.90.146.105:443",
          "111.90.148.132:443",
          "172.81.132.41:443",
          "172.93.184.62:443",
          "192.210.239.122:443",
          "216.244.71.233:443",
          "23.227.199.69:443",
          "68.168.123.86:443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/patrickwardle/status/1286109626941845504",
        "https://securelist.com/mata-multi-platform-targeted-malware-framework/97746/"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-07-21",
      "indicators": {
        "domain": [
          "trailads.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1367368069618700291",
        "https://twitter.com/_re_fox/status/1260931809103101957",
        "https://twitter.com/_re_fox/status/1301564536575733760",
        "https://twitter.com/_re_fox/status/1301565785345863689",
        "https://twitter.com/mattnotmax/status/1370311682354941954",
        "https://twitter.com/cyber__sloth/status/1285510760303656960",
        "https://www.virustotal.com/gui/file/d287388e5ff978bf6f8af477460a9b76a74fdc33535e392b70e58176fc9ad805/detection",
        "https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_302_kodera_jp.pdf (Japanese)",
        "https://www.virustotal.com/gui/file/01184a5acb8b3ec56c9e90f2e6cd6673ae83b4fd6982e17329b33da2f77bcf5b/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-07-09",
      "indicators": {
        "domain": [
          "focuscamere.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/gwillem/status/1281128245052805120"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2020-07-06",
      "indicators": {
        "domain": [
          "areac-agr.com",
          "papers0urce.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/felixaime/status/1280053007036624896",
        "https://sansec.io/research/north-korea-magecart",
        "https://www.bleepingcomputer.com/news/security/north-korean-hackers-linked-to-credit-card-stealing-attacks-on-us-stores/",
        "https://www.virustotal.com/gui/file/a6c803d7a185f896a6c90f78891c5dbb904df3535825764e05432641ab059fb1/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2020-06-26",
      "indicators": {
        "url": [
          "anca-aste.it/uploads/form/boeing_spe_leos_logo.jpg"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1276324740878102529"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-06-26",
      "indicators": {
        "domain": [
          "down.1230578.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/JAMESWT_MHT/status/1276471822217891840",
        "https://app.any.run/tasks/109752e9-2c7f-4d5c-9c3f-300bddc4c0db/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2020-06-23",
      "indicators": {
        "domain": [
          "1688dsj.com",
          "amytanathorn.com",
          "ccsnbao.com",
          "fmose.com",
          "lavaandstone.com",
          "vns1389.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.reversinglabs.com/blog/hidden-cobra",
        "https://otx.alienvault.com/pulse/5ef2252af73ae43d92eecd15"
      ],
      "total": 6
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2020-06-23",
      "indicators": {
        "url": [
          "thestreetsmartsalesman.com/wp-content/uploads/wp-logs/category.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/spider_girl22/status/1275366600560873473",
        "https://www.virustotal.com/gui/file/0fa91cac5712cfc0848af092190fd3d09948f1a7750547f0f16d1867dac6288a/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1,
        "url": 2
      },
      "first_seen": "2020-06-10",
      "indicators": {
        "ipv4": [
          "160.20.147.253:8443"
        ],
        "url": [
          "audiopodcasts.co/verify.php",
          "lastedforcast.com/list.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/MBThreatIntel/status/1270741821560406019"
      ],
      "total": 3
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2020-06-10",
      "indicators": {
        "url": [
          "ne-ba.org/files/gallery/img/img.asp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1270728525926944768"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2020-06-09",
      "indicators": {
        "url": [
          "paghera.com/include/inc-main-default-news.asp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/RedDrip7/status/1270201358721769475"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2020-06-07",
      "indicators": {
        "domain": [
          "bluemoonresearch.org",
          "fitnessdirector.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Vishnyak0v/status/1269635930878545922"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-06-03",
      "indicators": {
        "domain": [
          "kupaywallet.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ccxsaber/status/1268020350605910016",
        "https://twitter.com/h2jazi/status/1362109944791764993",
