{
  "aliases": [
    "ajax security team",
    "apt-c-51",
    "apt35",
    "apt42",
    "bellaciao",
    "charmingcypress",
    "educated manticore",
    "emennet pasargad",
    "great rift",
    "greencharlie",
    "iranian dream job",
    "magichound",
    "miragekitten",
    "nemesiskitten",
    "nimbus manticore",
    "phosphorus",
    "plaid rain",
    "screening serpens",
    "smoke sandstorm",
    "smudgedserpent",
    "snailresin",
    "subtle snail",
    "subtlesnail",
    "ta453",
    "ta455",
    "tunnelvision",
    "unc1549",
    "unc4453",
    "unc788",
    "wezrat"
  ],
  "attack_id": "G0058",
  "attack_name": "Charming Kitten",
  "attack_url": "https://attack.mitre.org/groups/G0058/",
  "counts": {
    "domain": 2262,
    "ipv4": 107,
    "url": 25,
    "url_path": 16
  },
  "first_seen": {
    "domain": {
      "012mail-net-uwclogin.ml": "2019-03-23",
      "0brandaeyes0.xyz": "2022-01-11",
      "0standavalue0.xyz": "2022-01-11",
      "0storageatools0.xyz": "2022-01-11",
      "1drv.casa": "2021-04-01",
      "1drv.cyou": "2021-04-01",
      "1drv.icu": "2021-04-01",
      "1drv.live": "2021-04-01",
      "1drv.online": "2021-04-01",
      "1drv.surf": "2021-04-01",
      "1drv.xyz": "2021-04-01",
      "1stemployer.com": "2024-02-28",
      "1stl.ink": "2026-01-02",
      "30min-ergmeeting.com": "2026-07-17",
      "30min-ergmeeting.net": "2026-07-17",
      "30min-smartsight-hr.com": "2026-07-17",
      "30min-smartsight.com": "2026-07-17",
      "30min-ziprecruiter.com": "2026-07-17",
      "30min-ziprecruiterhr.com": "2026-07-17",
      "30minmeeting-quality.com": "2026-07-17",
      "30minmeetinghr.com": "2026-07-17",
      "30minziprecruiterhr.net": "2026-07-17",
      "3dauth.live": "2024-05-03",
      "3dconfirrnation.com": "2024-09-30",
      "8475.freelancedeveloper.site": "2026-07-17",
      "8ghefkwdvbfdsg3asdf1.com": "2019-03-23",
      "academy-update.com": "2026-01-02",
      "accesscheckout.online": "2024-09-30",
      "accessverification.online": "2024-09-30",
      "acconut-mail.com": "2026-01-02",
      "acconut-signin.com": "2024-05-02",
      "acconut-verify.com": "2019-09-15",
      "account-customerservice.com": "2019-03-23",
      "account-drive.com": "2024-05-03",
      "account-dropbox.net": "2019-03-23",
      "account-google.co": "2019-03-23",
      "account-log-user-verify-mail.com": "2019-03-23",
      "account-login.net": "2019-03-23",
      "account-logins.com": "2019-03-23",
      "account-permission-mail-user.com": "2019-03-23",
      "account-profile-users.info": "2019-03-27",
      "account-servicemanagement.info": "2019-03-27",
      "account-servicerecovery.com": "2019-03-23",
      "account-servieemanagement.info": "2019-03-27",
      "account-signin-myaccount-users.ga": "2019-03-23",
      "account-signin.com": "2024-05-02",
      "account-siqnin.com": "2024-05-03",
      "account-support-user.com": "2019-03-23",
      "account-user-permission-account.com": "2019-03-23",
      "account-user-verify-mail.com": "2019-03-23",
      "account-user.com": "2019-03-23",
      "account-users-mail.com": "2019-03-23",
      "account-verifiy.net": "2019-03-27",
      "accountroyal.com": "2026-01-02",
      "accounts-apple.com": "2019-03-27",
      "accounts-drive.com": "2020-02-05",
      "accounts-googelmail.com": "2019-03-23",
      "accounts-googelmails.com": "2019-03-23",
      "accounts-logins.net": "2019-03-23",
      "accounts-mails.com": "2024-05-02",
      "accounts-manager.info": "2019-03-27",
      "accounts-service.support": "2019-03-23",
      "accounts-support.services": "2019-03-27",
      "accounts-web-maii.com": "2019-03-27",
      "accounts-web-mail.com": "2019-03-27",
      "accounts-yahoo.us": "2019-03-23",
      "accounts.google.live-meet.blog": "2026-01-02",
      "accounts.google.live-meet.cfd": "2026-01-02",
      "accounts.google.live-meet.cloud": "2026-01-02",
      "accounts.google.live-meet.info": "2026-01-02",
      "accounts.google.network-show.online": "2026-01-02",
      "accountservice.support": "2019-03-23",
      "accountsrecovery.ddns.net": "2019-03-23",
      "accountsservice-support.com": "2019-03-23",
      "accountts-google.com": "2019-03-23",
      "accredit-navigation.online": "2024-08-15",
      "accredit-validity.ddns.net": "2024-05-03",
      "accredit-validity.online": "2024-05-02",
      "accredit.network": "2024-05-03",
      "accredit.validity.werifcattion.info": "2024-08-15",
      "accunt-loqin.ml": "2024-09-30",
      "accurate-sprout-porpoise.glitch.me": "2024-05-02",
      "accurateprivacy.online": "2024-09-30",
      "ace-capitalpartners.ddns.net": "2026-01-02",
      "acounts-qooqie-con.ml": "2019-03-23",
      "activeeditor.info": "2024-08-20",
      "activehealthlab.azurewebsites.net": "2026-01-02",
      "activespiritluth.eastus.cloudapp.azure.com": "2026-01-02",
      "activities-recovery-options.info": "2019-03-27",
      "activities-servicesnotification.info": "2019-03-27",
      "activity-confirmationservice.info": "2019-03-27",
      "activity-session-recovery.info": "2019-03-27",
      "actor.rap-art.info": "2026-01-02",
      "acupuncturebentonville.com": "2026-01-02",
      "adams-cooling.online": "2026-01-02",
      "addons-mozilla.download": "2019-03-23",
      "admin-stable-right.top": "2024-05-02",
      "admin.cheap-case.site": "2024-08-20",
      "admiscion.online": "2024-05-02",
      "admit-roar-frame.top": "2024-05-02",
      "advission.online": "2024-05-02",
      "aecert.org": "2026-07-29",
      "aeroclinicit.azurewebsites.net": "2026-01-02",
      "aeroconf2014.org": "2019-03-27",
      "aerospace2014.org": "2019-03-27",
      "affect-fist-ton.online": "2024-05-02",
      "africanblackwidow.ddns.net": "2024-05-03",
      "agentappservice.ddns.net": "2021-01-09",
      "agm-rto-ewi.com": "2026-01-02",
      "aipak.org": "2019-03-23",
      "aiqac.org": "2019-03-23",
      "airbus-careers.onlyoffice.com": "2026-01-02",
      "airbus-survay.onlyoffice.com": "2026-01-02",
      "airbus.careers-portal.org": "2026-01-02",
      "airbus.careersworld.org": "2026-01-02",
      "airbus.germanywork.org": "2026-01-02",
      "airbus.global-careers.com": "2026-01-02",
      "airbus.usa-careers.com": "2026-01-02",
      "airbusaerodefence.com": "2026-01-02",
      "airbusaerodefence.nl": "2026-01-02",
      "airbusgroup-careers.com": "2026-01-02",
      "airbushiring.com": "2026-01-02",
      "airconnectionapi.azurewebsites.net": "2024-02-28",
      "airconnectionsapi.azurewebsites.net": "2024-02-28",
      "airconnectionsapijson.azurewebsites.net": "2024-02-28",
      "airgadgetsolution.azurewebsites.net": "2024-02-28",
      "airgadgetsolutions.azurewebsites.net": "2024-02-28",
      "airmdsolutions.azurewebsites.net": "2026-01-02",
      "airtravellog.com": "2026-01-02",
      "albert-company.online": "2026-01-02",
      "alex-mendez-fire.info": "2026-01-02",
      "alharbitelecom.co": "2022-04-07",
      "alison624.online": "2026-01-02",
      "all-for-city.info": "2026-01-02",
      "allocationwithour.info": "2024-12-11",
      "alpha-man.info": "2026-01-02",
      "alpha-meet.online": "2026-01-02",
      "alpha-met.online": "2026-01-02",
      "altnametestapi.azurewebsites.net": "2024-02-28",
      "alwayslivehealthy.com": "2026-01-02",
      "ameen-alkhalij.com": "2026-01-02",
      "ameen-alkhalij.is": "2026-01-02",
      "ameen-alkhalij.nu": "2026-01-02",
      "ameen-alkhalij.org": "2026-01-02",
      "ameen-alkhalij.se": "2026-01-02",
      "amg-car-ger.info": "2026-01-02",
      "analytics-google.org": "2017-04-13",
      "anna-blog.info": "2026-01-02",
      "answerssurveytest.azurewebsites.net": "2024-02-28",
      "anteromarketing.com": "2026-01-02",
      "anymediaapp.com": "2026-07-17",
      "aol-mail-account.com": "2019-03-23",
      "apache-utility.com": "2019-03-23",
      "api.cheap-case.site": "2024-08-20",
      "api.neexportfolio.com": "2026-07-29",
      "api.overall-continuing.site": "2024-08-20",
      "app-documents.com": "2019-03-23",
      "app-engage-station.help": "2024-08-27",
      "app-facebook.co": "2019-03-23",
      "app.cheap-case.site": "2024-08-20",
      "app.hostedlayer.com": "2026-07-17",
      "app.neexportfolio.com": "2026-07-29",
      "apphrquestion.azurewebsites.net": "2024-02-28",
      "apphrquestions.azurewebsites.net": "2024-02-28",
      "apphrquizapi.azurewebsites.net": "2024-02-28",
      "apple-ads-metric.com": "2025-01-04",
      "apple.beta-man.info": "2026-01-02",
      "appleid.com.co": "2019-03-27",
      "apply-jobs.com": "2022-04-07",
      "applytalents.com": "2022-04-07",
      "appslocallogin.online": "2022-04-07",
      "april.spring-club.info": "2026-01-02",
      "araamco.com": "2019-03-23",
      "arabiccountriestalent.azurewebsites.net": "2026-01-02",
      "arabiccountriestalent.com": "2026-01-02",
      "arabiccountriestalenthr.azurewebsites.net": "2026-01-02",
      "arabiccountriestalents.azurewebsites.net": "2026-01-02",
      "arabiccountriestalentshr.azurewebsites.net": "2026-01-02",
      "arcanet.online": "2026-01-02",
      "archery.dedyn.io": "2022-04-07",
      "archive-center.com": "2019-03-23",
      "archiverepositories.xyz": "2021-01-09",
      "arizonaclub.me": "2026-01-02",
      "arquestions.azurewebsites.net": "2024-02-28",
      "arquestionsapi.azurewebsites.net": "2024-02-28",
      "arrow-click.info": "2026-01-02",
      "asiandefenses.com": "2026-01-02",
      "aspenlnstitute.org": "2024-05-02",
      "asus-support.net": "2019-03-23",
      "asus-update.com": "2019-03-23",
      "asylimed.azurewebsites.net": "2026-01-02",
      "atlantic-council.com": "2024-09-30",
      "atlanticconucil.org": "2024-05-03",
      "atlanticcuoncil.com": "2024-05-03",
      "attacker-domain.com": "2019-03-27",
      "audiomanagerapi.azurewebsites.net": "2024-02-28",
      "audioservicetestapi.azurewebsites.net": "2024-02-28",
      "auto-updater.azurewebsites.net": "2026-01-02",
      "autoupdate.uk": "2024-09-05",
      "avid-striking-eagerness.online": "2024-05-02",
      "azadijobs.me": "2024-08-29",
      "azadlliq.info": "2024-05-02",
      "azdava.online": "2026-01-02",
      "backback.info": "2026-01-02",
      "backend.cheap-case.site": "2024-08-20",
      "background-update.azurewebsites.net": "2026-01-02",
      "backsrv66.azurewebsites.net": "2026-01-02",
      "backsrv74.azurewebsites.net": "2026-01-02",
      "bahaius.info": "2019-10-08",
      "bailment.org": "2019-10-08",
      "baochinhphu.org": "2026-01-13",
      "basementofdarkness.ddns.net": "2021-01-09",
      "bbmovements.com": "2026-01-02",
      "bc-app.orgdatasolutions.com": "2026-07-17",
      "bdroyer.webredirect.org": "2026-01-02",
      "beape.live": "2023-08-14",
      "beasze.live": "2023-08-14",
      "beaviews.online": "2024-05-02",
      "becker624.online": "2026-01-02",
      "beeasaze.top": "2023-08-14",
      "beetly.online": "2026-01-02",
      "benefitsredington.ddns.net": "2021-01-09",
      "beparas.com": "2024-08-29",
      "berozkhodro.com": "2019-03-23",
      "besatoo.online": "2026-01-02",
      "best85best.online": "2026-01-02",
      "bestshopu.online": "2026-01-02",
      "besvision.top": "2024-05-02",
      "beta-man.info": "2026-01-02",
      "bilal1com.com": "2024-08-29",
      "biolinksystems.azurewebsites.net": "2026-01-02",
      "birngthemhomenow.co.il": "2024-02-28",
      "bitly.org.il": "2024-02-17",
      "black-friday-store.online": "2026-01-02",
      "blackturtle.hopto.org": "2023-04-25",
      "blognewsalphaapijson.azurewebsites.net": "2024-02-28",
      "blogvolleyballstatus.azurewebsites.net": "2024-02-28",
      "blogvolleyballstatusapi.azurewebsites.net": "2024-02-28",
      "bloom-flatter-affably.top": "2024-05-02",
      "bmw.amg-car-ger.info": "2026-01-02",
      "bnt2.live": "2022-04-07",
      "bodywellnessbycynthia.com": "2026-01-02",
      "boeing-careers.com": "2026-01-02",
      "boeinginformation.onlyoffice.com": "2026-01-02",
      "boeingspace.com": "2026-01-02",
      "boeisurveyapplications.azurewebsites.net": "2024-02-28",
      "bonny-marvels-authentic.top": "2023-03-09",
      "book-archivecenter.bid": "2019-03-23",
      "book-handwrite.online": "2026-01-02",
      "book.anna-blog.info": "2026-01-02",
      "book.kuret-live.online": "2026-01-02",
      "booking.microsoftcalendars.com": "2026-07-17",
      "booking.mountainsgate.com": "2026-07-17",
      "booking.virtualdeskflowr.com": "2026-07-17",
      "bookings.hcpassociation.com.au": "2026-07-17",
      "bookmenow.info": "2026-07-17",
      "books-archivecenter.bid": "2019-03-23",
      "books-archivecenter.club": "2019-03-23",
      "books-google.books-archivecenter.bid": "2019-03-23",
      "books-view.com": "2019-03-23",
      "bookstoragestore.com": "2026-01-02",
      "boom-boom.ga": "2024-09-30",
      "bootstrap.serveftp.com": "2019-03-23",
      "bouncer.qc.to": "2026-01-02",
      "boundary.cfd": "2024-08-15",
      "bq-ledmagic.online": "2024-05-02",
      "bracs-lion.online": "2026-01-02",
      "brannew-home.info": "2026-01-02",
      "britishnews.com.co": "2019-03-23",
      "britishnews.org": "2019-03-23",
      "briview.online": "2024-05-02",
      "broadcastbritishnews.com": "2019-03-23",
      "broadcastnews.pro": "2019-03-27",
      "brookings-edu.in": "2019-03-23",
      "brookings.email": "2024-08-15",
      "browsercheckap.azurewebsites.net": "2024-02-28",
      "browsercheckingapi.azurewebsites.net": "2024-02-28",
      "browsercheckjson.azurewebsites.net": "2024-02-28",
      "budgetingscheduler.pages.dev": "2026-07-17",
      "buisness-centeral-transportation.azurewebsites.net": "2026-05-23",
      "buisness-centeral-transportation.com": "2026-05-23",
      "buisness-centeral.azurewebsites.net": "2026-05-23",
      "bulk-approach.site": "2021-01-09",
      "business-deegital.azurewebsites.net": "2026-07-29",
      "business-deegital.com": "2026-07-29",
      "business-startup.azurewebsites.net": "2026-05-23",
      "business-startup.org": "2026-05-23",
      "businessdeegital.azurewebsites.net": "2026-07-29",
      "businessinssider.org": "2024-05-03",
      "businesslnsider.org": "2024-05-02",
      "businesslocked.com": "2026-07-29",
      "businessmixture.com": "2026-07-29",
      "businessstartup.azurewebsites.net": "2026-05-23",
      "bvio85.info": "2026-01-02",
      "bytli.ink": "2026-01-02",
      "bytli.us": "2024-09-30",
      "cacademy-update.com": "2026-01-02",
      "cache-cleaner-check-111.azurewebsites.net": "2026-01-02",
      "cache-cleaner-check-805.azurewebsites.net": "2026-01-02",
      "cache-cleaner-check-926.azurewebsites.net": "2026-01-02",
      "cache-cleaner-check.azurewebsites.net": "2026-01-02",
      "cache-managment.northeurope.cloudapp.azure.com": "2026-01-02",
      "calendar-cn8.pages.dev": "2026-07-17",
      "calendar.fractionalleverage.com": "2026-07-17",
      "callfeedback.duia.ro": "2024-08-20",
      "canvas-life.me": "2023-11-12",
      "cardiomedspecialists.azurewebsites.net": "2026-01-02",
      "cards.ohana-village.org": "2026-07-29",
      "carebytesolutions.azurewebsites.net": "2026-01-02",
      "careers-finder.com": "2022-04-07",
      "careers-hub.org": "2026-01-02",
      "careers-portal.org": "2026-01-02",
      "careers2find.com": "2024-10-30",
      "careersworld.org": "2026-01-02",
      "carservices.dns-dynamic.net": "2024-08-20",
      "cashcloudservices.com": "2024-02-28",
      "cavinet.org": "2026-01-02",
      "cc-newton.info": "2026-01-02",
      "ccreservoir.info": "2026-01-02",
      "cdn-workspacestudio.redirectme.net": "2024-08-15",
      "cdn.careers2find.com": "2024-10-30",
      "cdsa.xyz": "2022-10-11",
      "centrallibrary.bounceme.net": "2026-01-02",
      "centrallibrary.info": "2024-05-03",
      "chakracleansetherapy.com": "2026-01-02",
      "challengechampions.ddns.net": "2021-01-09",
      "change-mail-account-nodes-permision.com": "2019-03-23",
      "change-mail-accounting-register-single.com": "2019-03-23",
      "change-permission-mail-user-managment.com": "2019-03-23",
      "change-user-account-mail-permission.com": "2019-03-23",
      "changequestionstypeapi.azurewebsites.net": "2024-02-28",
      "changequestionstypejsonapi.azurewebsites.net": "2024-02-28",
      "changequestiontypes.azurewebsites.net": "2024-02-28",
      "changequestiontypesapi.azurewebsites.net": "2024-02-28",
      "channel-shop.manage-tech.club": "2023-11-12",
      "chapter1.cc-newton.info": "2026-01-02",
      "chatsynctransfer.info": "2024-08-20",
      "cheap-case.site": "2024-08-20",
      "check-backup-service-179.azurewebsites.net": "2026-01-02",
      "check-backup-service-288.azurewebsites.net": "2026-01-02",
      "check-backup-service-736.azurewebsites.net": "2026-01-02",
      "check-backup-service.azurewebsites.net": "2026-01-02",
      "check-control-panel.live": "2023-08-14",
      "check-fa-pane.live": "2024-08-15",
      "check-online-panel.live": "2024-05-02",
      "check-pabnel-status.live": "2024-05-02",
      "check-panel-account.icu": "2020-11-16",
      "check-panel-live.icu": "2021-01-04",
      "check-panel-status.live": "2024-05-02",
      "check-reload-page.live": "2023-08-14",
      "check-reload-page.xyz": "2021-01-04",
      "check-security-update.azurewebsites.net": "2026-01-02",
      "check-short-panel.live": "2024-05-02",
      "checkapicountryquestions.azurewebsites.net": "2024-02-28",
      "checkapicountryquestionsjson.azurewebsites.net": "2024-02-28",
      "checking-paneling.live": "2024-08-15",
      "checkservicecustomerapi.azurewebsites.net": "2024-02-28",
      "checkup.webredirect.org": "2023-07-07",
      "cholyicker.ddns.net": "2026-01-02",
      "chrome-up.date": "2017-04-13",
      "city-splash.online": "2026-01-02",
      "clame-rade.online": "2026-01-02",
      "clarification.network": "2024-05-03",
      "cld-global.com": "2026-07-29",
      "clearmindhealthandwellness.com": "2026-01-02",
      "click-choose-figured.cfd": "2024-08-15",
      "click-manage-room.cfd": "2024-08-15",
      "clinichaven.azurewebsites.net": "2026-01-02",
      "cloth-model.blog": "2026-01-02",
      "clothes-show.online": "2026-01-02",
      "cloud-document-edit.onrender.com": "2024-01-17",
      "cloud.qc.to": "2026-01-02",
      "cloudarchive.info": "2024-08-20",
      "cloudaskingquestioning.azurewebsites.net": "2026-01-02",
      "cloudaskingquestioning.azurewebsites.net.net": "2026-01-02",
      "cloudaskingquestions.azurewebsites.net.net": "2026-01-02",
      "cloudaskingquestions.eastus.cloudapp.azure.com": "2026-01-02",
      "cloudaskingquestions.eastus.cloudapp.azure.com.net": "2026-01-02",
