{ "aliases": [ "apt10", "earth kasha", "gallium", "noopldr", "stone panda" ], "attack_id": "G0045", "attack_name": "menuPass", "attack_url": "https://attack.mitre.org/groups/G0045/", "counts": { "domain": 1487, "ipv4": 11, "url": 2 }, "first_seen": { "domain": { "002562066559681.r3u8.com": "2018-08-30", "031168053846049.r3u8.com": "2018-08-30", "0625.have8000.com": "2018-08-30", "1.gadskysun.com": "2018-08-30", "100fanwen.com": "2018-08-30", "11.usyahooapis.com": "2018-08-30", "19518473326.r3u8.com": "2018-08-30", "1960445709311199.r3u8.com": "2018-08-30", "1j.www1.biz": "2018-08-30", "1z.itsaol.com": "2018-08-30", "2012yearleft.com": "2018-08-30", "2014.zzux.com": "2017-04-14", "202017845.r3u8.com": "2018-08-30", "2139465544784.r3u8.com": "2018-08-30", "2789203959848958.r3u8.com": "2018-08-30", "5590428449750026.r3u8.com": "2018-08-30", "5q.niushenghuo.info": "2018-08-30", "6r.suibian2010.info": "2018-08-30", "9gowg.tech": "2018-08-30", "Jepsen.r3u8.com": "2017-04-14", "a.wubangtu.info": "2018-08-30", "a1.suibian2010.info": "2018-08-30", "ab.4pu.com": "2018-08-30", "abc.wikaba.com": "2018-08-30", "abcd100621.3322.org": "2019-06-29", "abcd120719.6600.org": "2018-08-30", "abcd120807.3322.org": "2018-08-30", "acc.emailfound.info": "2018-08-30", "acc.lehigtapp.com": "2018-08-30", "acsocietyy.com": "2018-08-30", "ad.getfond.info": "2018-08-30", "ad.webbooting.com": "2018-08-30", "additional.sexidude.com": "2018-08-30", "af.zyns.com": "2018-08-30", "afc.https443.org": "2018-08-30", "ako.ddns.us": "2018-08-30", "algorithm.ddnsgeek.com": "2018-10-24", "amsidgoo.thedomais.info": "2019-06-29", "androidmusicapp.onmypc.us": "2018-08-30", "announcements.toythieves.com": "2018-08-30", "anvprn.com": "2018-08-30", "aotuo.9966.org": "2018-08-30", "apec.qtsofta.com": "2018-08-30", "app.lehigtapp.com": "2017-04-14", "apple.cmdnetview.com": "2017-04-14", "apple.defensewar.org": "2018-08-30", "apple.ikwb.com": "2018-08-30", "appledownload.ourhobby.com": "2018-08-30", "appleimages.itemdb.com": "2018-08-30", "appleimages.longmusic.com": "2018-08-30", "applelib120102.9966.org": "2018-08-30", "applemirror.organiccrap.com": "2018-08-30", "applemirror.squirly.info": "2018-08-30", "applemusic.isasecret.com": "2018-08-30", "applemusic.itemdb.com": "2018-08-30", "applemusic.wikaba.com": "2018-08-30", "applemusic.xxuz.com": "2018-08-30", "applemusic.zzux.com": "2018-08-30", "apples.sytes.net": "2018-08-30", "appleupdate.itemdb.com": "2018-08-30", "architectisusa.com": "2018-08-30", "area.wthelpdesk.com": "2017-04-14", "arkouowi.com": "2019-06-29", "army.xxuz.com": "2018-08-30", "art.p6p6.net": "2018-08-30", "asfzx.x24hr.com": "2018-08-30", "asyspy256.ddns.net": "2019-06-25", "av.ddns.us": "2018-08-30", "availab.wikaba.com": "2018-08-30", "availability.justdied.com": "2018-08-30", "ba.my03.com": "2018-08-30", "baby.macforlinux.net": "2018-08-30", "baby.myie12.com": "2018-08-30", "baby.usmirocomney.net": "2018-08-30", "babyprintf.2288.org": "2019-06-29", "back.jungleheart.com": "2018-08-30", "back.mofa.dynamic-dns.net": "2018-08-30", "bak.have8000.com": "2018-08-30", "bak.ignorelist.com": "2018-08-30", "bak.un.dnsrd.com": "2018-08-30", "balance1.wikaba.com": "2018-08-30", "balk.n7go.com": "2018-08-30", "banana.cmdnetview.com": "2018-08-30", "barrybaker.6600.org": "2018-08-30", "bbs.jungleheart.com": "2018-08-30", "bdoncloud.com": "2018-08-30", "be.mrslove.com": "2018-08-30", "be.yourtrap.com": "2018-08-30", "belowto.com": "2018-08-30", "bethel.webhop.net": "2018-08-30", "bexm.cleansite.biz": "2018-08-30", "bezu.itemdb.com": "2018-08-30", "bk56.twilightparadox.com": "2018-08-30", "blaaaaaaaaaaaa.windowsupdate.3-a.net": "2018-08-30", "blog.defensewar.org": "2018-08-30", "brand.fartit.com": "2018-08-30", "bridgeluxlightmadness.com": "2018-08-30", "bulk.tmpxctl.com": "2019-06-29", "bulletproof.squirly.info": "2018-08-30", "caibi379.com": "2019-05-24", "cao.p6p6.net": "2018-08-30", "cargobussiness.site": "2022-06-28", "cata.qtsofta.com": "2018-08-30", "catholicmmb.com": "2018-08-30", "cc.dynamicdns.co.uk": "2018-08-30", "ccfchrist.com": "2018-08-30", "ccupdatedata.authorizeddns.net": "2018-08-30", "cd.usyahooapis.com": "2018-08-30", "cdn-sina.tw": "2026-01-02", "cdn.incloud-go.com": "2018-08-30", "center.shenajou.com": "2018-08-30", "cgei493860.r3u8.com": "2018-08-30", "chaindungeons.com": "2018-08-30", "chibashiri.com": "2018-08-30", "childrenstow.com": "2018-08-30", "cia.ezua.com": "2018-08-30", "cia.toh.info": "2017-04-14", "ciaoci.chickenkiller.com": "2018-08-30", "civilwar123.authorizeddns.org": "2018-08-30", "civilwar520.onmypc.org": "2018-08-30", "ckusshani.com": "2018-08-30", "cloud-kingl.com": "2018-08-30", "cloud-maste.com": "2018-08-30", "cloudns.8800.org": "2018-08-30", "cmdnetview.com": "2018-08-30", "cms.sindeali.com": "2018-08-30", "cnnews.mylftv.com": "2018-08-30", "commissioner.shenajou.com": "2018-08-30", "commons.onedumb.com": "2018-08-30", "contacts.rvenee.com": "2019-06-29", "contactus.myddns.com": "2018-08-30", "contactus.onmypc.us": "2018-08-30", "contract.4mydomain.com": "2018-08-30", "contractus.qpoe.com": "2017-04-14", "contractus.zzux.com": "2018-08-30", "coreck.suayay.com": "2018-08-30", "cpu.4pu.com": "2018-08-30", "creatos.kozow.com": "2019-06-29", "cs.lflink.com": "2018-08-30", "ctdl.windowsupdate.itsaol.com": "2018-08-30", "ctdl.windowsupdate.nsatcdns.com": "2018-08-30", "ctldl.appledownload.ourhobby.com": "2018-08-30", "ctldl.applemusic.itemdb.com": "2018-08-30", "ctldl.itunesmusic.jkub.com": "2018-08-30", "ctldl.microsoftmusic.onedumb.com": "2018-08-30", "ctldl.microsoftupdate.qhigh.com": "2018-08-30", "ctldl.windowsupdate.authorizeddns.org": "2018-08-30", "ctldl.windowsupdate.authorizeddns.us": "2018-08-30", "ctldl.windowsupdate.dnset.com": "2018-08-30", "ctldl.windowsupdate.esmtp.biz": "2018-08-30", "ctldl.windowsupdate.ezua.com": "2018-08-30", "ctldl.windowsupdate.gettrials.com": "2018-08-30", "ctldl.windowsupdate.itsaol.com": "2018-08-30", "ctldl.windowsupdate.lflinkup.com": "2018-08-30", "ctldl.windowsupdate.mrface.com": "2018-08-30", "ctldl.windowsupdate.nsatcdns.com": "2018-08-30", "ctldl.windowsupdate.organiccrap.com": "2018-08-30", "ctldl.windowsupdate.x24hr.com": "2018-08-30", "cvdfhjh1231.ddns.net": "2019-06-25", "cvdfhjh1231.myftp.biz": "2019-06-25", "cvdfhjh12311.ddns.net": "2019-06-25", "cvnx.zyns.com": "2017-04-14", "cwiinatonal.com": "2018-08-30", "daddy.gostudyantivirus.com": "2018-08-30", "davidgagnon.org": "2019-06-29", "dcc.jimingroup.com": "2018-08-30", "dd.ddns.us": "2018-08-30", "de.onmypc.info": "2018-08-30", "dear.loveddos.com": "2018-08-30", "dec.seyesb.acmetoy.com": "2018-08-30", "dedgesuite.net": "2018-08-30", "dedydns.ns01.us": "2018-08-30", "defensewar.org": "2018-08-30", "defineyourid.site": "2022-06-28", "demoones.com": "2018-08-30", "department.shenajou.com": "2018-08-30", "details.squirly.info": "2018-08-30", "development.shenajou.com": "2018-08-30", "devilcase.acmetoy.com": "2018-08-30", "df.micfkbeljacob.com": "2022-06-13", "dffwescwer4325.myftp.biz": "2019-06-25", "dfgwerzc.3322.org": "2018-08-30", "diamond.ninth.biz": "2019-06-29", "dick.ccfchrist.com": "2017-04-14", "digsby.ourhobby.com": "2018-08-30", "disruptive.https443.net": "2018-08-30", "dlmix.ourdvs.com": "2018-08-30", "dnspoddwg.authorizeddns.org": "2018-08-30", "do.ddns.ms": "2018-08-30", "document.methoder.com": "2018-08-30", "document.shenajou.com": "2018-08-30", "documents.kankuedu.org": "2022-06-28", "domain.casacam.net": "2019-06-29", "domainnow.yourtrap.com": "2018-08-30", "download.applemusic.itemdb.com": "2018-08-30", "download.microsoftmusic.onedumb.com": "2018-08-30", "download.windowsupdate.authorizeddns.org": "2018-08-30", "download.windowsupdate.dedgesuite.net": "2018-08-30", "download.windowsupdate.dnset.com": "2018-08-30", "download.windowsupdate.itsaol.com": "2018-08-30", "download.windowsupdate.lflinkup.com": "2018-08-30", "download.windowsupdate.nsatcdns.com": "2018-08-30", "download.windowsupdate.x24hr.com": "2018-08-30", "downloadlink.mypicture.info": "2018-08-30", "drives.methoder.com": "2018-08-30", "dst.1dumb.com": "2018-08-30", "ducksow.ddnsgeek.com": "2019-06-29", "duosay.com": "2018-08-30", "dyncojinf.6600.org": "2018-08-30", "dynsbluecheck.7766.org": "2018-08-30", "ea.onmypc.info": "2018-08-30", "ea.rebatesrule.net": "2018-08-30", "edgar.ccfchrist.com": "2018-08-30", "ehshiroshima.mylftv.com": "2018-08-30", "emailfound.info": "2018-08-30", "eric-averyanov.wha.la": "2018-08-30", "eservake.jetos.com": "2018-09-13", "essashi.com": "2018-08-30", "eu.acmetoy.com": "2018-08-30", "eu.wha.la": "2018-08-30", "eu.zzux.com": "2018-08-30", "everydayfilmlink.com": "2018-08-30", "ewe.toshste.com": "2018-08-30", "eweek.2waky.com": "2018-08-30", "exprenum.com": "2018-08-30", "express.lflinkup.com": "2018-08-30", "extraordinary.dynamic-dns.net": "2018-08-30", "f068v.site": "2018-08-30", "fabian.ccfchrist.com": "2018-08-30", "fastemail.dnsrd.com": "2018-08-30", "fastmail2.com": "2018-08-30", "fbi.sexxxy.biz": "2017-04-14", "fbi.zyns.com": "2018-08-30", "fcztqbg.zj.r3u8.com": "2018-08-30", "feed.jungleheart.com": "2018-08-30", "fftpoor.com": "2018-08-30", "fg.v4.download.windowsupdates.dnsrd.com": "2018-08-30", "fgipv6.download.windowsupdate.com.mwcname.com": "2018-08-30", "file.zzux.com": "2018-08-30", "files.architectisusa.com": "2018-08-30", "film.everydayfilmlink.com": "2018-08-30", "filmlist.everydayfilmlink.com": "2018-08-30", "findme.epac.to": "2018-08-30", "fire.mrface.com": "2018-08-30", "firefoxcomt.arkouowi.com": "2018-10-24", "firtstdata.kozow.com": "2019-06-29", "fish.toh.info": "2018-08-30", "fiveavmersi.websegoo.net": "2018-08-30", "fjs.wikaba.com": "2018-08-30", "flea.poulsenv.com": "2018-08-30", "flynews.edns.biz": "2018-08-30", "fo.mysecondarydns.com": "2018-08-30", "foal.wchildress.com": "2018-08-30", "follow.wha.la": "2018-08-30", "foo.shenajou.com": "2018-08-30", "for.ddns.mobi": "2018-08-30", "forward.davidgagnon.org": "2019-06-29", "fr.wikaba.com": "2018-08-30", "franck.demoones.com": "2018-08-30", "friendlysupport.giize.com": "2018-10-24", "ftp.2014.zzux.com": "2018-08-30", "ftp.additional.sexidude.com": "2018-08-30", "ftp.afc.https443.org": "2018-08-30", "ftp.announcements.toythieves.com": "2018-08-30", "ftp.apple.ikwb.com": "2018-08-30", "ftp.appledownload.ourhobby.com": "2018-08-30", "ftp.appleimages.itemdb.com": "2018-08-30", "ftp.appleimages.longmusic.com": "2018-08-30", "ftp.appleimages.organiccrap.com": "2018-08-30", "ftp.applemirror.organiccrap.com": "2018-08-30", "ftp.applemirror.squirly.info": "2018-08-30", "ftp.applemusic.isasecret.com": "2018-08-30", "ftp.applemusic.itemdb.com": "2018-08-30", "ftp.applemusic.wikaba.com": "2018-08-30", "ftp.applemusic.xxuz.com": "2018-08-30", "ftp.applemusic.zzux.com": "2018-08-30", "ftp.appleupdate.itemdb.com": "2018-08-30", "ftp.architectisusa.com": "2018-08-30", "ftp.asfzx.x24hr.com": "2018-08-30", "ftp.availab.wikaba.com": "2018-08-30", "ftp.availability.justdied.com": "2018-08-30", "ftp.back.jungleheart.com": "2018-08-30", "ftp.balance1.wikaba.com": "2018-08-30", "ftp.be.mrslove.com": "2018-08-30", "ftp.brand.fartit.com": "2018-08-30", "ftp.bulletproof.squirly.info": "2018-08-30", "ftp.cia.ezua.com": "2018-08-30", "ftp.cia.toh.info": "2018-08-30", "ftp.civilwar123.authorizeddns.org": "2018-08-30", "ftp.civilwar520.onmypc.org": "2018-08-30", "ftp.cloudfileserverbs.dynamicdns.co.uk": "2018-08-30", "ftp.cnnews.mylftv.com": "2018-08-30", "ftp.commons.onedumb.com": "2018-08-30", "ftp.contractus.qpoe.com": "2018-08-30", "ftp.cvnx.zyns.com": "2018-08-30", "ftp.de.onmypc.info": "2018-08-30", "ftp.details.squirly.info": "2018-08-30", "ftp.devilcase.acmetoy.com": "2018-08-30", "ftp.disruptive.https443.net": "2018-08-30", "ftp.domainnow.yourtrap.com": "2018-08-30", "ftp.ea.onmypc.info": "2018-08-30", "ftp.ehshiroshima.mylftv.com": "2018-08-30", "ftp.eric-averyanov.wha.la": "2018-08-30", "ftp.eu.acmetoy.com": "2018-08-30", "ftp.eu.wha.la": "2018-08-30", "ftp.eu.zzux.com": "2018-08-30", "ftp.fbi.sexxxy.biz": "2018-08-30", "ftp.file.zzux.com": "2018-08-30", "ftp.findme.epac.to": "2018-08-30", "ftp.fire.mrface.com": "2018-08-30", "ftp.fjs.wikaba.com": "2018-08-30", "ftp.fr.wikaba.com": "2018-08-30", "ftp.fuck.ikwb.com": "2018-08-30", "ftp.fuckmm.dns-dns.com": "2018-08-30", "ftp.generat.almostmy.com": "2018-08-30", "ftp.goldtoyota.com": "2018-08-30", "ftp.goodmusic.justdied.com": "2018-08-30", "ftp.helpus.ddns.info": "2018-08-30", "ftp.hii.qhigh.com": "2018-08-30", "ftp.innocent-isayev.sexidude.com": "2018-08-30", "ftp.invoices.sexxxy.biz": "2018-08-30", "ftp.iphone.vizvaz.com": "2018-08-30", "ftp.itlans.isasecret.com": "2018-08-30", "ftp.itunesdownload.jkub.com": "2018-08-30", "ftp.itunesdownload.wikaba.com": "2018-08-30", "ftp.itunesimages.itemdb.com": "2018-08-30", "ftp.itunesimages.itsaol.com": "2018-08-30", "ftp.itunesimages.qpoe.com": "2018-08-30", "ftp.itunesmirror.fartit.com": "2018-08-30", "ftp.itunesmirror.itsaol.com": "2018-08-30", "ftp.itunesmusic.ikwb.com": "2018-08-30", "ftp.itunesmusic.jetos.com": "2018-08-30", "ftp.itunesmusic.jkub.com": "2018-08-30", "ftp.itunesmusic.zzux.com": "2018-08-30", "ftp.itunesupdate.itsaol.com": "2018-08-30", "ftp.itunesupdates.organiccrap.com": "2018-08-30", "ftp.japanfilmsite.ikwb.com": "2018-08-30", "ftp.jimin.mymom.info": "2018-08-30", "ftp.jp.serveuser.com": "2018-08-30", "ftp.key.zzux.com": "2018-08-30", "ftp.knowledge.sellclassics.com": "2018-08-30", "ftp.lan.dynssl.com": "2018-08-30", "ftp.latestnews.epac.to": "2018-08-30", "ftp.latestnews.organiccrap.com": "2018-08-30", "ftp.leedong.longmusic.com": "2018-08-30", "ftp.macfee.mrface.com": "2018-08-30", "ftp.maffc.mrface.com": "2018-08-30", "ftp.malware.dsmtp.com": "2018-08-30", "ftp.manager.jetos.com": "2018-08-30", "ftp.martin.sellclassics.com": "2018-08-30", "ftp.mason.vizvaz.com": "2018-08-30", "ftp.mediapath.organiccrap.com": "2018-08-30", "ftp.microsoft.got-game.org": "2018-08-30", "ftp.microsoft.mrface.com": "2018-08-30", "ftp.microsoftimages.organiccrap.com": "2018-08-30", "ftp.microsoftmusic.mrbasic.com": "2018-08-30", "ftp.microsoftqckmanager.pcanywhere.net": "2018-08-30", "ftp.microsoftupdate.mrbasic.com": "2018-08-30", "ftp.microsoftupdate.qhigh.com": "2018-08-30", "ftp.micrsoftware.dsmtp.com": "2018-08-30", "ftp.mircsoft.compress.to": "2018-08-30", "ftp.mmy.ddns.us": "2018-08-30", "ftp.mod.jetos.com": "2018-08-30", "ftp.mofa.dynamic-dns.net": "2018-08-30", "ftp.mofa.ns01.info": "2018-08-30", "ftp.moscowdic.trickip.org": "2018-08-30", "ftp.msg.ezua.com": "2018-08-30", "ftp.musicfile.ikwb.com": "2018-08-30", "ftp.musicjj.zzux.com": "2018-08-30", "ftp.mymusicbox.vizvaz.com": "2018-08-30", "ftp.myphpwebsite.itsaol.com": "2018-08-30", "ftp.myrestroomimage.isasecret.com": "2018-08-30", "ftp.na.americanunfinished.com": "2018-08-30", "ftp.na.onmypc.org": "2018-08-30", "ftp.newsdata.jkub.com": "2018-08-30", "ftp.newsroom.cleansite.info": "2018-08-30", "ftp.no.authorizeddns.org": "2018-08-30", "ftp.nsa.mefound.com": "2018-08-30", "ftp.nt.mynumber.org": "2018-08-30", "ftp.nttdata.otzo.com": "2018-08-30", "ftp.nz.compress.to": "2018-08-30", "ftp.ol.almostmy.com": "2018-08-30", "ftp.oracleupdate.dns04.com": "2018-08-30", "ftp.portal.mrface.com": "2018-08-30", "ftp.portal.sendsmtp.com": "2018-08-30", "ftp.portalser.dynamic-dns.net": "2018-08-30", "ftp.praskovya-matveyeva.mefound.com": "2018-08-30", "ftp.praskovya-ulyanova.dumb1.com": "2018-08-30", "ftp.products.almostmy.com": "2018-08-30", "ftp.products.cleansite.us": "2018-08-30", "ftp.products.serveuser.com": "2018-08-30", "ftp.purchase.lflinkup.org": "2018-08-30", "ftp.recent.dns-stuff.com": "2018-08-30", "ftp.recent.fartit.com": "2018-08-30", "ftp.referred.gr8domain.biz": "2018-08-30", "ftp.referred.yourtrap.com": "2018-08-30", "ftp.register.ourhobby.com": "2018-08-30", "ftp.registration2.instanthq.com": "2018-08-30", "ftp.registrations.4pu.com": "2018-08-30", "ftp.registrations.organiccrap.com": "2018-08-30", "ftp.remeberdata.iownyour.org": "2018-08-30", "ftp.reserveds.onedumb.com": "2018-08-30", "ftp.rethem.almostmy.com": "2018-08-30", "ftp.sdmsg.onmypc.org": "2018-08-30", "ftp.se.toythieves.com": "2018-08-30", "ftp.secertnews.mrbasic.com": "2018-08-30", "ftp.senseye.ikwb.com": "2018-08-30", "ftp.senseye.mrbonus.com": "2018-08-30", "ftp.septdlluckysystem.jungleheart.com": "2018-08-30", "ftp.seraphim-yurieva.justdied.com": "2018-08-30", "ftp.serv.justdied.com": "2018-08-30", "ftp.server1.proxydns.com": "2018-08-30", "ftp.seyesb.acmetoy.com": "2018-08-30", "ftp.shugiin.jkub.com": "2018-08-30", "ftp.singed.otzo.com": "2018-08-30", "ftp.sstday.jkub.com": "2018-08-30", "ftp.support1.mrface.com": "2018-08-30", "ftp.supportus.mefound.com": "2018-08-30", "ftp.svc.dynssl.com": "2018-08-30", "ftp.synssl.dnset.com": "2018-08-30", "ftp.tamraj.fartit.com": "2018-08-30", "ftp.tfa.longmusic.com": "2018-08-30", "ftp.thunder.wikaba.com": "2018-08-30", "ftp.ticket.instanthq.com": "2018-08-30", "ftp.ticket.serveuser.com": "2018-08-30", "ftp.tokyofile.2waky.com": "2018-08-30", "ftp.tophost.dynamicdns.co.uk": "2018-08-30", "ftp.transfer.lflinkup.org": "2018-08-30", "ftp.transfer.mrbasic.com": "2018-08-30", "ftp.transfer.vizvaz.com": "2018-08-30", "ftp.ugreen.itemdb.com": "2018-08-30", "ftp.uk.dynamicdns.org.uk": "2018-08-30", "ftp.un.ddns.info": "2018-08-30", "ftp.un.dnsrd.com": "2018-08-30", "ftp.usa.itsaol.com": "2018-08-30", "ftp.well.itsaol.com": "2018-08-30", "ftp.well.mrbasic.com": "2018-08-30", "ftp.wike.wikaba.com": "2018-08-30", "ftp.windowfile.itemdb.com": "2018-08-30", "ftp.windowsimages.itemdb.com": "2018-08-30", "ftp.windowsimages.qhigh.com": "2018-08-30", "ftp.windowsmirrors.vizvaz.com": "2018-08-30", "ftp.windowsupdate.2waky.com": "2018-08-30", "ftp.windowsupdate.3-a.net": "2018-08-30", "ftp.windowsupdate.authorizeddns.us": "2018-08-30", "ftp.windowsupdate.dns05.com": "2018-08-30", "ftp.windowsupdate.esmtp.biz": "2018-08-30", "ftp.windowsupdate.ezua.com": "2018-08-30", "ftp.windowsupdate.fartit.com": "2018-08-30", "ftp.windowsupdate.gettrials.com": "2018-08-30", "ftp.windowsupdate.instanthq.com": "2018-08-30", "ftp.windowsupdate.jungleheart.com": "2018-08-30", "ftp.windowsupdate.lflink.com": "2018-08-30", "ftp.windowsupdate.mrface.com": "2018-08-30", "ftp.windowsupdate.mylftv.com": "2018-08-30", "ftp.windowsupdate.rebatesrule.net": "2018-08-30", "ftp.windowsupdate.sellclassics.com": "2018-08-30", "ftp.windowsupdate.serveusers.com": "2018-08-30", "ftp.yandexr.sellclassics.com": "2018-08-30", "fu.epac.to": "2018-08-30", "fuck.ikwb.com": "2018-08-30", "fuck.wikaba.com": "2024-11-30", "fuckanti.com": "2018-08-30", "fuckdd.8800.org": "2018-08-30", "fuckmm.8800.org": "2018-08-30", "fuckmm.dns-dns.com": "2018-08-30", "fukuoka.cloud-maste.com": "2017-04-14", "g3ypf.online": "2018-08-30", "gadskysun.com": "2018-08-30", "gavin.ccfchrist.com": "2017-04-18", "generat.almostmy.com": "2018-08-30", "generousd.hopto.org": "2018-08-30", "gensuzuki.6600.org": "2018-08-30", "getfond.info": "2018-08-30", "gh.mysecondarydns.com": "2018-08-30", "gifuonlineshopping.mynumber.org": "2018-08-30", "glicense.shenajou.com": "2018-08-30", "globalnews.wikaba.com": "2018-08-30", "gmail.com.mailsserver.com": "2018-08-30", "gmpcw.com": "2018-08-30", "gold.polopurple.com": "2018-08-30", "goldtoyota.com": "2018-08-30", "goodjob36.publicvm.com": "2022-06-13", "goodluck23.jp.us": "2022-06-13", "goodmusic.justdied.com": "2018-08-30", "goodsampjp.com": "2018-08-30", "gooesdataios.instanthq.com": "2018-08-30", "google.macforlinux.net": "2018-08-30", "google.usrobothome.com": "2018-08-30", "googlemeail.com": "2018-08-30", "gostudyantivirus.com": "2018-08-30", "gostudymbaa.com": "2018-08-30", "gotourisma.com": "2018-08-30", "grandeur.kozow.com": "2019-06-29", "grandfoodtony.com": "2022-06-28", "gt4study.com": "2018-08-30", "gtsofta.com": "2018-08-30", "hamiltion.catholicmmb.com": "2017-04-18", "haoyujd.info": "2018-08-30", "happy.workerisgood.com": "2018-08-30", "have8000.com": "2018-08-30", "helpinfo.publicvm.com": "2022-06-13", "helpus.ddns.info": "2018-08-30", "helshellfucde.8866.org": "2018-08-30", "herring.kozow.com": "2019-06-29", "hg8fmv.racing": "2018-08-30", "hii.qhigh.com": "2018-08-30", "hinitial.com": "2022-06-13", "hk.2012yearleft.com": "2018-08-30", "hk.cmdnetview.com": "2018-08-30", "hk.have8000.com": "2018-08-30", "hk.loveddos.com": "2018-08-30", "home.trickip.org": "2018-08-30", "hostport9.net": "2018-08-30", "hotkillmail9sddcc.ddns.net": "2019-06-25", "hotmai.info": "2018-08-30", "hotmail.com.mailsserver.com": "2018-08-30", "houwags.defineyourid.site": "2022-06-28", "hukuoka.cloud-maste.com": "2018-08-30", "iamges.itunesmusic.jkub.com": "2018-08-30", "ibmmsg.strangled.net": "2018-08-30", "icfeds.cf": "2018-08-30", "idpmus.hostport9.net": "2018-08-30", "ijica.in": "2018-08-30", "im.suibian2010.info": "2018-08-30", "image.websago.info": "2018-08-30", "images.cdn-sina.tw": "2023-10-28", "images.itunesmusic.jkub.com": "2018-08-30", "images.thedomais.info": "2018-08-30", "images.tyoto-go-jp.com": "2018-08-30", "images.windowsupdate.organiccrap.com": "2018-08-30", "imap.architectisusa.com": "2018-08-30", "imap.dnset.com": "2018-08-30", "imap.lflink.com": "2018-08-30", "imap.onmypc.net": "2018-08-30", "imap.ygto.com": "2018-08-30", "img.microtoo.info": "2019-06-29", "img.station155.com": "2018-08-30", "improvejpese.com": "2018-08-30", "incloud-go.com": "2018-08-30", "incloud-obert.com": "2018-08-30", "info.publicvm.com": "2023-05-19", "info.uroljp.com": "2019-06-29", "ingemar.catholicmmb.com": "2018-08-30", "innocent-isayev.sexidude.com": "2018-08-30", "innov-tec.com.ua": "2018-08-30", "inspgon.re26.com": "2017-04-14", "interpreter.shenajou.com": "2018-08-30", "invoices.sexxxy.biz": "2018-08-30", "io.jkub.com": "2018-08-30", "iphone.vizvaz.com": "2017-04-14", "ipv4.applemusic.itemdb.com": "2018-08-30", "ipv4.itunesmusic.jkub.com": "2018-08-30", "ipv4.japanenvnews.qpoe.com": "2018-08-30", "ipv4.microsoftmusic.onedumb.com": "2018-08-30", "ipv4.microsoftupdate.mrbasic.com": "2018-08-30", "ipv4.microsoftupdate.qhigh.com": "2018-08-30", "ipv4.windowsupdate.3-a.net": "2018-08-30", "ipv4.windowsupdate.authorizeddns.org": "2018-08-30", "ipv4.windowsupdate.authorizeddns.us": "2018-08-30", "ipv4.windowsupdate.dnset.com": "2018-08-30", "ipv4.windowsupdate.esmtp.biz": "2018-08-30", "ipv4.windowsupdate.ezua.com": "2018-08-30", "ipv4.windowsupdate.fartit.com": "2018-08-30", "ipv4.windowsupdate.gettrials.com": "2018-08-30", "ipv4.windowsupdate.itsaol.com": "2018-08-30", "ipv4.windowsupdate.lflink.com": "2018-08-30", "ipv4.windowsupdate.lflinkup.com": "2018-08-30", "ipv4.windowsupdate.mrface.com": "2018-08-30", "ipv4.windowsupdate.mylftv.com": "2018-08-30", "ipv4.windowsupdate.nsatcdns.com": "2018-08-30", "ipv4.windowsupdate.x24hr.com": "2018-08-30", "ipv6microsoft.dlmix.ourdvs.com": "2018-08-30", "itlans.isasecret.com": "2018-08-30", "itunesdownload.jkub.com": "2018-08-30", "itunesdownload.vizvaz.com": "2018-08-30", "itunesdownload.wikaba.com": "2018-08-30", "itunesimages.itemdb.com": "2018-08-30", "itunesimages.itsaol.com": "2018-08-30", "itunesimages.qpoe.com": "2018-08-30", "itunesmirror.fartit.com": "2018-08-30", "itunesmirror.itsaol.com": "2018-08-30", "itunesmusic.ikwb.com": "2018-08-30", "itunesmusic.jetos.com": "2018-08-30", "itunesmusic.jkub.com": "2018-08-30", "itunesmusic.zzux.com": "2018-08-30", "itunesupdate.itsaol.com": "2018-08-30", "itunesupdates.organiccrap.com": "2018-08-30", "iu.niushenghuo.info": "2019-06-29", "iw.mrslove.com": "2018-08-30", "ixrayeye.com": "2018-08-30", "jack.micfkbeljacob.com": "2022-06-13", "jadl-or.com": "2018-09-13", "james.tffghelth.com": "2018-08-30", "janpan.bigmoney.biz": "2018-08-30", "janpun.americanunfinished.com": "2018-08-30", "jap.japanmusicinfo.com": "2018-08-30", "japan.fuckanti.com": "2018-08-30", "japan.linuxforover.com": "2018-08-30", "japan.loveddos.com": "2018-08-30", "japanenvnews.qpoe.com": "2018-08-30", "japanfilmsite.ikwb.com": "2018-08-30", "japanfst.japanteam.org": "2018-08-30", "japanmusicinfo.com": "2018-08-30", "japanteam.org": "2018-08-30", "jcie.mofa.ns01.info": "2018-08-30", "jepsen.r3u8.com": "2018-08-30", "jica-go-jp.bike": "2018-08-30", "jica-go-jp.biz": "2018-08-30", "jimin-jp.biz": "2018-08-30", "jimin.jimindaddy.com": "2017-04-14", "jimin.mymom.info": "2018-08-30", "jimindaddy.com": "2018-08-30", "jimingroup.com": "2018-08-30", "jimintokoy.com": "2018-08-30", "jj.mysecondarydns.com": "2018-08-30", "jmuroran.com": "2018-08-30", "jp.rakutenmusic.com": "2018-08-30", "jp.serveuser.com": "2018-08-30", "jpcert.org": "2018-08-30", "jpn.longmusic.com": "2018-08-30", "jpnxzshopdata.authorizeddns.org": "2018-08-30", "jpstarmarket.serveusers.com": "2018-08-30", "js001.3322.org": "2019-06-29", "kaka.lehigtapp.com": "2018-08-30", "kankuedu.org": "2022-06-28", "kaspresksy.com": "2019-05-24", "kawasaki.cloud-maste.com": "2017-04-14", "kawasaki.unhamj.com": "2017-04-14", "kennedy.tffghelth.com": "2018-08-30", "key.zzux.com": "2018-08-30", "keyscratch.com": "2019-02-05", "kikimusic.sellclassics.com": "2018-08-30", "kmd.crabdance.com": "2018-08-30", "knowledge.sellclassics.com": "2018-08-30", "ktgmktanxgvn.r3u8.com": "2018-08-30", "kxsbwappupdate.dhcp.biz": "2018-08-30", "kyolpon.com": "2026-01-02", "kztmusiclnk.dnsrd.com": "2018-08-30", "lan.dynssl.com": "2018-08-30", "last.p6p6.net": "2018-08-30", "latestnews.epac.to": "2018-08-30", "latestnews.organiccrap.com": "2018-08-30", "leedong.longmusic.com": "2018-08-30", "lehigtapp.com": "2018-08-30", "lennon.fftpoor.com": "2018-08-30", "license.shenajou.com": "2018-08-30", "lie.jetos.com": "2018-08-30", "linuxforover.com": "2018-08-30", "linuxsofta.com": "2018-08-30", "lion.wchildress.com": "2017-04-14", "live.musicweb.xyz": "2022-06-28", "lizard.poulsenv.com": "2018-08-30", "logon-live.com": "2018-08-30", "lottedfstravel.webbooting.com": "2018-08-30", "loveddos.com": "2018-08-30", "lzf550.r3u8.com": "2018-08-30", "ma.vizvaz.com": "2018-08-30", "mac.goldtoyota.com": "2018-08-30", "mac.methoder.com": "2018-08-30", "macfee.mrface.com": "2018-08-30", "macforlinux.net": "2018-08-30", "maffc.mrface.com": "2018-08-30", "mail.architectisusa.com": "2018-08-30", "mail.macforlinux.net": "2018-08-30", "mailcarriage.co.uk": "2018-08-30", "mailedc.publicvm.com": "2022-06-13", "mailj.hostport9.net": "2018-08-30", "mailserever.com": "2018-08-30", "mailsserver.com": "2018-08-30", "mailvserver.com": "2018-08-30", "malcolm.fftpoor.com": "2018-08-30", "malware.DSMTP.COM": "2019-06-29", "malware.dsmtp.com": "2018-08-30", "manager.architectisusa.com": "2018-08-30", "manager.jetos.com": "2018-08-30", "markabcinfo.dynamicdns.me.uk": "2018-08-30", "martin.sellclassics.com": "2018-08-30", "mason.vizvaz.com": "2018-08-30", "mbaby.macforlinux.net": "2018-08-30", "medexplor.thedomais.info": "2018-08-30", "mediapath.organiccrap.com": "2018-08-30", "meibubaker.3322.org": "2019-06-29", "meiji-ac-jp.com": "2018-08-30", "mesjm.emailfound.info": "2018-08-30", "message.emailfound.info": "2018-08-30", "message.p6p6.net": "2018-08-30", "messagea.emailfound.info": "2018-08-30", "methoder.com": "2018-08-30", "mf.ddns.info": "2018-08-30", "micfkbeljacob.com": "2022-06-13", "microcnmlgb.3322.org": "2018-08-30", "microdef.2288.org": "2018-08-30", "microhome.wikaba.com": "2018-08-30", "microsoft.got-game.org": "2018-08-30", "microsoft.mrface.com": "2018-08-30", "microsoftdownload.zzux.com": "2018-08-30", "microsoftempowering.sendsmtp.com": "2018-08-30", "microsoften.com": "2018-08-30", "microsoftgame.mrface.com": "2018-08-30", "microsoftgetstarted.sexidude.com": "2018-08-30", "microsoftimages.organiccrap.com": "2018-08-30", "microsoftmirror.mrbasic.com": "2018-08-30", "microsoftmusic.itemdb.com": "2018-08-30", "microsoftmusic.mrbasic.com": "2018-08-30", "microsoftmusic.onedumb.com": "2018-08-30", "microsoftqckmanager.pcanywhere.net": "2018-08-30", "microsofts.org": "2019-05-24", "microsoftstore.jetos.com": "2018-08-30", "microsoftstores.itemdb.com": "2018-08-30", "microsoftupdate.mrbasic.com": "2018-08-30", "microsoftupdate.qhigh.com": "2018-08-30", "microsoftupdates.vizvaz.com": "2018-08-30", "microtoo.info": "2019-06-29", "micrsoftware.dsmtp.com": "2018-08-30", "mircsoft.compress.to": "2018-08-30", "miscrosofts.com": "2019-05-24", "mivsee.website0012.net": "2018-08-30", "mmofoojap.2288.org": "2018-08-30", "mmy.ddns.us": "2018-08-30", "mobile.2waky.com": "2018-08-30", "mocha.100fanwen.com": "2018-08-30", "mod.jetos.com": "2018-08-30", "mofa-go-jp.com": "2018-08-30", "mofa.dynamic-dns.net": "2018-08-30", "mofa.ns01.info": "2018-08-30", "mofa.strangled.net": "2018-08-30", "mofaess.com": "2018-08-30", "mongoles.3322.org": "2018-08-30", "monkey.2012yearleft.com": "2018-08-30", "moscowstdsupdate.toythieves.com": "2018-08-30", "mrsloveaqx.mrslove.com": "2018-08-30", "ms.ecc.u-tokyo-ac-jp.com": "2018-08-30", "mseupdate.ourhobby.com": "2018-08-30", "msg.ezua.com": "2018-08-30", "msn.incloud-go.com": "2017-04-14", "muller.exprenum.com": "2018-08-30", "music.applemusic.itemdb.com": "2018-08-30", "music.cleansite.us": "2018-08-30", "music.websegoo.net": "2018-08-30", "musicfile.ikwb.com": "2018-08-30", "musicinfo.everydayfilmlink.com": "2018-08-30", "musiclinker.jkub.com": "2018-08-30", "musicsecph.squirly.info": "2018-08-30", "musicweb.xyz": "2022-06-28", "mx.yetrula.eu": "2018-08-30", "myie12.com": "2018-08-30", "mymusicbox.lflinkup.org": "2018-08-30", "mymusicbox.vizvaz.com": "2018-08-30", "myphpwebsite.itsaol.com": "2018-08-30", "myrestroomimage.isasecret.com": "2018-08-30", "myststemsgame.com": "2026-01-02", "mytwhomeinst.sendsmtp.com": "2018-08-30", "myurinikoreaaps.ninth.biz": "2018-08-30", "na.americanunfinished.com": "2018-08-30", "na.onmypc.org": "2018-08-30", "nasa.xxuz.com": "2018-08-30", "nec.website0012.net": "2018-08-30", "news.100fanwen.com": "2018-08-30", "newsdata.jkub.com": "2018-08-30", "newsfile.toythieves.com": "2018-08-30", "newsreport.justdied.com": "2018-08-30", "newsroom.cleansite.info": "2018-08-30", "nezwq.ezua.com": "2018-08-30", "ngcc.8800.org": "2018-08-30", "niushenghuo.info": "2018-08-30", "nk10.belowto.com": "2018-08-30", "nk20.belowto.com": "2018-08-30", "nlddnsinfo.https443.org": "2018-08-30", "nmrx.mrbonus.com": "2018-08-30", "nn.dynssl.com": "2018-08-30", "no.authorizeddns.org": "2018-08-30", "node.mofaess.com": "2018-08-30", "nodns2.qipian.org": "2018-08-30", "noub.crabdance.com": "2022-06-28", "nposnewsinfo.qhigh.com": "2018-08-30", "ns1.belowto.com": "2018-08-30", "ns1.tlchs2.ml": "2018-08-30", "ns1.tlsart.com": "2024-11-30", "ns2.belowto.com": "2018-08-30", "ns21.belowto.com": "2018-08-30", "ns22.belowto.com": "2018-08-30", "ns4.belowto.com": "2018-08-30", "ns5.belowto.com": "2018-08-30", "nsa.mefound.com": "2018-08-30", "nsatcdns.com": "2018-08-30", "nt.mynumber.org": "2018-08-30", "nttdata.otzo.com": "2017-04-14", "nunluck.re26.com": "2017-04-14", "nz.compress.to": "2018-08-30", "obj.services": "2022-06-28", "obo.videocenter.org": "2022-06-28", "oipbl.com": "2018-08-30", "ol.almostmy.com": "2018-08-30", "oldbmwy.com": "2018-08-30", "oms.sindeali.com": "2018-08-30", "openmofa.8866.org": "2018-08-30", "oracleupdate.dns04.com": "2018-08-30", "order.cargobussiness.site": "2022-06-28", "osaka-jpgo.com": "2018-08-30", "oseupdate.dns-dns.com": "2020-03-17", "outlook.otzo.com": "2018-08-30", "owlmedia.mefound.com": "2018-08-30", "p6p6.net": "2018-08-30", "peopleinfodata.3-a.net": "2018-08-30", "phptecinfohelp.itemdb.com": "2018-08-30", "pictures.everydayfilmlink.com": "2018-08-30", "pj.qpoe.com": "2018-08-30", "points.mofaess.com": "2018-08-30", "polopurple.com": "2018-08-30", "pop.architectisusa.com": "2018-08-30", "pop.loveddos.com": "2018-08-30", "portal.mrface.com": "2018-08-30", "portal.sendsmtp.com": "2018-08-30", "portalser.dynamic-dns.net": "2018-08-30", "poulsenv.com": "2018-08-30", "praskovya-matveyeva.mefound.com": "2018-08-30", "praskovya-ulyanova.dumb1.com": "2018-08-30", "premium.redforlinux.com": "2018-08-30", "products.almostmy.com": "2018-08-30", "products.cleansite.us": "2018-08-30", "products.serveuser.com": "2018-08-30", "program.acmetoy.com": "2018-08-30", "prrmes4019.r3u8.com": "2018-08-30", "purchase.lflinkup.org": "2018-08-30", "q6.niushenghuo.info": "2018-08-30", "qtsofta.com": "2018-08-30", "quick.oldbmwy.com": "2018-08-30", "r3u8.com": "2018-08-30", "radiorig.com": "2018-08-30", "rain.orctldl.windowsupdate.authorizeddns.us": "2018-08-30", "rakutenmusic.com": "2018-08-30", "rare-coisns.com": "2021-02-01", "rdns-4.infoproduto1.tk": "2018-08-30", "re26.com": "2018-08-30", "read.xxuz.com": "2018-08-30", "recent.dns-stuff.com": "2018-08-30", "recent.fartit.com": "2018-08-30", "record.hostport9.net": "2018-08-30", "record.webssl9.info": "2018-08-30", "record.wschandler.com": "2018-08-30", "redforlinux.com": "2018-08-30", "referred.gr8domain.biz": "2018-08-30", "referred.yourtrap.com": "2018-08-30", "register.ourhobby.com": "2018-08-30", "registration2.instanthq.com": "2018-08-30", "registrations.4pu.com": "2018-08-30", "registrations.organiccrap.com": "2018-08-30", "reports.tomorrowforgood.com": "2018-08-30", "reserveds.onedumb.com": "2018-08-30", "resource.arkouowi.com": "2019-06-29", "resources.applemusic.itemdb.com": "2018-08-30", "rethem.almostmy.com": "2018-08-30", "rg197.win": "2018-08-30", "rlbeiydn.hi.r3u8.com": "2018-08-30", "rosaf112.ddns.net": "2019-06-25", "rvenee.com": "2019-06-29", "saiyo.exprenum.com": "2018-08-30", "sakai.unhamj.com": "2017-04-14", "salvaiona.com": "2018-08-30", "sappore.cloud-maste.com": "2018-08-30", "sapporo.cloud-maste.com": "2018-08-30", "sapporot.com": "2018-08-30", "saspecialforces.co.za": "2023-04-26", "sat.suayay.com": "2018-08-30", "saverd.re26.com": "2018-08-30", "sbuudd.webssl9.info": "2018-08-30", "sc.weboot.info": "2018-08-30", "scholz-versand.com": "2018-08-30", "scorpion.poulsenv.com": "2017-04-14", "scrlk.exprenum.com": "2018-08-30", "sdmsg.onmypc.org": "2018-08-30", "se.toythieves.com": "2018-08-30", "sea.websegoo.net": "2018-08-30", "secertnews.mrbasic.com": "2018-08-30", "secmicrosooo.6600.org": "2018-08-30", "secnetshit.com": "2018-08-30", "secserverupdate.toh.info": "2018-08-30", "sell.mofaess.com": "2018-08-30", "sema.linuxsofta.com": "2018-08-30", "send.have8000.com": "2018-08-30", "send.mofa.ns01.info": "2018-08-30", "sendmsg.jumpingcrab.com": "2018-08-30", "senseye.ikwb.com": "2018-08-30", "senseye.mrbonus.com": "2018-08-30", "septdlluckysystem.jungleheart.com": "2018-08-30", "seraphim-yurieva.justdied.com": "2018-08-30", "serv.justdied.com": "2018-08-30", "server1.proxydns.com": "2018-08-30", "services.arkouowi.com": "2019-06-29", "serviceusa.duckdns.org": "2026-01-02", "seyesb.acmetoy.com": "2018-08-30", "sh.chromeenter.com": "2019-06-29", "sha.25u.com": "2018-08-30", "sha.ikwb.com": "2018-08-30", "shell.cdn-sina.tw": "2023-10-28", "shenajou.com": "2018-08-30", "shoppingcentre.station155.com": "2018-08-30", "shrimp.bdoncloud.com": "2018-08-30", "shrimp.usffunicef.com": "2018-08-30", "shugiin.jkub.com": "2018-08-30", "sindeali.com": "2018-08-30", "singed.otzo.com": "2018-08-30", "siteinit.info": "2018-08-30", "sky.oldbmwy.com": "2018-08-30", "sma.jimindaddy.com": "2018-08-30", "smo.gadskysun.com": "2018-08-30", "smtp.architectisusa.com": "2018-08-30", "smtp.macforlinux.net": "2018-08-30", "smtp230.toldweb.com": "2018-08-30", "somthing.re26.com": "2018-08-30", "srmbr.com": "2024-12-23", "srmbr.net": "2026-01-02", "sstday.Jkub.com": "2019-06-29", "sstday.jkub.com": "2018-08-30", "start.usrobothome.com": "2018-08-30", "station155.com": "2018-08-30", "stevenlf.com": "2018-08-30", "stone.jumpingcrab.com": "2018-08-30", "style.u-tokyo-ac-jp.com": "2018-08-30", "suayay.com": "2018-08-30", "suibian2010.info": "2018-08-30", "support1.mrface.com": "2018-08-30", "supportus.mefound.com": "2018-08-30", "suzukigooogle.8866.org": "2018-08-30", "svc.dynssl.com": "2018-08-30", "synssl.dnset.com": "2018-08-30", "sz.thedomais.info": "2018-08-30", "sz2016rose.ddns.net": "2019-06-25", "t1.hinitial.com": "2022-06-13", "taipei.yourtrap.com": "2018-08-30", "taipeifoodsite.ocry.com": "2018-08-30", "tamraj.fartit.com": "2018-08-30", "tech.obj.services": "2022-06-28", "telegraph.mefound.com": "2018-08-30", "tencentchat.net": "2019-05-24", "test.usyahooapis.com": "2018-08-30", "tfa.longmusic.com": "2018-08-30", "tffghelth.com": "2018-08-30", "thedomais.info": "2018-08-30", "ticket.instanthq.com": "2018-08-30", "ticket.jetos.com": "2018-08-30", "ticket.serveuser.com": "2018-08-30", "tidatacenter.shenajou.com": "2018-08-30", "tisdatacenter.shenajou.com": "2018-08-30", "tisupdateinfo.faqserv.com": "2018-08-30", "tlsart.com": "2024-11-30", "tmpxctl.com": "2019-06-29", "tokyo-gojp.com": "2018-08-30", "tokyofile.2waky.com": "2018-08-30", "tomorrowforgood.com": "2018-08-30", "tophost.dynamicdns.co.uk": "2018-08-30", "toshste.com": "2018-08-30", "toya.7766.org": "2018-08-30", "transfer.lflinkup.org": "2018-08-30", "transfer.mrbasic.com": "2018-08-30", "transfer.vizvaz.com": "2018-08-30", "trasul.myPicture.info": "2019-06-29", "trasul.mypicture.info": "2018-08-30", "travelyokogawafz.fartit.com": "2018-08-30", "trems.rvenee.com": "2019-06-29", "trendmicroupdate.shenajou.com": "2018-08-30", "trendsecurity.shenajou.com": "2018-08-30", "trout.belowto.com": "2017-04-14", "tv.goldtoyota.com": "2018-08-30", "tw.2012yearleft.com": "2018-08-30", "tw8sl.com": "2024-12-23", "twmusic.proxydns.com": "2018-08-30", "twpeoplemusicsite.my03.com": "2018-08-30", "twtravelinfomation.toythieves.com": "2018-08-30", "twx.mynumber.org": "2018-08-30", "tyoto-go-jp.com": "2018-08-30", "u-tokyo-ac-jp.com": "2018-08-30", "u1.fartit.com": "2018-08-30", "u1.haoyujd.info": "2018-08-30", "ubuntusofta.com": "2018-08-30", "ugreen.itemdb.com": "2018-08-30", "ui.hdcdui.com": "2018-08-30", "uk.dynamicdns.org.uk": "2018-08-30", "ukuoka.cloud-maste.com": "2018-08-30", "ultimedia.vmmini.com": "2018-08-30", "un.ddns.info": "2018-08-30", "un.dnsrd.com": "2018-08-30", "unhamj.com": "2018-08-30", "unspa.hostport9.net": "2019-06-29", "update.arkouowi.com": "2018-10-24", "update.yourtrap.com": "2018-08-30", "updatemirrors.fartit.com": "2018-08-30", "updates.itsaol.com": "2018-08-30", "ups.improvejpese.com": "2018-08-30", "urearapetsu.com": "2018-08-30", "uroljp.com": "2019-06-29", "usa.got-game.org": "2018-08-30", "usa.itsaol.com": "2018-08-30", "usa.japanteam.org": "2018-08-30", "usa.radiorig.com": "2019-06-29", "usffunicef.com": "2018-08-30", "usmirocomney.net": "2018-08-30", "usrobothome.com": "2018