        "https://www.virustotal.com/gui/file/0bc7517aa2f0c1820ced399bfd66b993f10ad77e8d72727b0f3dc1ca35cad7ba/detection",
        "https://www.virustotal.com/gui/file/91eaf215be336eae983d069de16630cc3580e222c427f785e0da312d0692d0fd/detection",
        "https://www.virustotal.com/gui/file/dcb232409c799f6ddfe4bc0566161c2d0b372db6095a0018e6059e34c2b79c61/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-06-03",
      "indicators": {
        "domain": [
          "coingotrade.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ccxsaber/status/1268020350605910016"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-06-03",
      "indicators": {
        "domain": [
          "threegood.cc"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/IntezerLabs/status/1268158680593313794"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2020-06-02",
      "indicators": {
        "domain": [
          "fudcitydelivers.com",
          "sctemarkets.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1267431134662541317",
        "https://blog.reversinglabs.com/blog/hidden-cobra",
        "https://otx.alienvault.com/pulse/5ef2252af73ae43d92eecd15"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2020-05-27",
      "indicators": {
        "url": [
          "anca-aste.it/uploads/form/boeing_spectrolab_logo.jpg"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/spider_girl22/status/1265486116393713665"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2020-05-27",
      "indicators": {
        "url": [
          "mokawafm.com/wp-content/plugins/ckeditor-for-wordpress/ckeditor/plugins/image/dialog.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/cyberwar_15/status/1265266629044080642",
        "https://asec.ahnlab.com/1323 (Korean)",
        "https://blog.talosintelligence.com/2020/11/crat-and-plugins.html",
        "https://otx.alienvault.com/pulse/5faf04431c479940b422288b"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2020-05-27",
      "indicators": {
        "url": [
          "sixbitsmedia.com/wp-content/uploads/wp-logs/category.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/cyberwar_15/status/1265266629044080642",
        "https://asec.ahnlab.com/1323 (Korean)"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2020-05-26",
      "indicators": {
        "url": [
          "depts.washington.edu/dswkshp/wordpress/wp-content/themes/twentyfifteen/inc/io/"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/cyberwar_15/status/1264353716930412544",
        "https://www.virustotal.com/gui/file/e637c86ae20a7f36a0ad43618b00c48f47b5591a03af3fb689a16c45afa43733/detection",
        "https://www.virustotal.com/gui/file/d3a402458682c4febacc6ae4bc98e15e92142603a97d51316eeee9e8bca77f88/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-05-14",
      "indicators": {
        "domain": [
          "ownemail.me"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1367368069618700291",
        "https://twitter.com/_re_fox/status/1260931809103101957",
        "https://twitter.com/_re_fox/status/1301564536575733760",
        "https://twitter.com/_re_fox/status/1301565785345863689",
        "https://twitter.com/mattnotmax/status/1370311682354941954",
        "https://twitter.com/cyber__sloth/status/1285510760303656960",
        "https://www.virustotal.com/gui/file/d287388e5ff978bf6f8af477460a9b76a74fdc33535e392b70e58176fc9ad805/detection",
        "https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_302_kodera_jp.pdf (Japanese)",
        "https://www.virustotal.com/gui/file/01184a5acb8b3ec56c9e90f2e6cd6673ae83b4fd6982e17329b33da2f77bcf5b/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 2,
        "url": 3
      },
      "first_seen": "2020-05-11",
      "indicators": {
        "ipv4": [
          "192.169.250.185:443",
          "51.77.65.154:443"
        ],
        "url": [
          "elite4print.com/admin/order/batchPdfs.asp",
          "od.lk/d/MzBfMjA1Njc0ODdf/pubmaterial.dotm",
          "sanlorenzoyacht.com/newsl/uploads/docs/43.dotm"
        ]
      },
      "precision": "exact",
      "references": [
        "https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/North%20Korea/APT/Lazarus/2020-05-05/Analysis.md#IOC",
        "https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/North%20Korea/APT/Lazarus/2020-05-05/CSV/IOC-Lazarus_2020_05_05.csv",
        "https://www.virustotal.com/gui/file/1b0c82e71a53300c969da61b085c8ce623202722cf3fa2d79160dac16642303f/behavior/VMRay",
        "https://www.virustotal.com/gui/file/66e5371c3da7dc9a80fb4c0fabfa23a30d82650c434eec86a95b6e239eccab88/behavior/QiAnXin%20RedDrip"
      ],
      "total": 5
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2020-05-07",
      "indicators": {
        "url": [
          "astedams.it/uploads/frame/61.dotm"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/spider_girl22/status/1258224278194941953"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 2