      "cloudaskquestionanswers.azurewebsites.net": "2026-01-02",
      "cloudaskquestionanswers.azurewebsites.net.net": "2026-01-02",
      "cloudaskquestionanswers.com": "2026-01-02",
      "cloudaskquestionanswers.com.net": "2026-01-02",
      "cloudaskquestioning.eastus.cloudapp.azure.com": "2026-01-02",
      "cloudaskquestioning.eastus.cloudapp.azure.com.net": "2026-01-02",
      "cloudcomputing.webredirect.org": "2024-09-30",
      "cloudgoogle.co": "2022-04-07",
      "cloudregionpages.info": "2024-08-20",
      "cloudtools.duia.eu": "2024-08-20",
      "cloudtransferfile.info": "2026-01-02",
      "cloudviewer.site": "2024-09-30",
      "cnt-worth.online": "2026-01-02",
      "codeconfirm-recovery.bid": "2019-03-23",
      "codeconfirm-recovery.club": "2019-03-23",
      "codzienniefita.info": "2026-07-17",
      "codzienniefity.info": "2026-07-17",
      "coffeeonlineshop.azurewebsites.net": "2024-02-28",
      "coffeeonlineshoping.azurewebsites.net": "2024-02-28",
      "coldwarehexahash.dns-dynamic.net": "2024-08-20",
      "collab.vaf.ai": "2026-07-17",
      "collaboromarketing.com": "2026-01-02",
      "com-254514785965.site": "2021-01-09",
      "com-3654623478192.site": "2021-01-09",
      "com-5464825879854.site": "2021-01-09",
      "com-account-login.com": "2019-03-23",
      "com-accountidentifier.info": "2019-03-27",
      "com-accountrecovery.bid": "2019-03-23",
      "com-accountsecure-recovery.name": "2019-03-23",
      "com-accountsrecovery.name": "2019-03-23",
      "com-activities.site": "2019-10-08",
      "com-apk-6712qw123asd8awf7.site": "2021-01-09",
      "com-archive.site": "2021-01-09",
      "com-archivecenter.work": "2019-03-23",
      "com-customeradduser.bid": "2019-03-23",
      "com-customerservice.bid": "2019-03-23",
      "com-customerservice.name": "2019-03-23",
      "com-customerservices.name": "2019-03-23",
      "com-customersuperuser.bid": "2019-03-23",
      "com-download.ml": "2019-03-23",
      "com-identifier-servicelog.info": "2019-03-27",
      "com-identifier-servicelog.name": "2019-03-27",
      "com-identifier-servlcelog.name": "2019-03-27",
      "com-identifier.site": "2019-10-08",
      "com-mailbox.com": "2019-03-27",
      "com-manage-accountuser.club": "2019-03-23",
      "com-messagecenter.bid": "2019-03-23",
      "com-messengerservice.bid": "2019-03-23",
      "com-messengerservice.work": "2019-03-23",
      "com-microsoftonline.club": "2019-03-23",
      "com-myaccuants.com": "2019-03-27",
      "com-mychannel.bid": "2019-03-23",
      "com-orginal-links.ga": "2019-03-23",
      "com-posts6712qw12387.site": "2021-01-09",
      "com-privacy-help.info": "2019-03-27",
      "com-recoversessions.bid": "2019-03-23",
      "com-recovery.com": "2019-03-23",
      "com-recovery.site": "2020-05-07",
      "com-recoveryadduser.bid": "2019-03-23",
      "com-recoveryidentifier.bid": "2019-03-23",
      "com-recoveryidentifier.name": "2019-03-23",
      "com-recoveryidentifiers.bid": "2019-03-23",
      "com-recoverymail.bid": "2019-03-23",
      "com-recoverysecureuser.club": "2019-03-23",
      "com-recoverysecureusers.club": "2019-03-23",
      "com-recoveryservice.bid": "2019-03-23",
      "com-recoveryservice.info": "2019-03-23",
      "com-recoverysessions.bid": "2019-03-23",
      "com-recoverysubusers.bid": "2019-03-23",
      "com-recoverysuperuser.bid": "2019-03-23",
      "com-recoverysuperuser.club": "2019-03-23",
      "com-recoverysuperuser.name": "2019-03-23",
      "com-recoverysuperusers.bid": "2019-03-23",
      "com-recoverysupport.bid": "2019-03-23",
      "com-recoverysupport.club": "2019-03-23",
      "com-service.gq": "2019-03-23",
      "com-service.net": "2019-03-23",
      "com-servicecustomer.bid": "2019-03-23",
      "com-servicecustomer.name": "2019-03-23",
      "com-servicemail.bid": "2019-03-23",
      "com-servicerecovery.bid": "2019-03-23",
      "com-servicerecovery.club": "2019-03-23",
      "com-servicerecovery.info": "2019-03-23",
      "com-servicerecovery.name": "2019-03-23",
      "com-servicescustomer.name": "2019-03-23",
      "com-serviceslogin.com": "2019-03-23",
      "com-session.site": "2019-10-08",
      "com-sessionidentifier.info": "2019-03-27",
      "com-sessions.site": "2020-05-07",
      "com-showvideo.ga": "2019-03-23",
      "com-showvideo.gq": "2019-03-23",
      "com-statistics.com": "2019-03-23",
      "com-stats.com": "2019-03-23",
      "com-useraccount.info": "2019-03-27",
      "com-users.net": "2019-03-27",
      "com-verifications.site": "2019-10-08",
      "com-video.net": "2019-03-23",
      "com-videoservice.work": "2019-03-23",
      "com-viewchannel.club": "2019-03-23",
      "comidentifier-servicelog.name": "2019-03-27",
      "commercialstudio.ddns.net": "2026-01-02",
      "compact-miracle-abounds.top": "2023-02-26",
      "complete-telecom-operation.top": "2024-08-15",
      "computerlearning.ddns.net": "2026-01-02",
      "conferencecall.live": "2024-05-03",
      "configtools.linkpc.net": "2024-08-20",
      "confirm-direction.ddns.net": "2024-05-03",
      "confirm-identity.info": "2019-03-27",
      "confirm-identity.site": "2021-01-09",
      "confirm-integrity.ddns.net": "2024-05-03",
      "confirm-session-identification.info": "2019-03-27",
      "confirm-session-identifier.info": "2019-03-27",
      "confirm-sessionidentification.info": "2019-03-27",
      "confirm-validation.ddns.net": "2024-05-03",
      "confirm-validation.mywire.org": "2024-05-03",
      "confirm-validity.hopto.org": "2024-05-03",
      "confirm-verify.servepics.com": "2024-05-03",
      "confirmation-process.top": "2024-05-02",
      "confirmation-recoveryoptions.info": "2019-03-27",
      "confirmation-service.info": "2019-03-27",
      "confirmation-users-service.info": "2019-03-27",
      "confirmation-users-servlee.info": "2019-03-27",
      "confirmation-verify.hopto.org": "2024-05-03",
      "confirrnation.info": "2024-08-15",
      "conn-ectionor.cfd": "2026-01-02",
      "connect-room.online": "2026-01-02",
      "connectairapijson.azurewebsites.net": "2024-02-28",
      "connection-view.online": "2024-05-02",
      "connectionhandlerapi.azurewebsites.net": "2024-02-28",
      "consistent-provisioned.accesscam.org": "2026-01-02",
      "contentpreview.redirectme.net": "2024-08-20",
      "continue-recognized.ddns.net": "2024-05-03",
      "continue-recognized.hopto.org": "2024-05-03",
      "continue-recognized.online": "2024-05-02",
      "continue-session-identifier.info": "2019-03-27",
      "continue-sesslon-identifier.info": "2019-03-27",
      "continue-short.ddns.net": "2026-01-02",
      "continue-to-your-account.000webhostapp.com": "2024-09-30",
      "continue.duia.eu": "2024-08-20",
      "continueresource.forumz.info": "2024-08-20",
      "continuetogo.me": "2022-12-07",
      "continueworkflow.onthewifi.com": "2024-08-15",
      "conveniente-sharefile.info": "2024-12-11",
      "cook-tips.info": "2026-01-02",
      "coordinate.icu": "2024-05-02",
      "coral-polydactyl-dragonfruit.glitch.me": "2024-01-17",
      "correction.verify.rsession.site": "2024-08-15",
      "cortanaservice.com": "2022-04-07",
      "cortanaupdate.co": "2022-04-07",
      "countrybasedquestions.azurewebsites.net": "2024-02-28",
      "course-math.info": "2026-01-02",
      "cover-home-page.xyz": "2020-12-02",
      "cover-home-panel.xyz": "2020-11-16",
      "covi19questionaire.000webhostapp.com": "2024-09-30",
      "covid19questionnaire.freesite.vip": "2024-09-30",
      "cpanel-services.site": "2020-02-05",
      "cppsg.online": "2026-01-02",
      "crcperss.com": "2019-03-23",
      "createformquestionshelper.com": "2026-01-02",
      "createformquestionshelper.com.net": "2026-01-02",
      "creating-loceer.ddns.net": "2026-01-02",
      "cresearch-storage.com": "2026-01-02",
      "crimson-peaks.com": "2026-07-17",
      "crysus-h.info": "2026-01-02",
      "crysus-p.info": "2026-01-02",
      "csearchfilterapp.info": "2026-01-02",
      "csm-group.org": "2021-01-09",
      "cspvpn.duckdns.org": "2024-08-28",
      "css-ethz.ch": "2024-09-30",
      "cstoddart-meeting-scheduler.firebaseapp.com": "2026-07-17",
      "currentpageeditor.dns-dynamic.net": "2024-08-20",
      "customer-certificate.com": "2019-03-27",
      "customer-identifier.site": "2020-05-07",
      "customer-recovery.info": "2019-03-27",
      "customer-reminder.info": "2020-05-07",
      "customer-session.site": "2021-01-09",
      "customercareservice.azurewebsites.net": "2024-02-28",
      "customercareserviceapi.azurewebsites.net": "2024-02-28",
      "customers-activities.info": "2019-03-27",
      "customers-activities.site": "2019-10-08",
      "customers-activity.site": "2020-05-07",
      "customers-manager.info": "2019-03-27",
      "customers-recovery.site": "2019-10-08",
      "customers-reminder.info": "2019-10-08",
      "customers-service.ddns.net": "2020-02-05",
      "customers-services.info": "2019-03-27",
      "customize-identity.info": "2019-03-27",
      "cutly.biz": "2023-01-13",
      "cutly.vip": "2024-09-30",
      "cvcreate.org": "2019-03-23",
      "cvisiion.online": "2024-05-02",
      "cybercourt.io": "2024-10-31",
      "cyberflood.io": "2024-02-17",
      "cyberlattice.pro": "2026-01-02",
      "d75.site": "2024-05-02",
      "daemon-mailer.co": "2024-02-17",
      "daemon-mailer.com": "2024-09-30",
      "daemon-mailer.info": "2024-05-02",
      "damavand-hr.me": "2024-08-29",
      "damkahill.com": "2024-08-29",
      "darakeh.me": "2024-08-29",
      "dash.shortoni.live": "2024-12-17",
      "data.live-meet.blog": "2026-01-02",
      "datasheet96.azurewebsites.net": "2026-01-02",
      "dazedebtor.com": "2026-01-02",
      "db.qc.to": "2026-01-02",
      "de-ma.online": "2020-10-28",
      "decorous-super-blender.glitch.me": "2024-05-07",
      "deepspaceocean.info": "2024-08-21",
      "deepthinkingroom.ddns.net": "2021-01-09",
      "deersharpfork.info": "2023-04-25",
      "defenderupdate.ddns.net": "2022-04-07",
      "demo-meeting.captello.com": "2026-07-17",
      "demo.cheap-case.site": "2024-08-20",
      "destinationreferrer.serveirc.com": "2024-09-30",
      "destinationzone.duia.eu": "2024-08-20",
      "deutcshewelle.com": "2019-03-23",
      "deutcshewelle.org": "2019-03-23",
      "dev.cheap-case.site": "2024-08-20",
      "developer-app.xyz": "2020-12-12",
      "dhs-us.org": "2021-01-09",
      "differentintegrated.ddns.net": "2021-01-09",
      "digicura.azurewebsites.net": "2026-01-02",
      "digitalpufferfish.ddns.net": "2024-05-03",
      "digitalqlobe.com": "2019-03-23",
      "digithealthplatform.azurewebsites.net": "2026-01-02",
      "direct-access.info": "2024-09-30",
      "direct-view-check.live": "2023-08-14",
      "direct-view-panel.xyz": "2023-08-14",
      "directfileinternal.info": "2024-08-20",
      "direction-check.online": "2024-05-03",
      "direction-session-verify.site": "2024-05-03",
      "direction-veracity.ddns.net": "2024-05-03",
      "directpathfellow.zapto.org": "2024-09-30",
      "discovery-protocol.ml": "2024-09-30",
      "display-error-runtime.com": "2019-03-23",
      "display-ganavaro-abrashimchi.com": "2019-03-23",
      "dloffice.buzz": "2024-05-02",
      "dloffice.top": "2024-05-02",
      "dmn-for-car.online": "2026-01-02",
      "dmn-for-hall.online": "2026-01-02",
      "dmn-inter.online": "2026-01-02",
      "dn.neexportfolio.com": "2026-07-29",
      "dnx.capital": "2022-11-23",
      "doc-viewer.com": "2019-03-23",
      "doceditor.duckdns.org": "2024-08-20",
      "docfileview.org": "2024-09-30",
      "docs-google.co": "2019-03-23",
      "docspace-twpf0e.onlyoffice.com": "2026-05-23",
      "docspace-y4cumb.onlyoffice.com": "2026-05-23",
      "doctorconsult-app.azurewebsites.net": "2026-01-02",
      "doctransfer.online": "2024-09-30",
      "document-share.info": "2020-09-30",
      "document-sharing.online": "2019-10-08",
      "document-supportsharing.bid": "2019-03-23",
      "documentcloudeditor.ddnsgeek.com": "2024-08-20",
      "documentofficupdate.info": "2019-03-27",
      "documents-supportsharing.bid": "2019-03-23",
      "documents-supportsharing.club": "2019-03-23",
      "documents.sytes.net": "2019-03-23",
      "documentsfilesharing.cloud": "2019-03-27",
      "documentsharing.info": "2019-03-27",
      "door-black-meter.online": "2026-01-02",
      "download-link.top": "2019-03-23",
      "download-teamspeak.info": "2019-03-27",
      "dr-sup.live": "2024-09-30",
      "dream-jobs.org": "2024-08-29",
      "dream-jobs.vip": "2024-08-29",
      "dreamy-job.com": "2024-08-29",
      "dreamy-jobs.com": "2024-08-29",
      "dreamycareer.com": "2024-08-29",
      "drhealthyrecommends.com": "2026-07-29",
      "drive-acconut.com": "2024-05-03",
      "drive-acconuts.com": "2024-05-03",
      "drive-account.com": "2024-05-03",
      "drive-accounts.com": "2019-09-15",
      "drive-file-share.site": "2024-03-05",
      "drive-login.cf": "2019-03-23",
      "drive-permission-user-account.com": "2019-03-23",
      "drive-useraccount-signin-mail.ga": "2019-03-23",
      "drives.googles.site": "2026-01-02",
      "droneflywell.com": "2026-01-02",
      "dronetechasia.org": "2026-01-02",
      "drop-box.vip": "2019-03-23",
      "dropebox.co": "2019-03-23",
      "duschedule.ibridgellc.com": "2026-07-17",
      "duuuumpy.click": "2024-08-15",
      "dynamiceventmanager.ddns.net": "2021-01-09",
      "dynamicrender.line.pm": "2024-08-20",
      "dynamicroute.serveirc.com": "2024-08-15",
      "dynamictranslator.ddnsgeek.com": "2024-08-20",
      "eand.cyvehx.com": "2026-07-17",
      "east-healthy-dress.glitch.me": "2024-01-17",
      "easymarketing101.com": "2026-01-02",
      "eatonthehotground.ddns.net": "2024-05-03",
      "ecomonist.org": "2024-05-02",
      "edge-cloudservices.com": "2022-04-07",
      "editioncloudfiles.dns-dynamic.net": "2024-08-20",
      "ehealthpsuluth.com": "2026-01-02",
      "elated-supportive-exultation.top": "2024-05-03",
      "elecresearch.org": "2022-04-07",
      "electrons-residingonthemoon.info": "2026-01-02",
      "elementshift.azurewebsites.net": "2026-05-23",
      "elitemaildelivery.info": "2019-03-27",
      "ell-safe.online": "2026-01-02",
      "em-payments-bot.duckdns.org": "2024-08-28",
      "email-daemon.biz": "2024-05-02",
      "email-daemon.biz.tinurls.com": "2024-05-02",
      "email-daemon.online": "2024-05-02",
      "email-daemon.online.tinurls.com": "2024-05-02",
      "email-daemon.site": "2024-05-02",
      "email-deiivery.info": "2019-03-27",
      "email-delivery.info": "2019-03-27",
      "email-protection.online": "2024-09-30",
      "embraer.co": "2019-03-23",
      "emiartas.com": "2019-03-23",
      "emiratescareers.org": "2026-01-02",
      "emiratescheckapi.azurewebsites.net": "2024-02-28",
      "emiratescheckapijson.azurewebsites.net": "2024-02-28",
      "emiratesgroup-careers.com": "2026-01-02",
      "empaymentsbot.duckdns.org": "2024-08-28",
      "emv1.allocationwithour.info": "2024-12-11",
      "emv1.brannew-home.info": "2026-01-02",
      "emv1.newsaboutecology.info": "2026-01-02",
      "emv1.short-jg934hw.live": "2024-12-17",
      "emv1.short-rigf.live": "2024-12-17",
      "emv1.statuss-short-join.live": "2024-12-17",
      "encryption-redirect.online": "2026-01-02",
      "endorsement-services.online": "2024-05-02",
      "enerflex.ddns.net": "2022-04-07",
      "enerflex.org": "2022-04-07",
      "engineeringrssfeed.azurewebsites.net": "2024-02-28",
      "engineeringssfeed.azurewebsites.net": "2024-02-28",
      "enhanceservicchecke.hopto.org": "2021-01-09",
      "enovation-affirm.theworkpc.com": "2026-01-02",
      "entrpreneur.org": "2026-01-02",
      "entryconfirmation.duckdns.org": "2024-08-20",
      "entrydirect.ddns.net": "2024-09-30",
      "eocnomist.com": "2024-05-02",
      "eom-microsoftonline.club": "2019-03-27",
      "eom-useraccount.info": "2019-03-27",
      "epibvgvoszemkwjnplyc.supabase.co": "2024-01-17",
      "error-exchange.com": "2019-03-23",
      "essential-guide.serveirc.com": "2024-08-16",
      "essential-overview.sytes.net": "2024-09-30",
      "essentialeditor.serveirc.com": "2024-08-15",
      "est5090.online": "2026-01-02",
      "etisalatonline.com": "2022-04-07",
      "eu-meeting.captello.com": "2026-07-17",
      "eursaia.org": "2019-03-23",
      "eustomers-activities.info": "2019-03-27",
      "eventer.ink": "2026-01-02",
      "everything-here.info": "2026-01-02",
      "exchtestchecking.azurewebsites.net": "2026-01-02",
      "exchtestcheckingapi.azurewebsites.net": "2024-02-28",
      "exchtestcheckingapihealth.azurewebsites.net": "2024-02-28",
      "exchtestcheckingapihealth.com": "2026-01-02",
      "exchtestcheckingapijson.azurewebsites.net": "2026-01-02",
      "exir-juice.online": "2026-01-02",
      "exnovin.org": "2019-09-15",
      "expandprocess.serveblog.net": "2024-08-15",
      "expressmarket.online": "2026-01-02",
      "exprogroup.org": "2022-04-07",
      "ez-calendar.vercel.app": "2026-07-17",
      "fanderfart22.xyz": "2019-03-23",
      "fardenfart2017.xyz": "2019-03-23",
      "fazadi.info": "2024-12-17",
      "fb-login.cf": "2019-03-23",
      "fbmro.com": "2024-02-17",
      "fdns1.duckdns.org": "2026-01-02",
      "featurespace.ooguy.com": "2024-09-30",
      "featurespace.serveblog.net": "2024-09-30",
      "file-access.com": "2024-09-30",
      "file-review.hopto.org": "2026-01-02",
      "filecloudmanager.site": "2024-08-15",
      "fileeditiontools.linkpc.net": "2024-08-20",
      "filemanager.theworkpc.com": "2023-07-07",
      "filereader.dns-dynamic.net": "2024-08-20",
      "filetransfer.club": "2024-09-30",
      "fileviewitems.myftp.org": "2026-01-02",
      "filevisitresult.site": "2026-01-02",
      "filterfiletransfer.hopto.org": "2024-12-11",
      "filtertransferfile.online": "2024-12-11",
      "finaledition.redirectme.net": "2024-08-20",
      "finance-usbnc.info": "2020-02-05",
      "first-course.online": "2026-01-02",
      "first-myshortel.ddns.net": "2026-01-02",
      "flash-adobe.org": "2023-11-12",
      "flashpointfarm.gotdns.ch": "2024-09-30",
      "flighthelicopterahtest.azurewebsites.net": "2024-02-28",
      "flow-exulltation-uplift.top": "2024-08-15",
      "flowerskindergarten.ddns.net": "2024-05-03",
      "flydubai-careers.com": "2026-01-02",
      "flydubaicareers.ae.org": "2026-01-02",
      "focusfusion.eastus.cloudapp.azure.com": "2026-01-02",
      "food-tips-blog.online": "2026-01-02",
      "foreiqnaffairs.com": "2024-05-02",
      "foreiqnaffairs.org": "2024-05-02",