-08-30", "usyahooapis.com": "2018-08-30", "uu.logon-live.com": "2018-08-30", "uu.niushenghuo.info": "2018-08-30", "ux.niushenghuo.info": "2018-08-30", "v2.hinitial.com": "2022-06-13", "v3.hinitial.com": "2022-06-13", "v4.appledownload.ourhobby.com": "2018-08-30", "v4.hinitial.com": "2022-06-13", "v4.itunesmusic.jkub.com": "2018-08-30", "v4.microsoftmusic.onedumb.com": "2018-08-30", "v4.microsoftupdate.mrbasic.com": "2018-08-30", "v4.windowsupdate.authorizeddns.org": "2018-08-30", "v4.windowsupdate.dedgesuite.net": "2018-08-30", "v4.windowsupdate.dnset.com": "2018-08-30", "v4.windowsupdate.itsaol.com": "2018-08-30", "v4.windowsupdate.lflinkup.com": "2018-08-30", "v4.windowsupdate.mrface.com": "2018-08-30", "v4.windowsupdate.nsatcdns.com": "2018-08-30", "v4.windowsupdate.x24hr.com": "2018-08-30", "v4.windowsupdates.dnsrd.com": "2018-08-30", "v5.hinitial.com": "2022-06-13", "veryhuai.info": "2018-08-30", "video.vmdnsup.org": "2018-08-30", "videocenter.org": "2022-06-28", "vm.vmdnsup.org": "2019-06-29", "vmdnsup.org": "2018-08-30", "vmmini.com": "2018-08-30", "vmyiersend.websago.info": "2018-08-30", "vmyisan.website0012.net": "2018-08-30", "voov.2288.org": "2019-06-29", "vpn729380678.softether.net": "2023-04-26", "vscue.com": "2018-08-30", "wchildress.com": "2018-08-30", "wcwname.com": "2018-08-30", "wcxh.mynetav.net": "2018-08-30", "wdsupdates.com": "2018-08-30", "web.casacam.net": "2019-06-29", "webbooting.com": "2018-08-30", "webdirectnews.dynamicdns.biz": "2018-08-30", "webinfoseco.ygto.com": "2018-08-30", "webmailentry.jetos.com": "2018-08-30", "weboot.info": "2018-08-30", "websago.info": "2018-08-30", "websegoo.net": "2018-08-30", "website0012.net": "2018-08-30", "websiteboo.website0012.net": "2018-08-30", "websqlnewsmanager.ninth.biz": "2018-08-30", "webssl9.info": "2018-08-30", "weile3322a.3322.org": "2019-06-29", "weile3322b.3322.org": "2019-06-29", "well.itsaol.com": "2018-08-30", "well.mrbasic.com": "2018-08-30", "whale.toshste.com": "2018-08-30", "whellbuy.wschandler.com": "2018-08-30", "whyis.haoyujd.info": "2018-08-30", "wike.wikaba.com": "2018-08-30", "win32updates.duckdns.org": "2026-01-02", "windowfile.itemdb.com": "2018-08-30", "windows-11.duckdns.org": "2026-01-02", "windows-com.duckdns.org": "2026-01-02", "windows-defender.com": "2026-01-02", "windowsimages.itemdb.com": "2018-08-30", "windowsimages.qhigh.com": "2018-08-30", "windowsmirrors.vizvaz.com": "2018-08-30", "windowsstores.gettrials.com": "2018-08-30", "windowsstores.organiccrap.com": "2018-08-30", "windowsupdate.2waky.com": "2018-08-30", "windowsupdate.3-a.net": "2018-08-30", "windowsupdate.acmetoy.com": "2018-08-30", "windowsupdate.authorizeddns.net": "2018-08-30", "windowsupdate.authorizeddns.org": "2018-08-30", "windowsupdate.authorizeddns.us": "2018-08-30", "windowsupdate.com.mwcname.com": "2018-08-30", "windowsupdate.dedgesuite.net": "2018-08-30", "windowsupdate.dns05.com": "2018-08-30", "windowsupdate.dnset.com": "2018-08-30", "windowsupdate.esmtp.biz": "2018-08-30", "windowsupdate.ezua.com": "2018-08-30", "windowsupdate.fartit.com": "2018-08-30", "windowsupdate.gettrials.com": "2018-08-30", "windowsupdate.instanthq.com": "2018-08-30", "windowsupdate.itsaol.com": "2018-08-30", "windowsupdate.jungleheart.com": "2018-08-30", "windowsupdate.lflink.com": "2018-08-30", "windowsupdate.mrface.com": "2018-08-30", "windowsupdate.mylftv.com": "2018-08-30", "windowsupdate.nsatcdns.com": "2018-08-30", "windowsupdate.organiccrap.com": "2018-08-30", "windowsupdate.rebatesrule.net": "2018-08-30", "windowsupdate.sellclassics.com": "2018-08-30", "windowsupdate.serveusers.com": "2018-08-30", "windowsupdate.vizvaz.com": "2018-08-30", "windowsupdate.wcwname.com": "2018-08-30", "windowsupdate.x24hr.com": "2018-08-30", "windowsupdate.ygto.com": "2018-08-30", "windowsupdates.dnset.com": "2018-08-30", "windowsupdates.ezua.com": "2018-08-30", "windowsupdates.ikwb.com": "2018-08-30", "windowsupdates.itemdb.com": "2018-08-30", "windowsupdates.proxydns.com": "2018-08-30", "workerisgood.com": "2018-08-30", "woyaofanwen.com": "2018-08-30", "wschandler.com": "2018-08-30", "wthelpdesk.com": "2018-08-30", "wubangtu.info": "2018-08-30", "ww12.tlsart.com": "2024-11-30", "www-meti-go-jp.tyoto-go-jp.com": "2018-08-30", "www.2014.zzux.com": "2018-08-30", "www.97sm.com": "2018-08-30", "www.9gowg.tech": "2018-08-30", "www.abdominal.faqserv.com": "2018-08-30", "www.additional.sexidude.com": "2018-08-30", "www.afc.https443.org": "2018-08-30", "www.androidmusicapp.onmypc.us": "2018-08-30", "www.announcements.toythieves.com": "2018-08-30", "www.anx-own-334.mrbasic.com": "2018-08-30", "www.apple.ikwb.com": "2018-08-30", "www.appledownload.ourhobby.com": "2018-08-30", "www.appleimages.itemdb.com": "2018-08-30", "www.appleimages.longmusic.com": "2018-08-30", "www.appleimages.organiccrap.com": "2018-08-30", "www.applejuice.itemdb.com": "2018-08-30", "www.applemirror.organiccrap.com": "2018-08-30", "www.applemirror.squirly.info": "2018-08-30", "www.applemusic.isasecret.com": "2018-08-30", "www.applemusic.itemdb.com": "2018-08-30", "www.applemusic.wikaba.com": "2018-08-30", "www.applemusic.xxuz.com": "2018-08-30", "www.applemusic.zzux.com": "2018-08-30", "www.appleupdate.itemdb.com": "2018-08-30", "www.appleupdateurl.2waky.com": "2018-08-30", "www.architectisusa.com": "2018-08-30", "www.army.xxuz.com": "2018-08-30", "www.art.p6p6.net": "2018-08-30", "www.asfzx.x24hr.com": "2018-08-30", "www.availab.wikaba.com": "2018-08-30", "www.availability.justdied.com": "2018-08-30", "www.babymusicsitetr.mymom.info": "2018-08-30", "www.back.jungleheart.com": "2018-08-30", "www.balance1.wikaba.com": "2018-08-30", "www.be.mrslove.com": "2018-08-30", "www.belowto.com": "2018-08-30", "www.billing.organiccrap.com": "2018-08-30", "www.blaaaaaaaaaaaa.windowsupdate.3-a.net": "2018-08-30", "www.brand.fartit.com": "2018-08-30", "www.bulletproof.squirly.info": "2018-08-30", "www.cabbage.iownyour.biz": "2018-08-30", "www.ccupdatedata.authorizeddns.net": "2018-08-30", "www.cdn.incloud-go.com": "2018-08-30", "www.center.shenajou.com": "2018-08-30", "www.chaindungeons.com": "2018-08-30", "www.cia.ezua.com": "2018-08-30", "www.cia.toh.info": "2018-08-30", "www.civilwar123.authorizeddns.org": "2018-08-30", "www.civilwar520.onmypc.org": "2018-08-30", "www.cloud-maste.com": "2018-08-30", "www.cnnews.mylftv.com": "2018-08-30", "www.commissioner.shenajou.com": "2018-08-30", "www.commons.onedumb.com": "2018-08-30", "www.contractus.qpoe.com": "2018-08-30", "www.corp-dnsonline.itsaol.com": "2018-08-30", "www.courier.jetos.com": "2018-08-30", "www.cress.mynetav.net": "2018-08-30", "www.ctdl.windowsupdate.nsatcdns.com": "2018-08-30", "www.ctldl.microsoftupdate.qhigh.com": "2018-08-30", "www.ctldl.windowsupdate.authorizeddns.us": "2018-08-30", "www.ctldl.windowsupdate.esmtp.biz": "2018-08-30", "www.ctldl.windowsupdate.mrface.com": "2018-08-30", "www.cwiinatonal.com": "2018-08-30", "www.dasoftactivemodule.toythieves.com": "2018-08-30", "www.dasonews.youdontcare.com": "2018-08-30", "www.daughter.vizvaz.com": "2018-08-30", "www.de.onmypc.info": "2018-08-30", "www.details.squirly.info": "2018-08-30", "www.development.shenajou.com": "2018-08-30", "www.devilcase.acmetoy.com": "2018-08-30", "www.disruptive.https443.net": "2018-08-30", "www.dns-hinettw.25u.com": "2018-08-30", "www.document.shenajou.com": "2018-08-30", "www.domainnow.yourtrap.com": "2018-08-30", "www.download.windowsupdate.nsatcdns.com": "2018-08-30", "www.ea.onmypc.info": "2018-08-30", "www.eddo.qpoe.com": "2018-08-30", "www.ehshiroshima.mylftv.com": "2018-08-30", "www.eric-averyanov.wha.la": "2018-08-30", "www.eu.acmetoy.com": "2018-08-30", "www.eu.wha.la": "2018-08-30", "www.express.lflinkup.com": "2018-08-30", "www.extraordinary.dynamic-dns.net": "2018-08-30", "www.f068v.site": "2018-08-30", "www.facefile.fartit.com": "2018-08-30", "www.fertile.authorizeddns.net": "2018-08-30", "www.file.zzux.com": "2018-08-30", "www.findme.epac.to": "2018-08-30", "www.fire.mrface.com": "2018-08-30", "www.firstnews.jkub.com": "2018-08-30", "www.fjs.wikaba.com": "2018-08-30", "www.foal.wchildress.com": "2018-08-30", "www.fr.wikaba.com": "2018-08-30", "www.freegamecenter.onedumb.com": "2018-08-30", "www.fruit.qhigh.com": "2018-08-30", "www.fuck.ikwb.com": "2018-08-30", "www.fuckmm.dns-dns.com": "2018-08-30", "www.fukuoka.cloud-maste.com": "2018-08-30", "www.g3ypf.online": "2018-08-30", "www.garlic.dyndns.pro": "2018-08-30", "www.generat.almostmy.com": "2018-08-30", "www.glicense.shenajou.com": "2018-08-30", "www.goldtoyota.com": "2018-08-30", "www.goodmusic.justdied.com": "2018-08-30", "www.gooesdataios.instanthq.com": "2018-08-30", "www.grammar.jkub.com": "2018-08-30", "www.helpus.ddns.info": "2018-08-30", "www.hii.qhigh.com": "2018-08-30", "www.hinetonlinedns.dns05.com": "2018-08-30", "www.incloud-go.com": "2018-08-30", "www.innocent-isayev.sexidude.com": "2018-08-30", "www.interpreter.shenajou.com": "2018-08-30", "www.invoices.sexxxy.biz": "2018-08-30", "www.iphone.vizvaz.com": "2018-08-30", "www.ipv4.microsoftupdate.mrbasic.com": "2018-08-30", "www.ipv4.windowsupdate.3-a.net": "2018-08-30", "www.ipv4.windowsupdate.esmtp.biz": "2018-08-30", "www.ipv4.windowsupdate.fartit.com": "2018-08-30", "www.ipv4.windowsupdate.lflink.com": "2018-08-30", "www.ipv4.windowsupdate.mrface.com": "2018-08-30", "www.ipv4.windowsupdate.mylftv.com": "2018-08-30", "www.ipv4.windowsupdate.nsatcdns.com": "2018-08-30", "www.itlans.isasecret.com": "2018-08-30", "www.itunesdownload.jkub.com": "2018-08-30", "www.itunesdownload.vizvaz.com": "2018-08-30", "www.itunesdownload.wikaba.com": "2018-08-30", "www.itunesimages.itemdb.com": "2018-08-30", "www.itunesimages.itsaol.com": "2018-08-30", "www.itunesimages.qpoe.com": "2018-08-30", "www.itunesmirror.fartit.com": "2018-08-30", "www.itunesmirror.itsaol.com": "2018-08-30", "www.itunesmusic.ikwb.com": "2018-08-30", "www.itunesmusic.jetos.com": "2018-08-30", "www.itunesmusic.jkub.com": "2018-08-30", "www.itunesmusic.zzux.com": "2018-08-30", "www.itunesupdate.itsaol.com": "2018-08-30", "www.itunesupdates.organiccrap.com": "2018-08-30", "www.japanenvnews.qpoe.com": "2018-08-30", "www.jd978.com": "2018-08-30", "www.jimin.jimindaddy.com": "2018-08-30", "www.jimin.mymom.info": "2018-08-30", "www.jp.serveuser.com": "2018-08-30", "www.jpnappstore.ourhobby.com": "2018-08-30", "www.jpnewslogs.sendsmtp.com": "2018-08-30", "www.jpnxzshopdata.authorizeddns.org": "2018-08-30", "www.kawasaki.cloud-maste.com": "2018-08-30", "www.kawasaki.unhamj.com": "2018-08-30", "www.key.zzux.com": "2018-08-30", "www.knowledge.sellclassics.com": "2018-08-30", "www.lan.dynssl.com": "2018-08-30", "www.last.p6p6.net": "2018-08-30", "www.latestnews.epac.to": "2018-08-30", "www.latestnews.organiccrap.com": "2018-08-30", "www.leedong.longmusic.com": "2018-08-30", "www.leeks.mrbonus.com": "2018-08-30", "www.liberty.acmetoy.com": "2018-08-30", "www.license.shenajou.com": "2018-08-30", "www.lion.wchildress.com": "2018-08-30", "www.loveddos.com": "2018-08-30", "www.macfee.mrface.com": "2018-08-30", "www.macforlinux.net": "2018-08-30", "www.maffc.mrface.com": "2018-08-30", "www.malware.dsmtp.com": "2018-08-30", "www.manager.jetos.com": "2018-08-30", "www.markabcinfo.dynamicdns.me.uk": "2018-08-30", "www.mason.vizvaz.com": "2018-08-30", "www.mediapath.organiccrap.com": "2018-08-30", "www.meiji-ac-jp.com": "2018-08-30", "www.messagea.emailfound.info": "2018-08-30", "www.microsoft.got-game.org": "2018-08-30", "www.microsoft.mrface.com": "2018-08-30", "www.microsoftempowering.sendsmtp.com": "2018-08-30", "www.microsoftgame.mrface.com": "2018-08-30", "www.microsoftgetstarted.sexidude.com": "2018-08-30", "www.microsoftimages.organiccrap.com": "2018-08-30", "www.microsoftmirror.mrbasic.com": "2018-08-30", "www.microsoftmusic.itemdb.com": "2018-08-30", "www.microsoftmusic.mrbasic.com": "2018-08-30", "www.microsoftqckmanager.pcanywhere.net": "2018-08-30", "www.microsoftupdate.mrbasic.com": "2018-08-30", "www.microsoftupdate.qhigh.com": "2018-08-30", "www.micrsoftware.dsmtp.com": "2018-08-30", "www.mircsoft.compress.to": "2018-08-30", "www.mmy.ddns.us": "2018-08-30", "www.mod.jetos.com": "2018-08-30", "www.mofa.dynamic-dns.net": "2018-08-30", "www.mofa.ns01.info": "2018-08-30", "www.moonnightthse.zyns.com": "2018-08-30", "www.moscowdic.trickip.org": "2018-08-30", "www.moscowstdsupdate.toythieves.com": "2018-08-30", "www.mseupdate.ourhobby.com": "2017-04-14", "www.msg.ezua.com": "2018-08-30", "www.msn.incloud-go.com": "2018-08-30", "www.musicfile.ikwb.com": "2018-08-30", "www.musicjj.zzux.com": "2018-08-30", "www.musicsecph.squirly.info": "2018-08-30", "www.mymusicbox.lflinkup.org": "2018-08-30", "www.mymusicbox.vizvaz.com": "2018-08-30", "www.myrestroomimage.isasecret.com": "2018-08-30", "www.mytwhomeinst.sendsmtp.com": "2018-08-30", "www.myurinikoreaaps.ninth.biz": "2018-08-30", "www.na.americanunfinished.com": "2018-08-30", "www.na.onmypc.org": "2018-08-30", "www.networkjpnzee.mynetav.org": "2018-08-30", "www.newcityoforward.rebatesrule.net": "2018-08-30", "www.newdnssec-info.4mydomain.com": "2018-08-30", "www.newsdata.jkub.com": "2018-08-30", "www.newsfile.toythieves.com": "2018-08-30", "www.newsroom.cleansite.info": "2018-08-30", "www.nlddnsinfo.https443.org": "2018-08-30", "www.no.authorizeddns.org": "2018-08-30", "www.nposnewsinfo.qhigh.com": "2018-08-30", "www.nsa.mefound.com": "2018-08-30", "www.nt.mynumber.org": "2018-08-30", "www.nttdata.otzo.com": "2018-08-30", "www.nuisance.serveusers.com": "2018-08-30", "www.nz.compress.to": "2018-08-30", "www.ol.almostmy.com": "2018-08-30", "www.oldbmwy.com": "2018-08-30", "www.onion.jkub.com": "2018-08-30", "www.onlinednsserver.sendsmtp.com": "2018-08-30", "www.oracleupdate.dns04.com": "2018-08-30", "www.oyster.jkub.com": "2018-08-30", "www.p6p6.net": "2018-08-30", "www.packetsdsquery.dns05.com": "2018-08-30", "www.pepper.sexxxy.biz": "2018-08-30", "www.phptecinfohelp.itemdb.com": "2018-08-30", "www.pickled.myddns.com": "2018-08-30", "www.polopurple.com": "2018-08-30", "www.portal.mrface.com": "2018-08-30", "www.portal.sendsmtp.com": "2018-08-30", "www.portalser.dynamic-dns.net": "2018-08-30", "www.praskovya-matveyeva.mefound.com": "2018-08-30", "www.praskovya-ulyanova.dumb1.com": "2018-08-30", "www.products.almostmy.com": "2018-08-30", "www.products.cleansite.us": "2018-08-30", "www.products.serveuser.com": "2018-08-30", "www.purchase.lflinkup.org": "2018-08-30", "www.rainbow.mypop3.org": "2018-08-30", "www.re26.com": "2018-08-30", "www.read.xxuz.com": "2018-08-30", "www.recent.dns-stuff.com": "2018-08-30", "www.recent.fartit.com": "2018-08-30", "www.redflower.isasecret.com": "2018-08-30", "www.referred.gr8domain.biz": "2018-08-30", "www.referred.yourtrap.com": "2018-08-30", "www.register.ourhobby.com": "2018-08-30", "www.registration2.instanthq.com": "2018-08-30", "www.registrations.4pu.com": "2018-08-30", "www.registrations.organiccrap.com": "2018-08-30", "www.remeberdata.iownyour.org": "2018-08-30", "www.reserveds.onedumb.com": "2018-08-30", "www.rethem.almostmy.com": "2018-08-30", "www.rg197.win": "2018-08-30", "www.sakai.unhamj.com": "2018-08-30", "www.sapporo.cloud-maste.com": "2018-08-30", "www.sauerkraut.sellclassics.com": "2018-08-30", "www.saverd.re26.com": "2018-08-30", "www.sbuudd.webssl9.info": "2018-08-30", "www.sdmsg.onmypc.org": "2018-08-30", "www.se.toythieves.com": "2018-08-30", "www.secertnews.mrbasic.com": "2018-08-30", "www.secnetshit.com": "2018-08-30", "www.secserverupdate.toh.info": "2018-08-30", "www.senseye.ikwb.com": "2018-08-30", "www.senseye.mrbonus.com": "2018-08-30", "www.septdlluckysystem.jungleheart.com": "2018-08-30", "www.seraphim-yurieva.justdied.com": "2018-08-30", "www.serv.justdied.com": "2018-08-30", "www.server1.proxydns.com": "2018-08-30", "www.seyesb.acmetoy.com": "2018-08-30", "www.showy.almostmy.com": "2018-08-30", "www.shugiin.jkub.com": "2018-08-30", "www.sindeali.com": "2018-08-30", "www.singed.otzo.com": "2018-08-30", "www.sojourner.mypicture.info": "2018-08-30", "www.sstday.jkub.com": "2018-08-30", "www.support1.mrface.com": "2018-08-30", "www.supportus.mefound.com": "2018-08-30", "www.svc.dynssl.com": "2018-08-30", "www.sweetheart.sexxxy.biz": "2018-08-30", "www.synssl.dnset.com": "2018-08-30", "www.tamraj.fartit.com": "2018-08-30", "www.telegraph.mefound.com": "2018-08-30", "www.tfa.longmusic.com": "2018-08-30", "www.thunder.wikaba.com": "2018-08-30", "www.ticket.instanthq.com": "2018-08-30", "www.ticket.serveuser.com": "2018-08-30", "www.tisupdateinfo.faqserv.com": "2018-08-30", "www.tokyofile.2waky.com": "2018-08-30", "www.tophost.dynamicdns.co.uk": "2018-08-30", "www.transfer.lflinkup.org": "2018-08-30", "www.transfer.mrbasic.com": "2018-08-30", "www.transfer.vizvaz.com": "2018-08-30", "www.twgovernmentinfo.acmetoy.com": "2018-08-30", "www.twsslpopservupro.dynssl.com": "2018-08-30", "www.ugreen.itemdb.com": "2018-08-30", "www.uk.dynamicdns.org.uk": "2018-08-30", "www.un.ddns.info": "2018-08-30", "www.un.dnsrd.com": "2018-08-30", "www.unhamj.com": "2018-08-30", "www.usa.itsaol.com": "2018-08-30", "www.usffunicef.com": "2018-08-30", "www.usliveupdateonline.ygto.com": "2018-08-30", "www.ut-portal-u-tokyo-ac-jp.tyoto-go-jp.com": "2018-08-30", "www.v4.windowsupdate.mrface.com": "2018-08-30", "www.v4.windowsupdate.nsatcdns.com": "2018-08-30", "www.vmmini.com": "2018-08-30", "www.wchildress.com": "2018-08-30", "www.webdirectnews.dynamicdns.biz": "2018-08-30", "www.webmailentry.jetos.com": "2018-08-30", "www.websqlnewsmanager.ninth.biz": "2018-08-30", "www.well.itsaol.com": "2018-08-30", "www.well.mrbasic.com": "2018-08-30", "www.windowfile.itemdb.com": "2018-08-30", "www.windowsimages.itemdb.com": "2018-08-30", "www.windowsimages.qhigh.com": "2018-08-30", "www.windowsmirrors.vizvaz.com": "2018-08-30", "www.windowsupdate.2waky.com": "2018-08-30", "www.windowsupdate.3-a.net": "2018-08-30", "www.windowsupdate.acmetoy.com": "2018-08-30", "www.windowsupdate.authorizeddns.net": "2018-08-30", "www.windowsupdate.authorizeddns.org": "2018-08-30", "www.windowsupdate.authorizeddns.us": "2018-08-30", "www.windowsupdate.dns05.com": "2018-08-30", "www.windowsupdate.dnset.com": "2018-08-30", "www.windowsupdate.esmtp.biz": "2018-08-30", "www.windowsupdate.ezua.com": "2018-08-30", "www.windowsupdate.fartit.com": "2018-08-30", "www.windowsupdate.gettrials.com": "2018-08-30", "www.windowsupdate.instanthq.com": "2018-08-30", "www.windowsupdate.itsaol.com": "2018-08-30", "www.windowsupdate.jungleheart.com": "2018-08-30", "www.windowsupdate.lflink.com": "2018-08-30", "www.windowsupdate.mrface.com": "2018-08-30", "www.windowsupdate.mylftv.com": "2018-08-30", "www.windowsupdate.nsatcdns.com": "2018-08-30", "www.windowsupdate.organiccrap.com": "2018-08-30", "www.windowsupdate.rebatesrule.net": "2018-08-30", "www.windowsupdate.sellclassics.com": "2018-08-30", "www.windowsupdate.serveusers.com": "2018-08-30", "www.windowsupdate.x24hr.com": "2018-08-30", "www.yahoo.incloud-go.com": "2018-08-30", "www.yandexr.sellclassics.com": "2018-08-30", "www.yeahyeahyeahs.3322.org": "2018-08-30", "www.yokohamajpinstaz.mrbonus.com": "2018-08-30", "www.zaigawebinfo.rebatesrule.net": "2018-08-30", "www.zebra.incloud-go.com": "2018-08-30", "www2.qpoe.com": "2018-08-30", "www2.zyns.com": "2018-08-30", "www2.zzux.com": "2018-08-30", "x7.usyahooapis.com": "2018-08-30", "xi.dyndns.pro": "2018-08-30", "xi.sexxxy.biz": "2018-08-30", "xread10821.9966.org": "2018-08-30", "xsince.tk": "2018-08-30", "xt.dnset.com": "2018-08-30", "xyrn998754.2288.org": "2018-08-30", "yahoo.incloud-go.com": "2017-04-14", "yallago.cu.cc": "2018-08-30", "yandex2unitedstated.dns05.com": "2020-03-17", "yandex2unitedstated.dynamic-dns.net": "2020-03-17", "yandexr.sellclassics.com": "2018-08-30", "yeahyeahyeahs.3322.org": "2018-08-30", "yeap1.jumpingcrab.com": "2018-08-30", "yfrfyhf.youdontcare.com": "2018-08-30", "yo.acmetoy.com": "2018-08-30", "yrhsywu2009.zapto.org": "2023-04-26", "yz.chromeenter.com": "2019-06-29", "za.myftp.info": "2018-08-30", "zabbix.servercontrols.pw": "2018-08-30", "zaigawebinfo.rebatesrule.net": "2018-08-30", "zccw.cc": "2018-08-30", "zebra.bdoncloud.com": "2018-08-30", "zebra.incloud-go.com": "2018-08-30", "zebra.unhamj.com": "2018-08-30", "zebra.usffunicef.com": "2018-08-30", "zebra.wthelpdesk.com": "2017-04-14", "zero.pcanywhere.net": "2018-08-30", "zg.ns02.biz": "2018-08-30", "zone.demoones.com": "2018-08-30", "zone.usrobothome.com": "2019-06-29" }, "ipv4": { "185.117.88.80:8088": "2020-03-28", "204.79.197.200:8443": "2023-04-26", "31.220.92.125:11": "2026-01-02", "45.76.222.130:443": "2024-06-15", "45.77.183.161:443": "2024-06-15", "5.181.25.99:8443": "2023-04-26", "61.221.66.85:8080": "2022-06-13", "89.117.79.31:100": "2026-01-02", "89.117.79.31:2": "2023-12-04", "89.117.79.31:3": "2026-01-02", "89.117.79.31:88": "2026-01-02" }, "url": { "http://45.76.222.130": "2024-06-15", "http://45.77.183.161": "2024-06-15" } }, "first_seen_precision": { "domain": { "cdn-sina.tw": "at-or-before", "kyolpon.com": "at-or-before", "myststemsgame.com": "at-or-before", "serviceusa.duckdns.org": "at-or-before", "srmbr.net": "at-or-before", "win32updates.duckdns.org": "at-or-before", "windows-11.duckdns.org": "at-or-before", "windows-com.duckdns.org": "at-or-before", "windows-defender.com": "at-or-before" }, "ipv4": { "31.220.92.125:11": "at-or-before", "89.117.79.31:100": "at-or-before", "89.117.79.31:3": "at-or-before", "89.117.79.31:88": "at-or-before" }, "url": {} }, "first_seen_range": { "earliest": "2017-04-14", "latest": "2026-01-02" }, "generated_at": "2026-08-08T03:26:30+00:00", "indicators": { "domain": [ "002562066559681.r3u8.com", "031168053846049.r3u8.com", "0625.have8000.com", "1.gadskysun.com", "100fanwen.com", "11.usyahooapis.com", "19518473326.r3u8.com", "1960445709311199.r3u8.com", "1j.www1.biz", "1z.itsaol.com", "2012yearleft.com", "2014.zzux.com", "202017845.r3u8.com", "2139465544784.r3u8.com", "2789203959848958.r3u8.com", "5590428449750026.r3u8.com", "5q.niushenghuo.info", "6r.suibian2010.info", "9gowg.tech", "Jepsen.r3u8.com", "a.wubangtu.info", "a1.suibian2010.info", "ab.4pu.com", "abc.wikaba.com", "abcd100621.3322.org", "abcd120719.6600.org", "abcd120807.3322.org", "acc.emailfound.info", "acc.lehigtapp.com", "acsocietyy.com", "ad.getfond.info", "ad.webbooting.com", "additional.sexidude.com", "af.zyns.com", "afc.https443.org", "ako.ddns.us", "algorithm.ddnsgeek.com", "amsidgoo.thedomais.info", "androidmusicapp.onmypc.us", "announcements.toythieves.com", "anvprn.com", "aotuo.9966.org", "apec.qtsofta.com", "app.lehigtapp.com", "apple.cmdnetview.com", "apple.defensewar.org", "apple.ikwb.com", "appledownload.ourhobby.com", "appleimages.itemdb.com", "appleimages.longmusic.com", "applelib120102.9966.org", "applemirror.organiccrap.com", "applemirror.squirly.info", "applemusic.isasecret.com", "applemusic.itemdb.com", "applemusic.wikaba.com", "applemusic.xxuz.com", "applemusic.zzux.com", "apples.sytes.net", "appleupdate.itemdb.com", "architectisusa.com", "area.wthelpdesk.com", "arkouowi.com", "army.xxuz.com", "art.p6p6.net", "asfzx.x24hr.com", "asyspy256.ddns.net", "av.ddns.us", "availab.wikaba.com", "availability.justdied.com", "ba.my03.com", "baby.macforlinux.net", "baby.myie12.com", "baby.usmirocomney.net", "babyprintf.2288.org", "back.jungleheart.com", "back.mofa.dynamic-dns.net", "bak.have8000.com", "bak.ignorelist.com", "bak.un.dnsrd.com", "balance1.wikaba.com", "balk.n7go.com", "banana.cmdnetview.com", "barrybaker.6600.org", "bbs.jungleheart.com", "bdoncloud.com", "be.mrslove.com", "be.yourtrap.com", "belowto.com", "bethel.webhop.net", "bexm.cleansite.biz", "bezu.itemdb.com", "bk56.twilightparadox.com", "blaaaaaaaaaaaa.windowsupdate.3-a.net", "blog.defensewar.org", "brand.fartit.com", "bridgeluxlightmadness.com", "bulk.tmpxctl.com", "bulletproof.squirly.info", "caibi379.com", "cao.p6p6.net", "cargobussiness.site", "cata.qtsofta.com", "catholicmmb.com", "cc.dynamicdns.co.uk", "ccfchrist.com", "ccupdatedata.authorizeddns.net", "cd.usyahooapis.com", "cdn-sina.tw", "cdn.incloud-go.com", "center.shenajou.com", "cgei493860.r3u8.com", "chaindungeons.com", "chibashiri.com", "childrenstow.com", "cia.ezua.com", "cia.toh.info", "ciaoci.chickenkiller.com", "civilwar123.authorizeddns.org", "civilwar520.onmypc.org", "ckusshani.com", "cloud-kingl.com", "cloud-maste.com", "cloudns.8800.org", "cmdnetview.com", "cms.sindeali.com", "cnnews.mylftv.com", "commissioner.shenajou.com", "commons.onedumb.com", "contacts.rvenee.com", "contactus.myddns.com", "contactus.onmypc.us", "contract.4mydomain.com", "contractus.qpoe.com", "contractus.zzux.com", "coreck.suayay.com", "cpu.4pu.com", "creatos.kozow.com", "cs.lflink.com", "ctdl.windowsupdate.itsaol.com", "ctdl.windowsupdate.nsatcdns.com", "ctldl.appledownload.ourhobby.com", "ctldl.applemusic.itemdb.com", "ctldl.itunesmusic.jkub.com", "ctldl.microsoftmusic.onedumb.com", "ctldl.microsoftupdate.qhigh.com", "ctldl.windowsupdate.authorizeddns.org", "ctldl.windowsupdate.authorizeddns.us", "ctldl.windowsupdate.dnset.com", "ctldl.windowsupdate.esmtp.biz", "ctldl.windowsupdate.ezua.com", "ctldl.windowsupdate.gettrials.com", "ctldl.windowsupdate.itsaol.com", "ctldl.windowsupdate.lflinkup.com", "ctldl.windowsupdate.mrface.com", "ctldl.windowsupdate.nsatcdns.com", "ctldl.windowsupdate.organiccrap.com", "ctldl.windowsupdate.x24hr.com", "cvdfhjh1231.ddns.net", "cvdfhjh1231.myftp.biz", "cvdfhjh12311.ddns.net", "cvnx.zyns.com", "cwiinatonal.com", "daddy.gostudyantivirus.com", "davidgagnon.org", "dcc.jimingroup.com", "dd.ddns.us", "de.onmypc.info", "dear.loveddos.com", "dec.seyesb.acmetoy.com", "dedgesuite.net", "dedydns.ns01.us", "defensewar.org", "defineyourid.site", "demoones.com", "department.shenajou.com", "details.squirly.info", "development.shenajou.com", "devilcase.acmetoy.com", "df.micfkbeljacob.com", "dffwescwer4325.myftp.biz", "dfgwerzc.3322.org", "diamond.ninth.biz", "dick.ccfchrist.com", "digsby.ourhobby.com", "disruptive.https443.net", "dlmix.ourdvs.com", "dnspoddwg.authorizeddns.org", "do.ddns.ms", "document.methoder.com", "document.shenajou.com", "documents.kankuedu.org", "domain.casacam.net", "domainnow.yourtrap.com", "download.applemusic.itemdb.com", "download.microsoftmusic.onedumb.com", "download.windowsupdate.authorizeddns.org", "download.windowsupdate.dedgesuite.net", "download.windowsupdate.dnset.com", "download.windowsupdate.itsaol.com", "download.windowsupdate.lflinkup.com", "download.windowsupdate.nsatcdns.com", "download.windowsupdate.x24hr.com", "downloadlink.mypicture.info", "drives.methoder.com", "dst.1dumb.com", "ducksow.ddnsgeek.com", "duosay.com", "dyncojinf.6600.org", "dynsbluecheck.7766.org", "ea.onmypc.info", "ea.rebatesrule.net", "edgar.ccfchrist.com", "ehshiroshima.mylftv.com", "emailfound.info", "eric-averyanov.wha.la", "eservake.jetos.com", "essashi.com", "eu.acmetoy.com", "eu.wha.la", "eu.zzux.com", "everydayfilmlink.com", "ewe.toshste.com", "eweek.2waky.com", "exprenum.com", "express.lflinkup.com", "extraordinary.dynamic-dns.net", "f068v.site", "fabian.ccfchrist.com", "fastemail.dnsrd.com", "fastmail2.com", "fbi.sexxxy.biz", "fbi.zyns.com", "fcztqbg.zj.r3u8.com", "feed.jungleheart.com", "fftpoor.com", "fg.v4.download.windowsupdates.dnsrd.com", "fgipv6.download.windowsupdate.com.mwcname.com", "file.zzux.com", "files.architectisusa.com", "film.everydayfilmlink.com", "filmlist.everydayfilmlink.com", "findme.epac.to", "fire.mrface.com", "firefoxcomt.arkouowi.com", "firtstdata.kozow.com", "fish.toh.info", "fiveavmersi.websegoo.net", "fjs.wikaba.com", "flea.poulsenv.com", "flynews.edns.biz", "fo.mysecondarydns.com", "foal.wchildress.com", "follow.wha.la", "foo.shenajou.com", "for.ddns.mobi", "forward.davidgagnon.org", "fr.wikaba.com", "franck.demoones.com", "friendlysupport.giize.com", "ftp.2014.zzux.com", "ftp.additional.sexidude.com", "ftp.afc.https443.org", "ftp.announcements.toythieves.com", "ftp.apple.ikwb.com", "ftp.appledownload.ourhobby.com", "ftp.appleimages.itemdb.com", "ftp.appleimages.longmusic.com", "ftp.appleimages.organiccrap.com", "ftp.applemirror.organiccrap.com", "ftp.applemirror.squirly.info", "ftp.applemusic.isasecret.com", "ftp.applemusic.itemdb.com", "ftp.applemusic.wikaba.com", "ftp.applemusic.xxuz.com", "ftp.applemusic.zzux.com", "ftp.appleupdate.itemdb.com", "ftp.architectisusa.com", "ftp.asfzx.x24hr.com", "ftp.availab.wikaba.com", "ftp.availability.justdied.com", "ftp.back.jungleheart.com", "ftp.balance1.wikaba.com", "ftp.be.mrslove.com", "ftp.brand.fartit.com", "ftp.bulletproof.squirly.info", "ftp.cia.ezua.com", "ftp.cia.toh.info", "ftp.civilwar123.authorizeddns.org", "ftp.civilwar520.onmypc.org", "ftp.cloudfileserverbs.dynamicdns.co.uk", "ftp.cnnews.mylftv.com", "ftp.commons.onedumb.com", "ftp.contractus.qpoe.com", "ftp.cvnx.zyns.com", "ftp.de.onmypc.info", "ftp.details.squirly.info", "ftp.devilcase.acmetoy.com", "ftp.disruptive.https443.net", "ftp.domainnow.yourtrap.com", "ftp.ea.onmypc.info", "ftp.ehshiroshima.mylftv.com", "ftp.eric-averyanov.wha.la", "ftp.eu.acmetoy.com", "ftp.eu.wha.la", "ftp.eu.zzux.com", "ftp.fbi.sexxxy.biz", "ftp.file.zzux.com", "ftp.findme.epac.to", "ftp.fire.mrface.com", "ftp.fjs.wikaba.com", "ftp.fr.wikaba.com", "ftp.fuck.ikwb.com", "ftp.fuckmm.dns-dns.com", "ftp.generat.almostmy.com", "ftp.goldtoyota.com", "ftp.goodmusic.justdied.com", "ftp.helpus.ddns.info", "ftp.hii.qhigh.com", "ftp.innocent-isayev.sexidude.com", "ftp.invoices.sexxxy.biz", "ftp.iphone.vizvaz.com", "ftp.itlans.isasecret.com", "ftp.itunesdownload.jkub.com", "ftp.itunesdownload.wikaba.com", "ftp.itunesimages.itemdb.com", "ftp.itunesimages.itsaol.com", "ftp.itunesimages.qpoe.com", "ftp.itunesmirror.fartit.com", "ftp.itunesmirror.itsaol.com", "ftp.itunesmusic.ikwb.com", "ftp.itunesmusic.jetos.com", "ftp.itunesmusic.jkub.com", "ftp.itunesmusic.zzux.com", "ftp.itunesupdate.itsaol.com", "ftp.itunesupdates.organiccrap.com", "ftp.japanfilmsite.ikwb.com", "ftp.jimin.mymom.info", "ftp.jp.serveuser.com", "ftp.key.zzux.com", "ftp.knowledge.sellclassics.com", "ftp.lan.dynssl.com", "ftp.latestnews.epac.to", "ftp.latestnews.organiccrap.com", "ftp.leedong.longmusic.com", "ftp.macfee.mrface.com", "ftp.maffc.mrface.com", "ftp.malware.dsmtp.com", "ftp.manager.jetos.com", "ftp.martin.sellclassics.com", "ftp.mason.vizvaz.com", "ftp.mediapath.organiccrap.com", "ftp.microsoft.got-game.org", "ftp.microsoft.mrface.com", "ftp.microsoftimages.organiccrap.com", "ftp.microsoftmusic.mrbasic.com", "ftp.microsoftqckmanager.pcanywhere.net", "ftp.microsoftupdate.mrbasic.com", "ftp.microsoftupdate.qhigh.com", "ftp.micrsoftware.dsmtp.com", "ftp.mircsoft.compress.to", "ftp.mmy.ddns.us", "ftp.mod.jetos.com", "ftp.mofa.dynamic-dns.net", "ftp.mofa.ns01.info", "ftp.moscowdic.trickip.org", "ftp.msg.ezua.com", "ftp.musicfile.ikwb.com", "ftp.musicjj.zzux.com", "ftp.mymusicbox.vizvaz.com", "ftp.myphpwebsite.itsaol.com", "ftp.myrestroomimage.isasecret.com", "ftp.na.americanunfinished.com", "ftp.na.onmypc.org", "ftp.newsdata.jkub.com", "ftp.newsroom.cleansite.info", "ftp.no.authorizeddns.org", "ftp.nsa.mefound.com", "ftp.nt.mynumber.org", "ftp.nttdata.otzo.com", "ftp.nz.compress.to", "ftp.ol.almostmy.com", "ftp.oracleupdate.dns04.com", "ftp.portal.mrface.com", "ftp.portal.sendsmtp.com", "ftp.portalser.dynamic-dns.net", "ftp.praskovya-matveyeva.mefound.com", "ftp.praskovya-ulyanova.dumb1.com", "ftp.products.almostmy.com", "ftp.products.cleansite.us", "ftp.products.serveuser.com", "ftp.purchase.lflinkup.org", "ftp.recent.dns-stuff.com", "ftp.recent.fartit.com", "ftp.referred.gr8domain.biz", "ftp.referred.yourtrap.com", "ftp.register.ourhobby.com", "ftp.registration2.instanthq.com", "ftp.registrations.4pu.com", "ftp.registrations.organiccrap.com", "ftp.remeberdata.iownyour.org", "ftp.reserveds.onedumb.com", "ftp.rethem.almostmy.com", "ftp.sdmsg.onmypc.org", "ftp.se.toythieves.com", "ftp.secertnews.mrbasic.com", "ftp.senseye.ikwb.com", "ftp.senseye.mrbonus.com", "ftp.septdlluckysystem.jungleheart.com", "ftp.seraphim-yurieva.justdied.com", "ftp.serv.justdied.com", "ftp.server1.proxydns.com", "ftp.seyesb.acmetoy.com", "ftp.shugiin.jkub.com", "ftp.singed.otzo.com", "ftp.sstday.jkub.com", "ftp.support1.mrface.com", "ftp.supportus.mefound.com", "ftp.svc.dynssl.com", "ftp.synssl.dnset.com", "ftp.tamraj.fartit.com", "ftp.tfa.longmusic.com", "ftp.thunder.wikaba.com", "ftp.ticket.instanthq.com", "ftp.ticket.serveuser.com", "ftp.tokyofile.2waky.com", "ftp.tophost.dynamicdns.co.uk", "ftp.transfer.lflinkup.org", "ftp.transfer.mrbasic.com", "ftp.transfer.vizvaz.com", "ftp.ugreen.itemdb.com", "ftp.uk.dynamicdns.org.uk", "ftp.un.ddns.info", "ftp.un.dnsrd.com", "ftp.usa.itsaol.com", "ftp.well.itsaol.com", "ftp.well.mrbasic.com", "ftp.wike.wikaba.com", "ftp.windowfile.itemdb.com", "ftp.windowsimages.itemdb.com", "ftp.windowsimages.qhigh.com", "ftp.windowsmirrors.vizvaz.com", "ftp.windowsupdate.2waky.com", "ftp.windowsupdate.3-a.net", "ftp.windowsupdate.authorizeddns.us", "ftp.windowsupdate.dns05.com", "ftp.windowsupdate.esmtp.biz", "ftp.windowsupdate.ezua.com", "ftp.windowsupdate.fartit.com", "ftp.windowsupdate.gettrials.com", "ftp.windowsupdate.instanthq.com", "ftp.windowsupdate.jungleheart.com", "ftp.windowsupdate.lflink.com", "ftp.windowsupdate.mrface.com", "ftp.windowsupdate.mylftv.com", "ftp.windowsupdate.rebatesrule.net", "ftp.windowsupdate.sellclassics.com", "ftp.windowsupdate.serveusers.com", "ftp.yandexr.sellclassics.com", "fu.epac.to", "fuck.ikwb.com", "fuck.wikaba.com", "fuckanti.com", "fuckdd.8800.org", "fuckmm.8800.org", "fuckmm.dns-dns.com", "fukuoka.cloud-maste.com", "g3ypf.online", "gadskysun.com", "gavin.ccfchrist.com", "generat.almostmy.com", "generousd.hopto.org", "gensuzuki.6600.org", "getfond.info", "gh.mysecondarydns.com", "gifuonlineshopping.mynumber.org", "glicense.shenajou.com", "globalnews.wikaba.com", "gmail.com.mailsserver.com", "gmpcw.com", "gold.polopurple.com", "goldtoyota.com", "goodjob36.publicvm.com", "goodluck23.jp.us", "goodmusic.justdied.com", "goodsampjp.com", "gooesdataios.instanthq.com", "google.macforlinux.net", "google.usrobothome.com", "googlemeail.com", "gostudyantivirus.com", "gostudymbaa.com", "gotourisma.com", "grandeur.kozow.com", "grandfoodtony.com", "gt4study.com", "gtsofta.com", "hamiltion.catholicmmb.com", "haoyujd.info", "happy.workerisgood.com", "have8000.com", "helpinfo.publicvm.com", "helpus.ddns.info", "helshellfucde.8866.org", "herring.kozow.com", "hg8fmv.racing", "hii.qhigh.com", "hinitial.com", "hk.2012yearleft.com", "hk.cmdnetview.com", "hk.have8000.com", "hk.loveddos.com", "home.trickip.org", "hostport9.net", "hotkillmail9sddcc.ddns.net", "hotmai.info", "hotmail.com.mailsserver.com", "houwags.defineyourid.site", "hukuoka.cloud-maste.com", "iamges.itunesmusic.jkub.com", "ibmmsg.strangled.net", "icfeds.cf", "idpmus.hostport9.net", "ijica.in", "im.suibian2010.info", "image.websago.info", "images.cdn-sina.tw", "images.itunesmusic.jkub.com", "images.thedomais.info", "images.tyoto-go-jp.com", "images.windowsupdate.organiccrap.com", "imap.architectisusa.com", "imap.dnset.com", "imap.lflink.com", "imap.onmypc.net", "imap.ygto.com", "img.microtoo.info", "img.station155.com", "improvejpese.com", "incloud-go.com", "incloud-obert.com", "info.publicvm.com", "info.uroljp.com", "ingemar.catholicmmb.com", "innocent-isayev.sexidude.com", "innov-tec.com.ua", "inspgon.re26.com", "interpreter.shenajou.com", "invoices.sexxxy.biz", "io.jkub.com", "iphone.vizvaz.com", "ipv4.applemusic.itemdb.com", "ipv4.itunesmusic.jkub.com", "ipv4.japanenvnews.qpoe.com", "ipv4.microsoftmusic.onedumb.com", "ipv4.microsoftupdate.mrbasic.com", "ipv4.microsoftupdate.qhigh.com", "ipv4.windowsupdate.3-a.net", "ipv4.windowsupdate.authorizeddns.org", "ipv4.windowsupdate.authorizeddns.us", "ipv4.windowsupdate.dnset.com", "ipv4.windowsupdate.esmtp.biz", "ipv4.windowsupdate.ezua.com", "ipv4.windowsupdate.fartit.com", "ipv4.windowsupdate.gettrials.com", "ipv4.windowsupdate.itsaol.com", "ipv4.windowsupdate.lflink.com", "ipv4.windowsupdate.lflinkup.com", "ipv4.windowsupdate.mrface.com", "ipv4.windowsupdate.mylftv.com", "ipv4.windowsupdate.nsatcdns.com", "ipv4.windowsupdate.x24hr.com", "ipv6microsoft.dlmix.ourdvs.com", "itlans.isasecret.com", "itunesdownload.jkub.com", "itunesdownload.vizvaz.com", "itunesdownload.wikaba.com", "itunesimages.itemdb.com", "itunesimages.itsaol.com", "itunesimages.qpoe.com", "itunesmirror.fartit.com", "itunesmirror.itsaol.com", "itunesmusic.ikwb.com", "itunesmusic.jetos.com", "itunesmusic.jkub.com", "itunesmusic.zzux.com", "itunesupdate.itsaol.com", "itunesupdates.organiccrap.com", "iu.niushenghuo.info", "iw.mrslove.com", "ixrayeye.com", "jack.micfkbeljacob.com", "jadl-or.com", "james.tffghelth.com", "janpan.bigmoney.biz", "janpun.americanunfinished.com", "jap.japanmusicinfo.com", "japan.fuckanti.com", "japan.linuxforover.com", "japan.loveddos.com", "japanenvnews.qpoe.com", "japanfilmsite.ikwb.com", "japanfst.japanteam.org", "japanmusicinfo.com", "japanteam.org", "jcie.mofa.ns01.info", "jepsen.r3u8.com", "jica-go-jp.bike", "jica-go-jp.biz", "jimin-jp.biz", "jimin.jimindaddy.com", "jimin.mymom.info", "jimindaddy.com", "jimingroup.com", "jimintokoy.com", "jj.mysecondarydns.com", "jmuroran.com", "jp.rakutenmusic.com", "jp.serveuser.com", "jpcert.org", "jpn.longmusic.com", "jpnxzshopdata.authorizeddns.org", "jpstarmarket.serveusers.com", "js001.3322.org", "kaka.lehigtapp.com", "kankuedu.org", "kaspresksy.com", "kawasaki.cloud-maste.com", "kawasaki.unhamj.com", "kennedy.tffghelth.com", "key.zzux.com", "keyscratch.com", "kikimusic.sellclassics.com", "kmd.crabdance.com", "knowledge.sellclassics.com", "ktgmktanxgvn.r3u8.com", "kxsbwappupdate.dhcp.biz", "kyolpon.com", "kztmusiclnk.dnsrd.com", "lan.dynssl.com", "last.p6p6.net", "latestnews.epac.to", "latestnews.organiccrap.com", "leedong.longmusic.com", "lehigtapp.com", "lennon.fftpoor.com", "license.shenajou.com", "lie.jetos.com", "linuxforover.com", "linuxsofta.com", "lion.wchildress.com", "live.musicweb.xyz", "lizard.poulsenv.com", "logon-live.com", "lottedfstravel.webbooting.com", "loveddos.com", "lzf550.r3u8.com", "ma.vizvaz.com", "mac.goldtoyota.com", "mac.methoder.com", "macfee.mrface.com", "macforlinux.net", "maffc.mrface.com", "mail.architectisusa.com", "mail.macforlinux.net", "mailcarriage.co.uk", "mailedc.publicvm.com", "mailj.hostport9.net", "mailserever.com", "mailsserver.com", "mailvserver.com", "malcolm.fftpoor.com", "malware.DSMTP.COM", "malware.dsmtp.com", "manager.architectisusa.com", "manager.jetos.