      },
      "first_seen": "2020-05-06",
      "indicators": {
        "ipv4": [
          "185.62.58.207:443",
          "67.43.239.146:443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://objective-see.com/blog/blog_0x57.html",
        "https://blog.malwarebytes.com/threat-analysis/2020/05/new-mac-variant-of-lazarus-dacls-rat-distributed-via-trojanized-2fa-app/",
        "https://otx.alienvault.com/pulse/5eb2fabf6c26a287f705ca20",
        "https://twitter.com/patrickwardle/status/1286109626941845504",
        "https://securelist.com/mata-multi-platform-targeted-malware-framework/97746/"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 2
      },
      "first_seen": "2020-05-05",
      "indicators": {
        "url": [
          "astedams.it/include/inc-elenco-offerter.asp",
          "astedams.it/uploads/template/17.dotm"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/DeadlyLynn/status/1257504361577496576",
        "https://twitter.com/ShadowChasing1/status/1257511608189743105"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 6
      },
      "first_seen": "2020-04-27",
      "indicators": {
        "url": [
          "afuocolento.it/wp-admin/network/server_test.php",
          "mbrainingevents.com/wp-admin/network/server_test.php",
          "sofa.rs/wp-admin/network/server_test.php",
          "sofa.rs/wp-content/themes/twentynineteen/sass/layout/h1.jpg",
          "teslacontrols.ir/wp-includes/images/detail31.jpg",
          "teslacontrols.ir/wp-includes/images/detail32.jpg"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/RedDrip7/status/1254678135133442048",
        "https://ti.qianxin.com/blog/articles/analysis-of-lazarus-apt-targeted-attack-against-south-korea-using-new-crown-outbreak-bait/",
        "https://www.virustotal.com/gui/domain/teslacontrols.ir/relations",
        "https://blog.talosintelligence.com/2020/11/crat-and-plugins.html",
        "https://otx.alienvault.com/pulse/5faf04431c479940b422288b"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 1,
        "url_path": 1
      },
      "first_seen": "2020-04-27",
      "indicators": {
        "domain": [
          "kingsvc.cc"
        ],
        "url_path": [
          "/wp-admin/network/server_test.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/RedDrip7/status/1254678135133442048",
        "https://ti.qianxin.com/blog/articles/analysis-of-lazarus-apt-targeted-attack-against-south-korea-using-new-crown-outbreak-bait/",
        "https://www.virustotal.com/gui/domain/teslacontrols.ir/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2020-04-27",
      "indicators": {
        "url": [
          "matteoragazzini.it/wp-content/uploads/2017/06/category.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/cyberwar_15/status/1254736896330133504"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2020-04-04",
      "indicators": {
        "ipv4": [
          "88.204.166.59:8080"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Rmy_Reserve/status/1246404220040802309 (# DangerousPassword)"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2020-03-13",
      "indicators": {
        "ipv4": [
          "74.121.190.140:8443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/AffableKraut/status/1234726033930248198"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 6
      },
      "first_seen": "2020-03-05",
      "indicators": {
        "ipv4": [
          "107.6.12.135:443",
          "159.100.250.231:80",
          "188.165.37.168:80",
          "193.56.28.103:88",
          "210.202.40.35:443",
          "94.177.123.138:8088"
        ]
      },
      "precision": "exact",
      "references": [
        "https://labs.sentinelone.com/dprk-hidden-cobra-update-north-korean-malicious-cyber-activity/",
        "https://www.us-cert.gov/ncas/analysis-reports/ar20-045d",
        "https://www.us-cert.gov/ncas/analysis-reports/ar20-045e",
        "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A",
        "https://www.us-cert.gov/ncas/analysis-reports/ar20-045b",
        "https://www.us-cert.gov/ncas/analysis-reports/ar20-045a",
        "https://www.us-cert.gov/ncas/analysis-reports/ar20-045f"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-02-21",
      "indicators": {
        "domain": [
          "gdriveupload.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/c3rb3ru5d3d53c/status/1225581378840006656 (# DangerousPasswords)",
        "https://pastebin.com/raw/cLWvyJ20",
        "https://twitter.com/Rmy_Reserve/status/1230881875767377920",
        "https://twitter.com/ShadowChasing1/status/1328208737933246464",
        "https://www.virustotal.com/gui/file/4c574c1a2b126c8a5ba1ef9560516d0ac9990c0253119f874eb084b57742e3d7/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2020-02-14",