      "forieqnaffairs.com": "2024-05-02",
      "form.redberyl.co": "2026-07-17",
      "form.ritwiksingh.com": "2026-07-17",
      "formcloud.redirectme.net": "2024-09-30",
      "fortune-retire-home.top": "2024-05-02",
      "frameforward.azurewebsites.net": "2026-01-02",
      "freahman.online": "2024-09-30",
      "freechess.live": "2022-04-07",
      "freeheadlines.top": "2024-09-05",
      "freshconnect.live": "2024-09-30",
      "friends.lizza-blog.info": "2026-01-02",
      "friends.thomas-mark.xyz": "2026-01-02",
      "front-cover-panel.xyz": "2021-01-04",
      "front-home-panel.xyz": "2021-01-04",
      "frostsullivan.org": "2019-03-23",
      "ftur-sher.online": "2024-12-17",
      "funeral-engineering-expression.top": "2023-02-26",
      "funnychess.online": "2022-04-07",
      "fuschia-rhinestone.cleverapps.io": "2023-07-07",
      "g-online.org": "2024-05-02",
      "g20saudi.000webhostapp.com": "2020-10-28",
      "gallery-shop.online": "2026-01-02",
      "gamershotel.pro": "2024-11-18",
      "gatestonelnstitute.org": "2024-05-03",
      "gc.n-e.kr": "2026-01-02",
      "gdrive-files.com": "2024-09-30",
      "geaviews.site": "2024-05-02",
      "germanywork.org": "2026-01-02",
      "get-ready.blog": "2026-01-02",
      "getadobe.ddns.net": "2022-04-07",
      "getadobe.net": "2022-04-07",
      "geticarefunds.com": "2026-07-17",
      "getsqldeveloper.com": "2026-07-17",
      "getsqldeveloper.it.com": "2026-07-17",
      "gettogether.quest": "2024-09-30",
      "giitials.tk": "2019-03-27",
      "gl-sup.online": "2024-09-30",
      "gle-mail.com": "2019-03-23",
      "global-careers.com": "2026-01-02",
      "global-check-business-it.azurewebsites.net": "2026-07-17",
      "global-check-itbusiness.azurewebsites.net": "2026-07-17",
      "global-it-checkbusiness.azurewebsites.net": "2026-07-17",
      "global-it-checkers.azurewebsites.net": "2026-07-17",
      "global-it-consultants.azurewebsites.net": "2026-07-17",
      "global-reds.com": "2026-07-29",
      "globalbusiness-checkers-it.azurewebsites.net": "2026-07-17",
      "globalit-consultants.azurewebsites.net": "2026-07-17",
      "globalitconsultants.azurewebsites.net": "2026-07-17",
      "globaltalent.in": "2022-04-07",
      "glory-uplift-vouch.online": "2024-05-02",
      "glorynewstoday.com": "2024-02-17",
      "gm-sup.com": "2024-09-30",
      "gmail-recovery.ml": "2019-03-23",
      "gmal.cf": "2019-03-23",
      "go-conversation.lol": "2024-05-02",
      "go-forward.quest": "2024-05-02",
      "go0gle.online": "2026-01-02",
      "gocareers.org": "2026-01-02",
      "golanjobs.me": "2024-08-29",
      "gomyfiles.info": "2019-10-08",
      "goo-gle.bid": "2019-03-23",
      "goo-gle.cloud": "2019-03-23",
      "goo-gle.mobi": "2019-03-23",
      "good-news.cfd": "2026-01-02",
      "good-news.fashion": "2026-01-02",
      "good-student.online": "2026-01-02",
      "goods-companies.online": "2026-01-02",
      "goog-le.bid": "2019-03-23",
      "google-mail-recovery.com": "2019-03-23",
      "google-mail.com.co": "2019-03-23",
      "google-profile.com": "2019-03-23",
      "google-profiles.com": "2019-03-23",
      "google-setting.com": "2019-03-23",
      "google-verification.com": "2019-03-23",
      "google-verify.com": "2019-03-23",
      "google-verify.net": "2019-03-23",
      "google.live-meet.blog": "2026-01-02",
      "google.live-meet.cfd": "2026-01-02",
      "google.live-meet.cloud": "2026-01-02",
      "google.live-meet.info": "2026-01-02",
      "google.network-show": "2026-01-02",
      "google.network-show.online": "2026-01-02",
      "google.onedriver-srv.ml": "2022-02-01",
      "googledomalns.com": "2019-03-27",
      "googlemails.co": "2019-03-23",
      "googles.site": "2026-01-02",
      "googleservices.co": "2022-04-07",
      "googleupdate.co": "2022-04-07",
      "green-light.bond": "2024-08-15",
      "group-google.com": "2019-03-23",
      "group-policy-update.azurewebsites.net": "2026-01-02",
      "grownehealth.eastus.cloudapp.azure.com": "2026-01-02",
      "gview.site": "2024-05-02",
      "happened.fun": "2024-08-15",
      "hardbookshelf.ooguy.com": "2024-09-30",
      "hardship-management.com": "2022-10-11",
      "hat-cast.com": "2024-08-29",
      "hb.pee5.me": "2026-07-17",
      "healsanctum.azurewebsites.net": "2026-01-02",
      "healthbodymonitoring.azurewebsites.net": "2026-01-02",
      "healthcare-azureapi.azurewebsites.net": "2026-01-02",
      "healthcarefluent.com": "2026-01-02",
      "healthcarezoom-centeral.azurewebsites.net": "2026-07-29",
      "healthcarezoomcenteral.azurewebsites.net": "2026-07-29",
      "healthcarezoomcenteral.org": "2026-07-29",
      "healthdataanalyticsrecord.azurewebsites.net": "2026-01-02",
      "healthiestmama.com": "2026-01-02",
      "healthinfusiontherapy.com": "2026-01-02",
      "healthy-lifestyle.fit": "2026-01-02",
      "heisonhisway.ddns.net": "2021-01-09",
      "helicopterahtest.azurewebsites.net": "2024-02-28",
      "helicopterahtests.azurewebsites.net": "2024-02-28",
      "helicoptersahtests.azurewebsites.net": "2024-02-28",
      "hello-planet.com": "2021-01-09",
      "help-recovery.com": "2019-03-23",
      "helpdesk-product.com": "2022-04-07",
      "helper.canvas-life.me": "2023-11-12",
      "highlightsreview.line.pm": "2024-08-20",
      "hiringarabicregion.azurewebsites.net": "2024-02-28",
      "hivemedtech.azurewebsites.net": "2026-01-02",
      "holyicker.ddns.net": "2026-01-02",
      "home-access.online": "2019-10-08",
      "home-reload-page.xyz": "2020-12-17",
      "homedirections.ddns.net": "2021-01-09",
      "homefurniture.azurewebsites.net": "2024-02-28",
      "homeinspections.ddns.net": "2021-01-09",
      "host-bulk-stack.cfd": "2024-08-15",
      "hot-mail.ml": "2019-03-23",
      "hotchichenfly.info": "2026-01-02",
      "hoticecream.ddns.net": "2024-08-21",
      "house-server-digital.xyz": "2024-08-15",
      "hrapplicationtest.azurewebsites.net": "2024-02-28",
      "hrd-dmn.info": "2026-01-02",
      "hu.yes1.me": "2026-07-17",
      "hugmefirstddd.ddns.net": "2024-08-20",
      "human-fly900.online": "2026-01-02",
      "humanresourcesapi.azurewebsites.net": "2024-02-28",
      "humanresourcesapijson.azurewebsites.net": "2024-02-28",
      "humanresourcesapiquiz.azurewebsites.net": "2024-02-28",
      "hyperv-heartbeat-service.azurewebsites.net": "2026-01-02",
      "i-love-tux.qc.to": "2026-01-02",
      "iaidevrssfeed.centralus.cloudapp.azure.com": "2024-02-28",
      "iaidevrssfeed.centrualus.cloudapp.azure.com": "2024-02-28",
      "iaidevrssfeed.cloudapp.azure.com": "2024-02-28",
      "iaidevrssfeedp.cloudapp.azure.com": "2024-02-28",
      "icegelato.ddns.net": "2024-08-20",
      "icenotebook.ddns.net": "2024-08-20",
      "id-bayan.com": "2019-03-23",
      "idccovid19questionaire.000webhostapp.com": "2024-09-30",
      "idea-home.online": "2026-01-02",
      "identifier-activities.info": "2019-03-27",
      "identifier-activities.online": "2019-10-08",
      "identifier-direct.ddns.net": "2024-05-03",
      "identifier-direction.site": "2024-05-02",
      "identifier-service-verify.site": "2021-01-09",
      "identifier-service.ddns.net": "2024-05-03",
      "identifier-services-session.site": "2020-05-07",
      "identifier-services-sessions.info": "2019-03-27",
      "identifier-session-recovery.site": "2021-01-09",
      "identifier-verify.ddns.net": "2024-05-03",
      "identify-user-session.info": "2019-03-27",
      "identifycheckapplication.azurewebsites.net": "2024-02-28",
      "identifycheckapplications.azurewebsites.net": "2024-02-28",
      "identifycheckingapplications.azurewebsites.net": "2024-02-28",
      "identity-session-recovery.site": "2021-01-09",
      "identity-session.ddns.net": "2024-05-03",
      "identity-verification-service.info": "2019-10-08",
      "ie.codzienniefita.info": "2026-07-17",
      "iforget-memail-user-account.com": "2019-03-23",
      "ifstate.page.link": "2024-02-17",
      "igsecurity.email": "2023-12-06",
      "il-cert.net": "2024-10-31",
      "ilengineeringrssfeed.azurewebsites.net": "2024-02-28",
      "implemen-tmeasures.myftp.org": "2026-01-02",
      "inbox-drive.info": "2019-10-08",
      "inbox-sharif.info": "2019-10-08",
      "indication-service.online": "2024-05-02",
      "infinit-world.info": "2026-01-02",
      "instagram-com.site": "2020-02-05",
      "integratedblognewfeed.azurewebsites.net": "2024-02-28",
      "integratedblognews.azurewebsites.net": "2024-02-28",
      "integratedblognewsapi.azurewebsites.com": "2024-02-28",
      "integratedblognewsapi.azurewebsites.net": "2024-02-28",
      "intel-update.com": "2019-03-27",
      "intelligence.live-meet.blog": "2026-01-02",
      "intelupdate.com": "2019-03-27",
      "intengineeringrssfeed.azurewebsites.net": "2024-02-28",
      "interactive-view.myftp.org": "2026-01-02",
      "interconnected-equipment-buildings.buzz": "2024-08-15",
      "intergratedblognewsapi.azurewebsites.net": "2024-02-28",
      "internationalbester.ddns.net": "2026-01-02",
      "into-support.online": "2026-01-02",
      "inztaqram.ga": "2020-02-05",
      "ip-194-11-226-29.rockhoster.net": "2026-01-02",
      "ipsss.000webhostapp.com": "2024-09-30",
      "ir-owa-accountservice.bid": "2019-03-23",
      "iranianuknews.com": "2019-03-23",
      "irnjobs.me": "2024-08-29",
      "isftyviliam.platinum-cnt.info": "2026-01-02",
      "isis-online.net": "2019-09-15",
      "islamicemojimaker.com": "2019-09-15",
      "ismywhs.com.de": "2026-01-02",
      "isra-help.org": "2024-02-17",
      "israel-talent.com": "2026-01-02",
      "israel-talent.xyz": "2026-01-02",
      "israelhayum.com": "2024-05-02",
      "it-service.men": "2020-11-16",
      "itemselectionmode.info": "2024-08-20",
      "jadehealthcenter.com": "2026-01-02",
      "jafferbrothers.developmint.xyz": "2026-07-17",
      "jamaat-ul-islam.com": "2021-08-06",
      "jamaatforallah.com": "2021-08-06",
      "jamaatforummah.com": "2021-08-06",
      "jamatapplication.com": "2021-08-06",
      "javaruntime.azurewebsites.net": "2024-02-28",
      "javaruntimestestapi.azurewebsites.net": "2024-02-28",
      "javaruntimetestapi.azurewebsites.net": "2024-02-28",
      "javaruntimeversionchecking.azurewebsites.net": "2024-02-28",
      "javaruntimeversioncheckingapi.azurewebsites.net": "2024-02-28",
      "javedpension.is-a-good.dev": "2026-01-02",
      "jewishjournal.us": "2019-03-23",
      "join-paneling.online": "2024-05-02",
      "joinboeing.com": "2026-01-02",
      "joincloud.duckdns.org": "2024-08-20",
      "joincloud.mypi.co": "2024-08-20",
      "joinoptimahr.com": "2024-08-29",
      "jomehjob.com": "2024-08-29",
      "jpost.press": "2024-05-02",
      "jpostpress.com": "2024-05-02",
      "jubilatesee.site": "2024-05-03",
      "jupyternotebookcollection.azurewebsites.net": "2024-02-28",
      "jupyternotebookcollections.azurewebsites.net": "2024-02-28",
      "jupyternotebookcollections.com": "2024-02-28",
      "jupyternotebookscollection.azurewebsites.net": "2024-02-28",
      "k2intelliqence.com": "2019-03-23",
      "kandovani.org": "2024-08-29",
      "kanplus.org": "2026-01-02",
      "kavkazru.press": "2022-04-07",
      "khaleejtimes.co": "2022-04-07",
      "khaleejtimes.org": "2024-05-02",
      "khalejtimes.org": "2024-05-02",
      "kia-customerservice.ddns.net": "2020-09-30",
      "kibanacore.com": "2026-01-02",
      "ksat20.000webhostapp.com": "2020-10-28",
      "ksview.top": "2023-08-14",
      "kuret-live.online": "2026-01-02",
      "kwhfibejjyxregxmnpcs.supabase.co": "2024-01-17",
      "last-check-leave.buzz": "2024-05-02",
      "lastfilterfile.info": "2026-01-02",
      "latest-tools.store": "2024-02-17",
      "latinoamericareporta.com": "2022-04-07",
      "launchmeetprofile.servehttp.com": "2024-09-30",
      "lenan-rex.online": "2026-01-02",
      "lensvisionary.azurewebsites.net": "2026-01-02",
      "leslettrespersanes.net": "2019-09-15",
      "lesson-first.info": "2026-01-02",
      "letsschedulethis.com": "2026-07-17",
      "lgupluscdn.com": "2023-11-12",
      "library-store.camdvr.org": "2023-07-07",
      "librarycollection.org": "2022-04-07",
      "licencemanagers.azurewebsites.net": "2026-05-23",
      "licencesupporting.azurewebsites.net": "2026-05-23",
      "licentiegegevens.ddns.net": "2026-01-02",
      "line-en.me": "2019-03-23",
      "lineeditor.001www.com": "2024-08-20",
      "lineeditor.32-b.it": "2024-08-20",
      "lineeditor.mypi.co": "2024-08-20",
      "linereview.duia.eu": "2024-08-20",
      "linkauthenticator.online": "2024-09-30",
      "linkedinz.me": "2022-04-07",
      "listen-books.com": "2022-04-07",
      "litby.us": "2022-09-24",
      "live-board.online": "2026-01-02",
      "live-coaching.online": "2026-01-02",
      "live-conn.online": "2026-01-02",
      "live-content.online": "2026-01-02",
      "live-gml.online": "2026-01-02",
      "live-join-short.online": "2024-12-17",
      "live-meet.blog": "2026-01-02",
      "live-meet.cfd": "2026-01-02",
      "live-meet.cloud": "2026-01-02",
      "live-meet.info": "2026-01-02",
      "live-meet.live": "2026-01-02",
      "live-message.online": "2026-01-02",
      "live-project-online.live": "2024-05-02",
      "live-projects-online.top": "2024-05-02",
      "live-redirect-system.top": "2023-03-09",
      "live.besatoo.online": "2026-01-02",
      "live.connect-room.online": "2026-01-02",
      "live.goods-companies.online": "2026-01-02",
      "live.live-coaching.online": "2026-01-02",
      "live.live-gml.online": "2026-01-02",
      "live.live-meet": "2026-01-02",
      "live.live-meet.cloud": "2026-01-02",
      "live.live-meet.info": "2026-01-02",
      "live.online-room.online": "2026-01-02",
      "live.platinum-cnt.info": "2026-01-02",
      "live.white-life-bl.info": "2026-01-02",
      "live.yamal-group.online": "2026-01-02",
      "lizza-blog.info": "2026-01-02",
      "load-panel.online": "2023-08-14",
      "loads-ideas.online": "2026-01-02",
      "localadmin.online": "2022-04-07",
      "localadmin.ru": "2022-04-07",
      "log-in-dropbox.com": "2021-05-10",
      "login-account-mail.com": "2019-03-23",
      "login-account.net": "2019-03-23",
      "login-again.ml": "2019-03-23",
      "login-gov.info": "2019-03-27",
      "login-required.ga": "2019-03-23",
      "login-users-account.site": "2020-09-30",
      "login.loginto.me": "2023-11-12",
      "logsapimanagement.azurewebsites.net": "2024-02-28",
      "logsapimanagements.azurewebsites.net": "2024-02-28",
      "logupdatemanagementapi.azurewebsites.net": "2024-02-28",
      "logupdatemanagementapijson.azurewebsites.net": "2024-02-28",
      "lonelymanshadow.ddns.net": "2021-01-09",
      "longlivefreedom.ddns.net": "2024-08-20",
      "look-together-online.online": "2026-01-02",
      "loriginal.online": "2024-05-02",
      "loss-modification.site": "2024-12-11",
      "lovetoflight.com": "2024-09-30",
      "lst-accurate.com": "2024-09-30",
      "ltf.world": "2024-09-30",
      "lukoil.in": "2022-04-07",
      "lynda-tricks.online": "2026-01-02",
      "m.neexportfolio.com": "2026-07-29",
      "m85.online": "2024-05-02",
      "maadinglobal.com": "2026-07-29",
      "maariv.net": "2024-05-02",
      "magic-delivery.info": "2019-10-08",
      "mail-account-register-recovery.com": "2019-03-23",
      "mail-newyorker.com": "2021-01-09",
      "mail-update.info": "2024-09-05",
      "mail-updateservice.info": "2023-04-27",
      "mail-yahoo.com.co": "2019-03-23",
      "mail.brannew-home.info": "2026-01-02",
      "mail.bvio85.info": "2026-01-02",
      "mail.jewishjournal.us": "2019-03-23",
      "mail.smart-sight-hr.com": "2026-07-17",
      "mailer-daemon-message.co": "2022-12-07",
      "mailer-daemon.co": "2024-02-17",
      "mailer-daemon.info": "2024-05-02",
      "mailer-daemon.live": "2022-12-01",
      "mailer-daemon.me": "2022-12-01",
      "mailer-daemon.net": "2022-12-01",
      "mailer-daemon.online": "2022-12-01",
      "mailer-daemon.org": "2022-12-01",
      "mailer-daemon.site": "2024-09-30",
      "mailer-daemon.us": "2024-05-02",
      "mailer-support.online": "2024-09-30",
      "mailerdaemon.info": "2024-09-30",
      "mailerdaemon.online": "2024-02-17",
      "maill-support.com": "2023-04-27",
      "mails-account-signin-users-permssion.com": "2019-03-23",
      "mailssender.bid": "2019-03-23",
      "mailupdate.com": "2023-04-27",
      "mailupdate.info": "2023-04-27",
      "main-packages.strangled.net": "2024-09-30",
      "mainrepo10.azurewebsites.net": "2026-01-02",
      "make-host-solution.buzz": "2024-08-15",
      "make-house.online": "2026-01-02",
      "makeit.lat": "2024-08-15",
      "malcolmrifkind.site": "2020-02-05",
      "malebachhew2506090936.onlyoffice.com": "2026-01-02",
      "manage-accounts.info": "2020-09-30",
      "manage-tech.club": "2023-11-12",
      "managetools-platform.azurewebsites.net": "2026-01-02",
      "manpowerfeedapi.azurewebsites.net": "2024-02-28",
      "manpowerfeedapijson.azurewebsites.net": "2024-02-28",
      "marineblogapi.azurewebsites.net": "2024-02-28",
      "market-account-login.net": "2019-03-23",
      "market.dedyn.io": "2022-04-07",
      "market.vinam.me": "2022-04-07",
      "marketinglw.com": "2026-01-02",
      "marsoxygen.azurewebsites.net": "2026-01-02",
      "master-club.info": "2026-01-02",
      "masterflexiblecloud.azurewebsites.net": "2026-01-02",
      "mastergatevpn.com": "2022-04-07",
      "matchtomeet.ddns.net": "2024-09-30",
      "maydaymed.azurewebsites.net": "2026-01-02",
      "mccainlnstitute.org": "2024-05-02",
      "mediasylum.azurewebsites.net": "2026-01-02",
      "medical-deepresearch.azurewebsites.net": "2026-01-02",
      "medicalit-imaging.azurewebsites.net": "2026-01-02",
      "medicoreit.azurewebsites.net": "2026-01-02",
      "medicpathsolutions.azurewebsites.net": "2026-01-02",
      "meet-online.site": "2026-01-02",
      "meet-room.site": "2026-01-02",
      "meet-work.info": "2026-01-02",
      "meet.13bytes.de": "2026-07-17",
      "meet.azdava.online": "2026-01-02",
      "meet.dynamicsmind.in": "2026-07-17",
      "meet.ell-safe.online": "2026-01-02",
      "meet.fruitcakemedia.co.uk": "2026-07-17",
      "meet.go0gle.online": "2026-01-02",
      "meet.proof-video.online": "2026-01-02",
      "meet.thijsblom.app": "2026-07-17",
      "meet.thijsblom.dev": "2026-07-17",
      "meet.video-connect.online": "2026-01-02",
      "meet.webdeploy.dev": "2026-07-17",
      "meetime.info": "2026-01-02",
      "meeting-invite.live": "2026-01-02",
      "meeting-room.live": "2026-01-02",