com", "markabcinfo.dynamicdns.me.uk", "martin.sellclassics.com", "mason.vizvaz.com", "mbaby.macforlinux.net", "medexplor.thedomais.info", "mediapath.organiccrap.com", "meibubaker.3322.org", "meiji-ac-jp.com", "mesjm.emailfound.info", "message.emailfound.info", "message.p6p6.net", "messagea.emailfound.info", "methoder.com", "mf.ddns.info", "micfkbeljacob.com", "microcnmlgb.3322.org", "microdef.2288.org", "microhome.wikaba.com", "microsoft.got-game.org", "microsoft.mrface.com", "microsoftdownload.zzux.com", "microsoftempowering.sendsmtp.com", "microsoften.com", "microsoftgame.mrface.com", "microsoftgetstarted.sexidude.com", "microsoftimages.organiccrap.com", "microsoftmirror.mrbasic.com", "microsoftmusic.itemdb.com", "microsoftmusic.mrbasic.com", "microsoftmusic.onedumb.com", "microsoftqckmanager.pcanywhere.net", "microsofts.org", "microsoftstore.jetos.com", "microsoftstores.itemdb.com", "microsoftupdate.mrbasic.com", "microsoftupdate.qhigh.com", "microsoftupdates.vizvaz.com", "microtoo.info", "micrsoftware.dsmtp.com", "mircsoft.compress.to", "miscrosofts.com", "mivsee.website0012.net", "mmofoojap.2288.org", "mmy.ddns.us", "mobile.2waky.com", "mocha.100fanwen.com", "mod.jetos.com", "mofa-go-jp.com", "mofa.dynamic-dns.net", "mofa.ns01.info", "mofa.strangled.net", "mofaess.com", "mongoles.3322.org", "monkey.2012yearleft.com", "moscowstdsupdate.toythieves.com", "mrsloveaqx.mrslove.com", "ms.ecc.u-tokyo-ac-jp.com", "mseupdate.ourhobby.com", "msg.ezua.com", "msn.incloud-go.com", "muller.exprenum.com", "music.applemusic.itemdb.com", "music.cleansite.us", "music.websegoo.net", "musicfile.ikwb.com", "musicinfo.everydayfilmlink.com", "musiclinker.jkub.com", "musicsecph.squirly.info", "musicweb.xyz", "mx.yetrula.eu", "myie12.com", "mymusicbox.lflinkup.org", "mymusicbox.vizvaz.com", "myphpwebsite.itsaol.com", "myrestroomimage.isasecret.com", "myststemsgame.com", "mytwhomeinst.sendsmtp.com", "myurinikoreaaps.ninth.biz", "na.americanunfinished.com", "na.onmypc.org", "nasa.xxuz.com", "nec.website0012.net", "news.100fanwen.com", "newsdata.jkub.com", "newsfile.toythieves.com", "newsreport.justdied.com", "newsroom.cleansite.info", "nezwq.ezua.com", "ngcc.8800.org", "niushenghuo.info", "nk10.belowto.com", "nk20.belowto.com", "nlddnsinfo.https443.org", "nmrx.mrbonus.com", "nn.dynssl.com", "no.authorizeddns.org", "node.mofaess.com", "nodns2.qipian.org", "noub.crabdance.com", "nposnewsinfo.qhigh.com", "ns1.belowto.com", "ns1.tlchs2.ml", "ns1.tlsart.com", "ns2.belowto.com", "ns21.belowto.com", "ns22.belowto.com", "ns4.belowto.com", "ns5.belowto.com", "nsa.mefound.com", "nsatcdns.com", "nt.mynumber.org", "nttdata.otzo.com", "nunluck.re26.com", "nz.compress.to", "obj.services", "obo.videocenter.org", "oipbl.com", "ol.almostmy.com", "oldbmwy.com", "oms.sindeali.com", "openmofa.8866.org", "oracleupdate.dns04.com", "order.cargobussiness.site", "osaka-jpgo.com", "oseupdate.dns-dns.com", "outlook.otzo.com", "owlmedia.mefound.com", "p6p6.net", "peopleinfodata.3-a.net", "phptecinfohelp.itemdb.com", "pictures.everydayfilmlink.com", "pj.qpoe.com", "points.mofaess.com", "polopurple.com", "pop.architectisusa.com", "pop.loveddos.com", "portal.mrface.com", "portal.sendsmtp.com", "portalser.dynamic-dns.net", "poulsenv.com", "praskovya-matveyeva.mefound.com", "praskovya-ulyanova.dumb1.com", "premium.redforlinux.com", "products.almostmy.com", "products.cleansite.us", "products.serveuser.com", "program.acmetoy.com", "prrmes4019.r3u8.com", "purchase.lflinkup.org", "q6.niushenghuo.info", "qtsofta.com", "quick.oldbmwy.com", "r3u8.com", "radiorig.com", "rain.orctldl.windowsupdate.authorizeddns.us", "rakutenmusic.com", "rare-coisns.com", "rdns-4.infoproduto1.tk", "re26.com", "read.xxuz.com", "recent.dns-stuff.com", "recent.fartit.com", "record.hostport9.net", "record.webssl9.info", "record.wschandler.com", "redforlinux.com", "referred.gr8domain.biz", "referred.yourtrap.com", "register.ourhobby.com", "registration2.instanthq.com", "registrations.4pu.com", "registrations.organiccrap.com", "reports.tomorrowforgood.com", "reserveds.onedumb.com", "resource.arkouowi.com", "resources.applemusic.itemdb.com", "rethem.almostmy.com", "rg197.win", "rlbeiydn.hi.r3u8.com", "rosaf112.ddns.net", "rvenee.com", "saiyo.exprenum.com", "sakai.unhamj.com", "salvaiona.com", "sappore.cloud-maste.com", "sapporo.cloud-maste.com", "sapporot.com", "saspecialforces.co.za", "sat.suayay.com", "saverd.re26.com", "sbuudd.webssl9.info", "sc.weboot.info", "scholz-versand.com", "scorpion.poulsenv.com", "scrlk.exprenum.com", "sdmsg.onmypc.org", "se.toythieves.com", "sea.websegoo.net", "secertnews.mrbasic.com", "secmicrosooo.6600.org", "secnetshit.com", "secserverupdate.toh.info", "sell.mofaess.com", "sema.linuxsofta.com", "send.have8000.com", "send.mofa.ns01.info", "sendmsg.jumpingcrab.com", "senseye.ikwb.com", "senseye.mrbonus.com", "septdlluckysystem.jungleheart.com", "seraphim-yurieva.justdied.com", "serv.justdied.com", "server1.proxydns.com", "services.arkouowi.com", "serviceusa.duckdns.org", "seyesb.acmetoy.com", "sh.chromeenter.com", "sha.25u.com", "sha.ikwb.com", "shell.cdn-sina.tw", "shenajou.com", "shoppingcentre.station155.com", "shrimp.bdoncloud.com", "shrimp.usffunicef.com", "shugiin.jkub.com", "sindeali.com", "singed.otzo.com", "siteinit.info", "sky.oldbmwy.com", "sma.jimindaddy.com", "smo.gadskysun.com", "smtp.architectisusa.com", "smtp.macforlinux.net", "smtp230.toldweb.com", "somthing.re26.com", "srmbr.com", "srmbr.net", "sstday.Jkub.com", "sstday.jkub.com", "start.usrobothome.com", "station155.com", "stevenlf.com", "stone.jumpingcrab.com", "style.u-tokyo-ac-jp.com", "suayay.com", "suibian2010.info", "support1.mrface.com", "supportus.mefound.com", "suzukigooogle.8866.org", "svc.dynssl.com", "synssl.dnset.com", "sz.thedomais.info", "sz2016rose.ddns.net", "t1.hinitial.com", "taipei.yourtrap.com", "taipeifoodsite.ocry.com", "tamraj.fartit.com", "tech.obj.services", "telegraph.mefound.com", "tencentchat.net", "test.usyahooapis.com", "tfa.longmusic.com", "tffghelth.com", "thedomais.info", "ticket.instanthq.com", "ticket.jetos.com", "ticket.serveuser.com", "tidatacenter.shenajou.com", "tisdatacenter.shenajou.com", "tisupdateinfo.faqserv.com", "tlsart.com", "tmpxctl.com", "tokyo-gojp.com", "tokyofile.2waky.com", "tomorrowforgood.com", "tophost.dynamicdns.co.uk", "toshste.com", "toya.7766.org", "transfer.lflinkup.org", "transfer.mrbasic.com", "transfer.vizvaz.com", "trasul.myPicture.info", "trasul.mypicture.info", "travelyokogawafz.fartit.com", "trems.rvenee.com", "trendmicroupdate.shenajou.com", "trendsecurity.shenajou.com", "trout.belowto.com", "tv.goldtoyota.com", "tw.2012yearleft.com", "tw8sl.com", "twmusic.proxydns.com", "twpeoplemusicsite.my03.com", "twtravelinfomation.toythieves.com", "twx.mynumber.org", "tyoto-go-jp.com", "u-tokyo-ac-jp.com", "u1.fartit.com", "u1.haoyujd.info", "ubuntusofta.com", "ugreen.itemdb.com", "ui.hdcdui.com", "uk.dynamicdns.org.uk", "ukuoka.cloud-maste.com", "ultimedia.vmmini.com", "un.ddns.info", "un.dnsrd.com", "unhamj.com", "unspa.hostport9.net", "update.arkouowi.com", "update.yourtrap.com", "updatemirrors.fartit.com", "updates.itsaol.com", "ups.improvejpese.com", "urearapetsu.com", "uroljp.com", "usa.got-game.org", "usa.itsaol.com", "usa.japanteam.org", "usa.radiorig.com", "usffunicef.com", "usmirocomney.net", "usrobothome.com", "usyahooapis.com", "uu.logon-live.com", "uu.niushenghuo.info", "ux.niushenghuo.info", "v2.hinitial.com", "v3.hinitial.com", "v4.appledownload.ourhobby.com", "v4.hinitial.com", "v4.itunesmusic.jkub.com", "v4.microsoftmusic.onedumb.com", "v4.microsoftupdate.mrbasic.com", "v4.windowsupdate.authorizeddns.org", "v4.windowsupdate.dedgesuite.net", "v4.windowsupdate.dnset.com", "v4.windowsupdate.itsaol.com", "v4.windowsupdate.lflinkup.com", "v4.windowsupdate.mrface.com", "v4.windowsupdate.nsatcdns.com", "v4.windowsupdate.x24hr.com", "v4.windowsupdates.dnsrd.com", "v5.hinitial.com", "veryhuai.info", "video.vmdnsup.org", "videocenter.org", "vm.vmdnsup.org", "vmdnsup.org", "vmmini.com", "vmyiersend.websago.info", "vmyisan.website0012.net", "voov.2288.org", "vpn729380678.softether.net", "vscue.com", "wchildress.com", "wcwname.com", "wcxh.mynetav.net", "wdsupdates.com", "web.casacam.net", "webbooting.com", "webdirectnews.dynamicdns.biz", "webinfoseco.ygto.com", "webmailentry.jetos.com", "weboot.info", "websago.info", "websegoo.net", "website0012.net", "websiteboo.website0012.net", "websqlnewsmanager.ninth.biz", "webssl9.info", "weile3322a.3322.org", "weile3322b.3322.org", "well.itsaol.com", "well.mrbasic.com", "whale.toshste.com", "whellbuy.wschandler.com", "whyis.haoyujd.info", "wike.wikaba.com", "win32updates.duckdns.org", "windowfile.itemdb.com", "windows-11.duckdns.org", "windows-com.duckdns.org", "windows-defender.com", "windowsimages.itemdb.com", "windowsimages.qhigh.com", "windowsmirrors.vizvaz.com", "windowsstores.gettrials.com", "windowsstores.organiccrap.com", "windowsupdate.2waky.com", "windowsupdate.3-a.net", "windowsupdate.acmetoy.com", "windowsupdate.authorizeddns.net", "windowsupdate.authorizeddns.org", "windowsupdate.authorizeddns.us", "windowsupdate.com.mwcname.com", "windowsupdate.dedgesuite.net", "windowsupdate.dns05.com", "windowsupdate.dnset.com", "windowsupdate.esmtp.biz", "windowsupdate.ezua.com", "windowsupdate.fartit.com", "windowsupdate.gettrials.com", "windowsupdate.instanthq.com", "windowsupdate.itsaol.com", "windowsupdate.jungleheart.com", "windowsupdate.lflink.com", "windowsupdate.mrface.com", "windowsupdate.mylftv.com", "windowsupdate.nsatcdns.com", "windowsupdate.organiccrap.com", "windowsupdate.rebatesrule.net", "windowsupdate.sellclassics.com", "windowsupdate.serveusers.com", "windowsupdate.vizvaz.com", "windowsupdate.wcwname.com", "windowsupdate.x24hr.com", "windowsupdate.ygto.com", "windowsupdates.dnset.com", "windowsupdates.ezua.com", "windowsupdates.ikwb.com", "windowsupdates.itemdb.com", "windowsupdates.proxydns.com", "workerisgood.com", "woyaofanwen.com", "wschandler.com", "wthelpdesk.com", "wubangtu.info", "ww12.tlsart.com", "www-meti-go-jp.tyoto-go-jp.com", "www.2014.zzux.com", "www.97sm.com", "www.9gowg.tech", "www.abdominal.faqserv.com", "www.additional.sexidude.com", "www.afc.https443.org", "www.androidmusicapp.onmypc.us", "www.announcements.toythieves.com", "www.anx-own-334.mrbasic.com", "www.apple.ikwb.com", "www.appledownload.ourhobby.com", "www.appleimages.itemdb.com", "www.appleimages.longmusic.com", "www.appleimages.organiccrap.com", "www.applejuice.itemdb.com", "www.applemirror.organiccrap.com", "www.applemirror.squirly.info", "www.applemusic.isasecret.com", "www.applemusic.itemdb.com", "www.applemusic.wikaba.com", "www.applemusic.xxuz.com", "www.applemusic.zzux.com", "www.appleupdate.itemdb.com", "www.appleupdateurl.2waky.com", "www.architectisusa.com", "www.army.xxuz.com", "www.art.p6p6.net", "www.asfzx.x24hr.com", "www.availab.wikaba.com", "www.availability.justdied.com", "www.babymusicsitetr.mymom.info", "www.back.jungleheart.com", "www.balance1.wikaba.com", "www.be.mrslove.com", "www.belowto.com", "www.billing.organiccrap.com", "www.blaaaaaaaaaaaa.windowsupdate.3-a.net", "www.brand.fartit.com", "www.bulletproof.squirly.info", "www.cabbage.iownyour.biz", "www.ccupdatedata.authorizeddns.net", "www.cdn.incloud-go.com", "www.center.shenajou.com", "www.chaindungeons.com", "www.cia.ezua.com", "www.cia.toh.info", "www.civilwar123.authorizeddns.org", "www.civilwar520.onmypc.org", "www.cloud-maste.com", "www.cnnews.mylftv.com", "www.commissioner.shenajou.com", "www.commons.onedumb.com", "www.contractus.qpoe.com", "www.corp-dnsonline.itsaol.com", "www.courier.jetos.com", "www.cress.mynetav.net", "www.ctdl.windowsupdate.nsatcdns.com", "www.ctldl.microsoftupdate.qhigh.com", "www.ctldl.windowsupdate.authorizeddns.us", "www.ctldl.windowsupdate.esmtp.biz", "www.ctldl.windowsupdate.mrface.com", "www.cwiinatonal.com", "www.dasoftactivemodule.toythieves.com", "www.dasonews.youdontcare.com", "www.daughter.vizvaz.com", "www.de.onmypc.info", "www.details.squirly.info", "www.development.shenajou.com", "www.devilcase.acmetoy.com", "www.disruptive.https443.net", "www.dns-hinettw.25u.com", "www.document.shenajou.com", "www.domainnow.yourtrap.com", "www.download.windowsupdate.nsatcdns.com", "www.ea.onmypc.info", "www.eddo.qpoe.com", "www.ehshiroshima.mylftv.com", "www.eric-averyanov.wha.la", "www.eu.acmetoy.com", "www.eu.wha.la", "www.express.lflinkup.com", "www.extraordinary.dynamic-dns.net", "www.f068v.site", "www.facefile.fartit.com", "www.fertile.authorizeddns.net", "www.file.zzux.com", "www.findme.epac.to", "www.fire.mrface.com", "www.firstnews.jkub.com", "www.fjs.wikaba.com", "www.foal.wchildress.com", "www.fr.wikaba.com", "www.freegamecenter.onedumb.com", "www.fruit.qhigh.com", "www.fuck.ikwb.com", "www.fuckmm.dns-dns.com", "www.fukuoka.cloud-maste.com", "www.g3ypf.online", "www.garlic.dyndns.pro", "www.generat.almostmy.com", "www.glicense.shenajou.com", "www.goldtoyota.com", "www.goodmusic.justdied.com", "www.gooesdataios.instanthq.com", "www.grammar.jkub.com", "www.helpus.ddns.info", "www.hii.qhigh.com", "www.hinetonlinedns.dns05.com", "www.incloud-go.com", "www.innocent-isayev.sexidude.com", "www.interpreter.shenajou.com", "www.invoices.sexxxy.biz", "www.iphone.vizvaz.com", "www.ipv4.microsoftupdate.mrbasic.com", "www.ipv4.windowsupdate.3-a.net", "www.ipv4.windowsupdate.esmtp.biz", "www.ipv4.windowsupdate.fartit.com", "www.ipv4.windowsupdate.lflink.com", "www.ipv4.windowsupdate.mrface.com", "www.ipv4.windowsupdate.mylftv.com", "www.ipv4.windowsupdate.nsatcdns.com", "www.itlans.isasecret.com", "www.itunesdownload.jkub.com", "www.itunesdownload.vizvaz.com", "www.itunesdownload.wikaba.com", "www.itunesimages.itemdb.com", "www.itunesimages.itsaol.com", "www.itunesimages.qpoe.com", "www.itunesmirror.fartit.com", "www.itunesmirror.itsaol.com", "www.itunesmusic.ikwb.com", "www.itunesmusic.jetos.com", "www.itunesmusic.jkub.com", "www.itunesmusic.zzux.com", "www.itunesupdate.itsaol.com", "www.itunesupdates.organiccrap.com", "www.japanenvnews.qpoe.com", "www.jd978.com", "www.jimin.jimindaddy.com", "www.jimin.mymom.info", "www.jp.serveuser.com", "www.jpnappstore.ourhobby.com", "www.jpnewslogs.sendsmtp.com", "www.jpnxzshopdata.authorizeddns.org", "www.kawasaki.cloud-maste.com", "www.kawasaki.unhamj.com", "www.key.zzux.com", "www.knowledge.sellclassics.com", "www.lan.dynssl.com", "www.last.p6p6.net", "www.latestnews.epac.to", "www.latestnews.organiccrap.com", "www.leedong.longmusic.com", "www.leeks.mrbonus.com", "www.liberty.acmetoy.com", "www.license.shenajou.com", "www.lion.wchildress.com", "www.loveddos.com", "www.macfee.mrface.com", "www.macforlinux.net", "www.maffc.mrface.com", "www.malware.dsmtp.com", "www.manager.jetos.com", "www.markabcinfo.dynamicdns.me.uk", "www.mason.vizvaz.com", "www.mediapath.organiccrap.com", "www.meiji-ac-jp.com", "www.messagea.emailfound.info", "www.microsoft.got-game.org", "www.microsoft.mrface.com", "www.microsoftempowering.sendsmtp.com", "www.microsoftgame.mrface.com", "www.microsoftgetstarted.sexidude.com", "www.microsoftimages.organiccrap.com", "www.microsoftmirror.mrbasic.com", "www.microsoftmusic.itemdb.com", "www.microsoftmusic.mrbasic.com", "www.microsoftqckmanager.pcanywhere.net", "www.microsoftupdate.mrbasic.com", "www.microsoftupdate.qhigh.com", "www.micrsoftware.dsmtp.com", "www.mircsoft.compress.to", "www.mmy.ddns.us", "www.mod.jetos.com", "www.mofa.dynamic-dns.net", "www.mofa.ns01.info", "www.moonnightthse.zyns.com", "www.moscowdic.trickip.org", "www.moscowstdsupdate.toythieves.com", "www.mseupdate.ourhobby.com", "www.msg.ezua.com", "www.msn.incloud-go.com", "www.musicfile.ikwb.com", "www.musicjj.zzux.com", "www.musicsecph.squirly.info", "www.mymusicbox.lflinkup.org", "www.mymusicbox.vizvaz.com", "www.myrestroomimage.isasecret.com", "www.mytwhomeinst.sendsmtp.com", "www.myurinikoreaaps.ninth.biz", "www.na.americanunfinished.com", "www.na.onmypc.org", "www.networkjpnzee.mynetav.org", "www.newcityoforward.rebatesrule.net", "www.newdnssec-info.4mydomain.com", "www.newsdata.jkub.com", "www.newsfile.toythieves.com", "www.newsroom.cleansite.info", "www.nlddnsinfo.https443.org", "www.no.authorizeddns.org", "www.nposnewsinfo.qhigh.com", "www.nsa.mefound.com", "www.nt.mynumber.org", "www.nttdata.otzo.com", "www.nuisance.serveusers.com", "www.nz.compress.to", "www.ol.almostmy.com", "www.oldbmwy.com", "www.onion.jkub.com", "www.onlinednsserver.sendsmtp.com", "www.oracleupdate.dns04.com", "www.oyster.jkub.com", "www.p6p6.net", "www.packetsdsquery.dns05.com", "www.pepper.sexxxy.biz", "www.phptecinfohelp.itemdb.com", "www.pickled.myddns.com", "www.polopurple.com", "www.portal.mrface.com", "www.portal.sendsmtp.com", "www.portalser.dynamic-dns.net", "www.praskovya-matveyeva.mefound.com", "www.praskovya-ulyanova.dumb1.com", "www.products.almostmy.com", "www.products.cleansite.us", "www.products.serveuser.com", "www.purchase.lflinkup.org", "www.rainbow.mypop3.org", "www.re26.com", "www.read.xxuz.com", "www.recent.dns-stuff.com", "www.recent.fartit.com", "www.redflower.isasecret.com", "www.referred.gr8domain.biz", "www.referred.yourtrap.com", "www.register.ourhobby.com", "www.registration2.instanthq.com", "www.registrations.4pu.com", "www.registrations.organiccrap.com", "www.remeberdata.iownyour.org", "www.reserveds.onedumb.com", "www.rethem.almostmy.com", "www.rg197.win", "www.sakai.unhamj.com", "www.sapporo.cloud-maste.com", "www.sauerkraut.sellclassics.com", "www.saverd.re26.com", "www.sbuudd.webssl9.info", "www.sdmsg.onmypc.org", "www.se.toythieves.com", "www.secertnews.mrbasic.com", "www.secnetshit.com", "www.secserverupdate.toh.info", "www.senseye.ikwb.com", "www.senseye.mrbonus.com", "www.septdlluckysystem.jungleheart.com", "www.seraphim-yurieva.justdied.com", "www.serv.justdied.com", "www.server1.proxydns.com", "www.seyesb.acmetoy.com", "www.showy.almostmy.com", "www.shugiin.jkub.com", "www.sindeali.com", "www.singed.otzo.com", "www.sojourner.mypicture.info", "www.sstday.jkub.com", "www.support1.mrface.com", "www.supportus.mefound.com", "www.svc.dynssl.com", "www.sweetheart.sexxxy.biz", "www.synssl.dnset.com", "www.tamraj.fartit.com", "www.telegraph.mefound.com", "www.tfa.longmusic.com", "www.thunder.wikaba.com", "www.ticket.instanthq.com", "www.ticket.serveuser.com", "www.tisupdateinfo.faqserv.com", "www.tokyofile.2waky.com", "www.tophost.dynamicdns.co.uk", "www.transfer.lflinkup.org", "www.transfer.mrbasic.com", "www.transfer.vizvaz.com", "www.twgovernmentinfo.acmetoy.com", "www.twsslpopservupro.dynssl.com", "www.ugreen.itemdb.com", "www.uk.dynamicdns.org.uk", "www.un.ddns.info", "www.un.dnsrd.com", "www.unhamj.com", "www.usa.itsaol.com", "www.usffunicef.com", "www.usliveupdateonline.ygto.com", "www.ut-portal-u-tokyo-ac-jp.tyoto-go-jp.com", "www.v4.windowsupdate.mrface.com", "www.v4.windowsupdate.nsatcdns.com", "www.vmmini.com", "www.wchildress.com", "www.webdirectnews.dynamicdns.biz", "www.webmailentry.jetos.com", "www.websqlnewsmanager.ninth.biz", "www.well.itsaol.com", "www.well.mrbasic.com", "www.windowfile.itemdb.com", "www.windowsimages.itemdb.com", "www.windowsimages.qhigh.com", "www.windowsmirrors.vizvaz.com", "www.windowsupdate.2waky.com", "www.windowsupdate.3-a.net", "www.windowsupdate.acmetoy.com", "www.windowsupdate.authorizeddns.net", "www.windowsupdate.authorizeddns.org", "www.windowsupdate.authorizeddns.us", "www.windowsupdate.dns05.com", "www.windowsupdate.dnset.com", "www.windowsupdate.esmtp.biz", "www.windowsupdate.ezua.com", "www.windowsupdate.fartit.com", "www.windowsupdate.gettrials.com", "www.windowsupdate.instanthq.com", "www.windowsupdate.itsaol.com", "www.windowsupdate.jungleheart.com", "www.windowsupdate.lflink.com", "www.windowsupdate.mrface.com", "www.windowsupdate.mylftv.com", "www.windowsupdate.nsatcdns.com", "www.windowsupdate.organiccrap.com", "www.windowsupdate.rebatesrule.net", "www.windowsupdate.sellclassics.com", "www.windowsupdate.serveusers.com", "www.windowsupdate.x24hr.com", "www.yahoo.incloud-go.com", "www.yandexr.sellclassics.com", "www.yeahyeahyeahs.3322.org", "www.yokohamajpinstaz.mrbonus.com", "www.zaigawebinfo.rebatesrule.net", "www.zebra.incloud-go.com", "www2.qpoe.com", "www2.zyns.com", "www2.zzux.com", "x7.usyahooapis.com", "xi.dyndns.pro", "xi.sexxxy.biz", "xread10821.9966.org", "xsince.tk", "xt.dnset.com", "xyrn998754.2288.org", "yahoo.incloud-go.com", "yallago.cu.cc", "yandex2unitedstated.dns05.com", "yandex2unitedstated.dynamic-dns.net", "yandexr.sellclassics.com", "yeahyeahyeahs.3322.org", "yeap1.jumpingcrab.com", "yfrfyhf.youdontcare.com", "yo.acmetoy.com", "yrhsywu2009.zapto.org", "yz.chromeenter.com", "za.myftp.info", "zabbix.servercontrols.pw", "zaigawebinfo.rebatesrule.net", "zccw.cc", "zebra.bdoncloud.com", "zebra.incloud-go.com", "zebra.unhamj.com", "zebra.usffunicef.com", "zebra.wthelpdesk.com", "zero.pcanywhere.net", "zg.ns02.biz", "zone.demoones.com", "zone.usrobothome.com" ], "ipv4": [ "185.117.88.80:8088", "204.79.197.200:8443", "31.220.92.125:11", "45.76.222.130:443", "45.77.183.161:443", "5.181.25.99:8443", "61.221.66.85:8080", "89.117.79.31:100", "89.117.79.31:2", "89.117.79.31:3", "89.117.79.31:88" ], "url": [ "http://45.76.222.130", "http://45.77.183.161" ] }, "last_modified": "2026-01-02T23:10:15+00:00", "maltrail_groups": [ "HOGFISH", "MENUPASS" ], "references": [ "http://blog.jpcert.or.jp/2017/02/chches-malware--93d6.html", "http://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_202_niwa-yanagishita_en.pdf", "http://researchcenter.paloaltonetworks.com/2017/02/unit42-menupass-returns-new-malware-new-attacks-japanese-academics-organizations/", "https://1275.ru/ioc/8083/earth-kasha-apt10-apt-iocs/", "https://app.any.run/tasks/875fe058-ade2-4d26-86fc-411417e33dff/", "https://app.any.run/tasks/b5634afb-0d3a-4d0b-97c8-fbbd25b9aa97/", "https://blog-en.itochuci.co.jp/entry/2024/01/24/134100", "https://blog.ensilo.com/uncovering-new-activity-by-apt10", "https://brica.de/alerts/alert/public/1214983/apt10-using-cobalt-strike-confirm-new-attack-with-apt-attacker-group-menupass-apt10/", "https://community.emergingthreats.net/t/ruleset-update-summary-2024-12-02-v10781/2210", "https://documents.trendmicro.com/images/TEx/Earth-Kasha-Blog-IoCshFxTmpo.txt", "https://github.com/janhenrikdotcom/iocs/blob/master/APT10/cloud-hopper-indicators-of-compromise-v3.pdf", "https://github.com/pan-unit42/iocs/blob/master/menuPass", "https://ics-cert.kaspersky.com/publications/reports/2022/06/27/attacks-on-industrial-control-systems-using-shadowpad/", "https://otx.alienvault.com/indicator/ip/185.117.88.80", "https://otx.alienvault.com/pulse/5b02d669f283a83d0cc4e7b5", "https://otx.alienvault.com/pulse/5ce7e40de8145f2cd9272a4e", "https://otx.alienvault.com/pulse/5d120d47d09d67b4d8dc5241", "https://otx.alienvault.com/pulse/601832343e90a9658287a666/", "https://otx.alienvault.com/pulse/651aca1636127242b4dd6af9", "https://otx.alienvault.com/pulse/65b7c5ce83210bf49833afdd", "https://raw.githubusercontent.com/jonaslejon/apt10/master/apt_apt10.yar", "https://twitter.com/KorbenD_Intel/status/1243668874102321152", "https://twitter.com/Vishnyak0v/status/1239908264831311872", "https://twitter.com/Vishnyak0v/status/1239908305117552644", "https://twitter.com/malwrhunterteam/status/1659534793124593665", "https://unit42.paloaltonetworks.com/alloy-taurus-targets-se-asian-government/", "https://unit42.paloaltonetworks.com/alloy-taurus/", "https://unit42.paloaltonetworks.com/menupass-playbook-and-iocs/", "https://unit42.paloaltonetworks.com/pingpull-gallium/", "https://www.accenture.com/t20180423T055005Z__w__/us-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf", "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers", "https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html", "https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/", "https://www.ptsecurity.com/ru-ru/research/pt-esc-threat-intelligence/shadowpad-novaya-aktivnost-gruppirovki-winnti/ (# Related Domains chapter)", "https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html", "https://www.virustotal.com/gui/file/0a4888750a50461effd10757fc9bebfacbc661a9ad57fd4c23eefbc735f7ca94/detection", "https://www.virustotal.com/gui/file/0b798ce8880a01eaf5496830e31cde3adceb933b15da8e1cdab6e8796993e23a/detection", "https://www.virustotal.com/gui/file/117b4adb50bb27641f732f7e8b70ade5acf74d17e74b4242ed289f9d5c2b7679/detection", "https://www.virustotal.com/gui/file/5896dbc54fe973c18bc0a4505f4a8cfc215f6743609cb29e9d9738c087797e08/detection", "https://www.virustotal.com/gui/file/5ba043c074818fdd06ae1d3939ddfe7d3d35bab5d53445bc1f2f689859a87507/detection", "https://www.virustotal.com/gui/file/62c4d17c1e5ed099efcbd26725837b4e4226a6bd5228554a6b3eb2ce2a3ad101/detection", "https://www.virustotal.com/gui/file/661f649f83451c344879cebcc7d56d275377c9ec3ed385e93aa4a04238c390e0/detection", "https://www.virustotal.com/gui/file/70c4600d6920dadc1899603b131119427784fcd83d04da5c886bcad5a7af913b/detection", "https://www.virustotal.com/gui/file/861abfc3ca4e8b450afdc33af689219505ad9bb9fbc6f4b6ed9c3c036e25cbda/detection", "https://www.virustotal.com/gui/file/cb0922d8b130504bf9a3078743294791201789c5a3d7bc0369afd096ea15f0ae/detection", "https://www.virustotal.com/gui/ip-address/89.117.79.31/relations", "https://x.com/malwrhunterteam/status/1924559400242454554", "https://x.com/skocherhan/status/1901765548670955804" ], "related": [ { "evidence": [ { "detail": "shares UPPERCUT", "kind": "software", "weight": 0.5 } ], "slug": "G1054" }, { "evidence": [ { "detail": "shares cmd", "kind": "software", "weight": 0.333 } ], "slug": "G0026" }, { "evidence": [ { "detail": "shares cmd", "kind": "software", "weight": 0.333 } ], "slug": "G0060" } ], "slug": "G0045", "timeline": [ { "counts": { "domain": 4, "ipv4": 2 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "win32updates.duckdns.org", "windows-11.duckdns.org", "windows-com.duckdns.org", "windows-defender.com" ], "ipv4": [ "31.220.92.125:11", "89.117.79.31:3" ] }, "precision": "at-or-before", "references": [ "https://www.virustotal.com/gui/ip-address/89.117.79.31/relations", "https://www.virustotal.com/gui/file/0b798ce8880a01eaf5496830e31cde3adceb933b15da8e1cdab6e8796993e23a/detection", "https://www.virustotal.com/gui/file/117b4adb50bb27641f732f7e8b70ade5acf74d17e74b4242ed289f9d5c2b7679/detection", "https://www.virustotal.com/gui/file/661f649f83451c344879cebcc7d56d275377c9ec3ed385e93aa4a04238c390e0/detection", "https://www.virustotal.com/gui/file/62c4d17c1e5ed099efcbd26725837b4e4226a6bd5228554a6b3eb2ce2a3ad101/detection" ], "total": 6 }, { "counts": { "domain": 1, "ipv4": 1 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "serviceusa.duckdns.org" ], "ipv4": [ "89.117.79.31:100" ] }, "precision": "at-or-before", "references": [ "https://x.com/skocherhan/status/1901765548670955804", "https://www.virustotal.com/gui/file/5896dbc54fe973c18bc0a4505f4a8cfc215f6743609cb29e9d9738c087797e08/detection" ], "total": 2 }, { "counts": { "domain": 1, "ipv4": 1 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "myststemsgame.com" ], "ipv4": [ "89.117.79.31:88" ] }, "precision": "at-or-before", "references": [ "https://x.com/malwrhunterteam/status/1924559400242454554", "https://www.virustotal.com/gui/file/0a4888750a50461effd10757fc9bebfacbc661a9ad57fd4c23eefbc735f7ca94/detection" ], "total": 2 }, { "counts": { "domain": 2 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "kyolpon.com", "srmbr.net" ] }, "precision": "at-or-before", "references": [ "https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html", "https://documents.trendmicro.com/images/TEx/Earth-Kasha-Blog-IoCshFxTmpo.txt" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "cdn-sina.tw" ] }, "precision": "at-or-before", "references": [ "https://unit42.paloaltonetworks.com/alloy-taurus-targets-se-asian-government/", "https://otx.alienvault.com/pulse/651aca1636127242b4dd6af9" ], "total": 1 }, { "counts": { "domain": 2 }, "first_seen": "2024-12-23", "indicators": { "domain": [ "srmbr.com", "tw8sl.com" ] }, "precision": "exact", "references": [ "https://community.emergingthreats.net/t/ruleset-update-summary-2024-12-02-v10781/2210" ], "total": 2 }, { "counts": { "domain": 3 }, "first_seen": "2024-11-30", "indicators": { "domain": [ "ns1.tlsart.com", "tlsart.com", "ww12.tlsart.com" ] }, "precision": "exact", "references": [ "https://1275.ru/ioc/8083/earth-kasha-apt10-apt-iocs/" ], "total": 3 }, { "counts": { "domain": 1 }, "first_seen": "2024-11-30", "indicators": { "domain": [ "fuck.wikaba.com" ] }, "precision": "exact", "references": [ "https://github.com/janhenrikdotcom/iocs/blob/master/APT10/cloud-hopper-indicators-of-compromise-v3.pdf", "https://raw.githubusercontent.com/jonaslejon/apt10/master/apt_apt10.yar" ], "total": 1 }, { "counts": { "ipv4": 2, "url": 2 }, "first_seen": "2024-06-15", "indicators": { "ipv4": [ "45.76.222.130:443", "45.77.183.161:443" ], "url": [ "http://45.76.222.130", "http://45.77.183.161" ] }, "precision": "exact", "references": [ "https://blog-en.itochuci.co.jp/entry/2024/01/24/134100", "https://otx.alienvault.com/pulse/65b7c5ce83210bf49833afdd" ], "total": 4 }, { "counts": { "ipv4": 1 }, "first_seen": "2023-12-04", "indicators": { "ipv4": [ "89.117.79.31:2" ] }, "precision": "exact", "references": [ "https://www.virustotal.com/gui/ip-address/89.117.79.31/relations", "https://www.virustotal.com/gui/file/0b798ce8880a01eaf5496830e31cde3adceb933b15da8e1cdab6e8796993e23a/detection", "https://www.virustotal.com/gui/file/117b4adb50bb27641f732f7e8b70ade5acf74d17e74b4242ed289f9d5c2b7679/detection", "https://www.virustotal.com/gui/file/661f649f83451c344879cebcc7d56d275377c9ec3ed385e93aa4a04238c390e0/detection", "https://www.virustotal.com/gui/file/62c4d17c1e5ed099efcbd26725837b4e4226a6bd5228554a6b3eb2ce2a3ad101/detection" ], "total": 1 }, { "counts": { "domain": 2 }, "first_seen": "2023-10-28", "indicators": { "domain": [ "images.cdn-sina.tw", "shell.cdn-sina.tw" ] }, "precision": "exact", "references": [ "https://unit42.paloaltonetworks.com/alloy-taurus-targets-se-asian-government/", "https://otx.alienvault.com/pulse/651aca1636127242b4dd6af9" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2023-05-19", "indicators": { "domain": [ "info.publicvm.com" ] }, "precision": "exact", "references": [ "https://twitter.com/malwrhunterteam/status/1659534793124593665", "https://www.virustotal.com/gui/file/70c4600d6920dadc1899603b131119427784fcd83d04da5c886bcad5a7af913b/detection" ], "total": 1 }, { "counts": { "domain": 3, "ipv4": 2 }, "first_seen": "2023-04-26", "indicators": { "domain": [ "saspecialforces.co.za", "vpn729380678.softether.net", "yrhsywu2009.zapto.org" ], "ipv4": [ "204.79.197.200:8443", "5.181.25.99:8443" ] }, "precision": "exact", "references": [ "https://unit42.paloaltonetworks.com/alloy-taurus/", "https://www.virustotal.com/gui/file/5ba043c074818fdd06ae1d3939ddfe7d3d35bab5d53445bc1f2f689859a87507/detection", "https://www.virustotal.com/gui/file/cb0922d8b130504bf9a3078743294791201789c5a3d7bc0369afd096ea15f0ae/detection" ], "total": 5 }, { "counts": { "domain": 14 }, "first_seen": "2022-06-28", "indicators": { "domain": [ "cargobussiness.site", "defineyourid.site", "documents.kankuedu.org", "grandfoodtony.com", "houwags.defineyourid.site", "kankuedu.org", "live.musicweb.xyz", "musicweb.xyz", "noub.crabdance.com", "obj.services", "obo.videocenter.org", "order.cargobussiness.site", "tech.obj.services", "videocenter.org" ] }, "precision": "exact", "references": [ "https://ics-cert.kaspersky.com/publications/reports/2022/06/27/attacks-on-industrial-control-systems-using-shadowpad/" ], "total": 14 }, { "counts": { "domain": 13, "ipv4": 1 }, "first_seen": "2022-06-13", "indicators": { "domain": [ "df.micfkbeljacob.com", "goodjob36.publicvm.com", "goodluck23.jp.us", "helpinfo.publicvm.com", "hinitial.com", "jack.micfkbeljacob.com", "mailedc.publicvm.com", "micfkbeljacob.com", "t1.hinitial.com", "v2.hinitial.com", "v3.hinitial.com", "v4.hinitial.com", "v5.hinitial.com" ], "ipv4": [ "61.221.66.85:8080" ] }, "precision": "exact", "references": [ "https://unit42.paloaltonetworks.com/pingpull-gallium/", "https://www.virustotal.com/gui/file/861abfc3ca4e8b450afdc33af689219505ad9bb9fbc6f4b6ed9c3c036e25cbda/detection" ], "total": 14 }, { "counts": { "domain": 1 }, "first_seen": "2021-02-01", "indicators": { "domain": [ "rare-coisns.com" ] }, "precision": "exact", "references": [ "http://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_202_niwa-yanagishita_en.pdf", "https://otx.alienvault.com/pulse/601832343e90a9658287a666/" ], "total": 1 }, { "counts": { "ipv4": 1 }, "first_seen": "2020-03-28", "indicators": { "ipv4": [ "185.117.88.80:8088" ] }, "precision": "exact", "references": [ "https://twitter.com/KorbenD_Intel/status/1243668874102321152", "https://otx.alienvault.com/indicator/ip/185.117.88.80" ], "total": 1 }, { "counts": { "domain": 3 }, "first_seen": "2020-03-17", "indicators": { "domain": [ "oseupdate.dns-dns.com", "yandex2unitedstated.dns05.com", "yandex2unitedstated.dynamic-dns.net" ] }, "precision": "exact", "references": [ "https://twitter.com/Vishnyak0v/status/1239908264831311872", "https://twitter.com/Vishnyak0v/status/1239908305117552644", "https://www.ptsecurity.com/ru-ru/research/pt-esc-threat-intelligence/shadowpad-novaya-aktivnost-gruppirovki-winnti/ (# Related Domains chapter)" ], "total": 3 }, { "counts": { "domain": 40 }, "first_seen": "2019-06-29", "indicators": { "domain": [ "abcd100621.3322.org", "amsidgoo.thedomais.info", "arkouowi.com", "babyprintf.2288.org", "bulk.tmpxctl.com", "contacts.rvenee.com", "creatos.kozow.com", "davidgagnon.org", "diamond.ninth.biz", "domain.casacam.net", "ducksow.ddnsgeek.com", "firtstdata.kozow.com", "forward.davidgagnon.org", "grandeur.kozow.com", "herring.kozow.com", "img.microtoo.info", "info.uroljp.com", "iu.niushenghuo.info", "js001.3322.org", "malware.DSMTP.COM", "meibubaker.3322.org", "microtoo.info", "resource.arkouowi.com", "rvenee.com", "services.arkouowi.com", "sh.chromeenter.com", "sstday.Jkub.com", "tmpxctl.com", "trasul.myPicture.info", "trems.rvenee.com", "unspa.hostport9.net", "uroljp.com", "usa.radiorig.com", "vm.vmdnsup.org", "voov.2288.org", "web.casacam.net", "weile3322a.3322.org", "weile3322b.3322.org", "yz.chromeenter.com", "zone.usrobothome.com" ] }, "precision": "exact", "references": [ "https://github.com/pan-unit42/iocs/blob/master/menuPass" ], "total": 40 }, { "counts": { "domain": 8 }, "first_seen": "2019-06-25", "indicators": { "domain": [ "asyspy256.ddns.net", "cvdfhjh1231.ddns.net", "cvdfhjh1231.myftp.biz", "cvdfhjh12311.ddns.net", "dffwescwer4325.myftp.biz", "hotkillmail9sddcc.ddns.net", "rosaf112.ddns.net", "sz2016rose.ddns.net" ] }, "precision": "exact", "references": [ "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers", "https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/", "https://otx.alienvault.com/pulse/5d120d47d09d67b4d8dc5241" ], "total": 8 }, { "counts": { "domain": 5 }, "first_seen": "2019-05-24", "indicators": { "domain": [ "caibi379.com", "kaspresksy.com", "microsofts.org", "miscrosofts.com", "tencentchat.net" ] }, "precision": "exact", "references": [ "https://otx.alienvault.com/pulse/5ce7e40de8145f2cd9272a4e", "https://blog.ensilo.com/uncovering-new-activity-by-apt10" ], "total": 5 }, { "counts": { "domain": 1 }, "first_seen": "2019-02-05", "indicators": { "domain": [ "keyscratch.com" ] }, "precision": "exact", "references": [ "https://unit42.paloaltonetworks.com/menupass-playbook-and-iocs/", "https://github.com/pan-unit42/iocs/blob/master/menuPass" ], "total": 1 }, { "counts": { "domain": 3 }, "first_seen": "2018-10-24", "indicators": { "domain": [ "algorithm.ddnsgeek.com", "firefoxcomt.arkouowi.com", "friendlysupport.giize.com" ] }, "precision": "exact", "references": [ "https://www.accenture.com/t20180423T055005Z__w__/us-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf", "https://github.com/pan-unit42/iocs/blob/master/menuPass" ], "total": 3 }, { "counts": { "domain": 1 }, "first_seen": "2018-10-24", "indicators": { "domain": [ "update.arkouowi.com" ] }, "precision": "exact", "references": [ "https://www.accenture.com/t20180423T055005Z__w__/us-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2018-09-13", "indicators": { "domain": [ "eservake.jetos.com" ] }, "precision": "exact", "references": [ "https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2018-09-13", "indicators": { "domain": [ "jadl-or.com" ] }, "precision": "exact", "references": [ "https://brica.de/alerts/alert/public/1214983/apt10-using-cobalt-strike-confirm-new-attack-with-apt-attacker-group-menupass-apt10/", "https://otx.alienvault.com/pulse/5b02d669f283a83d0cc4e7b5", "https://github.com/pan-unit42/iocs/blob/master/menuPass" ], "total": 1 }, { "counts": { "domain": 1258 }, "first_seen": "2018-08-30", "indicators": { "domain": [ "002562066559681.r3u8.com", "031168053846049.r3u8.com", "0625.have8000.com", "1.gadskysun.com", "100fanwen.com", "11.usyahooapis.com", "19518473326.r3u8.com", "1960445709311199.r3u8.com", "1z.itsaol.com", "2012yearleft.com", "202017845.r3u8.com", "2139465544784.r3u8.com", "2789203959848958.r3u8.com", "5590428449750026.r3u8.com", "5q.niushenghuo.info", "6r.suibian2010.info", "9gowg.tech", "a.wubangtu.info", "a1.suibian2010.info", "ab.4pu.com", "abc.wikaba.com", "abcd120807.3322.org", "acc.emailfound.info", "acc.lehigtapp.com", "acsocietyy.com", "ad.getfond.info", "ad.webbooting.com", "additional.sexidude.com", "af.zyns.com", "afc.https443.org", "ako.ddns.us", "androidmusicapp.onmypc.us", "announcements.toythieves.com", "anvprn.com", "apec.qtsofta.com", "apple.defensewar.org", "appledownload.ourhobby.com", "appleimages.itemdb.com", "appleimages.longmusic.com", "applemirror.organiccrap.com", "applemirror.squirly.info", "applemusic.isasecret.com", "applemusic.itemdb.com", "applemusic.wikaba.com", "applemusic.xxuz.com", "applemusic.zzux.com", "apples.sytes.net", "appleupdate.itemdb.com", "architectisusa.com", "asfzx.x24hr.com", "availab.wikaba.com", "availability.justdied.com", "ba.my03.com", "baby.myie12.com", "baby.usmirocomney.net", "back.jungleheart.com", "back.mofa.dynamic-dns.net", "bak.un.dnsrd.com", "balance1.wikaba.com", "balk.n7go.com", "banana.cmdnetview.com", "barrybaker.6600.org", "bbs.jungleheart.com", "bdoncloud.com", "be.mrslove.com", "bethel.webhop.net", "bexm.cleansite.biz", "bezu.itemdb.com", "blaaaaaaaaaaaa.windowsupdate.3-a.net", "blog.defensewar.org", "brand.fartit.com", "bridgeluxlightmadness.com", "bulletproof.squirly.info", "cata.qtsofta.com", "catholicmmb.com", "cc.dynamicdns.co.uk", "ccupdatedata.authorizeddns.net", "cd.usyahooapis.com", "cdn.incloud-go.com", "center.shenajou.com", "cgei493860.r3u8.com", "chaindungeons.com", "chibashiri.com", "childrenstow.com", "cia.ezua.com", "ciaoci.chickenkiller.com", "civilwar123.authorizeddns.org", "civilwar520.onmypc.org", "ckusshani.com", "cloud-kingl.com", "cloudns.8800.org", "cms.sindeali.com", "cnnews.mylftv.com", "commissioner.shenajou.com", "commons.onedumb.com", "contactus.myddns.com", "contactus.onmypc.us", "contract.4mydomain.com", "contractus.zzux.com", "coreck.suayay.com", "cs.lflink.com", "ctdl.windowsupdate.itsaol.com", "ctdl.windowsupdate.nsatcdns.com", "ctldl.appledownload.ourhobby.com", "ctldl.applemusic.itemdb.com", "ctldl.itunesmusic.jkub.com", "ctldl.microsoftmusic.onedumb.com", "ctldl.microsoftupdate.qhigh.com", "ctldl.windowsupdate.authorizeddns.org", "ctldl.windowsupdate.authorizeddns.us", "ctldl.windowsupdate.dnset.com", "ctldl.windowsupdate.esmtp.biz", "ctldl.windowsupdate.ezua.com", "ctldl.windowsupdate.gettrials.com", "ctldl.windowsupdate.itsaol.com", "ctldl.windowsupdate.lflinkup.com", "ctldl.windowsupdate.mrface.com", "ctldl.windowsupdate.nsatcdns.com", "ctldl.windowsupdate.organiccrap.com", "ctldl.windowsupdate.x24hr.com", "cwiinatonal.com", "daddy.gostudyantivirus.com", "dcc.jimingroup.com", "dd.ddns.us", "de.onmypc.info", "dear.loveddos.com", "dec.seyesb.acmetoy.com", "dedgesuite.net", "defensewar.org", "demoones.com", "department.shenajou.com", "details.squirly.info", "development.shenajou.com", "devilcase.acmetoy.com", "dfgwerzc.3322.org", "digsby.ourhobby.com", "disruptive.https443.net", "dlmix.ourdvs.com", "dnspoddwg.authorizeddns.org", "do.ddns.ms", "document.shenajou.com", "domainnow.yourtrap.com", "download.applemusic.itemdb.com", "download.microsoftmusic.onedumb.com", "download.windowsupdate.authorizeddns.org", "download.windowsupdate.dedgesuite.net", "download.windowsupdate.dnset.com", "download.windowsupdate.itsaol.com", "download.windowsupdate.lflinkup.com", "download.windowsupdate.nsatcdns.com", "download.windowsupdate.x24hr.com", "downloadlink.mypicture.info", "dst.1dumb.com", "duosay.com", "dyncojinf.6600.org", "dynsbluecheck.7766.org", "ea.onmypc.info", "ea.rebatesrule.net", "edgar.ccfchrist.com", "ehshiroshima.mylftv.com", "eric-averyanov.wha.la", "essashi.com", "eu.acmetoy.com", "eu.wha.la", "eu.zzux.com", "everydayfilmlink.com", "ewe.toshste.com", "eweek.2waky.com", "exprenum.com", "express.lflinkup.com", "extraordinary.dynamic-dns.net", "f068v.site", "fabian.ccfchrist.com", "fastemail.dnsrd.com", "fastmail2.com", "fbi.zyns.com", "fcztqbg.zj.r3u8.com", "feed.jungleheart.com", "fftpoor.com", "fg.v4.download.windowsupdates.dnsrd.com", "fgipv6.download.windowsupdate.com.mwcname.com", "file.zzux.com", "files.architectisusa.com", "film.everydayfilmlink.com", "filmlist.everydayfilmlink.com", "findme.epac.to", "fire.mrface.com", "fish.toh.info", "fjs.wikaba.com", "flea.poulsenv.com", "flynews.edns.biz", "fo.mysecondarydns.com", "foal.wchildress.com", "follow.wha.la", "foo.shenajou.com", "for.ddns.mobi", "fr.wikaba.com", "franck.demoones.com", "ftp.2014.zzux.com", "ftp.additional.sexidude.com", "ftp.afc.https443.org", "ftp.announcements.toythieves.com", "ftp.apple.ikwb.com", "ftp.appledownload.ourhobby.com", "ftp.appleimages.itemdb.com", "ftp.appleimages.longmusic.com", "ftp.appleimages.organiccrap.com", "ftp.applemirror.organiccrap.com", "ftp.applemirror.squirly.info", "ftp.applemusic.isasecret.com", "ftp.applemusic.itemdb.com", "ftp.applemusic.wikaba.com", "ftp.applemusic.xxuz.com", "ftp.applemusic.zzux.com", "ftp.appleupdate.itemdb.com", "ftp.architectisusa.com", "ftp.asfzx.x24hr.com", "ftp.availab.wikaba.com", "ftp.availability.justdied.com", "ftp.back.jungleheart.com", "ftp.balance1.wikaba.com", "ftp.be.mrslove.com", "ftp.brand.fartit.com", "ftp.bulletproof.squirly.info", "ftp.cia.ezua.com", "ftp.cia.toh.info", "ftp.civilwar123.authorizeddns.org", "ftp.civilwar520.onmypc.org", "ftp.cloudfileserverbs.dynamicdns.co.uk", "ftp.cnnews.mylftv.com", "ftp.commons.onedumb.com", "ftp.contractus.qpoe.com", "ftp.cvnx.zyns.com", "ftp.de.onmypc.info", "ftp.details.squirly.info", "ftp.devilcase.acmetoy.com", "ftp.disruptive.https443.net", "ftp.domainnow.yourtrap.com", "ftp.ea.onmypc.info", "ftp.ehshiroshima.mylftv.com", "ftp.eric-averyanov.wha.la", "ftp.eu.acmetoy.com", "ftp.eu.wha.la", "ftp.eu.zzux.com", "ftp.fbi.sexxxy.biz", "ftp.file.zzux.com", "ftp.findme.epac.to", "ftp.fire.mrface.com", "ftp.fjs.wikaba.com", "ftp.fr.wikaba.com", "ftp.fuck.ikwb.com", "ftp.fuckmm.dns-dns.com", "ftp.generat.almostmy.com", "ftp.goldtoyota.com", "ftp.goodmusic.justdied.com", "ftp.helpus.ddns.info", "ftp.hii.qhigh.com", "ftp.innocent-isayev.sexidude.com", "ftp.invoices.sexxxy.biz", "ftp.iphone.vizvaz.com", "ftp.itlans.isasecret.com", "ftp.itunesdownload.jkub.com", "ftp.itunesdownload.wikaba.com", "ftp.itunesimages.itemdb.com", "ftp.itunesimages.itsaol.com", "ftp.itunesimages.qpoe.com", "ftp.itunesmirror.fartit.com", "ftp.itunesmirror.itsaol.com", "ftp.itunesmusic.ikwb.com", "ftp.itunesmusic.jetos.com", "ftp.itunesmusic.jkub.com", "ftp.itunesmusic.zzux.com", "ftp.itunesupdate.itsaol.com", "ftp.itunesupdates.organiccrap.com", "ftp.japanfilmsite.ikwb.com", "ftp.jimin.mymom.info", "ftp.jp.serveuser.com", "ftp.key.zzux.com", "ftp.knowledge.sellclassics.com", "ftp.lan.dynssl.com", "ftp.latestnews.epac.to", "ftp.latestnews.organiccrap.com", "ftp.leedong.longmusic.com", "ftp.macfee.mrface.com", "ftp.maffc.mrface.com", "ftp.malware.dsmtp.com", "ftp.manager.jetos.com", "ftp.martin.sellclassics.com", "ftp.mason.vizvaz.com", "ftp.mediapath.organiccrap.com", "ftp.microsoft.got-game.org", "ftp.microsoft.mrface.com", "ftp.microsoftimages.organiccrap.com", "ftp.microsoftmusic.mrbasic.com", "ftp.microsoftqckmanager.pcanywhere.net", "ftp.microsoftupdate.mrbasic.com", "ftp.microsoftupdate.qhigh.com", "ftp.micrsoftware.dsmtp.com", "ftp.mircsoft.compress.to", "ftp.mmy.ddns.us", "ftp.mod.jetos.com", "ftp.mofa.dynamic-dns.net", "ftp.mofa.ns01.info", "ftp.moscowdic.trickip.org", "ftp.msg.ezua.com", "ftp.musicfile.ikwb.com", "ftp.musicjj.zzux.com", "ftp.mymusicbox.vizvaz.com", "ftp.myphpwebsite.itsaol.com", "ftp.myrestroomimage.isasecret.com", "ftp.na.americanunfinished.com", "ftp.na.onmypc.org", "ftp.newsdata.jkub.com", "ftp.newsroom.cleansite.info", "ftp.no.authorizeddns.org", "ftp.nsa.mefound.com", "ftp.nt.mynumber.org", "ftp.nttdata.otzo.com", "ftp.nz.compress.to", "ftp.ol.almostmy.com", "ftp.oracleupdate.dns04.com", "ftp.portal.mrface.com", "ftp.portal.sendsmtp.com", "ftp.portalser.dynamic-dns.net", "ftp.praskovya-matveyeva.mefound.com", "ftp.praskovya-ulyanova.dumb1.com", "ftp.products.almostmy.com", "ftp.products.cleansite.us", "ftp.products.serveuser.com", "ftp.purchase.lflinkup.org", "ftp.recent.dns-stuff.com", "ftp.recent.fartit.com", "ftp.referred.gr8domain.biz", "ftp.referred.yourtrap.com", "ftp.register.ourhobby.com", "ftp.registration2.instanthq.com", "ftp.registrations.4pu.com", "ftp.registrations.organiccrap.com", "ftp.remeberdata.iownyour.org", "ftp.reserveds.onedumb.com", "ftp.rethem.almostmy.com", "ftp.sdmsg.onmypc.org", "ftp.se.toythieves.com", "ftp.secertnews.mrbasic.com", "ftp.senseye.ikwb.com", "ftp.senseye.mrbonus.com", "ftp.septdlluckysystem.jungleheart.com", "ftp.seraphim-yurieva.justdied.com", "ftp.serv.justdied.com", "ftp.server1.proxydns.com", "ftp.seyesb.acmetoy.com", "ftp.shugiin.jkub.com", "ftp.singed.otzo.com", "ftp.sstday.jkub.com", "ftp.support1.mrface.com", "ftp.supportus.mefound.com", "ftp.svc.dynssl.com", "ftp.synssl.dnset.com", "ftp.tamraj.fartit.com", "ftp.tfa.longmusic.com", "ftp.thunder.wikaba.com", "ftp.ticket.instanthq.com", "ftp.ticket.serveuser.com", "ftp.tokyofile.2waky.com", "ftp.tophost.dynamicdns.co.uk", "ftp.transfer.lflinkup.org", "ftp.transfer.mrbasic.com", "ftp.transfer.vizvaz.com", "ftp.ugreen.itemdb.com", "ftp.uk.dynamicdns.org.uk", "ftp.un.ddns.info", "ftp.un.dnsrd.com", "ftp.usa.itsaol.com", "ftp.well.itsaol.com", "ftp.well.mrbasic.com", "ftp.wike.wikaba.com", "ftp.windowfile.itemdb.com", "ftp.windowsimages.itemdb.com", "ftp.windowsimages.qhigh.com", "ftp.windowsmirrors.vizvaz.com", "ftp.windowsupdate.2waky.com", "ftp.windowsupdate.3-a.net", "ftp.windowsupdate.authorizeddns.us", "ftp.windowsupdate.dns05.com", "ftp.windowsupdate.esmtp.biz", "ftp.windowsupdate.ezua.com", "ftp.windowsupdate.fartit.com", "ftp.windowsupdate.gettrials.com", "ftp.windowsupdate.instanthq.com", "ftp.windowsupdate.jungleheart.com", "ftp.windowsupdate.lflink.com", "ftp.windowsupdate.mrface.com", "ftp.windowsupdate.mylftv.com", "ftp.windowsupdate.rebatesrule.net", "ftp.windowsupdate.sellclassics.com", "ftp.windowsupdate.serveusers.com", "ftp.yandexr.sellclassics.com", "fu.epac.to", "fuck.ikwb.com", "fuckdd.8800.org", "fuckmm.8800.org", "fuckmm.dns-dns.com", "g3ypf.online", "generat.almostmy.com", "generousd.hopto.org", "gensuzuki.6600.org", "getfond.info", "gh.mysecondarydns.com", "gifuonlineshopping.mynumber.org", "glicense.shenajou.com", "globalnews.wikaba.com", "gmail.com.mailsserver.com", "gmpcw.com", "goodmusic.justdied.com", "goodsampjp.com", "gooesdataios.instanthq.com", "googlemeail.com", "gostudyantivirus.com", "gostudymbaa.com", "gotourisma.com", "gt4study.com", "gtsofta.com", "haoyujd.info", "happy.workerisgood.com", "helpus.ddns.info", "helshellfucde.8866.org", "hg8fmv.racing", "hii.qhigh.com", "hk.2012yearleft.com", "hk.loveddos.com", "home.trickip.org", "hotmai.info", "hotmail.com.mailsserver.com", "hukuoka.cloud-maste.com", "iamges.itunesmusic.jkub.com", "ibmmsg.strangled.net", "icfeds.cf", "ijica.in", "image.websago.info", "images.itunesmusic.jkub.com", "images.thedomais.info", "images.tyoto-go-jp.com", "images.windowsupdate.organiccrap.com", "imap.architectisusa.com", "imap.dnset.com", "imap.lflink.com", "imap.onmypc.net", "imap.ygto.com", "img.station155.com", "improvejpese.com", "incloud-go.com", "incloud-obert.com", "ingemar.catholicmmb.com", "innocent-isayev.sexidude.com", "innov-tec.com.ua", "interpreter.shenajou.com", "invoices.sexxxy.biz", "io.jkub.com", "ipv4.applemusic.itemdb.com", "ipv4.itunesmusic.jkub.com", "ipv4.japanenvnews.qpoe.com", "ipv4.microsoftmusic.onedumb.com", "ipv4.microsoftupdate.mrbasic.com", "ipv4.microsoftupdate.qhigh.com", "ipv4.windowsupdate.3-a.net", "ipv4.windowsupdate.authorizeddns.org", "ipv4.windowsupdate.authorizeddns.us", "ipv4.windowsupdate.dnset.com", "ipv4.windowsupdate.esmtp.biz", "ipv4.windowsupdate.ezua.com", "ipv4.windowsupdate.fartit.com", "ipv4.windowsupdate.gettrials.com", "ipv4.windowsupdate.itsaol.com", "ipv4.windowsupdate.lflink.com", "ipv4.windowsupdate.lflinkup.com", "ipv4.windowsupdate.mrface.com", "ipv4.windowsupdate.mylftv.com", "ipv4.windowsupdate.nsatcdns.com", "ipv4.windowsupdate.x24hr.com", "ipv6microsoft.dlmix.ourdvs.com", "itlans.isasecret.com", "itunesdownload.jkub.com", "itunesdownload.vizvaz.com", "itunesdownload.wikaba.com", "itunesimages.itemdb.com", "itunesimages.itsaol.com", "itunesimages.qpoe.com", "itunesmirror.fartit.com", "itunesmirror.itsaol.com", "itunesmusic.ikwb.com", "itunesmusic.jetos.com", "itunesmusic.jkub.com", "itunesmusic.zzux.com", "itunesupdate.itsaol.com", "itunesupdates.organiccrap.com", "iw.mrslove.com", "ixrayeye.com", "james.tffghelth.com", "janpun.americanunfinished.com", "jap.japanmusicinfo.com", "japan.linuxforover.com", "japan.loveddos.com", "japanenvnews.qpoe.com", "japanfilmsite.ikwb.com", "japanfst.japanteam.org", "japanmusicinfo.com", "japanteam.org", "jcie.mofa.ns01.info", "jica-go-jp.bike", "jica-go-jp.biz", "jimin-jp.biz", "jimin.mymom.info", "jimingroup.com", "jimintokoy.com", "jj.mysecondarydns.com", "jmuroran.com", "jp.rakutenmusic.com", "jp.serveuser.com", "jpcert.org", "jpnxzshopdata.authorizeddns.org", "jpstarmarket.serveusers.com", "kaka.lehigtapp.com", "kennedy.tffghelth.com", "key.zzux.com", "kikimusic.sellclassics.com", "knowledge.sellclassics.com", "ktgmktanxgvn.r3u8.com", "kxsbwappupdate.dhcp.biz", "kztmusiclnk.dnsrd.com", "lan.dynssl.com", "latestnews.epac.to", "latestnews.organiccrap.com", "leedong.longmusic.com", "lennon.fftpoor.com", "license.shenajou.com", "lie.jetos.com", "linuxforover.com", "linuxsofta.com", "lizard.poulsenv.com", "logon-live.com", "lottedfstravel.webbooting.com", "loveddos.com", "lzf550.r3u8.com", "ma.vizvaz.com", "mac.goldtoyota.com", "mac.methoder.com", "macfee.mrface.com", "maffc.mrface.com", "mail.architectisusa.com", "mail.macforlinux.net", "mailcarriage.co.uk", "mailserever.com", "mailsserver.com", "mailvserver.com", "malcolm.fftpoor.com", "malware.dsmtp.com", "manager.architectisusa.com", "manager.jetos.com", "markabcinfo.dynamicdns.me.uk", "martin.sellclassics.com", "mason.vizvaz.com", "mbaby.macforlinux.net", "medexplor.thedomais.info", "mediapath.organiccrap.com", "meiji-ac-jp.com", "mesjm.emailfound.info", "message.emailfound.info", "message.p6p6.net", "methoder.com", "mf.ddns.info", "microdef.2288.org", "microhome.wikaba.com", "microsoft.got-game.org", "microsoft.mrface.com", "microsoftdownload.zzux.com", "microsoftempowering.sendsmtp.com", "microsoften.com", "microsoftgame.mrface.com", "microsoftgetstarted.sexidude.com", "microsoftimages.organiccrap.com", "microsoftmirror.mrbasic.com", "microsoftmusic.itemdb.com", "microsoftmusic.mrbasic.com", "microsoftmusic.onedumb.com", "microsoftqckmanager.pcanywhere.net", "microsoftstore.jetos.com", "microsoftstores.itemdb.com", "microsoftupdate.mrbasic.com", "microsoftupdate.qhigh.com", "microsoftupdates.vizvaz.com", "micrsoftware.dsmtp.com", "mircsoft.compress.to", "mivsee.website0012.net", "mmofoojap.2288.org", "mmy.ddns.us", "mobile.2waky.com", "mocha.100fanwen.com", "mod.jetos.com", "mofa-go-jp.com", "mofa.dynamic-dns.net", "mofa.ns01.info", "mofa.strangled.net", "mofaess.com", "mongoles.3322.org", "monkey.2012yearleft.com", "moscowstdsupdate.toythieves.com", "mrsloveaqx.mrslove.com", "ms.ecc.u-tokyo-ac-jp.com", "mseupdate.ourhobby.com", "msg.ezua.com", "muller.exprenum.com", "music.applemusic.itemdb.com", "music.cleansite.us", "musicfile.ikwb.com", "musicinfo.everydayfilmlink.com", "musiclinker.jkub.com", "musicsecph.squirly.info", "mx.yetrula.eu", "myie12.com", "mymusicbox.lflinkup.org", "mymusicbox.vizvaz.com", "myphpwebsite.itsaol.com", "myrestroomimage.isasecret.com", "mytwhomeinst.sendsmtp.com", "myurinikoreaaps.ninth.biz", "na.americanunfinished.com", "na.onmypc.org", "nasa.xxuz.com", "nec.website0012.net", "news.100fanwen.com", "newsdata.jkub.com", "newsfile.toythieves.com", "newsreport.justdied.com", "newsroom.cleansite.info", "nezwq.ezua.com", "ngcc.8800.org", "niushenghuo.info", "nk10.belowto.com", "nk20.belowto.com", "nlddnsinfo.https443.org", "nmrx.mrbonus.com", "nn.dynssl.com", "no.authorizeddns.org", "node.mofaess.com", "nodns2.qipian.org", "nposnewsinfo.qhigh.com", "ns1.belowto.com", "ns1.tlchs2.ml", "ns2.belowto.com", "ns21.belowto.com", "ns22.belowto.com", "ns4.belowto.com", "ns5.belowto.com", "nsa.mefound.com", "nsatcdns.com", "nt.mynumber.org", "nz.compress.to", "oipbl.com", "ol.almostmy.com", "oms.sindeali.com", "openmofa.8866.org", "oracleupdate.dns04.com", "osaka-jpgo.com", "outlook.otzo.com", "owlmedia.mefound.com", "peopleinfodata.3-a.net", "phptecinfohelp.itemdb.com", "pictures.everydayfilmlink.com", "pj.qpoe.com", "points.mofaess.com", "pop.architectisusa.com", "pop.loveddos.com", "portal.mrface.com", "portal.sendsmtp.com", "portalser.dynamic-dns.net", "praskovya-matveyeva.mefound.com", "praskovya-ulyanova.dumb1.com", "premium.redforlinux.com", "products.almostmy.com", "products.cleansite.us", "products.serveuser.com", "program.acmetoy.com", "prrmes4019.r3u8.com", "purchase.lflinkup.org", "q6.niushenghuo.info", "qtsofta.com", "rain.orctldl.windowsupdate.authorizeddns.us", "rakutenmusic.com", "rdns-4.infoproduto1.tk", "read.xxuz.com", "recent.dns-stuff.com", "recent.fartit.com", "record.webssl9.info", "redforlinux.com", "referred.gr8domain.biz", "referred.yourtrap.com", "register.ourhobby.com", "registration2.instanthq.com", "registrations.4pu.com", "registrations.organiccrap.com", "reports.tomorrowforgood.com", "reserveds.onedumb.com", "resources.applemusic.itemdb.com", "rethem.almostmy.com", "rg197.win", "rlbeiydn.hi.r3u8.com", "saiyo.exprenum.com", "salvaiona.com", "sappore.cloud-maste.com", "sapporo.cloud-maste.com", "sapporot.com", "sat.suayay.com", "saverd.re26.com", "sc.weboot.info", "scholz-versand.com", "scrlk.exprenum.com", "se.toythieves.com", "sea.websegoo.net", "secertnews.mrbasic.com", "secmicrosooo.6600.org", "secnetshit.com", "secserverupdate.toh.info", "sell.mofaess.com", "sema.linuxsofta.com", "senseye.ikwb.com", "senseye.mrbonus.com", "septdlluckysystem.jungleheart.com", "seraphim-yurieva.justdied.com", "serv.justdied.com", "server1.proxydns.com", "seyesb.acmetoy.com", "sha.25u.com", "sha.ikwb.com", "shenajou.com", "shoppingcentre.station155.com", "shrimp.bdoncloud.com", "shrimp.usffunicef.com", "shugiin.jkub.com", "sindeali.com", "singed.otzo.com", "siteinit.info", "sma.jimindaddy.com", "smtp.architectisusa.com", "smtp.macforlinux.net", "smtp230.toldweb.com", "somthing.re26.com", "station155.com", "stevenlf.com", "style.u-tokyo-ac-jp.com", "suayay.com", "supportus.mefound.com", "suzukigooogle.8866.org", "svc.dynssl.com", "taipeifoodsite.ocry.com", "tamraj.fartit.com", "telegraph.mefound.com", "test.usyahooapis.com", "tfa.longmusic.com", "tffghelth.com", "ticket.instanthq.com", "ticket.jetos.com", "ticket.serveuser.com", "tidatacenter.shenajou.com", "tisdatacenter.shenajou.com", "tisupdateinfo.faqserv.com", "tokyo-gojp.com", "tokyofile.2waky.com", "tomorrowforgood.com", "tophost.dynamicdns.co.uk", "toshste.com", "toya.7766.org", "transfer.lflinkup.org", "transfer.mrbasic.com", "transfer.vizvaz.com", "trasul.mypicture.info", "travelyokogawafz.fartit.com", "trendmicroupdate.shenajou.com", "trendsecurity.shenajou.com", "tw.2012yearleft.com", "twmusic.proxydns.com", "twpeoplemusicsite.my03.com", "twtravelinfomation.toythieves.com", "twx.mynumber.org", "tyoto-go-jp.com", "u-tokyo-ac-jp.com", "u1.fartit.com", "u1.haoyujd.info", "ubuntusofta.com", "ugreen.itemdb.com", "ui.hdcdui.com", "uk.dynamicdns.org.uk", "ukuoka.cloud-maste.com", "ultimedia.vmmini.com", "un.ddns.info", "update.yourtrap.com", "updatemirrors.fartit.com", "updates.itsaol.com", "ups.improvejpese.com", "urearapetsu.com", "usa.got-game.org", "usa.itsaol.com", "usa.japanteam.org", "usffunicef.com", "usmirocomney.net", "usyahooapis.com", "uu.logon-live.com", "uu.niushenghuo.info", "ux.niushenghuo.info", "v4.appledownload.ourhobby.com", "v4.itunesmusic.jkub.com", "v4.microsoftmusic.onedumb.com", "v4.microsoftupdate.mrbasic.com", "v4.windowsupdate.authorizeddns.org", "v4.windowsupdate.dedgesuite.net", "v4.windowsupdate.dnset.com", "v4.windowsupdate.itsaol.com", "v4.windowsupdate.lflinkup.com", "v4.windowsupdate.mrface.com", "v4.windowsupdate.nsatcdns.com", "v4.windowsupdate.x24hr.com", "v4.windowsupdates.dnsrd.com", "veryhuai.info", "vmdnsup.org", "vmmini.com", "vmyisan.website0012.net", "vscue.com", "wcwname.com", "wcxh.mynetav.net", "wdsupdates.com", "webbooting.com", "webdirectnews.dynamicdns.biz", "webinfoseco.ygto.com", "