      "indicators": {
        "ipv4": [
          "159.100.250.231:8080"
        ]
      },
      "precision": "exact",
      "references": [
        "https://labs.sentinelone.com/dprk-hidden-cobra-update-north-korean-malicious-cyber-activity/",
        "https://www.us-cert.gov/ncas/analysis-reports/ar20-045d",
        "https://www.us-cert.gov/ncas/analysis-reports/ar20-045e",
        "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A",
        "https://www.us-cert.gov/ncas/analysis-reports/ar20-045b",
        "https://www.us-cert.gov/ncas/analysis-reports/ar20-045a",
        "https://www.us-cert.gov/ncas/analysis-reports/ar20-045f"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 8,
        "ipv4": 1
      },
      "first_seen": "2020-02-07",
      "indicators": {
        "domain": [
          "amazonaws1.info",
          "gdrvup.xyz",
          "gmaildrive.site",
          "googleauth.pro",
          "googledriver.info",
          "googleupload.info",
          "liveonedrvshare.xyz",
          "secureshares.online"
        ],
        "ipv4": [
          "103.205.179.4:8080"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/c3rb3ru5d3d53c/status/1225581378840006656 (# DangerousPasswords)",
        "https://pastebin.com/raw/cLWvyJ20",
        "https://twitter.com/Rmy_Reserve/status/1230881875767377920",
        "https://twitter.com/ShadowChasing1/status/1328208737933246464",
        "https://www.virustotal.com/gui/file/4c574c1a2b126c8a5ba1ef9560516d0ac9990c0253119f874eb084b57742e3d7/detection"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 9
      },
      "first_seen": "2020-01-08",
      "indicators": {
        "domain": [
          "aeroplans.info",
          "buckfast-zucht.de",
          "chainfun365.com",
          "cyptian.com",
          "invesuccess.com",
          "jmttrading.org",
          "mydealoman.com",
          "private-kurier.com",
          "wfcwallet.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/operation-applejeus-sequel/95596/",
        "https://otx.alienvault.com/pulse/5e15b526b4f8bc605744ad76"
      ],
      "total": 9
    },
    {
      "counts": {
        "ipv4": 6
      },
      "first_seen": "2019-12-17",
      "indicators": {
        "ipv4": [
          "107.172.197.175:443",
          "172.93.201.219:443",
          "198.180.198.6:443",
          "209.90.234.34:443",
          "23.227.199.53:443",
          "23.254.119.12:443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.netlab.360.com/dacls-the-dual-platform-rat/",
        "https://twitter.com/patrickwardle/status/1286109626941845504",
        "https://securelist.com/mata-multi-platform-targeted-malware-framework/97746/"
      ],
      "total": 6
    },
    {
      "counts": {
        "ipv4": 6
      },
      "first_seen": "2019-12-17",
      "indicators": {
        "ipv4": [
          "192.210.213.178:443",
          "23.227.196.116:443",
          "23.81.246.179:443",
          "37.72.175.179:443",
          "64.188.19.117:443",
          "74.121.190.121:443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.netlab.360.com/dacls-the-dual-platform-rat/"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-12-04",
      "indicators": {
        "domain": [
          "unioncrypto.vip"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1202177008572092417",
        "https://securelist.com/operation-applejeus-sequel/95596/",
        "https://otx.alienvault.com/pulse/5e15b526b4f8bc605744ad76"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1,
        "url": 1,
        "url_path": 3
      },
      "first_seen": "2019-10-30",
      "indicators": {
        "domain": [
          "materialindia.in"
        ],
        "url": [
          "katawaku.jp/bbs/data/theme/profile2.php"
        ],
        "url_path": [
          "/gallery/profile2.php",
          "/theme/profile2.php",
          "/wp/profile2.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/my-name-is-dtrack/93338/",
        "https://unit42.paloaltonetworks.com/inside-tdrop2-technical-analysis-of-new-dark-seoul-malware/",
        "https://otx.alienvault.com/pulse/5d88b31dea7f4b9d4701d7e8",
        "https://www.virustotal.com/gui/file/fe51590db6f835a3a210eba178d78d5eeafe8a47bf4ca44b3a6b3dfb599f1702/detection",
        "https://www.virustotal.com/gui/file/58fef66f346fe3ed320e22640ab997055e54c8704fc272392d71e367e2d1c2bb/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-10-26",
      "indicators": {
        "domain": [
          "curiofirenze.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Rmy_Reserve/status/1188235835956551680",
        "https://app.any.run/tasks/42c972b1-ec38-4637-9354-9de930ff50b2/"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 2
      },
      "first_seen": "2019-10-25",
      "indicators": {
        "ipv4": [
          "119.18.230.253:443",