      "meeting-schedular-flame.vercel.app": "2026-07-17",
      "meeting-schedular.aptc.ricoh.com": "2026-07-17",
      "meeting-scheduler-ui.pages.dev": "2026-07-17",
      "meeting-scheduler.cloud": "2026-07-17",
      "meeting-scheduler.co.uk": "2026-07-17",
      "meeting-scheduler.com": "2026-07-17",
      "meeting-scheduler.metal.kaldi.si": "2026-07-17",
      "meeting-scheduler.ncb.org": "2026-07-17",
      "meeting-scheduler.online": "2026-07-17",
      "meeting-scheduler.saetta.co.jp": "2026-07-17",
      "meeting-scheduler.tous33f.live": "2026-07-17",
      "meeting-scheduler.xyz": "2026-07-17",
      "meeting-scheduling.oldcountry.ai": "2026-07-17",
      "meeting-share.online": "2024-05-03",
      "meeting-space-scheduler-9946.taskade.app": "2026-07-17",
      "meeting-time.info": "2026-01-02",
      "meeting.captello.com": "2026-07-17",
      "meeting.dalqan.com": "2026-07-17",
      "meeting.ignsoftwares.in": "2026-07-17",
      "meeting.jackz.me": "2026-07-17",
      "meeting.wilawan.com": "2026-07-17",
      "meeting.xn--grnlund-b1a.net": "2026-07-17",
      "meetingonline.live": "2026-01-02",
      "meetings-demo.apigateway.co": "2026-07-17",
      "meetings-prod.apigateway.co": "2026-07-17",
      "meetings.dialexa.com": "2026-07-17",
      "meetings.fl2f.ca": "2026-07-17",
      "meetings.sabonzy.com": "2026-07-17",
      "meetings.xn--grnlund-b1a.net": "2026-07-17",
      "meetingscheduler.sandbox.aws.corp.cloud5.com": "2026-07-17",
      "meetingscheduler.servehttp.com": "2026-07-17",
      "meetingscheduler.thebeautymatcher.com": "2026-07-17",
      "meetingzone.info": "2026-01-02",
      "meetland.info": "2026-01-02",
      "meetonline.pro": "2026-01-02",
      "meetroomonlin1925.w3spaces.com": "2024-08-15",
      "meets.armankhan.me": "2026-07-17",
      "meets.armankhan.space": "2026-07-17",
      "mehrnews.info": "2019-03-23",
      "mentalhealth-support-portal.azurewebsites.net": "2026-01-02",
      "meot-roem.online": "2026-01-02",
      "message-live.online": "2026-01-02",
      "message-serviceprovider.info": "2019-03-27",
      "messagepending.info": "2024-08-20",
      "messageservice.bid": "2019-03-23",
      "messageservice.club": "2019-03-23",
      "metaemailsecurity.com": "2023-12-06",
      "metaemailsecurity.net": "2023-12-06",
      "metahelpservice.net": "2023-12-06",
      "metasecurityemail.org": "2023-12-06",
      "metasupportmail.co": "2023-12-06",
      "metasupportmail.com": "2023-12-06",
      "mfa-ic.ae": "2024-09-30",
      "mickel.besatoo.online": "2026-01-02",
      "mickel.connect-room.online": "2026-01-02",
      "mickel.goods-companies.online": "2026-01-02",
      "mickel.live-coaching.online": "2026-01-02",
      "mickel.platinum-cnt.info": "2026-01-02",
      "mickel.white-life-bl.info": "2026-01-02",
      "mickel.yamal-group.online": "2026-01-02",
      "microsoft-hotfix.com": "2019-03-23",
      "microsoft-update.bid": "2019-03-23",
      "microsoft-updateserver.cf": "2022-02-17",
      "microsoft-upgrade.mobi": "2019-03-23",
      "microsoft-utility.com": "2019-03-23",
      "microsoftcdn.co": "2022-04-07",
      "microsoftdefender.info": "2022-04-07",
      "microsoftedgesh.info": "2022-04-07",
      "microsoftexplorerservices.cloud": "2020-01-26",
      "microsoftinternetsafety.net": "2016-03-09",
      "microsoftsubsystem.com-adm.in": "2017-04-13",
      "mideasthiring.com": "2022-04-07",
      "mikel.yamal-group.online": "2026-01-02",
      "minascs.ddns.net": "2024-08-20",
      "minimumservicechek.ddns.net": "2021-01-09",
      "miniurl.duckdns.org": "2026-01-02",
      "mobile-activity-session.site": "2023-06-07",
      "mobile-airbnb.site": "2020-05-07",
      "mobile-check-activity.site": "2021-01-09",
      "mobile-messengerplus.network": "2019-03-27",
      "mobile-sessionid.customize-identity.info": "2019-03-27",
      "mobile-uber.site": "2020-05-07",
      "mobile.proctor-custodian.site": "2026-01-02",
      "mobile.shorten-abbreviate.site": "2026-01-02",
      "mobilecontinue.network": "2019-10-08",
      "mobiles-sessionid.customize-identity.info": "2019-03-27",
      "mobiletoolssdk.dns-dynamic.net": "2024-08-20",
      "modification-check.online": "2024-05-03",
      "modification-control.online": "2024-08-15",
      "modification-verify.ddns.net": "2024-05-03",
      "mofa-ic.ae": "2024-09-30",
      "mojavemassageandwellness.com": "2026-01-02",
      "monitor-ua.com": "2022-04-07",
      "moses-staff.io": "2026-01-02",
      "moses-staff.to": "2026-01-02",
      "mrz.fazadi.info": "2024-12-17",
      "ms.supermwario.com": "2026-07-17",
      "msn-center.uk": "2023-04-27",
      "msn-service.co": "2023-04-27",
      "msnapp.help": "2026-01-02",
      "msnapp.live": "2026-01-02",
      "msnclouds.com": "2026-01-02",
      "msnl.ink": "2026-01-02",
      "msnotetask-insights.azurewebsites.net": "2026-01-02",
      "msoffice-update.com": "2019-03-23",
      "msp.medatron.co": "2026-07-17",
      "mstrakcer-tools.azurewebsites.net": "2026-01-02",
      "mterview.site": "2024-05-02",
      "musalas.se": "2026-01-02",
      "mx0.jewishjournal.us": "2019-03-23",
      "my-healthequity.com": "2019-03-23",
      "my-mailcoil.ml": "2019-03-23",
      "my.abrdns.com": "2026-01-02",
      "myaccount-login.net": "2019-03-23",
      "myaccount-services.net": "2019-03-27",
      "myaccount-signin.com": "2024-05-02",
      "mychannel.ddns.net": "2019-03-23",
      "mycloudhosting.redirectme.net": "2024-09-30",
      "myconnect-support.com": "2020-03-17",
      "myprofileface.page.link": "2024-02-17",
      "myscreenname.bid": "2019-03-23",
      "myselfdatahistory.serveirc.com": "2024-09-30",
      "mywebdout.ddns.net": "2026-01-02",
      "nail-forward-valid.lol": "2024-08-15",
      "nanobreathe.azurewebsites.net": "2026-01-02",
      "nanomatrix.azurewebsites.net": "2026-05-23",
      "navigationtools.site": "2024-09-30",
      "ncgrassfed.com": "2024-02-17",
      "ndrrftqrlblfecpupppp.supabase.co": "2024-01-17",
      "neexportfolio.azurewebsites.net": "2026-07-29",
      "neexportfolio.com": "2026-07-29",
      "neexportfolio.eastus.cloudapp.azure.com": "2026-07-29",
      "network-game.xyz": "2026-01-02",
      "network-review.xyz": "2026-01-02",
      "network-show-a.online": "2026-01-02",
      "network-show.online": "2026-01-02",
      "neurocloudhq.azurewebsites.net": "2026-01-02",
      "news-onlines.info": "2019-03-23",
      "newsaboutecology.info": "2026-01-02",
      "newspedia.ddns.net": "2020-05-07",
      "nex1music.ml": "2019-03-23",
      "nextbox.line.pm": "2024-08-20",
      "nextcloud.duia.us": "2024-08-20",
      "nextcloudzone.dns-dynamic.net": "2024-08-20",
      "nextgenhealthtrack.azurewebsites.net": "2026-01-02",
      "niaconucil.org": "2019-09-15",
      "nice-goods.online": "2026-01-02",
      "node-dashboard.site": "2023-02-26",
      "node-panel.site": "2023-02-26",
      "normal-dmn.info": "2026-01-02",
      "notebooktextchecking.azurewebsites.net": "2024-02-28",
      "notebooktextcheckings.azurewebsites.net": "2024-02-28",
      "notebooktextcheckings.com": "2024-02-28",
      "notebooktexts.azurewebsites.net": "2024-02-28",
      "notification-accountrecovery.com": "2019-03-23",
      "notification-accountservice.com": "2019-03-27",
      "notification-accountservice.info": "2019-03-27",
      "notification-manager.info": "2019-03-27",
      "notification-managers.info": "2019-03-27",
      "notification-signal-agnecy.info": "2019-03-27",
      "notificationapp.info": "2019-03-27",
      "notifications-center.info": "2019-03-27",
      "notificatlon-signal-agnecy.info": "2019-03-27",
      "ns1.deutcshewelle.com": "2019-03-23",
      "ns1.jewishjournal.us": "2019-03-23",
      "ns2.allocationwithour.info": "2024-12-11",
      "ns2.brannew-home.info": "2026-01-02",
      "ns2.deutcshewelle.com": "2019-03-23",
      "ns2.freeheadlines.top": "2024-09-05",
      "ns2.jewishjournal.us": "2019-03-23",
      "ns2.newsaboutecology.info": "2026-01-02",
      "ns2.servicechecker.top": "2024-09-05",
      "nsdrive-phone.online": "2023-11-12",
      "nsim-pa.info": "2026-01-02",
      "nsim-ph.info": "2026-01-02",
      "nterview.site": "2024-05-02",
      "ntp-clock-h.info": "2026-01-02",
      "ntp-clock-p.info": "2026-01-02",
      "nvidia-support.com": "2019-03-23",
      "nvidia-update.com": "2019-03-23",
      "o5vdb.org": "2019-03-27",
      "oceanofinformation.ddns.net": "2024-05-03",
      "office-live-activity.icu": "2021-01-04",
      "office-shop.me": "2022-04-07",
      "office-updates.info": "2022-10-11",
      "office365calendar.com": "2026-07-17",
      "official-uploads.com": "2019-03-23",
      "officialswebsites.info": "2019-03-23",
      "ohana-village.org": "2026-07-29",
      "olemanage-dashboard.azurewebsites.net": "2026-01-02",
      "oletask-tracker.azurewebsites.net": "2026-01-02",
      "onedrive-signin.com": "2019-03-23",
      "onedrivelive.me": "2022-04-07",
      "onedriver-srv.ml": "2022-02-01",
      "onedriveupdate.net": "2022-04-07",
      "onequestions.azurewebsites.net": "2024-02-28",
      "onequestionsapi.azurewebsites.net": "2024-02-28",
      "onequestionsapicheck.azurewebsites.net": "2024-02-28",
      "onetimestorage.info": "2024-08-20",
      "online-access.live": "2024-05-02",
      "online-audible.com": "2022-04-07",
      "online-chess.live": "2022-04-07",
      "online-room.online": "2026-01-02",
      "online-speak.online": "2026-01-02",
      "online-supportaccount.com": "2019-03-23",
      "onlinecalendar.ddnsgeek.com": "2024-08-20",
      "onlinecloudzone.info": "2024-08-20",
      "onlinedocument.bid": "2019-03-23",
      "onlinedocuments.org": "2019-03-23",
      "onlinedrie-account-permission-verify.com": "2019-03-23",
      "onlinelive.info": "2024-10-31",
      "onlinereader.linkpc.net": "2024-08-20",
      "onlineserver.myftp.biz": "2019-03-23",
      "onwards-gerencia.ddns.net": "2026-01-02",
      "openapplicationcheck.azurewebsites.net": "2024-02-28",
      "opportunities2get.com": "2026-01-02",
      "opthrltd.me": "2024-08-29",
      "optima-hr.com": "2024-08-29",
      "optimac-hr.com": "2023-04-24",
      "optimax-hr.com": "2023-04-24",
      "optio-nalynk.online": "2026-01-02",
      "optionalapplication.azurewebsites.net": "2024-02-28",
      "oranus.albert-company.online": "2026-01-02",
      "oranus.besatoo.online": "2026-01-02",
      "oranus.connect-room.online": "2026-01-02",
      "oranus.human-fly900.online": "2026-01-02",
      "oranus.live-coaching.online": "2026-01-02",
      "oranus.platinum-cnt.info": "2026-01-02",
      "oranus.white-life-bl.info": "2026-01-02",
      "oranus.yamal-group.online": "2026-01-02",
      "orginal-links.com": "2019-03-23",
      "ourredbucket.ddns.net": "2024-05-03",
      "outlook-livecom.bid": "2019-03-23",
      "outlook-verify.net": "2019-03-27",
      "outlook.live.live-meet.cloud": "2026-01-02",
      "outlook.live.live-meet.info": "2026-01-02",
      "outlookde.live": "2022-04-07",
      "outlookdelivery.com": "2022-04-07",
      "outstanding.revstoragefile.site": "2026-01-02",
      "overall-continuing.site": "2024-08-20",
      "overflow.duia.eu": "2024-08-20",
      "overviewstatus.redirectme.net": "2024-08-15",
      "owa-insss-org-ill-owa-authen.ml": "2019-03-23",
      "owner-rate.online": "2026-01-02",
      "p-safe.online": "2026-01-02",
      "pa-crtdomain.info": "2026-01-02",
      "packctstormsccurity.com": "2019-03-27",
      "page-home-reload.xyz": "2021-01-04",
      "pagerender.duckdns.org": "2024-08-20",
      "pagerendercloud.linkpc.net": "2024-08-20",
      "pagerenderstatus.info": "2024-09-30",
      "pages.ultimatecartanddolly.com": "2026-07-17",
      "pageviewer.linkpc.net": "2024-08-20",
      "palaerospace.careers": "2026-01-02",
      "panel-check-live.live": "2024-08-15",
      "panel-check-short.live": "2024-05-02",
      "panel-live-check.online": "2024-05-02",
      "panel-meeting.info": "2026-01-02",
      "panel-network.online": "2026-01-02",
      "panel-redirect.online": "2026-01-02",
      "panel-review-check.live": "2023-08-14",
      "panel-short-check.live": "2024-05-02",
      "panel-status-join.live": "2024-05-03",
      "panel-status-joining.live": "2024-08-15",
      "panel-view-short.online": "2024-05-02",
      "panel-view.live": "2024-05-02",
      "panel-view.online": "2024-05-02",
      "panel-views-cheking.live": "2024-05-02",
      "panel.live-meet.blog": "2026-01-02",
      "panel.live-meet.cfd": "2026-01-02",
      "panel.live-meet.cloud": "2026-01-02",
      "panel.live-meet.info": "2026-01-02",
      "panel.live-meet.live": "2026-01-02",
      "panel.network-show.online": "2026-01-02",
      "panelchecking.live": "2024-05-02",
      "paneling-check-live.live": "2024-05-03",
      "paneling-checke.live": "2024-08-15",
      "paneling-cheking-df.live": "2024-05-03",
      "paneling-viewing.live": "2024-05-02",
      "panels-views-ckeck.live": "2024-05-02",
      "parasil.me": "2024-08-29",
      "pasmoiapp.com": "2024-02-17",
      "patch-provider-247.azurewebsites.net": "2026-01-02",
      "patch-provider-597.azurewebsites.net": "2026-01-02",
      "patch-provider-745.azurewebsites.net": "2026-01-02",
      "patch-provider.azurewebsites.net": "2026-01-02",
      "patchtheschool.ddns.net": "2021-01-09",
      "patient-azureportal.azurewebsites.net": "2026-01-02",
      "patientcare-portal.azurewebsites.net": "2026-01-02",
      "pay.entrpreneur.org": "2026-01-02",
      "pee5.me": "2026-07-17",
      "peerdistsvcmanagers.azurewebsites.net": "2026-05-23",
      "pencilbrush.ddns.net": "2024-08-21",
      "permission-data.online": "2024-05-03",
      "personalcloudparent.info": "2024-08-20",
      "personalitytestquestionapi.azurewebsites.net": "2024-02-28",
      "personalizationsurvey.azurewebsites.net": "2024-02-28",
      "personalstoragebox.linkpc.net": "2024-08-20",
      "personalwebview.info": "2024-08-20",
      "pfl.redirect-review.online": "2026-01-02",
      "ph-crtdomain.info": "2026-01-02",
      "ph-work.info": "2026-01-02",
      "pharmainfo.azurewebsites.net": "2026-01-02",
      "phonechallenges-submit.site": "2020-02-05",
      "picofile.xyz": "2019-03-23",
      "pinnaclegen.com": "2024-08-21",
      "pkglessplans.xyz": "2024-08-20",
      "planet-labs.site": "2021-01-09",
      "planner.croes.info": "2026-07-17",
      "planner.houseedge.co.za": "2026-07-17",
      "plans.pravd.in": "2026-07-17",
      "plansdev.pravd.in": "2026-07-17",
      "platinum-cnt.info": "2026-01-02",
      "plugin-adobe.com": "2019-03-27",
      "pnael-checking.live": "2024-05-03",
      "pnl-worth.online": "2026-01-02",
      "policy-facebook.com": "2019-03-23",
      "politica.in.ua": "2022-04-07",
      "populationnote.com": "2026-01-02",
      "ppmataro.com": "2024-02-17",
      "premier-healthadvisory.azurewebsites.net": "2026-05-23",
      "premierhealthadvisory.azurewebsites.net": "2026-05-23",
      "premierhealthadvisory.com": "2026-05-23",
      "preparingdestination.fixip.org": "2024-08-20",
      "prism-west-candy.glitch.me": "2024-02-04",
      "privacy-facebook.com": "2019-03-23",
      "privacy-gmail.com": "2019-03-23",
      "privacy-google.com": "2019-03-27",
      "privacy-yahoomail.com": "2019-03-23",
      "private-file-sharing.000webhostapp.com": "2024-09-30",
      "prj-pa.info": "2026-01-02",
      "prj-ph.info": "2026-01-02",
      "pro-today.org": "2024-10-31",
      "proceeddestination.dns-dynamic.net": "2024-08-20",
      "proctor-custodian.site": "2026-01-02",
      "procurement-inl-gov.us": "2021-01-09",
      "procurements-inl-gov.us": "2021-01-09",
      "products-services.network": "2024-05-03",
      "profile-facebook.co": "2019-03-23",
      "profile-verification.com": "2019-03-23",
      "profile.arizonaclub.me": "2026-01-02",
      "profile.best85best.online": "2026-01-02",
      "profilechangeruser.ddns.net": "2021-01-09",
      "profiles-facebook.com": "2019-03-23",
      "profivoda.slotig.cz": "2026-07-17",
      "program-indipendent-system.buzz": "2024-08-15",
      "progress-captivate-amply.top": "2023-03-09",
      "projectdrivevirtualcloud.co.uk": "2024-08-20",
      "proof-video.online": "2026-01-02",
      "prostozdrowo.info": "2026-07-17",
      "prostozdrowoa.info": "2026-07-17",
      "prt-max.online": "2026-01-02",
      "ptr-cc.online": "2026-01-02",
      "publicreservoir.info": "2026-01-02",
      "puredcmeeting.com": "2026-07-17",
      "qaquestionapi.azurewebsites.net": "2024-02-28",
      "qaquestions.azurewebsites.net": "2024-02-28",
      "qaquestionsapi.azurewebsites.net": "2024-02-28",
      "qaquestionsapijson.azurewebsites.net": "2024-02-28",
      "qet-adobe.com": "2019-03-23",
      "qmaiil.ml": "2024-09-30",
      "quantumweave.azurewebsites.net": "2026-05-23",
      "queryfindquestions.azurewebsites.net": "2024-02-28",
      "queryquestions.azurewebsites.net": "2024-02-28",
      "ques-tion-ing.xyz": "2026-01-02",
      "questionsapplicationapi.azurewebsites.net": "2024-02-28",
      "questionsapplicationapijson.azurewebsites.net": "2024-02-28",
      "questionsapplicationbackup.azurewebsites.net": "2024-02-28",
      "questionsdatabases.azurewebsites.net": "2024-02-28",
      "questionsurveyapp.azurewebsites.net": "2024-02-28",
      "questionsurveyappserver.azurewebsites.net": "2024-02-28",
      "quickmath-solver.site": "2026-01-02",
      "quiz.careers2find.com": "2024-10-30",
      "quiztestapplication.azurewebsites.net": "2024-02-28",
      "quomodocunquize.site": "2024-05-02",
      "rabot.pisrc.net": "2026-07-17",
      "radabala.com": "2024-08-29",
      "radio-m.cf": "2019-03-23",
      "radiofarda.site": "2020-05-07",
      "ramiltons-finance.azurewebsites.net": "2026-05-23",
      "ramiltonsfinance.azurewebsites.net": "2026-05-23",
      "ramiltonsfinance.com": "2026-05-23",
      "randcorp.onlyoffice.com": "2026-01-02",
      "randomworldcity.ddns.net": "2021-01-09",
      "rap-art.info": "2026-01-02",
      "raykiel.net": "2019-03-23",
      "rb1chesid8.ocry.com": "2026-01-02",
      "rb2chesid8.otzo.com": "2026-01-02",
      "rb4chesid8.serveuser.com": "2026-01-02",
      "rbconline-support.info": "2026-01-02",
      "re-brandly.store": "2024-08-27",
      "reactivate-disabled-accuonts.000webhostapp.com": "2024-09-30",
      "reading-course.online": "2026-01-02",
      "readquickarticle.dns-dynamic.net": "2024-08-20",
      "real-vision.redirectme.net": "2024-08-15",
      "realcdnworker.site": "2024-09-30",
      "realcloud.info": "2024-08-20",
      "realhealthshop.com": "2026-07-29",
      "realpage.redirectme.net": "2024-08-20",