webmailentry.jetos.com", "weboot.info", "website0012.net", "websiteboo.website0012.net", "websqlnewsmanager.ninth.biz", "well.itsaol.com", "well.mrbasic.com", "whale.toshste.com", "whyis.haoyujd.info", "windowfile.itemdb.com", "windowsimages.itemdb.com", "windowsimages.qhigh.com", "windowsmirrors.vizvaz.com", "windowsstores.gettrials.com", "windowsstores.organiccrap.com", "windowsupdate.2waky.com", "windowsupdate.3-a.net", "windowsupdate.acmetoy.com", "windowsupdate.authorizeddns.net", "windowsupdate.authorizeddns.org", "windowsupdate.authorizeddns.us", "windowsupdate.com.mwcname.com", "windowsupdate.dedgesuite.net", "windowsupdate.dns05.com", "windowsupdate.dnset.com", "windowsupdate.esmtp.biz", "windowsupdate.ezua.com", "windowsupdate.fartit.com", "windowsupdate.gettrials.com", "windowsupdate.instanthq.com", "windowsupdate.itsaol.com", "windowsupdate.jungleheart.com", "windowsupdate.lflink.com", "windowsupdate.mrface.com", "windowsupdate.mylftv.com", "windowsupdate.nsatcdns.com", "windowsupdate.organiccrap.com", "windowsupdate.rebatesrule.net", "windowsupdate.sellclassics.com", "windowsupdate.serveusers.com", "windowsupdate.vizvaz.com", "windowsupdate.wcwname.com", "windowsupdate.x24hr.com", "windowsupdate.ygto.com", "windowsupdates.dnset.com", "windowsupdates.ezua.com", "windowsupdates.ikwb.com", "windowsupdates.itemdb.com", "windowsupdates.proxydns.com", "workerisgood.com", "woyaofanwen.com", "wubangtu.info", "www-meti-go-jp.tyoto-go-jp.com", "www.2014.zzux.com", "www.97sm.com", "www.9gowg.tech", "www.abdominal.faqserv.com", "www.additional.sexidude.com", "www.afc.https443.org", "www.androidmusicapp.onmypc.us", "www.announcements.toythieves.com", "www.anx-own-334.mrbasic.com", "www.apple.ikwb.com", "www.appledownload.ourhobby.com", "www.appleimages.itemdb.com", "www.appleimages.longmusic.com", "www.appleimages.organiccrap.com", "www.applejuice.itemdb.com", "www.applemirror.organiccrap.com", "www.applemirror.squirly.info", "www.applemusic.isasecret.com", "www.applemusic.itemdb.com", "www.applemusic.wikaba.com", "www.applemusic.xxuz.com", "www.applemusic.zzux.com", "www.appleupdate.itemdb.com", "www.appleupdateurl.2waky.com", "www.architectisusa.com", "www.army.xxuz.com", "www.art.p6p6.net", "www.asfzx.x24hr.com", "www.availab.wikaba.com", "www.availability.justdied.com", "www.babymusicsitetr.mymom.info", "www.back.jungleheart.com", "www.balance1.wikaba.com", "www.be.mrslove.com", "www.belowto.com", "www.billing.organiccrap.com", "www.blaaaaaaaaaaaa.windowsupdate.3-a.net", "www.brand.fartit.com", "www.bulletproof.squirly.info", "www.cabbage.iownyour.biz", "www.ccupdatedata.authorizeddns.net", "www.cdn.incloud-go.com", "www.center.shenajou.com", "www.chaindungeons.com", "www.cia.ezua.com", "www.cia.toh.info", "www.civilwar123.authorizeddns.org", "www.civilwar520.onmypc.org", "www.cloud-maste.com", "www.cnnews.mylftv.com", "www.commissioner.shenajou.com", "www.commons.onedumb.com", "www.contractus.qpoe.com", "www.corp-dnsonline.itsaol.com", "www.courier.jetos.com", "www.cress.mynetav.net", "www.ctdl.windowsupdate.nsatcdns.com", "www.ctldl.microsoftupdate.qhigh.com", "www.ctldl.windowsupdate.authorizeddns.us", "www.ctldl.windowsupdate.esmtp.biz", "www.ctldl.windowsupdate.mrface.com", "www.cwiinatonal.com", "www.dasoftactivemodule.toythieves.com", "www.dasonews.youdontcare.com", "www.daughter.vizvaz.com", "www.de.onmypc.info", "www.details.squirly.info", "www.development.shenajou.com", "www.devilcase.acmetoy.com", "www.disruptive.https443.net", "www.dns-hinettw.25u.com", "www.document.shenajou.com", "www.domainnow.yourtrap.com", "www.download.windowsupdate.nsatcdns.com", "www.ea.onmypc.info", "www.eddo.qpoe.com", "www.ehshiroshima.mylftv.com", "www.eric-averyanov.wha.la", "www.eu.acmetoy.com", "www.eu.wha.la", "www.express.lflinkup.com", "www.extraordinary.dynamic-dns.net", "www.f068v.site", "www.facefile.fartit.com", "www.fertile.authorizeddns.net", "www.file.zzux.com", "www.findme.epac.to", "www.fire.mrface.com", "www.firstnews.jkub.com", "www.fjs.wikaba.com", "www.foal.wchildress.com", "www.fr.wikaba.com", "www.freegamecenter.onedumb.com", "www.fruit.qhigh.com", "www.fuck.ikwb.com", "www.fuckmm.dns-dns.com", "www.fukuoka.cloud-maste.com", "www.g3ypf.online", "www.garlic.dyndns.pro", "www.generat.almostmy.com", "www.glicense.shenajou.com", "www.goldtoyota.com", "www.goodmusic.justdied.com", "www.gooesdataios.instanthq.com", "www.grammar.jkub.com", "www.helpus.ddns.info", "www.hii.qhigh.com", "www.hinetonlinedns.dns05.com", "www.incloud-go.com", "www.innocent-isayev.sexidude.com", "www.interpreter.shenajou.com", "www.invoices.sexxxy.biz", "www.iphone.vizvaz.com", "www.ipv4.microsoftupdate.mrbasic.com", "www.ipv4.windowsupdate.3-a.net", "www.ipv4.windowsupdate.esmtp.biz", "www.ipv4.windowsupdate.fartit.com", "www.ipv4.windowsupdate.lflink.com", "www.ipv4.windowsupdate.mrface.com", "www.ipv4.windowsupdate.mylftv.com", "www.ipv4.windowsupdate.nsatcdns.com", "www.itlans.isasecret.com", "www.itunesdownload.jkub.com", "www.itunesdownload.vizvaz.com", "www.itunesdownload.wikaba.com", "www.itunesimages.itemdb.com", "www.itunesimages.itsaol.com", "www.itunesimages.qpoe.com", "www.itunesmirror.fartit.com", "www.itunesmirror.itsaol.com", "www.itunesmusic.ikwb.com", "www.itunesmusic.jetos.com", "www.itunesmusic.jkub.com", "www.itunesmusic.zzux.com", "www.itunesupdate.itsaol.com", "www.itunesupdates.organiccrap.com", "www.japanenvnews.qpoe.com", "www.jd978.com", "www.jimin.jimindaddy.com", "www.jimin.mymom.info", "www.jp.serveuser.com", "www.jpnappstore.ourhobby.com", "www.jpnewslogs.sendsmtp.com", "www.jpnxzshopdata.authorizeddns.org", "www.kawasaki.cloud-maste.com", "www.kawasaki.unhamj.com", "www.key.zzux.com", "www.knowledge.sellclassics.com", "www.lan.dynssl.com", "www.last.p6p6.net", "www.latestnews.epac.to", "www.latestnews.organiccrap.com", "www.leedong.longmusic.com", "www.leeks.mrbonus.com", "www.liberty.acmetoy.com", "www.license.shenajou.com", "www.lion.wchildress.com", "www.loveddos.com", "www.macfee.mrface.com", "www.macforlinux.net", "www.maffc.mrface.com", "www.malware.dsmtp.com", "www.manager.jetos.com", "www.markabcinfo.dynamicdns.me.uk", "www.mason.vizvaz.com", "www.mediapath.organiccrap.com", "www.meiji-ac-jp.com", "www.messagea.emailfound.info", "www.microsoft.got-game.org", "www.microsoft.mrface.com", "www.microsoftempowering.sendsmtp.com", "www.microsoftgame.mrface.com", "www.microsoftgetstarted.sexidude.com", "www.microsoftimages.organiccrap.com", "www.microsoftmirror.mrbasic.com", "www.microsoftmusic.itemdb.com", "www.microsoftmusic.mrbasic.com", "www.microsoftqckmanager.pcanywhere.net", "www.microsoftupdate.mrbasic.com", "www.microsoftupdate.qhigh.com", "www.micrsoftware.dsmtp.com", "www.mircsoft.compress.to", "www.mmy.ddns.us", "www.mod.jetos.com", "www.mofa.dynamic-dns.net", "www.mofa.ns01.info", "www.moonnightthse.zyns.com", "www.moscowdic.trickip.org", "www.moscowstdsupdate.toythieves.com", "www.msg.ezua.com", "www.msn.incloud-go.com", "www.musicfile.ikwb.com", "www.musicjj.zzux.com", "www.musicsecph.squirly.info", "www.mymusicbox.lflinkup.org", "www.mymusicbox.vizvaz.com", "www.myrestroomimage.isasecret.com", "www.mytwhomeinst.sendsmtp.com", "www.myurinikoreaaps.ninth.biz", "www.na.americanunfinished.com", "www.na.onmypc.org", "www.networkjpnzee.mynetav.org", "www.newcityoforward.rebatesrule.net", "www.newdnssec-info.4mydomain.com", "www.newsdata.jkub.com", "www.newsfile.toythieves.com", "www.newsroom.cleansite.info", "www.nlddnsinfo.https443.org", "www.no.authorizeddns.org", "www.nposnewsinfo.qhigh.com", "www.nsa.mefound.com", "www.nt.mynumber.org", "www.nttdata.otzo.com", "www.nuisance.serveusers.com", "www.nz.compress.to", "www.ol.almostmy.com", "www.oldbmwy.com", "www.onion.jkub.com", "www.onlinednsserver.sendsmtp.com", "www.oracleupdate.dns04.com", "www.oyster.jkub.com", "www.p6p6.net", "www.packetsdsquery.dns05.com", "www.pepper.sexxxy.biz", "www.phptecinfohelp.itemdb.com", "www.pickled.myddns.com", "www.polopurple.com", "www.portal.mrface.com", "www.portal.sendsmtp.com", "www.portalser.dynamic-dns.net", "www.praskovya-matveyeva.mefound.com", "www.praskovya-ulyanova.dumb1.com", "www.products.almostmy.com", "www.products.cleansite.us", "www.products.serveuser.com", "www.purchase.lflinkup.org", "www.rainbow.mypop3.org", "www.re26.com", "www.read.xxuz.com", "www.recent.dns-stuff.com", "www.recent.fartit.com", "www.redflower.isasecret.com", "www.referred.gr8domain.biz", "www.referred.yourtrap.com", "www.register.ourhobby.com", "www.registration2.instanthq.com", "www.registrations.4pu.com", "www.registrations.organiccrap.com", "www.remeberdata.iownyour.org", "www.reserveds.onedumb.com", "www.rethem.almostmy.com", "www.rg197.win", "www.sakai.unhamj.com", "www.sapporo.cloud-maste.com", "www.sauerkraut.sellclassics.com", "www.saverd.re26.com", "www.sbuudd.webssl9.info", "www.sdmsg.onmypc.org", "www.se.toythieves.com", "www.secertnews.mrbasic.com", "www.secnetshit.com", "www.secserverupdate.toh.info", "www.senseye.ikwb.com", "www.senseye.mrbonus.com", "www.septdlluckysystem.jungleheart.com", "www.seraphim-yurieva.justdied.com", "www.serv.justdied.com", "www.server1.proxydns.com", "www.seyesb.acmetoy.com", "www.showy.almostmy.com", "www.shugiin.jkub.com", "www.sindeali.com", "www.singed.otzo.com", "www.sojourner.mypicture.info", "www.sstday.jkub.com", "www.support1.mrface.com", "www.supportus.mefound.com", "www.svc.dynssl.com", "www.sweetheart.sexxxy.biz", "www.synssl.dnset.com", "www.tamraj.fartit.com", "www.telegraph.mefound.com", "www.tfa.longmusic.com", "www.thunder.wikaba.com", "www.ticket.instanthq.com", "www.ticket.serveuser.com", "www.tisupdateinfo.faqserv.com", "www.tokyofile.2waky.com", "www.tophost.dynamicdns.co.uk", "www.transfer.lflinkup.org", "www.transfer.mrbasic.com", "www.transfer.vizvaz.com", "www.twgovernmentinfo.acmetoy.com", "www.twsslpopservupro.dynssl.com", "www.ugreen.itemdb.com", "www.uk.dynamicdns.org.uk", "www.un.ddns.info", "www.un.dnsrd.com", "www.unhamj.com", "www.usa.itsaol.com", "www.usffunicef.com", "www.usliveupdateonline.ygto.com", "www.ut-portal-u-tokyo-ac-jp.tyoto-go-jp.com", "www.v4.windowsupdate.mrface.com", "www.v4.windowsupdate.nsatcdns.com", "www.vmmini.com", "www.wchildress.com", "www.webdirectnews.dynamicdns.biz", "www.webmailentry.jetos.com", "www.websqlnewsmanager.ninth.biz", "www.well.itsaol.com", "www.well.mrbasic.com", "www.windowfile.itemdb.com", "www.windowsimages.itemdb.com", "www.windowsimages.qhigh.com", "www.windowsmirrors.vizvaz.com", "www.windowsupdate.2waky.com", "www.windowsupdate.3-a.net", "www.windowsupdate.acmetoy.com", "www.windowsupdate.authorizeddns.net", "www.windowsupdate.authorizeddns.org", "www.windowsupdate.authorizeddns.us", "www.windowsupdate.dns05.com", "www.windowsupdate.dnset.com", "www.windowsupdate.esmtp.biz", "www.windowsupdate.ezua.com", "www.windowsupdate.fartit.com", "www.windowsupdate.gettrials.com", "www.windowsupdate.instanthq.com", "www.windowsupdate.itsaol.com", "www.windowsupdate.jungleheart.com", "www.windowsupdate.lflink.com", "www.windowsupdate.mrface.com", "www.windowsupdate.mylftv.com", "www.windowsupdate.nsatcdns.com", "www.windowsupdate.organiccrap.com", "www.windowsupdate.rebatesrule.net", "www.windowsupdate.sellclassics.com", "www.windowsupdate.serveusers.com", "www.windowsupdate.x24hr.com", "www.yahoo.incloud-go.com", "www.yandexr.sellclassics.com", "www.yeahyeahyeahs.3322.org", "www.yokohamajpinstaz.mrbonus.com", "www.zaigawebinfo.rebatesrule.net", "www.zebra.incloud-go.com", "www2.qpoe.com", "www2.zyns.com", "www2.zzux.com", "x7.usyahooapis.com", "xi.dyndns.pro", "xi.sexxxy.biz", "xread10821.9966.org", "xsince.tk", "xt.dnset.com", "xyrn998754.2288.org", "yallago.cu.cc", "yandexr.sellclassics.com", "yeahyeahyeahs.3322.org", "yeap1.jumpingcrab.com", "yfrfyhf.youdontcare.com", "yo.acmetoy.com", "za.myftp.info", "zabbix.servercontrols.pw", "zaigawebinfo.rebatesrule.net", "zccw.cc", "zebra.bdoncloud.com", "zebra.incloud-go.com", "zebra.unhamj.com", "zebra.usffunicef.com", "zero.pcanywhere.net", "zg.ns02.biz", "zone.demoones.com" ] }, "precision": "exact", "references": [ "https://github.com/janhenrikdotcom/iocs/blob/master/APT10/cloud-hopper-indicators-of-compromise-v3.pdf", "https://raw.githubusercontent.com/jonaslejon/apt10/master/apt_apt10.yar" ], "total": 1258 }, { "counts": { "domain": 88 }, "first_seen": "2018-08-30", "indicators": { "domain": [ "1j.www1.biz", "abcd120719.6600.org", "aotuo.9966.org", "apple.ikwb.com", "applelib120102.9966.org", "army.xxuz.com", "art.p6p6.net", "av.ddns.us", "baby.macforlinux.net", "bak.have8000.com", "bak.ignorelist.com", "be.yourtrap.com", "bk56.twilightparadox.com", "cao.p6p6.net", "ccfchrist.com", "cloud-maste.com", "cmdnetview.com", "cpu.4pu.com", "dedydns.ns01.us", "document.methoder.com", "drives.methoder.com", "emailfound.info", "fiveavmersi.websegoo.net", "fuckanti.com", "gadskysun.com", "gold.polopurple.com", "goldtoyota.com", "google.macforlinux.net", "google.usrobothome.com", "have8000.com", "hk.cmdnetview.com", "hk.have8000.com", "hostport9.net", "idpmus.hostport9.net", "im.suibian2010.info", "janpan.bigmoney.biz", "japan.fuckanti.com", "jepsen.r3u8.com", "jimindaddy.com", "jpn.longmusic.com", "kmd.crabdance.com", "last.p6p6.net", "lehigtapp.com", "macforlinux.net", "mailj.hostport9.net", "messagea.emailfound.info", "microcnmlgb.3322.org", "music.websegoo.net", "oldbmwy.com", "p6p6.net", "polopurple.com", "poulsenv.com", "quick.oldbmwy.com", "r3u8.com", "radiorig.com", "re26.com", "record.hostport9.net", "record.wschandler.com", "sbuudd.webssl9.info", "sdmsg.onmypc.org", "send.have8000.com", "send.mofa.ns01.info", "sendmsg.jumpingcrab.com", "sky.oldbmwy.com", "smo.gadskysun.com", "sstday.jkub.com", "start.usrobothome.com", "stone.jumpingcrab.com", "suibian2010.info", "support1.mrface.com", "synssl.dnset.com", "sz.thedomais.info", "taipei.yourtrap.com", "thedomais.info", "tv.goldtoyota.com", "un.dnsrd.com", "unhamj.com", "usrobothome.com", "video.vmdnsup.org", "vmyiersend.websago.info", "wchildress.com", "websago.info", "websegoo.net", "webssl9.info", "whellbuy.wschandler.com", "wike.wikaba.com", "wschandler.com", "wthelpdesk.com" ] }, "precision": "exact", "references": [ "https://github.com/janhenrikdotcom/iocs/blob/master/APT10/cloud-hopper-indicators-of-compromise-v3.pdf", "https://raw.githubusercontent.com/jonaslejon/apt10/master/apt_apt10.yar", "https://github.com/pan-unit42/iocs/blob/master/menuPass" ], "total": 88 }, { "counts": { "domain": 1 }, "first_seen": "2018-08-30", "indicators": { "domain": [ "belowto.com" ] }, "precision": "exact", "references": [ "https://github.com/janhenrikdotcom/iocs/blob/master/APT10/cloud-hopper-indicators-of-compromise-v3.pdf", "https://raw.githubusercontent.com/jonaslejon/apt10/master/apt_apt10.yar", "https://unit42.paloaltonetworks.com/menupass-playbook-and-iocs/", "https://github.com/pan-unit42/iocs/blob/master/menuPass" ], "total": 1 }, { "counts": { "domain": 2 }, "first_seen": "2017-04-18", "indicators": { "domain": [ "gavin.ccfchrist.com", "hamiltion.catholicmmb.com" ] }, "precision": "exact", "references": [ "http://blog.jpcert.or.jp/2017/02/chches-malware--93d6.html", "https://app.any.run/tasks/b5634afb-0d3a-4d0b-97c8-fbbd25b9aa97/", "https://github.com/janhenrikdotcom/iocs/blob/master/APT10/cloud-hopper-indicators-of-compromise-v3.pdf", "https://raw.githubusercontent.com/jonaslejon/apt10/master/apt_apt10.yar" ], "total": 2 }, { "counts": { "domain": 13 }, "first_seen": "2017-04-14", "indicators": { "domain": [ "2014.zzux.com", "app.lehigtapp.com", "apple.cmdnetview.com", "cia.toh.info", "cvnx.zyns.com", "fbi.sexxxy.biz", "fukuoka.cloud-maste.com", "inspgon.re26.com", "iphone.vizvaz.com", "jimin.jimindaddy.com", "lion.wchildress.com", "nttdata.otzo.com", "nunluck.re26.com" ] }, "precision": "exact", "references": [ "http://researchcenter.paloaltonetworks.com/2017/02/unit42-menupass-returns-new-malware-new-attacks-japanese-academics-organizations/", "https://github.com/janhenrikdotcom/iocs/blob/master/APT10/cloud-hopper-indicators-of-compromise-v3.pdf", "https://raw.githubusercontent.com/jonaslejon/apt10/master/apt_apt10.yar", "https://github.com/pan-unit42/iocs/blob/master/menuPass" ], "total": 13 }, { "counts": { "domain": 6 }, "first_seen": "2017-04-14", "indicators": { "domain": [ "area.wthelpdesk.com", "dick.ccfchrist.com", "kawasaki.cloud-maste.com", "kawasaki.unhamj.com", "sakai.unhamj.com", "scorpion.poulsenv.com" ] }, "precision": "exact", "references": [ "http://researchcenter.paloaltonetworks.com/2017/02/unit42-menupass-returns-new-malware-new-attacks-japanese-academics-organizations/", "http://blog.jpcert.or.jp/2017/02/chches-malware--93d6.html", "https://app.any.run/tasks/b5634afb-0d3a-4d0b-97c8-fbbd25b9aa97/", "https://github.com/janhenrikdotcom/iocs/blob/master/APT10/cloud-hopper-indicators-of-compromise-v3.pdf", "https://raw.githubusercontent.com/jonaslejon/apt10/master/apt_apt10.yar", "https://github.com/pan-unit42/iocs/blob/master/menuPass" ], "total": 6 }, { "counts": { "domain": 4 }, "first_seen": "2017-04-14", "indicators": { "domain": [ "contractus.qpoe.com", "msn.incloud-go.com", "www.mseupdate.ourhobby.com", "yahoo.incloud-go.com" ] }, "precision": "exact", "references": [ "http://researchcenter.paloaltonetworks.com/2017/02/unit42-menupass-returns-new-malware-new-attacks-japanese-academics-organizations/", "https://github.com/janhenrikdotcom/iocs/blob/master/APT10/cloud-hopper-indicators-of-compromise-v3.pdf", "https://raw.githubusercontent.com/jonaslejon/apt10/master/apt_apt10.yar" ], "total": 4 }, { "counts": { "domain": 1 }, "first_seen": "2017-04-14", "indicators": { "domain": [ "zebra.wthelpdesk.com" ] }, "precision": "exact", "references": [ "http://researchcenter.paloaltonetworks.com/2017/02/unit42-menupass-returns-new-malware-new-attacks-japanese-academics-organizations/", "http://blog.jpcert.or.jp/2017/02/chches-malware--93d6.html", "https://app.any.run/tasks/b5634afb-0d3a-4d0b-97c8-fbbd25b9aa97/", "https://github.com/janhenrikdotcom/iocs/blob/master/APT10/cloud-hopper-indicators-of-compromise-v3.pdf", "https://raw.githubusercontent.com/jonaslejon/apt10/master/apt_apt10.yar", "https://github.com/pan-unit42/iocs/blob/master/menuPass", "https://app.any.run/tasks/875fe058-ade2-4d26-86fc-411417e33dff/" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2017-04-14", "indicators": { "domain": [ "trout.belowto.com" ] }, "precision": "exact", "references": [ "http://researchcenter.paloaltonetworks.com/2017/02/unit42-menupass-returns-new-malware-new-attacks-japanese-academics-organizations/", "http://blog.jpcert.or.jp/2017/02/chches-malware--93d6.html", "https://app.any.run/tasks/b5634afb-0d3a-4d0b-97c8-fbbd25b9aa97/", "https://github.com/janhenrikdotcom/iocs/blob/master/APT10/cloud-hopper-indicators-of-compromise-v3.pdf", "https://raw.githubusercontent.com/jonaslejon/apt10/master/apt_apt10.yar" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2017-04-14", "indicators": { "domain": [ "Jepsen.r3u8.com" ] }, "precision": "exact", "references": [ "http://researchcenter.paloaltonetworks.com/2017/02/unit42-menupass-returns-new-malware-new-attacks-japanese-academics-organizations/" ], "total": 1 } ] }