          "218.255.24.226:443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1187619261612609536",
        "https://www.fortinet.com/blog/threat-research/deep-analysis-nukesped-rat.html",
        "https://www.virustotal.com/gui/ip-address/218.255.24.226/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 4
      },
      "first_seen": "2019-10-24",
      "indicators": {
        "url": [
          "juliesoskin.com/includes/common/list.php",
          "necaled.com/modules/applet/list.php",
          "thevagabondsatchel.com/wp-content/uploads/2019/09/public.avi",
          "valentinsblog.de/wp-admin/includes/list.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/0xD0CF11E0A1B11/status/1187264570861076481"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2019-10-23",
      "indicators": {
        "domain": [
          "czinfo.club",
          "pegasusco.net",
          "smilekeepers.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/RedDrip7/status/1186562944311517184",
        "https://blog.alyac.co.kr/2388 (Korean)",
        "https://otx.alienvault.com/pulse/5db06ad90686f3bad959d7fc"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2019-10-22",
      "indicators": {
        "domain": [
          "crabbedly.club",
          "craypot.live",
          "indagator.club"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/RedDrip7/status/1186562944311517184",
        "https://blog.alyac.co.kr/2388 (Korean)",
        "https://otx.alienvault.com/pulse/5db06ad90686f3bad959d7fc"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-10-15",
      "indicators": {
        "domain": [
          "dev.jmttrading.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/kyleehmke/status/1184120287199223808",
        "https://www.virustotal.com/gui/ip-address/185.228.83.129/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2019-10-13",
      "indicators": {
        "ipv4": [
          "185.228.83.32:443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/VK_Intel/status/1182722604240719872",
        "https://objective-see.com/blog/blog_0x49.html (# AppleJeus)"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-10-11",
      "indicators": {
        "domain": [
          "beastgoc.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/VK_Intel/status/1182722604240719872",
        "https://objective-see.com/blog/blog_0x49.html (# AppleJeus)",
        "https://securelist.com/operation-applejeus-sequel/95596/",
        "https://otx.alienvault.com/pulse/5e15b526b4f8bc605744ad76"
      ],
      "total": 1
    },
    {
      "counts": {
        "url_path": 1
      },
      "first_seen": "2019-10-11",
      "indicators": {
        "url_path": [
          "/grepmonux.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/VK_Intel/status/1182722604240719872",
        "https://objective-see.com/blog/blog_0x49.html (# AppleJeus)"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2019-10-08",
      "indicators": {
        "domain": [
          "gp-core.com",
          "gp-main.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.any.run/tasks/01497f45-7fba-4356-bbdc-4270e51c2465/",
        "https://twitter.com/Rmy_Reserve/status/1181528617374777344",
        "https://www.alienvault.com/blogs/labs-research/malicious-documents-from-lazarus-group-targeting-south-korea"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-10-05",
      "indicators": {
        "domain": [
          "falcancoin.io"
        ]
      },
      "precision": "exact",
      "references": [
        "https://github.com/advanced-threat-research/IOCs/blob/master/2018/2018-03-08-hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant.csv"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-10-05",
      "indicators": {
        "domain": [
          "vmware-probe.zol.co.zw"
        ]
      },
      "precision": "exact",
      "references": [
        "https://github.com/advanced-threat-research/IOCs/blob/master/2017/2017-11-20-android-malware-appears-linked-to-lazarus-cybercrime-group/android-malware-appears-linked-to-lazarus-cybercrime-group.csv"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-10-04",
      "indicators": {
        "domain": [
          "palgong-cc.co.kr"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.picussecurity.com/resource/blog/lazarus-group-apt38-explained-timeline-ttps-and-major-attacks",
        "https://www.virustotal.com/gui/file/0a472fdc188c9da6b8610e9eabed467b4a76457fb01ab16cf3a887d24adb9065/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-10-04",
      "indicators": {
        "domain": [
          "deltaemis.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://github.com/advanced-threat-research/IOCs/blob/master/2018/2018-02-12-lazarus-resurfaces-targets-global-banks-bitcoin-users/lazarus-resurfaces-targets-global-banks-bitcoin-users.csv"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2019-09-30",