      "recognize-validation.online": "2024-05-02",
      "recognize-validation.theworkpc.com": "2024-05-03",
      "recognize.site": "2024-08-15",
      "recognized-activity.info": "2019-03-27",
      "recognizedshare.site": "2024-12-11",
      "reconsider.site": "2024-05-02",
      "recover-customers-service.info": "2019-03-27",
      "recover-identity.site": "2021-01-09",
      "recover-session-service.site": "2021-01-09",
      "recovery-customer-service.site": "2021-01-09",
      "recovery-customerservice.com": "2019-03-23",
      "recovery-emailcustomer.com": "2019-03-23",
      "recovery-option.site": "2020-05-07",
      "recovery-options.site": "2020-02-05",
      "recovery-service.site": "2020-09-30",
      "recovery-services.info": "2019-10-08",
      "recovery-session-change.info": "2019-03-27",
      "recovery-session-service.site": "2021-01-09",
      "recovery-session.site": "2021-01-09",
      "recoverycodeconfirm.bid": "2019-03-23",
      "recoverysuperuser.bid": "2019-03-23",
      "recoverysuperuser.info": "2019-10-08",
      "recoveryusercustomer.info": "2019-03-27",
      "rectification.info": "2024-08-15",
      "recursivedns.site": "2024-08-15",
      "redfoxteeth.site": "2026-01-02",
      "redirect-b.online": "2024-12-17",
      "redirect-c.live": "2024-12-17",
      "redirect-d.online": "2024-12-17",
      "redirect-drive.online": "2024-09-30",
      "redirect-k.online": "2024-12-17",
      "redirect-l.online": "2024-12-17",
      "redirect-m.live": "2024-12-17",
      "redirect-o.online": "2024-12-17",
      "redirect-p.online": "2024-12-17",
      "redirect-q.online": "2024-12-17",
      "redirect-r.online": "2024-12-17",
      "redirect-review.online": "2026-01-02",
      "redirect-s.online": "2024-12-17",
      "redirect-t.online": "2024-12-17",
      "redirect-u.online": "2024-12-17",
      "refaeldevrssfeed.centralus.cloudapp.azure.com": "2024-02-28",
      "reg-d.info": "2026-01-02",
      "regionuaequestions.azurewebsites.net": "2024-02-28",
      "register-multiplay.ml": "2019-03-23",
      "registerinsurance.azurewebsites.net": "2024-02-28",
      "remgrogroup.com": "2022-04-07",
      "rendercomponents.site": "2024-08-15",
      "reproduce.outstanding.revstoragefile.site": "2026-01-02",
      "request-human-received.xyz": "2024-08-15",
      "research-storage.com": "2026-01-02",
      "researchdocument.info": "2024-08-20",
      "reset-account.com": "2021-01-09",
      "responsiblestatcraft.org": "2024-05-03",
      "review-continue-entered.cfd": "2024-08-15",
      "review-session.hopto.org": "2024-05-03",
      "review-status-plan.online": "2023-03-09",
      "review.validation.recognize.site": "2024-08-15",
      "reviewedition.duia.eu": "2024-08-20",
      "revistadcr.com": "2022-04-07",
      "revive-project-live.online": "2024-05-02",
      "revstoragefil.ddns.net": "2026-01-02",
      "revstoragefile.ddns.net": "2026-01-02",
      "revstoragefile.site": "2026-01-02",
      "rgud-group.com": "2024-10-31",
      "rgud-group.net": "2024-10-31",
      "rhealthylivingsolutions.com": "2025-01-11",
      "rheinmetall.careers-hub.org": "2026-01-02",
      "rheinmetall.careersworld.org": "2026-01-02",
      "rheinmetall.gocareers.org": "2026-01-02",
      "rheinmetall.theworldcareers.com": "2026-01-02",
      "rheinmetallcareer.com": "2026-01-02",
      "rheinmetallcareer.onlyoffice.com": "2026-01-02",
      "rheinmetallcareer.org": "2026-01-02",
      "rheinmetallcareers.com": "2026-01-02",
      "ricardo-mell.online": "2026-01-02",
      "richard-3th.online": "2026-01-02",
      "right.arrow-click.info": "2026-01-02",
      "roadmapselector.azurewebsites.net": "2024-02-28",
      "roadmapselectorapi.azurewebsites.net": "2024-02-28",
      "robinthing123.online": "2026-01-02",
      "rockhoster.net": "2026-01-02",
      "rohand63.xyz": "2026-01-02",
      "roland-cc.online": "2026-01-02",
      "room-meet-url.live": "2024-12-17",
      "room-online.one": "2026-01-02",
      "rostam-hr.vip": "2024-08-29",
      "royalsoul.online": "2026-01-02",
      "rozetka.dyndns.org": "2024-08-20",
      "rpcconnection.azurewebsites.net": "2026-01-02",
      "rsession.site": "2024-08-15",
      "rwccalendar.rwcsystems.net": "2026-07-17",
      "s1vega.dyndns.org": "2024-08-20",
      "s20.site": "2024-05-02",
      "s3api.shop": "2024-08-15",
      "s4api.shop": "2024-08-23",
      "s51.online": "2024-05-02",
      "s59.site": "2024-05-02",
      "sadashboard.com": "2019-03-23",
      "safe-lord.online": "2026-01-02",
      "safe-solution.site": "2020-05-07",
      "safeshortl.ink": "2024-05-03",
      "safrangroup-careers.com": "2026-01-02",
      "saipem.org": "2022-04-07",
      "salamjobs.me": "2024-08-29",
      "sandbox.live-meet.blog": "2026-01-02",
      "saudi-government.com": "2019-03-23",
      "saudi-haj.com": "2019-03-23",
      "saudiarabiadigitaldashboards.com": "2019-03-23",
      "sauditourismguide.com": "2022-04-07",
      "savemoneytrick.com": "2022-04-07",
      "schedule.gmta.nl": "2026-07-17",
      "scheduler.niced.cloud": "2026-07-17",
      "scheduler.scratchspace.dev": "2026-07-17",
      "scheduler.unionsavings.ca": "2026-07-17",
      "schoolofculture.ddns.net": "2021-01-09",
      "schoolofpinkmice.ddns.net": "2024-05-03",
      "screen-royall-in-corporate.com": "2019-03-23",
      "screen-shotuser-trash-green.com": "2019-03-23",
      "scribdinc.site": "2020-05-07",
      "searchfilterapp.info": "2026-01-02",
      "searchstatistics.duckdns.org": "2024-08-20",
      "secnetdc.com": "2026-01-02",
      "securelogicalrepository.com": "2021-01-09",
      "security-supportteams-mail-change.ga": "2019-03-23",
      "see-us.info": "2019-10-08",
      "seisolarpros.org": "2019-09-15",
      "sejoinu.cc": "2026-01-02",
      "selfpackage.info": "2024-08-20",
      "send-feedback-296.azurewebsites.net": "2026-01-02",
      "send-feedback-413.azurewebsites.net": "2026-01-02",
      "send-feedback-838.azurewebsites.net": "2026-01-02",
      "send-feedback.azurewebsites.net": "2026-01-02",
      "sendly-ink.shop": "2026-01-02",
      "sers-login.com": "2019-03-23",
      "serverbroadcast.info": "2019-03-27",
      "service-accountrecoverv.com": "2019-03-27",
      "service-accountrecovery.com": "2019-03-23",
      "service-activity-checkup.site": "2020-02-05",
      "service-broadcast.com": "2019-03-23",
      "service-issues.site": "2020-02-05",
      "service-logins.net": "2019-03-23",
      "service-management.tk": "2022-02-17",
      "service-recovery-session.info": "2019-03-27",
      "service-recovery.site": "2021-01-09",
      "service-recoveryaccount.com": "2019-03-23",
      "service-session-confirm.info": "2019-03-27",
      "service-session-continue.info": "2019-03-27",
      "service-session-recovery.site": "2021-01-09",
      "service-support.site": "2021-01-09",
      "service-verification.site": "2021-01-09",
      "servicechecker.top": "2024-09-05",
      "servicecustomer.bid": "2019-03-23",
      "servicemailbroadcast.bid": "2019-03-23",
      "servicepackupdate.info": "2024-09-05",
      "services-issue-notification.info": "2019-03-27",
      "services-sessionconfirmation.info": "2019-03-27",
      "services-update-check.azurewebsites.net": "2026-01-02",
      "servicesfiledrop.theworkpc.com": "2024-08-20",
      "servicesupdate.info": "2024-09-05",
      "servicesystem.serveirc.com": "2017-04-13",
      "session-confirmation.site": "2021-01-09",
      "session-customer-activity.site": "2021-01-09",
      "session-mail-customers.info": "2019-03-27",
      "session-management.info": "2019-03-27",
      "session-manager.info": "2019-03-27",
      "session-managment.info": "2019-03-27",
      "session-recovery-options.info": "2019-03-27",
      "session-review.hopto.org": "2024-05-03",
      "session-users-activities.com": "2019-03-27",
      "session-verify-user.info": "2019-03-27",
      "sessions-identifier-memberemailid.network": "2019-10-08",
      "sessions-identifiermemberemailid.network": "2019-03-27",
      "sessions-notification.info": "2019-03-27",
      "set-ymail-user-account-permission-challenge.com": "2019-03-23",
      "sh-tro.live": "2024-12-17",
      "shadow-network.best": "2026-01-02",
      "shaer-likn.store": "2026-01-02",
      "share.veracity-revision.info": "2026-01-02",
      "shared-access.com": "2019-03-23",
      "shared-files-access.live": "2024-09-30",
      "shared-login.com": "2019-03-23",
      "shared-permission.com": "2019-03-23",
      "sharedrive.ink": "2022-11-23",
      "sharedrive.webredirect.org": "2024-08-15",
      "sharefilesonline.live": "2024-09-30",
      "sharepointnotify.com": "2022-04-07",
      "sharestoredocs.theworkpc.com": "2024-08-20",
      "shebacenter.online": "2024-02-17",
      "shebacenter.org": "2024-02-17",
      "shirazicom.com": "2024-08-29",
      "sho-flu.live": "2024-12-17",
      "shooort.site": "2024-08-15",
      "shooourt.click": "2024-08-15",
      "shop-sellwear.info": "2019-03-27",
      "shopleta.ru": "2026-01-02",
      "shor-erier-f.xyz": "2024-12-17",
      "shor-fg.live": "2024-12-17",
      "shor-trv.live": "2024-12-17",
      "shoring-live.live": "2024-08-15",
      "short-abbreviate.info": "2026-01-02",
      "short-ion-per.live": "2024-08-15",
      "short-jg934hw.live": "2024-08-15",
      "short-join-live.online": "2024-12-17",
      "short-modification.site": "2024-05-03",
      "short-redirect.online": "2024-12-17",
      "short-rigf.live": "2024-08-15",
      "short-url.live": "2024-05-02",
      "short-urling.live": "2024-05-03",
      "short-view-url.online": "2024-12-17",
      "short-view.online": "2024-05-02",
      "shorten-abbreviate.ddns.net": "2026-01-02",
      "shorten-abbreviate.site": "2026-01-02",
      "shortener-abbreviate.info": "2026-01-02",
      "shortener.ddns.net": "2026-01-02",
      "shortenurl.online": "2024-05-02",
      "shorter.kozow.com": "2026-01-02",
      "shortfile-interactive.webredirect.org": "2026-01-02",
      "shorting-ce.live": "2024-05-02",
      "shorting-urling.live": "2024-05-03",
      "shortingurling.live": "2024-05-02",
      "shortlinkview.live": "2024-05-02",
      "shortlycc.site": "2026-01-02",
      "shortoni.live": "2024-05-03",
      "shortulonline.live": "2024-05-02",
      "shorturlbot.club": "2019-03-23",
      "shorturling.live": "2024-05-03",
      "shoting-urls.live": "2024-05-02",
      "show-verify.xyz": "2026-01-02",
      "show-video.info": "2019-03-23",
      "shr-r4yr93d.live": "2024-12-17",
      "shrtlink.space": "2026-01-02",
      "shrtlnk.info": "2026-01-02",
      "sht-rgtio9.live": "2024-12-17",
      "signin-acconut.com": "2024-05-02",
      "signin-accounts.com": "2024-05-02",
      "signin-identifi.com": "2026-01-02",
      "signin-mail.com": "2024-05-02",
      "signin-mails.com": "2024-05-02",
      "signin-myaccounts.com": "2024-05-02",
      "signin.dedyn.io": "2022-04-07",
      "simple-process-static.top": "2024-05-02",
      "sincerely-sensation-outdo.top": "2023-03-09",
      "sirc.travyfy.com": "2026-07-17",
      "sites.bounceme.net": "2026-01-02",
      "sky-writer.online": "2026-01-02",
      "skynevvs.com": "2019-09-15",
      "slmkhubi.ddns.net": "2019-03-23",
      "smaaaal.cfd": "2024-08-15",
      "smart-sight-hr.com": "2026-07-17",
      "smartapptools.azurewebsites.net": "2026-01-02",
      "smartconnect.azurewebsites.net": "2026-07-29",
      "smartmediq.azurewebsites.net": "2026-01-02",
      "smarttradingfast.com": "2019-10-08",
      "smartview.dns-dynamic.net": "2024-08-20",
      "smstagram.com": "2019-03-23",
      "smtp.amg-car-ger.info": "2026-01-02",
      "snap-short.online": "2026-01-02",
      "socks.beauty": "2026-01-02",
      "softservicetel.ddns.net": "2024-08-20",
      "software-updating-managers.site": "2020-02-05",
      "solofansapp.page.link": "2024-02-17",
      "sourceusedirection.mypi.co": "2024-08-20",
      "sparrowsgroup.org": "2022-04-07",
      "splitviewer.linkpc.net": "2024-08-20",
      "sportblogs.azurewebsites.net": "2024-02-28",
      "spring-club.info": "2026-01-02",
      "sprinqer.com": "2019-03-23",
      "stablis.online": "2026-01-02",
      "stadium-fresh.online": "2026-01-02",
      "staging-meeting.captello.com": "2026-07-17",
      "starmanblind.ddns.net": "2026-01-02",
      "stats.live-meet.blog": "2026-01-02",
      "status-short.live": "2024-05-02",
      "statuss-short-join.live": "2024-12-17",
      "stellar-roar-right.buzz": "2024-05-02",
      "stellar-stable-faith.top": "2023-02-26",
      "steve-brown.info": "2026-01-02",
      "storageprovider.duia.eu": "2024-08-20",
      "storagewiz.co.azurewebsites.net": "2026-01-02",
      "storm-wave.online": "2026-01-02",
      "strainitiatives.ddns.net": "2024-05-03",
      "streaml23.duia.eu": "2024-08-20",
      "stromectolonline.com": "2024-02-17",
      "student-rank-number.icu": "2020-11-16",
      "stylzdrowia.info": "2026-07-17",
      "stylzdrowiaa.info": "2026-07-17",
      "subinfralab.info": "2023-04-25",
      "sublimetxtcontent.serveblog.net": "2024-09-30",
      "submissiveness.online": "2024-08-15",
      "suite-moral.info": "2026-01-02",
      "sulumorbusinessservices.com": "2026-01-02",
      "summit-files.com": "2024-09-30",
      "superlite.online": "2026-01-02",
      "superset.sandbox.live-meet.blog": "2026-01-02",
      "supervisor-protector.online": "2026-01-02",
      "support-aasaam.bid": "2019-03-23",
      "support-aasaam.com": "2019-03-23",
      "support-account.xyz": "2024-05-02",
      "support-accountsrecovery.com": "2019-03-23",
      "support-google.co": "2019-03-23",
      "support-recoverycustomers.com": "2019-03-23",
      "support-servics.com": "2019-03-27",
      "support-servics.net": "2019-03-27",
      "support-verify-account-user.com": "2019-03-23",
      "support.services": "2019-03-27",
      "supportmailservice.info": "2019-03-27",
      "supports-recoverycustomers.com": "2019-03-23",
      "supportskype.com": "2022-04-07",
      "surveyappquery.azurewebsites.net": "2024-02-28",
      "surveyonlinetest.azurewebsites.net": "2024-02-28",
      "surveyonlinetestapi.azurewebsites.net": "2024-02-28",
      "sweet-pinnacle-readily.online": "2024-05-02",
      "symptom-recordchecker.azurewebsites.net": "2026-01-02",
      "synctimezone.dns-dynamic.net": "2024-08-20",
      "syrtime.me": "2024-08-29",
      "system-services.site": "2019-10-08",
      "systemmedicaleducation.azurewebsites.net": "2026-01-02",
      "systemupdate.info": "2024-09-05",
      "tacticalsnap.eastus.cloudapp.azure.com": "2026-01-02",
      "tadawul.com.co": "2019-03-23",
      "tai-tr.com": "2019-03-23",
      "talent-recruitment.org": "2022-04-07",
      "talenthumanresourcestalent.com": "2026-01-02",
      "talktalky.azurewebsites.net": "2022-04-07",
      "taskprocess.viewdns.net": "2024-08-15",
      "tb-meet.pages.dev": "2026-07-17",
      "tcvision.online": "2024-05-02",
      "team-speak.cf": "2019-03-23",
      "team-speak.ga": "2019-03-23",
      "team-speak.ml": "2019-03-23",
      "teammate-live.online": "2026-01-02",
      "teams.webredirect.org": "2024-08-15",
      "teamspeak-download.ml": "2019-03-23",
      "teamspeaks.cf": "2019-03-23",
      "technewsblogapi.azurewebsites.net": "2024-02-28",
      "technical-updates.info": "2022-09-21",
      "tecret.com": "2026-01-02",
      "telagram.cf": "2019-03-23",
      "telagram.net": "2019-10-08",
      "teledyneflir.com.de": "2024-02-28",
      "telehealthconnectpro.azurewebsites.net": "2026-01-02",
      "telespazio-careers.com": "2026-01-02",
      "tensore.online": "2026-01-02",
      "tepbit.site": "2026-01-02",
      "termite.nu": "2026-01-02",
      "terms-service-notification.info": "2019-03-27",
      "terms-service-notlfication.info": "2019-03-27",
      "termsstatement.duckdns.org": "2024-08-20",
      "teslator.online": "2026-01-02",
      "testecs48.ddns.net": "2024-08-20",
      "testmanagementapi1.azurewebsites.net": "2024-02-28",
      "testmanagementapis.azurewebsites.net": "2024-02-28",
      "testmanagementapisjson.azurewebsites.net": "2024-02-28",
      "testquestionapplicationapi.azurewebsites.net": "2024-02-28",
      "testtesttes.azurewebsites.net": "2024-02-28",
      "thecareershub.org": "2026-01-02",
      "thecloudappbox.azurewebsites.net": "2026-01-02",
      "thefireisburnt.ddns.net": "2024-05-03",
      "thefreemovies.net": "2022-04-07",
      "thehealth-life.com": "2026-07-29",
      "themedealine.org": "2024-05-02",
      "themesmanagers.azurewebsites.net": "2026-05-23",
      "themesprovidermanagers.azurewebsites.net": "2026-05-23",
      "therashelter.azurewebsites.net": "2026-01-02",
      "thetacticstore.com": "2026-01-02",
      "theush.uk": "2026-07-17",
      "theworldcareers.com": "2026-01-02",
      "thisismyapp.accesscam.org": "2024-08-20",
      "thisismydomain.chickenkiller.com": "2024-08-20",
      "thomas-mark.xyz": "2026-01-02",
      "threshold.tailba29da.ts.net": "2026-07-17",
      "tiappschecktest.azurewebsites.net": "2024-02-28",
      "timelinepage.dns-dynamic.net": "2024-08-20",
      "timesfisrael.com": "2024-05-02",
      "timezone-update.duckdns.org": "2024-08-20",
      "timezone.live": "2017-04-13",
      "timtechlab.duckdns.org": "2026-01-02",
      "tinyandjudy.com": "2026-07-29",
      "tinygo.duckdns.org": "2026-01-02",
      "tinyurl.co.il": "2024-09-30",
      "tinyurl.ink": "2022-12-01",
      "tinyurl.live": "2024-09-30",
      "titanium-hr.com": "2024-08-29",
      "title-flow-store.online": "2024-05-02",
      "tjconsultingservices.com": "2026-07-29",
      "tnlsowki.westus3.cloudapp.azure.com": "2024-02-28",
      "tnlsowkis.westus3.cloudapp.azure.com": "2024-02-28",
      "tnt200.mywire.org": "2024-05-02",
      "toadreport.azurewebsites.net": "2026-07-29",
      "token-ep.com": "2019-03-23",
      "tomas-company.online": "2026-01-02",
      "toolfare.online": "2026-01-02",
      "top-game.online": "2026-01-02",
      "topiranjobs.me": "2024-08-29",
      "topwor4u.com": "2024-08-29",
      "totalcaremedcenter.azurewebsites.net": "2026-01-02",
      "towerreseller.dns-dynamic.net": "2024-08-20",
      "tracedestination.duia.eu": "2024-08-20",
      "tracking.ns02.info": "2026-01-02",
      "transfer-filterless.ddns.net": "2024-12-14",
      "transfer.loss-modification.site": "2024-12-11",
      "translatorupdater.dns-dynamic.net": "2024-08-20",
      "travel-airbnb.site": "2020-05-07",
      "traveltipspage.com": "2026-01-02",
      "trnjobs.me": "2024-08-29",
      "trustedcarehub360.azurewebsites.net": "2026-01-02",
      "tuinpe.shop": "2026-07-29",
      "turbulencemd.azurewebsites.net": "2026-01-02",
      "turkairline.azurewebsites.net": "2024-02-28",
      "twision.top": "2024-05-02",
      "twittsupport.com": "2023-04-27",
      "two-step-checkup.site": "2020-02-05",
      "tymelinx.com": "2026-07-17",
      "uaeaircheckon.azurewebsites.net": "2024-02-28",
      "uaeairchecks.azurewebsites.net": "2024-02-28",
      "uani.us": "2024-09-30",
      "uavnodes.com": "2026-01-02",
      "ude-final.online": "2026-01-02",
      "uk-service.org": "2019-03-23",
      "ukborderhomeoffice-gov.org": "2021-01-09",
      "ukraine2day.com": "2022-04-07",
      "umberella.icu": "2024-08-15",
      "understandingthewar.org": "2024-08-15",
      "uniquethinksession.ddns.net": "2021-01-09",
      "unirsd.com": "2020-02-05",
      "unrisd.com": "2019-09-15",
      "update-checker.net": "2019-03-23",
      "update-driversonline.bid": "2019-03-23",
      "update-driversonline.club": "2019-03-23",
      "update-finder.com": "2019-03-23",
      "update-health-service.azurewebsites.net": "2026-01-02",
      "update-microsoft.bid": "2019-03-23",
      "update-system-driversonline.bid": "2019-03-23",
      "update.windows-driver.ml": "2022-02-01",
      "updateddns.ddns.net": "2022-04-07",
      "updatedefender.net": "2022-04-07",
      "updatedisplacement.ddns.net": "2026-01-02",
      "updatedns.ddns.net": "2022-02-19",
      "updater-driversonline.club": "2019-03-23",
      "updateservices.co": "2022-04-07",
      "upload-services.com": "2019-03-23",
      "uploaddata.info": "2019-10-08",
      "uploader.sytes.net": "2017-03-30",
      "uptime-timezone.dns-dynamic.net": "2024-08-20",
      "uptimezonemetadta.run.place": "2024-08-20",
      "uri.cab": "2019-03-23",
      "url-room-meet.live": "2024-12-17",
      "us2-mail-login-profile.site": "2020-09-30",
      "usa-careers.com": "2026-01-02",
      "usabilitystatus.servehttp.com": "2024-09-30",
      "user-activity-issues.info": "2019-03-27",
      "user-profile-credentials.com": "2019-03-27",
      "useridentity-confirm.info": "2019-03-27",
      "users-facebook.com": "2019-03-23",
      "users-issue-services.info": "2019-03-27",
      "users-login.com": "2019-03-23",
      "users-yahoomail.com": "2019-03-23",
      "usersettings.cf": "2019-03-23",
      "ush.team": "2026-07-17",
      "utopaisystems.net": "2019-03-23",
      "v4automaticreferrals.com": "2026-07-17",
      "validation-confirm.ddns.net": "2024-05-03",
      "validation.recognize.site": "2024-08-15",
      "validity-accredit.ddns.net": "2024-05-03",
      "validity.werifcattion.info": "2024-08-15",
      "vanityfaire.org": "2024-05-02",
      "vector.kozow.com": "2024-08-20",
      "vegas777.dyndns.org": "2024-08-20",
      "ventilateainest.azurewebsites.net": "2026-01-02",
      "veracity-revision.info": "2026-01-02",
      "verification-live.com": "2019-03-27",
      "verification-llve.com": "2019-03-27",
      "verification-services.info": "2019-10-08",
      "verificationlive.com": "2019-03-27",
      "verificationservice.online": "2024-09-30",
      "verifiy-account.net": "2019-03-27",
      "verifv-linkedin.net": "2019-03-27",
      "verify-account.services": "2019-03-23",
      "verify-accounts.info": "2019-03-23",
      "verify-corroborate.ddns.net": "2024-05-03",
      "verify-facebook.com": "2019-03-23",
      "verify-gmail.tk": "2019-03-23",
      "verify-linke.com": "2019-03-27",
      "verify-linkedin.net": "2019-03-27",
      "verify-person-entry.top": "2024-05-02",
      "verify-publisher.azurewebsites.net": "2026-01-02",
      "verify-session-service.site": "2021-01-09",
      "verify-user-session.info": "2019-03-27",
      "verify.rsession.site": "2024-08-15",
      "verifymeet.live": "2026-01-02",
      "video-connect.online": "2026-01-02",
      "video-youtube.cf": "2019-03-23",
      "videozoom.ddns.net": "2026-01-02",
      "view-cope-flow.online": "2024-05-02",
      "view-direct-panel.live": "2023-08-14",
      "view-direct-panel.xyz": "2023-08-14",
      "view-home-panel.xyz": "2023-08-14",
      "view-panel.live": "2024-05-02",
      "view-pool-cope.online": "2024-05-02",
      "view-total-step.online": "2024-05-02",
      "viewdestination.vpndns.net": "2024-08-20",
      "viewfileitems.info": "2024-12-11",
      "viewfileitems.myftp.org": "2026-01-02",
      "viewstand.online": "2024-05-02",
      "viewtop.online": "2024-05-02",
      "viliam-live-identity.online": "2026-01-02",
      "viliam.albert-company.online": "2026-01-02",
      "viliam.alpha-meet.online": "2026-01-02",
      "viliam.alpha-met.online": "2026-01-02",
      "viliam.arcanet.online": "2026-01-02",
      "viliam.azdava.online": "2026-01-02",
      "viliam.besatoo.online": "2026-01-02",
      "viliam.cnt-worth.online": "2026-01-02",
      "viliam.connect-room.online": "2026-01-02",
      "viliam.cppsg.online": "2026-01-02",
      "viliam.crysus-h.info": "2026-01-02",
      "viliam.dmn-for-car.online": "2026-01-02",
      "viliam.dmn-inter.online": "2026-01-02",
      "viliam.exir-juice.online": "2026-01-02",
      "viliam.goods-companies.online": "2026-01-02",
      "viliam.hrd-dmn.info": "2026-01-02",
      "viliam.human-fly900.online": "2026-01-02",
      "viliam.into-support.online": "2026-01-02",
      "viliam.kuret-live.online": "2026-01-02",
      "viliam.kuret-met.online": "2026-01-02",
      "viliam.live-board.online": "2026-01-02",
      "viliam.live-coaching.online": "2026-01-02",
      "viliam.live-conn.online": "2026-01-02",
      "viliam.look-together-online.online": "2026-01-02",
      "viliam.lynda-tricks.online": "2026-01-02",
      "viliam.meet-work.info": "2026-01-02",
      "viliam.message-live.online": "2026-01-02",
      "viliam.nsim-ph.info": "2026-01-02",
      "viliam.ntp-clock-h.info": "2026-01-02",
      "viliam.online-room.online": "2026-01-02",
      "viliam.online-speak.online": "2026-01-02",
      "viliam.owner-rate.online": "2026-01-02",
      "viliam.p-safe.online": "2026-01-02",
      "viliam.ph-crtdomain.info": "2026-01-02",
      "viliam.platinum-cnt.info": "2026-01-02",
      "viliam.prj-ph.info": "2026-01-02",
      "viliam.prt-max.online": "2026-01-02",
      "viliam.richard-3th.online": "2026-01-02",
      "viliam.robinthing123.online": "2026-01-02",
      "viliam.rohand63.xyz": "2026-01-02",
      "viliam.roland-cc.online": "2026-01-02",
      "viliam.safe-lord.online": "2026-01-02",
      "viliam.steve-brown.info": "2026-01-02",
      "viliam.superlite.online": "2026-01-02",
      "viliam.tensore.online": "2026-01-02",
      "viliam.teslator.online": "2026-01-02",
      "viliam.toolfare.online": "2026-01-02",
      "viliam.viliam-live-identity.online": "2026-01-02",
      "viliam.warning-d.info": "2026-01-02",
      "viliam.wer-d.info": "2026-01-02",
      "viliam.white-life-bl.info": "2026-01-02",
      "viliam.work-meeting.info": "2026-01-02",
      "viliam.yamal-group.online": "2026-01-02",
      "villiam.online-speak.online": "2026-01-02",
      "violet.backback.info": "2026-01-02",
      "vipjobsglobal.com": "2024-08-29",
      "virgomarketingsolutions.com": "2026-01-02",
      "virgomarketingsolutions.comtions.com": "2026-01-02",
      "virtual-notes.gotdns.ch": "2024-09-30",
      "virtualcliniczone.azurewebsites.net": "2026-01-02",
      "virtualphoneassistant.com": "2026-07-17",
      "virtue-regular-ready.online": "2024-05-02",
      "visioneditor.loseyourip.com": "2024-08-15",
      "visit-site-online.online": "2024-12-17",
      "vitatechlink.azurewebsites.net": "2026-01-02",
      "vitatechlinks.azurewebsites.net": "2026-01-02",
      "vote.nikosevag.gr": "2026-07-17",
      "vpncsp.duckdns.org": "2024-08-28",
      "vscodeupdater.azurewebsites.net": "2024-02-28",
      "vsliveagent.com": "2024-02-28",
      "vvincicivj-c-ssenrjais.tk": "2019-03-27",
      "w3-schools.org": "2019-09-15",
      "w3sch00ls.hopto.org": "2019-03-23",
      "w3school.hopto.org": "2019-03-23",
      "w3schools-html.com": "2019-03-23",
      "w3schools.hopto.org": "2019-03-23",
      "warning-d.info": "2026-01-02",
      "warplogic.pro": "2026-01-02",
      "wash-less.online": "2026-01-02",
      "washingtonlnstitute.org": "2022-11-23",
      "washinqtonpost.press": "2024-05-02",
      "watch-youtube.org.uk": "2019-03-23",
      "wazayif-halima.com": "2024-08-29",
      "wazayif-halima.org": "2024-08-29",
      "we-transfer.shop": "2024-05-02",
      "wearefirefighters.ddns.net": "2021-01-09",
      "web-getdata.site": "2024-05-03",
      "webdirecthost.site": "2024-08-15",
      "webemail.info": "2019-03-27",
      "webmaiil-tau-ac-il.ml": "2019-03-23",
      "webmail-tidhar-co-il.ml": "2019-03-23",
      "websites.freemyip.com": "2026-01-02",
      "webviewerpage.info": "2024-08-20",
      "wehatcast.com": "2024-08-29",
      "wellnessfirstgroup.azurewebsites.net": "2026-01-02",
      "wellnessglowluth.azurewebsites.net": "2026-01-02",
      "wer-d.info": "2026-01-02",
      "werifcattion.info": "2024-08-15",
      "wh1425239.ispot.cc": "2026-07-17",
      "whensy.ru": "2026-07-17",
      "white-car.online": "2026-01-02",
      "white-life-bl.info": "2026-01-02",
      "white-life.info": "2026-01-02",
      "win-ptf9aurtg8u.jewishjournal.us": "2019-03-23",
      "windows-driver.ml": "2022-02-01",
      "windows-update.systems": "2019-03-23",
      "wood-house.online": "2026-01-02",
      "word-course.online": "2026-01-02",
      "work-meeting.info": "2026-01-02",
      "workersquestions.azurewebsites.net": "2024-02-28",
      "workersquestionsapi.azurewebsites.net": "2024-02-28",
      "workersquestionsjson.azurewebsites.net": "2024-02-28",
      "workspaceconsole.servehttp.com": "2024-09-30",
      "workspaceviewers.com": "2026-07-17",
      "workstation2020.000webhostapp.com": "2024-09-30",
      "world-shop.online": "2026-01-02",
      "worldcareers.org": "2026-01-02",
      "worldstate.duia.us": "2024-08-20",
      "worried-eastern-salto.glitch.me": "2024-03-05",
      "wulpfsrqupnuqorhexiw.supabase.co": "2024-05-07",
      "www-myaccounts-support.000webhostapp.com": "2024-09-30",
      "wwwlmeetic.com": "2026-01-02",
      "wybieramzdrowie.info": "2026-07-17",
      "wybieramzdrowiea.info": "2026-07-17",
      "wysebeyond.gotdns.ch": "2024-08-15",
      "xboxapicenter.com": "2024-10-30",
      "xboxplayservice.com": "2024-02-28",
      "xn--facebook-06k.com": "2019-03-27",
      "xn--googe-q2e.ml": "2019-03-23",
      "xn--google-yri.com": "2019-03-27",
      "yah00.site": "2020-02-05",
      "yahoo-proflles.com": "2019-03-23",
      "yahoo-verification.net": "2019-03-23",
      "yahoo-verification.org": "2019-03-23",
      "yahoo-verify.net": "2019-03-23",
      "yahoomail.com.co": "2019-03-27",
      "yamal-group.online": "2026-01-02",
      "yes1.me": "2026-07-17",
      "ynetnews.press": "2024-05-02",
      "youetube.ga": "2019-03-23",
      "youna101.me": "2024-08-29",
      "younamesh.com": "2024-08-29",
      "yourfamilymdclinic.azurewebsites.net": "2026-01-02",
      "yourl.bid": "2019-03-23",
      "youronlineregister.com": "2024-05-02",
      "youtransfer.live": "2024-05-02",
      "youtransfer.online": "2024-08-15",
      "youttube.ga": "2019-03-23",
      "youttube.gq": "2019-03-23",
      "youtubbe.cf": "2019-03-23",
      "youtubbe.ml": "2019-03-23",
      "youtube-com.watch": "2019-03-23",
      "youtubee-videos.com": "2019-03-23",
      "youtuebe.co": "2019-03-23",
      "youtuobe.com.co": "2019-03-23",
      "youutube.cf": "2019-03-23",
      "yurl.bid": "2019-03-23",
      "zdrowaplaneta.info": "2026-07-17",
      "zdrowaplanetaa.info": "2026-07-17",
      "zdrowaplanetab.com": "2026-07-17",
      "zdrowaprzemiana.com": "2026-07-17",
      "zdrowaprzemianaa.com": "2026-07-17",
      "zdrowaprzemianab.com": "2026-07-17",
      "zdrowienapelnym.com": "2026-07-17",
      "zdrowienapelnyma.com": "2026-07-17",
      "zdrowienapelnymb.com": "2026-07-17",
      "zdrowykierunek.com": "2026-07-17",
      "zdrowykieruneka.com": "2026-07-17",
      "zdrowykierunekb.com": "2026-07-17",
      "zedisdead.duckdns.org": "2024-08-28",
      "zerogmed.azurewebsites.net": "2026-01-02",
      "zeusistalking.com": "2024-10-31",
      "zeusistalking.io": "2024-10-31",
      "zeusistalking.net": "2024-10-31",
      "zoomcloud.redirectme.net": "2024-09-30",
      "zra-roll.online": "2026-01-02",
      "zytonhealth.com": "2026-01-02"
    },
    "ipv4": {
      "103.57.251.153:2000": "2026-01-02",
      "103.57.251.153:443": "2026-01-02",
      "136.243.108.10:10000": "2022-08-28",
      "136.243.108.10:22": "2022-08-28",
      "136.243.108.10:25": "2022-08-28",
      "136.243.108.10:4040": "2022-08-28",
      "136.243.108.10:443": "2022-08-28",
      "136.243.108.10:465": "2022-08-28",
      "136.243.108.10:587": "2022-08-28",
      "136.243.108.10:993": "2022-08-28",
      "136.243.108.10:995": "2022-08-28",
      "136.243.108.11:10000": "2022-08-28",
      "136.243.108.11:22": "2022-08-28",
      "136.243.108.11:25": "2022-08-28",
      "136.243.108.11:4040": "2022-08-28",
      "136.243.108.11:443": "2022-08-28",
      "136.243.108.11:465": "2022-08-28",
      "136.243.108.11:587": "2022-08-28",
      "136.243.108.11:993": "2022-08-28",
      "136.243.108.11:995": "2022-08-28",
      "136.243.108.12:10000": "2022-08-28",
      "136.243.108.12:22": "2022-08-28",
      "136.243.108.12:25": "2022-08-28",
      "136.243.108.12:4040": "2022-08-28",
      "136.243.108.12:443": "2022-08-28",
      "136.243.108.12:465": "2022-08-28",
      "136.243.108.12:587": "2022-08-28",
      "136.243.108.12:993": "2022-08-28",
      "136.243.108.12:995": "2022-08-28",
      "136.243.108.13:10000": "2022-08-28",
      "136.243.108.13:22": "2022-08-28",
      "136.243.108.13:25": "2022-08-28",
      "136.243.108.13:4040": "2022-08-28",
      "136.243.108.13:443": "2022-08-28",
      "136.243.108.13:465": "2022-08-28",
      "136.243.108.13:587": "2022-08-28",
      "136.243.108.13:993": "2022-08-28",
      "136.243.108.13:995": "2022-08-28",
      "136.243.108.14:10000": "2022-08-28",
      "136.243.108.14:22": "2022-08-28",
      "136.243.108.14:25": "2022-08-28",
      "136.243.108.14:4040": "2022-08-28",
      "136.243.108.14:443": "2022-08-28",
      "136.243.108.14:465": "2022-08-28",
      "136.243.108.14:587": "2022-08-28",
      "136.243.108.14:993": "2022-08-28",
      "136.243.108.14:995": "2022-08-28",
      "136.243.108.9:10000": "2022-08-28",
      "136.243.108.9:22": "2022-08-28",
      "136.243.108.9:25": "2022-08-28",
      "136.243.108.9:4040": "2022-08-28",
      "136.243.108.9:443": "2022-08-28",
      "136.243.108.9:465": "2022-08-28",
      "136.243.108.9:587": "2022-08-28",
      "136.243.108.9:993": "2022-08-28",
      "136.243.108.9:995": "2022-08-28",
      "137.184.212.205:4373": "2022-10-11",
      "144.217.139.155:4444": "2022-01-11",
      "159.69.105.181:2082": "2022-08-28",
      "159.69.105.181:2083": "2022-08-28",
      "159.69.105.181:2086": "2022-08-28",
      "159.69.105.181:2087": "2022-08-28",
      "159.69.105.181:21": "2022-08-28",
      "159.69.105.181:22": "2022-08-28",
      "159.69.105.181:443": "2022-08-28",
      "159.69.105.181:53": "2022-08-28",
      "169.51.60.221:1331": "2022-02-01",
      "173.209.51.54:5985": "2022-08-28",
      "179.43.177.130:3333": "2026-01-02",
      "188.165.174.199:18080": "2024-12-27",
      "190.2.150.50:443": "2024-08-23",
      "194.11.226.9:443": "2024-11-18",
      "194.4.49.175:443": "2024-11-18",
      "195.201.46.42:10000": "2022-08-28",
      "195.201.46.42:22": "2022-08-28",
      "195.201.46.42:25": "2022-08-28",
      "195.201.46.42:443": "2022-08-28",
      "195.201.46.42:465": "2022-08-28",
      "195.201.46.42:587": "2022-08-28",
      "195.201.46.42:993": "2022-08-28",
      "195.201.46.42:995": "2022-08-28",
      "212.175.168.58:443": "2026-01-02",
      "45.143.167.87:443": "2024-11-18",
      "45.77.76.158:23643": "2022-02-01",
      "46.249.58.136:4444": "2024-11-18",
      "46.249.58.136:8080": "2024-11-18",
      "51.38.87.253:3535": "2022-10-11",
      "51.89.181.64:443": "2022-11-17",
      "54.38.49.6:21": "2022-01-11",
      "58.158.177.102:5050": "2022-10-11",
      "78.47.90.60:10000": "2022-08-28",
      "78.47.90.60:110": "2022-08-28",
      "78.47.90.60:143": "2022-08-28",
      "78.47.90.60:2082": "2022-08-28",
      "78.47.90.60:2083": "2022-08-28",
      "78.47.90.60:2086": "2022-08-28",
      "78.47.90.60:2087": "2022-08-28",
      "78.47.90.60:21": "2022-08-28",
      "78.47.90.60:25": "2022-08-28",
      "78.47.90.60:443": "2022-08-28",
      "78.47.90.60:465": "2022-08-28",
      "78.47.90.60:53": "2022-08-28",
      "78.47.90.60:587": "2022-08-28",
      "78.47.90.60:993": "2022-08-28",
      "78.47.90.60:995": "2022-08-28",
      "85.17.172.180:5050": "2022-10-11",
      "94.156.128.60:5252": "2026-01-02"
    },
    "url": {
      "http://136.243.108.10": "2022-08-28",
      "http://136.243.108.11": "2022-08-28",
      "http://136.243.108.12": "2022-08-28",
      "http://136.243.108.13": "2022-08-28",
      "http://136.243.108.14": "2022-08-23",
      "http://136.243.108.9": "2022-08-28",
      "http://148.251.71.182": "2021-12-22",
      "http://159.69.105.181": "2022-08-28",
      "http://162.55.136.233": "2022-02-01",
      "http://162.55.137.20": "2022-02-01",
      "http://173.209.51.54": "2022-08-23",
      "http://182.54.217.2": "2022-02-18",
      "http://185.132.176.240": "2026-01-02",
      "http://185.153.197.236": "2026-01-02",
      "http://190.2.150.50": "2024-08-23",
      "http://194.11.226.9": "2024-11-18",
      "http://194.4.49.175": "2024-11-18",
      "http://195.201.46.42": "2022-08-28",
      "http://212.175.168.58": "2026-01-02",
      "http://37.120.222.168": "2023-09-12",
      "http://45.143.167.87": "2024-11-18",
      "http://78.47.90.60": "2022-08-28",
      "http://88.80.148.162": "2024-12-27",
      "http://91.107.150.184": "2024-08-15",
      "https://community.emergingthreats.net/t/ruleset-update-summary-2024-05-06-v10590/1615": "2024-05-07"
    },
    "url_path": {
      "/CkliPwaM": "2024-08-15",
      "/F53OQQkE": "2024-08-15",
      "/Gallery/Ref/FSaEM5gG": "2024-08-15",
      "/Gcollection/Ref/CkliPwaM": "2024-08-15",
      "/Lcollection/Ref/F53OQQkE": "2024-08-15",
      "/Ref/CkliPwaM": "2024-08-15",
      "/Ref/F53OQQkE": "2024-08-15",
      "/aliasauthG/autoref/vNSX6c2m": "2024-08-15",
      "/aspx_wkggiyvttmu.aspx": "2022-03-21",
      "/autoref/vNSX6c2m": "2024-08-15",
      "/dhvqx.aspx": "2022-03-21",
      "/ecp/auth/aspx_wkggiyvttmu.aspx": "2022-03-21",
      "/edfcvfgbhnjmkqwasderfgg": "2026-07-29",
      "/gadfTs55sghsSSS": "2022-02-18",
      "/gadfTs55sghsSSS/phppost.php": "2022-02-01",
      "/vNSX6c2m": "2024-08-15"