      "indicators": {
        "url": [
          "heromessi.com/wp-public/career/car_add.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/KseProso/status/1178580006047539200"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 2
      },
      "first_seen": "2019-09-23",
      "indicators": {
        "url": [
          "http://158.69.57.135",
          "http://92.222.106.229"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/cyberwar_15/status/1175940165425958912"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1,
        "url": 1
      },
      "first_seen": "2019-09-23",
      "indicators": {
        "domain": [
          "totalmateria.net"
        ],
        "url": [
          "cyberub.com/board/icon/template/template_ro.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/my-name-is-dtrack/93338/",
        "https://unit42.paloaltonetworks.com/inside-tdrop2-technical-analysis-of-new-dark-seoul-malware/",
        "https://otx.alienvault.com/pulse/5d88b31dea7f4b9d4701d7e8",
        "https://www.virustotal.com/gui/file/fe51590db6f835a3a210eba178d78d5eeafe8a47bf4ca44b3a6b3dfb599f1702/detection",
        "https://www.virustotal.com/gui/file/58fef66f346fe3ed320e22640ab997055e54c8704fc272392d71e367e2d1c2bb/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 3
      },
      "first_seen": "2019-08-31",
      "indicators": {
        "url": [
          "alnagm-press.com/wp-content/plugins/cloudflare/list.php",
          "elsouq.org/aramex/left.php",
          "swedishmassageamsterdam.nl/wp-content/themes/top.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.alyac.co.kr/2500 (Korean)",
        "https://otx.alienvault.com/pulse/5d6940cb9e719255258969f5"
      ],
      "total": 3
    },
    {
      "counts": {
        "url": 2
      },
      "first_seen": "2019-08-27",
      "indicators": {
        "url": [
          "youdermoscopy.org/media/fly.avi",
          "youdermoscopy.org/media/fly312.avi"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/cyberwar_15/status/1166282138179624960",
        "https://twitter.com/navSi16/status/1166287915959214080"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-08-06",
      "indicators": {
        "domain": [
          "policyupdates.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/KorbenD_Intel/status/1158479283549089792",
        "https://www.virustotal.com/gui/file/3bba04f277e7f51a5500f7b144fdbd851954e4f94bb0290e49fc63f6fc807321/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 3
      },
      "first_seen": "2019-07-22",
      "indicators": {
        "url": [
          "3x-tv.com/plugins/editors/about.php",
          "cabba-cacao.com/wp-content/themes/integral/about.php",
          "rhythm86.com/wp-content/themes/twentysixteen/about.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/cyberwar_15/status/1153123863435214848"
      ],
      "total": 3
    },
    {
      "counts": {
        "url": 3
      },
      "first_seen": "2019-07-19",
      "indicators": {
        "url": [
          "amytanathorn.com/wp-admin/includes/about.php",
          "lavaandstone.com/wp-content/plugins/fusion-core/about.php",
          "sales.alitho.com/wp-content/themes/sketch/about.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/cyberwar_15/status/1152035187196223488"
      ],
      "total": 3
    },
    {
      "counts": {
        "url": 3
      },
      "first_seen": "2019-07-16",
      "indicators": {
        "url": [
          "byucksanpaint.com/main/main4.asp",
          "keyang.co.kr/pub/editor/wa_path.asp",
          "upload.childu.co.kr/include/OnlyOne1.asp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://otx.alienvault.com/pulse/5d2dca0a1c7d00fa07be15e5"
      ],
      "total": 3
    },
    {
      "counts": {
        "url": 10
      },
      "first_seen": "2019-07-15",
      "indicators": {
        "url": [
          "chanbang.co.kr/board/check.asp",
          "chanbang.co.kr/family/check.asp",
          "chanbang.co.kr/gonggu/upload.asp",
          "egreenland.co.kr/cheditor2/example/newpost.asp",
          "http://103.53.176.145:8080/ServiceDeskPlus/products.do",
          "http://111.68.126.155:8080/ServiceDeskPlus/products.do",
          "http://137.117.57.244:8080/ServiceDeskPlus/products.do",
          "kgsa1015.co.kr/upload/member/member.asp",
          "rodaxsankyokorea.com/upload/favicon/favicon.asp",
          "sinokor-eng.com/sub/sub01_09.asp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://otx.alienvault.com/pulse/5d2c64b174175b03e7db85cd"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-07-10",
      "indicators": {
        "domain": [
          "drupdate.club"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.flashpoint-intel.com/blog/disclosure-chilean-redbanc-intrusion-lazarus-ties/",
        "https://twitter.com/KevinPerlow/status/1083759627714682880",