    }
  },
  "first_seen_precision": {
    "domain": {
      "1stl.ink": "at-or-before",
      "academy-update.com": "at-or-before",
      "acconut-mail.com": "at-or-before",
      "accountroyal.com": "at-or-before",
      "accounts.google.live-meet.blog": "at-or-before",
      "accounts.google.live-meet.cfd": "at-or-before",
      "accounts.google.live-meet.cloud": "at-or-before",
      "accounts.google.live-meet.info": "at-or-before",
      "accounts.google.network-show.online": "at-or-before",
      "ace-capitalpartners.ddns.net": "at-or-before",
      "activehealthlab.azurewebsites.net": "at-or-before",
      "activespiritluth.eastus.cloudapp.azure.com": "at-or-before",
      "actor.rap-art.info": "at-or-before",
      "acupuncturebentonville.com": "at-or-before",
      "adams-cooling.online": "at-or-before",
      "aeroclinicit.azurewebsites.net": "at-or-before",
      "agm-rto-ewi.com": "at-or-before",
      "airbus-careers.onlyoffice.com": "at-or-before",
      "airbus-survay.onlyoffice.com": "at-or-before",
      "airbus.careers-portal.org": "at-or-before",
      "airbus.careersworld.org": "at-or-before",
      "airbus.germanywork.org": "at-or-before",
      "airbus.global-careers.com": "at-or-before",
      "airbus.usa-careers.com": "at-or-before",
      "airbusaerodefence.com": "at-or-before",
      "airbusaerodefence.nl": "at-or-before",
      "airbusgroup-careers.com": "at-or-before",
      "airbushiring.com": "at-or-before",
      "airmdsolutions.azurewebsites.net": "at-or-before",
      "airtravellog.com": "at-or-before",
      "albert-company.online": "at-or-before",
      "alex-mendez-fire.info": "at-or-before",
      "alison624.online": "at-or-before",
      "all-for-city.info": "at-or-before",
      "alpha-man.info": "at-or-before",
      "alpha-meet.online": "at-or-before",
      "alpha-met.online": "at-or-before",
      "alwayslivehealthy.com": "at-or-before",
      "ameen-alkhalij.com": "at-or-before",
      "ameen-alkhalij.is": "at-or-before",
      "ameen-alkhalij.nu": "at-or-before",
      "ameen-alkhalij.org": "at-or-before",
      "ameen-alkhalij.se": "at-or-before",
      "amg-car-ger.info": "at-or-before",
      "anna-blog.info": "at-or-before",
      "anteromarketing.com": "at-or-before",
      "apple.beta-man.info": "at-or-before",
      "april.spring-club.info": "at-or-before",
      "arabiccountriestalent.azurewebsites.net": "at-or-before",
      "arabiccountriestalent.com": "at-or-before",
      "arabiccountriestalenthr.azurewebsites.net": "at-or-before",
      "arabiccountriestalents.azurewebsites.net": "at-or-before",
      "arabiccountriestalentshr.azurewebsites.net": "at-or-before",
      "arcanet.online": "at-or-before",
      "arizonaclub.me": "at-or-before",
      "arrow-click.info": "at-or-before",
      "asiandefenses.com": "at-or-before",
      "asylimed.azurewebsites.net": "at-or-before",
      "auto-updater.azurewebsites.net": "at-or-before",
      "azdava.online": "at-or-before",
      "backback.info": "at-or-before",
      "background-update.azurewebsites.net": "at-or-before",
      "backsrv66.azurewebsites.net": "at-or-before",
      "backsrv74.azurewebsites.net": "at-or-before",
      "bbmovements.com": "at-or-before",
      "bdroyer.webredirect.org": "at-or-before",
      "becker624.online": "at-or-before",
      "beetly.online": "at-or-before",
      "besatoo.online": "at-or-before",
      "best85best.online": "at-or-before",
      "bestshopu.online": "at-or-before",
      "beta-man.info": "at-or-before",
      "biolinksystems.azurewebsites.net": "at-or-before",
      "black-friday-store.online": "at-or-before",
      "bmw.amg-car-ger.info": "at-or-before",
      "bodywellnessbycynthia.com": "at-or-before",
      "boeing-careers.com": "at-or-before",
      "boeinginformation.onlyoffice.com": "at-or-before",
      "boeingspace.com": "at-or-before",
      "book-handwrite.online": "at-or-before",
      "book.anna-blog.info": "at-or-before",
      "book.kuret-live.online": "at-or-before",
      "bookstoragestore.com": "at-or-before",
      "bouncer.qc.to": "at-or-before",
      "bracs-lion.online": "at-or-before",
      "brannew-home.info": "at-or-before",
      "bvio85.info": "at-or-before",
      "bytli.ink": "at-or-before",
      "cacademy-update.com": "at-or-before",
      "cache-cleaner-check-111.azurewebsites.net": "at-or-before",
      "cache-cleaner-check-805.azurewebsites.net": "at-or-before",
      "cache-cleaner-check-926.azurewebsites.net": "at-or-before",
      "cache-cleaner-check.azurewebsites.net": "at-or-before",
      "cache-managment.northeurope.cloudapp.azure.com": "at-or-before",
      "cardiomedspecialists.azurewebsites.net": "at-or-before",
      "carebytesolutions.azurewebsites.net": "at-or-before",
      "careers-hub.org": "at-or-before",
      "careers-portal.org": "at-or-before",
      "careersworld.org": "at-or-before",
      "cavinet.org": "at-or-before",
      "cc-newton.info": "at-or-before",
      "ccreservoir.info": "at-or-before",
      "centrallibrary.bounceme.net": "at-or-before",
      "chakracleansetherapy.com": "at-or-before",
      "chapter1.cc-newton.info": "at-or-before",
      "check-backup-service-179.azurewebsites.net": "at-or-before",
      "check-backup-service-288.azurewebsites.net": "at-or-before",
      "check-backup-service-736.azurewebsites.net": "at-or-before",
      "check-backup-service.azurewebsites.net": "at-or-before",
      "check-security-update.azurewebsites.net": "at-or-before",
      "cholyicker.ddns.net": "at-or-before",
      "city-splash.online": "at-or-before",
      "clame-rade.online": "at-or-before",
      "clearmindhealthandwellness.com": "at-or-before",
      "clinichaven.azurewebsites.net": "at-or-before",
      "cloth-model.blog": "at-or-before",
      "clothes-show.online": "at-or-before",
      "cloud.qc.to": "at-or-before",
      "cloudaskingquestioning.azurewebsites.net": "at-or-before",
      "cloudaskingquestioning.azurewebsites.net.net": "at-or-before",
      "cloudaskingquestions.azurewebsites.net.net": "at-or-before",
      "cloudaskingquestions.eastus.cloudapp.azure.com": "at-or-before",
      "cloudaskingquestions.eastus.cloudapp.azure.com.net": "at-or-before",
      "cloudaskquestionanswers.azurewebsites.net": "at-or-before",
      "cloudaskquestionanswers.azurewebsites.net.net": "at-or-before",
      "cloudaskquestionanswers.com": "at-or-before",
      "cloudaskquestionanswers.com.net": "at-or-before",
      "cloudaskquestioning.eastus.cloudapp.azure.com": "at-or-before",
      "cloudaskquestioning.eastus.cloudapp.azure.com.net": "at-or-before",
      "cloudtransferfile.info": "at-or-before",
      "cnt-worth.online": "at-or-before",
      "collaboromarketing.com": "at-or-before",
      "commercialstudio.ddns.net": "at-or-before",
      "computerlearning.ddns.net": "at-or-before",
      "conn-ectionor.cfd": "at-or-before",
      "connect-room.online": "at-or-before",
      "consistent-provisioned.accesscam.org": "at-or-before",
      "continue-short.ddns.net": "at-or-before",
      "cook-tips.info": "at-or-before",
      "course-math.info": "at-or-before",
      "cppsg.online": "at-or-before",
      "createformquestionshelper.com": "at-or-before",
      "createformquestionshelper.com.net": "at-or-before",
      "creating-loceer.ddns.net": "at-or-before",
      "cresearch-storage.com": "at-or-before",
      "crysus-h.info": "at-or-before",
      "crysus-p.info": "at-or-before",
      "csearchfilterapp.info": "at-or-before",
      "cyberlattice.pro": "at-or-before",
      "data.live-meet.blog": "at-or-before",
      "datasheet96.azurewebsites.net": "at-or-before",
      "dazedebtor.com": "at-or-before",
      "db.qc.to": "at-or-before",
      "digicura.azurewebsites.net": "at-or-before",
      "digithealthplatform.azurewebsites.net": "at-or-before",
      "dmn-for-car.online": "at-or-before",
      "dmn-for-hall.online": "at-or-before",
      "dmn-inter.online": "at-or-before",
      "doctorconsult-app.azurewebsites.net": "at-or-before",
      "door-black-meter.online": "at-or-before",
      "drives.googles.site": "at-or-before",
      "droneflywell.com": "at-or-before",
      "dronetechasia.org": "at-or-before",
      "easymarketing101.com": "at-or-before",
      "ehealthpsuluth.com": "at-or-before",
      "electrons-residingonthemoon.info": "at-or-before",
      "ell-safe.online": "at-or-before",
      "emiratescareers.org": "at-or-before",
      "emiratesgroup-careers.com": "at-or-before",
      "emv1.brannew-home.info": "at-or-before",
      "emv1.newsaboutecology.info": "at-or-before",
      "encryption-redirect.online": "at-or-before",
      "enovation-affirm.theworkpc.com": "at-or-before",
      "entrpreneur.org": "at-or-before",
      "est5090.online": "at-or-before",
      "eventer.ink": "at-or-before",
      "everything-here.info": "at-or-before",
      "exchtestchecking.azurewebsites.net": "at-or-before",
      "exchtestcheckingapihealth.com": "at-or-before",
      "exchtestcheckingapijson.azurewebsites.net": "at-or-before",
      "exir-juice.online": "at-or-before",
      "expressmarket.online": "at-or-before",
      "fdns1.duckdns.org": "at-or-before",
      "file-review.hopto.org": "at-or-before",
      "fileviewitems.myftp.org": "at-or-before",
      "filevisitresult.site": "at-or-before",
      "first-course.online": "at-or-before",
      "first-myshortel.ddns.net": "at-or-before",
      "flydubai-careers.com": "at-or-before",
      "flydubaicareers.ae.org": "at-or-before",
      "focusfusion.eastus.cloudapp.azure.com": "at-or-before",
      "food-tips-blog.online": "at-or-before",
      "frameforward.azurewebsites.net": "at-or-before",
      "friends.lizza-blog.info": "at-or-before",
      "friends.thomas-mark.xyz": "at-or-before",
      "gallery-shop.online": "at-or-before",
      "gc.n-e.kr": "at-or-before",
      "germanywork.org": "at-or-before",
      "get-ready.blog": "at-or-before",
      "global-careers.com": "at-or-before",
      "go0gle.online": "at-or-before",
      "gocareers.org": "at-or-before",
      "good-news.cfd": "at-or-before",
      "good-news.fashion": "at-or-before",
      "good-student.online": "at-or-before",
      "goods-companies.online": "at-or-before",
      "google.live-meet.blog": "at-or-before",
      "google.live-meet.cfd": "at-or-before",
      "google.live-meet.cloud": "at-or-before",
      "google.live-meet.info": "at-or-before",
      "google.network-show": "at-or-before",
      "google.network-show.online": "at-or-before",
      "googles.site": "at-or-before",
      "group-policy-update.azurewebsites.net": "at-or-before",
      "grownehealth.eastus.cloudapp.azure.com": "at-or-before",
      "healsanctum.azurewebsites.net": "at-or-before",
      "healthbodymonitoring.azurewebsites.net": "at-or-before",
      "healthcare-azureapi.azurewebsites.net": "at-or-before",
      "healthcarefluent.com": "at-or-before",
      "healthdataanalyticsrecord.azurewebsites.net": "at-or-before",
      "healthiestmama.com": "at-or-before",
      "healthinfusiontherapy.com": "at-or-before",
      "healthy-lifestyle.fit": "at-or-before",
      "hivemedtech.azurewebsites.net": "at-or-before",
      "holyicker.ddns.net": "at-or-before",
      "hotchichenfly.info": "at-or-before",
      "hrd-dmn.info": "at-or-before",
      "human-fly900.online": "at-or-before",
      "hyperv-heartbeat-service.azurewebsites.net": "at-or-before",
      "i-love-tux.qc.to": "at-or-before",
      "idea-home.online": "at-or-before",
      "implemen-tmeasures.myftp.org": "at-or-before",
      "infinit-world.info": "at-or-before",
      "intelligence.live-meet.blog": "at-or-before",
      "interactive-view.myftp.org": "at-or-before",
      "internationalbester.ddns.net": "at-or-before",
      "into-support.online": "at-or-before",
      "ip-194-11-226-29.rockhoster.net": "at-or-before",
      "isftyviliam.platinum-cnt.info": "at-or-before",
      "ismywhs.com.de": "at-or-before",
      "israel-talent.com": "at-or-before",
      "israel-talent.xyz": "at-or-before",
      "jadehealthcenter.com": "at-or-before",
      "javedpension.is-a-good.dev": "at-or-before",
      "joinboeing.com": "at-or-before",
      "kanplus.org": "at-or-before",
      "kibanacore.com": "at-or-before",
      "kuret-live.online": "at-or-before",
      "lastfilterfile.info": "at-or-before",
      "lenan-rex.online": "at-or-before",
      "lensvisionary.azurewebsites.net": "at-or-before",
      "lesson-first.info": "at-or-before",
      "licentiegegevens.ddns.net": "at-or-before",
      "live-board.online": "at-or-before",
      "live-coaching.online": "at-or-before",
      "live-conn.online": "at-or-before",
      "live-content.online": "at-or-before",
      "live-gml.online": "at-or-before",
      "live-meet.blog": "at-or-before",
      "live-meet.cfd": "at-or-before",
      "live-meet.cloud": "at-or-before",
      "live-meet.info": "at-or-before",
      "live-meet.live": "at-or-before",
      "live-message.online": "at-or-before",
      "live.besatoo.online": "at-or-before",
      "live.connect-room.online": "at-or-before",
      "live.goods-companies.online": "at-or-before",
      "live.live-coaching.online": "at-or-before",
      "live.live-gml.online": "at-or-before",
      "live.live-meet": "at-or-before",
      "live.live-meet.cloud": "at-or-before",
      "live.live-meet.info": "at-or-before",
      "live.online-room.online": "at-or-before",
      "live.platinum-cnt.info": "at-or-before",
      "live.white-life-bl.info": "at-or-before",
      "live.yamal-group.online": "at-or-before",
      "lizza-blog.info": "at-or-before",
      "loads-ideas.online": "at-or-before",
      "look-together-online.online": "at-or-before",
      "lynda-tricks.online": "at-or-before",
      "mail.brannew-home.info": "at-or-before",
      "mail.bvio85.info": "at-or-before",
      "mainrepo10.azurewebsites.net": "at-or-before",
      "make-house.online": "at-or-before",
      "malebachhew2506090936.onlyoffice.com": "at-or-before",
      "managetools-platform.azurewebsites.net": "at-or-before",
      "marketinglw.com": "at-or-before",
      "marsoxygen.azurewebsites.net": "at-or-before",
      "master-club.info": "at-or-before",
      "masterflexiblecloud.azurewebsites.net": "at-or-before",
      "maydaymed.azurewebsites.net": "at-or-before",
      "mediasylum.azurewebsites.net": "at-or-before",
      "medical-deepresearch.azurewebsites.net": "at-or-before",
      "medicalit-imaging.azurewebsites.net": "at-or-before",
      "medicoreit.azurewebsites.net": "at-or-before",
      "medicpathsolutions.azurewebsites.net": "at-or-before",
      "meet-online.site": "at-or-before",
      "meet-room.site": "at-or-before",
      "meet-work.info": "at-or-before",
      "meet.azdava.online": "at-or-before",
      "meet.ell-safe.online": "at-or-before",
      "meet.go0gle.online": "at-or-before",
      "meet.proof-video.online": "at-or-before",
      "meet.video-connect.online": "at-or-before",
      "meetime.info": "at-or-before",
      "meeting-invite.live": "at-or-before",
      "meeting-room.live": "at-or-before",
      "meeting-time.info": "at-or-before",
      "meetingonline.live": "at-or-before",
      "meetingzone.info": "at-or-before",
      "meetland.info": "at-or-before",
      "meetonline.pro": "at-or-before",
      "mentalhealth-support-portal.azurewebsites.net": "at-or-before",
      "meot-roem.online": "at-or-before",
      "message-live.online": "at-or-before",
      "mickel.besatoo.online": "at-or-before",
      "mickel.connect-room.online": "at-or-before",
      "mickel.goods-companies.online": "at-or-before",
      "mickel.live-coaching.online": "at-or-before",
      "mickel.platinum-cnt.info": "at-or-before",
      "mickel.white-life-bl.info": "at-or-before",
      "mickel.yamal-group.online": "at-or-before",
      "mikel.yamal-group.online": "at-or-before",
      "miniurl.duckdns.org": "at-or-before",
      "mobile.proctor-custodian.site": "at-or-before",
      "mobile.shorten-abbreviate.site": "at-or-before",
      "mojavemassageandwellness.com": "at-or-before",
      "moses-staff.io": "at-or-before",
      "moses-staff.to": "at-or-before",
      "msnapp.help": "at-or-before",
      "msnapp.live": "at-or-before",
      "msnclouds.com": "at-or-before",
      "msnl.ink": "at-or-before",
      "msnotetask-insights.azurewebsites.net": "at-or-before",
      "mstrakcer-tools.azurewebsites.net": "at-or-before",
      "musalas.se": "at-or-before",
      "my.abrdns.com": "at-or-before",
      "mywebdout.ddns.net": "at-or-before",
      "nanobreathe.azurewebsites.net": "at-or-before",
      "network-game.xyz": "at-or-before",
      "network-review.xyz": "at-or-before",
      "network-show-a.online": "at-or-before",
      "network-show.online": "at-or-before",
      "neurocloudhq.azurewebsites.net": "at-or-before",
      "newsaboutecology.info": "at-or-before",
      "nextgenhealthtrack.azurewebsites.net": "at-or-before",
      "nice-goods.online": "at-or-before",
      "normal-dmn.info": "at-or-before",
      "ns2.brannew-home.info": "at-or-before",
      "ns2.newsaboutecology.info": "at-or-before",
      "nsim-pa.info": "at-or-before",
      "nsim-ph.info": "at-or-before",
      "ntp-clock-h.info": "at-or-before",
      "ntp-clock-p.info": "at-or-before",
      "olemanage-dashboard.azurewebsites.net": "at-or-before",
      "oletask-tracker.azurewebsites.net": "at-or-before",
      "online-room.online": "at-or-before",
      "online-speak.online": "at-or-before",
      "onwards-gerencia.ddns.net": "at-or-before",
      "opportunities2get.com": "at-or-before",
      "optio-nalynk.online": "at-or-before",
      "oranus.albert-company.online": "at-or-before",
      "oranus.besatoo.online": "at-or-before",
      "oranus.connect-room.online": "at-or-before",
      "oranus.human-fly900.online": "at-or-before",
      "oranus.live-coaching.online": "at-or-before",
      "oranus.platinum-cnt.info": "at-or-before",
      "oranus.white-life-bl.info": "at-or-before",
      "oranus.yamal-group.online": "at-or-before",
      "outlook.live.live-meet.cloud": "at-or-before",
      "outlook.live.live-meet.info": "at-or-before",
      "outstanding.revstoragefile.site": "at-or-before",
      "owner-rate.online": "at-or-before",
      "p-safe.online": "at-or-before",
      "pa-crtdomain.info": "at-or-before",
      "palaerospace.careers": "at-or-before",
      "panel-meeting.info": "at-or-before",
      "panel-network.online": "at-or-before",
      "panel-redirect.online": "at-or-before",
      "panel.live-meet.blog": "at-or-before",
      "panel.live-meet.cfd": "at-or-before",