        "https://twitter.com/Bank_Security/status/1107543887462064128",
        "https://www.hybrid-analysis.com/sample/7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be/5c8a414a0388381b3f329926",
        "https://www.virustotal.com/gui/file/7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be/detection",
        "https://twitter.com/ClearskySec/status/1084463729633316864"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2019-07-10",
      "indicators": {
        "ipv4": [
          "194.45.8.41:443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1148843702690832385"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2019-07-10",
      "indicators": {
        "url": [
          "http://178.128.253.67/tbl_add.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/bad_packets/status/1148864469486854144",
        "https://pastebin.com/G0Ad5Ut6"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2019-07-10",
      "indicators": {
        "url": [
          "byucksanpaint.com/community/com_gon_open.asp"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/RedDrip7/status/1148887458152472576",
        "https://otx.alienvault.com/pulse/5d2dca0a1c7d00fa07be15e5"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2019-07-09",
      "indicators": {
        "url": [
          "sensationalsecrets.com/js/left.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/navSi16/status/1148192534654439426",
        "https://otx.alienvault.com/pulse/5d24562845fe64e37ffc46a7"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 4
      },
      "first_seen": "2019-06-25",
      "indicators": {
        "url": [
          "difa.or.kr/common/asp/inc_Comn.asp",
          "edenenc.co.kr/Report/RptMyReport.asp",
          "hanbook.co.kr/partnershop/hanmail_ep.asp",
          "img.kindermom.co.kr/frameart/print/footer.mov"
        ]
      },
      "precision": "exact",
      "references": [
        "https://otx.alienvault.com/pulse/5d2c64b174175b03e7db85cd"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-06-07",
      "indicators": {
        "domain": [
          "sbackservice.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/KevinPerlow/status/1136994848341409792"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 17
      },
      "first_seen": "2019-04-26",
      "indicators": {
        "url": [
          "028xmz.com/include/common.php",
          "168wangpi.com/include/charset.php",
          "33cow.com/include/control.php",
          "51up.com/ace/main.asp",
          "530hr.com/data/common.php",
          "97nb.net/include/arc.sglistview.php",
          "ando.co.kr/service/s_top.asp",
          "anlway.com/include/arc.search.class.php",
          "ansetech.co.kr/smarteditor/common.asp",
          "ap8898.com/include/arc.search.class.php",
          "apshenyihl.com/include/arc.speclist.class.php",
          "marmarademo.com/include/extend.php",
          "mileage.krb.co.kr/common/db_conf.asp",
          "paulkaren.com/synthpop/main.asp",
          "shieldonline.co.za/sitemap.asp",
          "tpddata.com/skins/skin-6.thm",
          "tpddata.com/skins/skin-8.thm"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.alienvault.com/blogs/labs-research/malicious-documents-from-lazarus-group-targeting-south-korea"
      ],
      "total": 17
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-04-26",
      "indicators": {
        "domain": [
          "celasllc.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/operation-applejeus/87553/"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 14
      },
      "first_seen": "2019-04-15",
      "indicators": {
        "ipv4": [
          "112.175.92.57:443",
          "113.114.117.122:23397",
          "128.200.115.228:52884",
          "137.139.135.151:64694",
          "181.39.135.126:7443",
          "186.169.2.237:65292",
          "197.211.212.59:7443",
          "21.252.107.198:23164",
          "26.165.218.44:2248",
          "47.206.4.145:59067",
          "70.224.36.194:59681",
          "81.94.192.147:443",
          "84.49.242.125:17770",
          "97.90.44.200:37120"
        ]
      },
      "precision": "exact",
      "references": [
        "https://labs.sentinelone.com/dprk-hidden-cobra-update-north-korean-malicious-cyber-activity/",
        "https://www.us-cert.gov/ncas/analysis-reports/ar20-045d",
        "https://www.us-cert.gov/ncas/analysis-reports/ar20-045e",
        "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A",
        "https://www.us-cert.gov/ncas/analysis-reports/ar20-045b",
        "https://www.us-cert.gov/ncas/analysis-reports/ar20-045a",
        "https://www.us-cert.gov/ncas/analysis-reports/ar20-045f"
      ],
      "total": 14
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2019-03-29",
      "indicators": {
        "domain": [
          "wb-bot.org",
          "wb-invest.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1111449536910680065",
        "https://securelist.com/operation-applejeus-sequel/95596/",
        "https://otx.alienvault.com/pulse/5e15b526b4f8bc605744ad76"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1,
        "url": 2
      },
      "first_seen": "2019-03-27",
      "indicators": {
        "domain": [
          "alahbabgroup.com"
        ],
        "url": [
          "http://103.225.168.159/admin/verify.php",
          "http://47.91.56.21/verify.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1110750919082147842",
        "https://blog.alyac.co.kr/2219"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2,
        "url": 12
      },
      "first_seen": "2019-03-26",
      "indicators": {
        "domain": [
          "dev.microcravate.com",
          "nzssdm.com"
        ],
        "url": [
          "baseballcharlemagnelegardeur.com/wp-content/languages/common.php",
          "bluecreekrobotics.com/wp-includes/common.php",
          "bogorcenter.com/wp-content/themes/index2.php",
          "dev.microcravate.com/wp-includes/common.php",
          "dev.whatsyourcrunch.com/wp-includes/common.php",
          "enterpriseheroes.com.ng/wp-includes/common.php",
          "eventum.cwsdev3.bi.com/wp-includes/common.php",
          "hrgp.asselsolutions.com/wp-includes/common.php",
          "streamf.ru/wp-content/index2.php",
          "tangowithcolette.com/pages/common.php",
          "towingoperations.com/chat/chat.php",
          "vinhsake.com/wp-content/uploads/index2.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://otx.alienvault.com/pulse/5c9a4d9f90726d0988873a2b",
        "https://securelist.com/cryptocurrency-businesses-still-being-targeted-by-lazarus/90019/"
      ],
      "total": 14
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2019-03-18",
      "indicators": {
        "domain": [
          "bodyshoppechiropractic.com",
          "ecombox.store"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.flashpoint-intel.com/blog/disclosure-chilean-redbanc-intrusion-lazarus-ties/",
        "https://twitter.com/KevinPerlow/status/1083759627714682880",
        "https://twitter.com/Bank_Security/status/1107543887462064128",
        "https://www.hybrid-analysis.com/sample/7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be/5c8a414a0388381b3f329926",
        "https://www.virustotal.com/gui/file/7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be/detection",
        "https://twitter.com/ClearskySec/status/1084463729633316864"
      ],
      "total": 2
    },
    {
      "counts": {
        "url_path": 1
      },
      "first_seen": "2019-03-15",
      "indicators": {
        "url_path": [
          "/tbl_add.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.flashpoint-intel.com/blog/disclosure-chilean-redbanc-intrusion-lazarus-ties/",
        "https://twitter.com/KevinPerlow/status/1083759627714682880",
        "https://twitter.com/Bank_Security/status/1107543887462064128",
        "https://www.hybrid-analysis.com/sample/7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be/5c8a414a0388381b3f329926",
        "https://www.virustotal.com/gui/file/7646c2afbc8b9719b0295e5a880bb89fb85bdd4346603a52768b161eda12e8be/detection",
        "https://twitter.com/ClearskySec/status/1084463729633316864"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2019-03-15",
      "indicators": {
        "url": [
          "http://37.238.135.70/img/anan.jpg"
        ]
      },
      "precision": "exact",
      "references": [
        "https://otx.alienvault.com/pulse/5c8b8e19261a7451de02bf60/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2018-09-13",
      "indicators": {
        "domain": [
          "bitfiniex.org",
          "coinmaketcape.com",
          "coinoen.org",
          "itaddnet.com",
          "tpddata.com",
          "wifispeedcheck.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.alienvault.com/blogs/labs-research/malicious-documents-from-lazarus-group-targeting-south-korea"
      ],
      "total": 6
    },
    {
      "counts": {
        "ipv4": 4
      },
      "first_seen": "2018-08-23",
      "indicators": {
        "ipv4": [
          "185.142.236.226",
          "185.142.239.173",
          "196.38.48.121",
          "80.82.64.91"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/operation-applejeus/87553/"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2017-04-12",
      "indicators": {
        "domain": [
          "exbonus.mrbasic.com",
          "movis-es.ignorelist.com",
          "sap.misapor.ch",
          "tradeboard.mefound.com",
          "update.toythieves.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://cdn.securelist.com/files/2017/04/Lazarus_Under_The_Hood_PDF_final.pdf"
      ],
      "total": 5
    }
  ]
}