      "panel.live-meet.cloud": "at-or-before",
      "panel.live-meet.info": "at-or-before",
      "panel.live-meet.live": "at-or-before",
      "panel.network-show.online": "at-or-before",
      "patch-provider-247.azurewebsites.net": "at-or-before",
      "patch-provider-597.azurewebsites.net": "at-or-before",
      "patch-provider-745.azurewebsites.net": "at-or-before",
      "patch-provider.azurewebsites.net": "at-or-before",
      "patient-azureportal.azurewebsites.net": "at-or-before",
      "patientcare-portal.azurewebsites.net": "at-or-before",
      "pay.entrpreneur.org": "at-or-before",
      "pfl.redirect-review.online": "at-or-before",
      "ph-crtdomain.info": "at-or-before",
      "ph-work.info": "at-or-before",
      "pharmainfo.azurewebsites.net": "at-or-before",
      "platinum-cnt.info": "at-or-before",
      "pnl-worth.online": "at-or-before",
      "populationnote.com": "at-or-before",
      "prj-pa.info": "at-or-before",
      "prj-ph.info": "at-or-before",
      "proctor-custodian.site": "at-or-before",
      "profile.arizonaclub.me": "at-or-before",
      "profile.best85best.online": "at-or-before",
      "proof-video.online": "at-or-before",
      "prt-max.online": "at-or-before",
      "ptr-cc.online": "at-or-before",
      "publicreservoir.info": "at-or-before",
      "ques-tion-ing.xyz": "at-or-before",
      "quickmath-solver.site": "at-or-before",
      "randcorp.onlyoffice.com": "at-or-before",
      "rap-art.info": "at-or-before",
      "rb1chesid8.ocry.com": "at-or-before",
      "rb2chesid8.otzo.com": "at-or-before",
      "rb4chesid8.serveuser.com": "at-or-before",
      "rbconline-support.info": "at-or-before",
      "reading-course.online": "at-or-before",
      "redfoxteeth.site": "at-or-before",
      "redirect-review.online": "at-or-before",
      "reg-d.info": "at-or-before",
      "reproduce.outstanding.revstoragefile.site": "at-or-before",
      "research-storage.com": "at-or-before",
      "revstoragefil.ddns.net": "at-or-before",
      "revstoragefile.ddns.net": "at-or-before",
      "revstoragefile.site": "at-or-before",
      "rheinmetall.careers-hub.org": "at-or-before",
      "rheinmetall.careersworld.org": "at-or-before",
      "rheinmetall.gocareers.org": "at-or-before",
      "rheinmetall.theworldcareers.com": "at-or-before",
      "rheinmetallcareer.com": "at-or-before",
      "rheinmetallcareer.onlyoffice.com": "at-or-before",
      "rheinmetallcareer.org": "at-or-before",
      "rheinmetallcareers.com": "at-or-before",
      "ricardo-mell.online": "at-or-before",
      "richard-3th.online": "at-or-before",
      "right.arrow-click.info": "at-or-before",
      "robinthing123.online": "at-or-before",
      "rockhoster.net": "at-or-before",
      "rohand63.xyz": "at-or-before",
      "roland-cc.online": "at-or-before",
      "room-online.one": "at-or-before",
      "royalsoul.online": "at-or-before",
      "rpcconnection.azurewebsites.net": "at-or-before",
      "safe-lord.online": "at-or-before",
      "safrangroup-careers.com": "at-or-before",
      "sandbox.live-meet.blog": "at-or-before",
      "searchfilterapp.info": "at-or-before",
      "secnetdc.com": "at-or-before",
      "sejoinu.cc": "at-or-before",
      "send-feedback-296.azurewebsites.net": "at-or-before",
      "send-feedback-413.azurewebsites.net": "at-or-before",
      "send-feedback-838.azurewebsites.net": "at-or-before",
      "send-feedback.azurewebsites.net": "at-or-before",
      "sendly-ink.shop": "at-or-before",
      "services-update-check.azurewebsites.net": "at-or-before",
      "shadow-network.best": "at-or-before",
      "shaer-likn.store": "at-or-before",
      "share.veracity-revision.info": "at-or-before",
      "shopleta.ru": "at-or-before",
      "short-abbreviate.info": "at-or-before",
      "shorten-abbreviate.ddns.net": "at-or-before",
      "shorten-abbreviate.site": "at-or-before",
      "shortener-abbreviate.info": "at-or-before",
      "shortener.ddns.net": "at-or-before",
      "shorter.kozow.com": "at-or-before",
      "shortfile-interactive.webredirect.org": "at-or-before",
      "shortlycc.site": "at-or-before",
      "show-verify.xyz": "at-or-before",
      "shrtlink.space": "at-or-before",
      "shrtlnk.info": "at-or-before",
      "signin-identifi.com": "at-or-before",
      "sites.bounceme.net": "at-or-before",
      "sky-writer.online": "at-or-before",
      "smartapptools.azurewebsites.net": "at-or-before",
      "smartmediq.azurewebsites.net": "at-or-before",
      "smtp.amg-car-ger.info": "at-or-before",
      "snap-short.online": "at-or-before",
      "socks.beauty": "at-or-before",
      "spring-club.info": "at-or-before",
      "stablis.online": "at-or-before",
      "stadium-fresh.online": "at-or-before",
      "starmanblind.ddns.net": "at-or-before",
      "stats.live-meet.blog": "at-or-before",
      "steve-brown.info": "at-or-before",
      "storagewiz.co.azurewebsites.net": "at-or-before",
      "storm-wave.online": "at-or-before",
      "suite-moral.info": "at-or-before",
      "sulumorbusinessservices.com": "at-or-before",
      "superlite.online": "at-or-before",
      "superset.sandbox.live-meet.blog": "at-or-before",
      "supervisor-protector.online": "at-or-before",
      "symptom-recordchecker.azurewebsites.net": "at-or-before",
      "systemmedicaleducation.azurewebsites.net": "at-or-before",
      "tacticalsnap.eastus.cloudapp.azure.com": "at-or-before",
      "talenthumanresourcestalent.com": "at-or-before",
      "teammate-live.online": "at-or-before",
      "tecret.com": "at-or-before",
      "telehealthconnectpro.azurewebsites.net": "at-or-before",
      "telespazio-careers.com": "at-or-before",
      "tensore.online": "at-or-before",
      "tepbit.site": "at-or-before",
      "termite.nu": "at-or-before",
      "teslator.online": "at-or-before",
      "thecareershub.org": "at-or-before",
      "thecloudappbox.azurewebsites.net": "at-or-before",
      "therashelter.azurewebsites.net": "at-or-before",
      "thetacticstore.com": "at-or-before",
      "theworldcareers.com": "at-or-before",
      "thomas-mark.xyz": "at-or-before",
      "timtechlab.duckdns.org": "at-or-before",
      "tinygo.duckdns.org": "at-or-before",
      "tomas-company.online": "at-or-before",
      "toolfare.online": "at-or-before",
      "top-game.online": "at-or-before",
      "totalcaremedcenter.azurewebsites.net": "at-or-before",
      "tracking.ns02.info": "at-or-before",
      "traveltipspage.com": "at-or-before",
      "trustedcarehub360.azurewebsites.net": "at-or-before",
      "turbulencemd.azurewebsites.net": "at-or-before",
      "uavnodes.com": "at-or-before",
      "ude-final.online": "at-or-before",
      "update-health-service.azurewebsites.net": "at-or-before",
      "updatedisplacement.ddns.net": "at-or-before",
      "usa-careers.com": "at-or-before",
      "ventilateainest.azurewebsites.net": "at-or-before",
      "veracity-revision.info": "at-or-before",
      "verify-publisher.azurewebsites.net": "at-or-before",
      "verifymeet.live": "at-or-before",
      "video-connect.online": "at-or-before",
      "videozoom.ddns.net": "at-or-before",
      "viewfileitems.myftp.org": "at-or-before",
      "viliam-live-identity.online": "at-or-before",
      "viliam.albert-company.online": "at-or-before",
      "viliam.alpha-meet.online": "at-or-before",
      "viliam.alpha-met.online": "at-or-before",
      "viliam.arcanet.online": "at-or-before",
      "viliam.azdava.online": "at-or-before",
      "viliam.besatoo.online": "at-or-before",
      "viliam.cnt-worth.online": "at-or-before",
      "viliam.connect-room.online": "at-or-before",
      "viliam.cppsg.online": "at-or-before",
      "viliam.crysus-h.info": "at-or-before",
      "viliam.dmn-for-car.online": "at-or-before",
      "viliam.dmn-inter.online": "at-or-before",
      "viliam.exir-juice.online": "at-or-before",
      "viliam.goods-companies.online": "at-or-before",
      "viliam.hrd-dmn.info": "at-or-before",
      "viliam.human-fly900.online": "at-or-before",
      "viliam.into-support.online": "at-or-before",
      "viliam.kuret-live.online": "at-or-before",
      "viliam.kuret-met.online": "at-or-before",
      "viliam.live-board.online": "at-or-before",
      "viliam.live-coaching.online": "at-or-before",
      "viliam.live-conn.online": "at-or-before",
      "viliam.look-together-online.online": "at-or-before",
      "viliam.lynda-tricks.online": "at-or-before",
      "viliam.meet-work.info": "at-or-before",
      "viliam.message-live.online": "at-or-before",
      "viliam.nsim-ph.info": "at-or-before",
      "viliam.ntp-clock-h.info": "at-or-before",
      "viliam.online-room.online": "at-or-before",
      "viliam.online-speak.online": "at-or-before",
      "viliam.owner-rate.online": "at-or-before",
      "viliam.p-safe.online": "at-or-before",
      "viliam.ph-crtdomain.info": "at-or-before",
      "viliam.platinum-cnt.info": "at-or-before",
      "viliam.prj-ph.info": "at-or-before",
      "viliam.prt-max.online": "at-or-before",
      "viliam.richard-3th.online": "at-or-before",
      "viliam.robinthing123.online": "at-or-before",
      "viliam.rohand63.xyz": "at-or-before",
      "viliam.roland-cc.online": "at-or-before",
      "viliam.safe-lord.online": "at-or-before",
      "viliam.steve-brown.info": "at-or-before",
      "viliam.superlite.online": "at-or-before",
      "viliam.tensore.online": "at-or-before",
      "viliam.teslator.online": "at-or-before",
      "viliam.toolfare.online": "at-or-before",
      "viliam.viliam-live-identity.online": "at-or-before",
      "viliam.warning-d.info": "at-or-before",
      "viliam.wer-d.info": "at-or-before",
      "viliam.white-life-bl.info": "at-or-before",
      "viliam.work-meeting.info": "at-or-before",
      "viliam.yamal-group.online": "at-or-before",
      "villiam.online-speak.online": "at-or-before",
      "violet.backback.info": "at-or-before",
      "virgomarketingsolutions.com": "at-or-before",
      "virgomarketingsolutions.comtions.com": "at-or-before",
      "virtualcliniczone.azurewebsites.net": "at-or-before",
      "vitatechlink.azurewebsites.net": "at-or-before",
      "vitatechlinks.azurewebsites.net": "at-or-before",
      "warning-d.info": "at-or-before",
      "warplogic.pro": "at-or-before",
      "wash-less.online": "at-or-before",
      "websites.freemyip.com": "at-or-before",
      "wellnessfirstgroup.azurewebsites.net": "at-or-before",
      "wellnessglowluth.azurewebsites.net": "at-or-before",
      "wer-d.info": "at-or-before",
      "white-car.online": "at-or-before",
      "white-life-bl.info": "at-or-before",
      "white-life.info": "at-or-before",
      "wood-house.online": "at-or-before",
      "word-course.online": "at-or-before",
      "work-meeting.info": "at-or-before",
      "world-shop.online": "at-or-before",
      "worldcareers.org": "at-or-before",
      "wwwlmeetic.com": "at-or-before",
      "yamal-group.online": "at-or-before",
      "yourfamilymdclinic.azurewebsites.net": "at-or-before",
      "zerogmed.azurewebsites.net": "at-or-before",
      "zra-roll.online": "at-or-before",
      "zytonhealth.com": "at-or-before"
    },
    "ipv4": {
      "103.57.251.153:2000": "at-or-before",
      "103.57.251.153:443": "at-or-before",
      "179.43.177.130:3333": "at-or-before",
      "212.175.168.58:443": "at-or-before",
      "94.156.128.60:5252": "at-or-before"
    },
    "url": {
      "http://185.132.176.240": "at-or-before",
      "http://185.153.197.236": "at-or-before",
      "http://212.175.168.58": "at-or-before"
    },
    "url_path": {}
  },
  "first_seen_range": {
    "earliest": "2016-03-09",
    "latest": "2026-07-29"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "012mail-net-uwclogin.ml",
      "0brandaeyes0.xyz",
      "0standavalue0.xyz",
      "0storageatools0.xyz",
      "1drv.casa",
      "1drv.cyou",
      "1drv.icu",
      "1drv.live",
      "1drv.online",
      "1drv.surf",
      "1drv.xyz",
      "1stemployer.com",
      "1stl.ink",
      "30min-ergmeeting.com",
      "30min-ergmeeting.net",
      "30min-smartsight-hr.com",
      "30min-smartsight.com",
      "30min-ziprecruiter.com",
      "30min-ziprecruiterhr.com",
      "30minmeeting-quality.com",
      "30minmeetinghr.com",
      "30minziprecruiterhr.net",
      "3dauth.live",
      "3dconfirrnation.com",
      "8475.freelancedeveloper.site",
      "8ghefkwdvbfdsg3asdf1.com",
      "academy-update.com",
      "accesscheckout.online",
      "accessverification.online",
      "acconut-mail.com",
      "acconut-signin.com",
      "acconut-verify.com",
      "account-customerservice.com",
      "account-drive.com",
      "account-dropbox.net",
      "account-google.co",
      "account-log-user-verify-mail.com",
      "account-login.net",
      "account-logins.com",
      "account-permission-mail-user.com",
      "account-profile-users.info",
      "account-servicemanagement.info",
      "account-servicerecovery.com",
      "account-servieemanagement.info",
      "account-signin-myaccount-users.ga",
      "account-signin.com",
      "account-siqnin.com",
      "account-support-user.com",
      "account-user-permission-account.com",
      "account-user-verify-mail.com",
      "account-user.com",
      "account-users-mail.com",
      "account-verifiy.net",
      "accountroyal.com",
      "accounts-apple.com",
      "accounts-drive.com",
      "accounts-googelmail.com",
      "accounts-googelmails.com",
      "accounts-logins.net",
      "accounts-mails.com",
      "accounts-manager.info",
      "accounts-service.support",
      "accounts-support.services",
      "accounts-web-maii.com",
      "accounts-web-mail.com",
      "accounts-yahoo.us",
      "accounts.google.live-meet.blog",
      "accounts.google.live-meet.cfd",
      "accounts.google.live-meet.cloud",
      "accounts.google.live-meet.info",
      "accounts.google.network-show.online",
      "accountservice.support",
      "accountsrecovery.ddns.net",
      "accountsservice-support.com",
      "accountts-google.com",
      "accredit-navigation.online",
      "accredit-validity.ddns.net",
      "accredit-validity.online",
      "accredit.network",
      "accredit.validity.werifcattion.info",
      "accunt-loqin.ml",
      "accurate-sprout-porpoise.glitch.me",
      "accurateprivacy.online",
      "ace-capitalpartners.ddns.net",
      "acounts-qooqie-con.ml",
      "activeeditor.info",
      "activehealthlab.azurewebsites.net",
      "activespiritluth.eastus.cloudapp.azure.com",
      "activities-recovery-options.info",
      "activities-servicesnotification.info",
      "activity-confirmationservice.info",
      "activity-session-recovery.info",
      "actor.rap-art.info",
      "acupuncturebentonville.com",
      "adams-cooling.online",
      "addons-mozilla.download",
      "admin-stable-right.top",
      "admin.cheap-case.site",
      "admiscion.online",
      "admit-roar-frame.top",
      "advission.online",
      "aecert.org",
      "aeroclinicit.azurewebsites.net",
      "aeroconf2014.org",
      "aerospace2014.org",
      "affect-fist-ton.online",
      "africanblackwidow.ddns.net",
      "agentappservice.ddns.net",
      "agm-rto-ewi.com",
      "aipak.org",
      "aiqac.org",
      "airbus-careers.onlyoffice.com",
      "airbus-survay.onlyoffice.com",
      "airbus.careers-portal.org",
      "airbus.careersworld.org",
      "airbus.germanywork.org",
      "airbus.global-careers.com",
      "airbus.usa-careers.com",
      "airbusaerodefence.com",
      "airbusaerodefence.nl",
      "airbusgroup-careers.com",
      "airbushiring.com",
      "airconnectionapi.azurewebsites.net",
      "airconnectionsapi.azurewebsites.net",
      "airconnectionsapijson.azurewebsites.net",
      "airgadgetsolution.azurewebsites.net",
      "airgadgetsolutions.azurewebsites.net",
      "airmdsolutions.azurewebsites.net",
      "airtravellog.com",
      "albert-company.online",
      "alex-mendez-fire.info",
      "alharbitelecom.co",
      "alison624.online",
      "all-for-city.info",
      "allocationwithour.info",
      "alpha-man.info",
      "alpha-meet.online",
      "alpha-met.online",
      "altnametestapi.azurewebsites.net",
      "alwayslivehealthy.com",
      "ameen-alkhalij.com",
      "ameen-alkhalij.is",
      "ameen-alkhalij.nu",
      "ameen-alkhalij.org",
      "ameen-alkhalij.se",
      "amg-car-ger.info",
      "analytics-google.org",
      "anna-blog.info",
      "answerssurveytest.azurewebsites.net",
      "anteromarketing.com",
      "anymediaapp.com",
      "aol-mail-account.com",
      "apache-utility.com",
      "api.cheap-case.site",
      "api.neexportfolio.com",
      "api.overall-continuing.site",
      "app-documents.com",
      "app-engage-station.help",
      "app-facebook.co",
      "app.cheap-case.site",
      "app.hostedlayer.com",
      "app.neexportfolio.com",
      "apphrquestion.azurewebsites.net",
      "apphrquestions.azurewebsites.net",
      "apphrquizapi.azurewebsites.net",
      "apple-ads-metric.com",
      "apple.beta-man.info",
      "appleid.com.co",
      "apply-jobs.com",
      "applytalents.com",
      "appslocallogin.online",
      "april.spring-club.info",
      "araamco.com",
      "arabiccountriestalent.azurewebsites.net",
      "arabiccountriestalent.com",
      "arabiccountriestalenthr.azurewebsites.net",
      "arabiccountriestalents.azurewebsites.net",
      "arabiccountriestalentshr.azurewebsites.net",
      "arcanet.online",
      "archery.dedyn.io",
      "archive-center.com",
      "archiverepositories.xyz",
      "arizonaclub.me",
      "arquestions.azurewebsites.net",
      "arquestionsapi.azurewebsites.net",
      "arrow-click.info",
      "asiandefenses.com",
      "aspenlnstitute.org",
      "asus-support.net",
      "asus-update.com",
      "asylimed.azurewebsites.net",
      "atlantic-council.com",
      "atlanticconucil.org",
      "atlanticcuoncil.com",
      "attacker-domain.com",
      "audiomanagerapi.azurewebsites.net",
      "audioservicetestapi.azurewebsites.net",
      "auto-updater.azurewebsites.net",
      "autoupdate.uk",
      "avid-striking-eagerness.online",
      "azadijobs.me",
      "azadlliq.info",
      "azdava.online",
      "backback.info",
      "backend.cheap-case.site",
      "background-update.azurewebsites.net",
      "backsrv66.azurewebsites.net",
      "backsrv74.azurewebsites.net",
      "bahaius.info",
      "bailment.org",
      "baochinhphu.org",
      "basementofdarkness.ddns.net",
      "bbmovements.com",
      "bc-app.orgdatasolutions.com",
      "bdroyer.webredirect.org",
      "beape.live",
      "beasze.live",
      "beaviews.online",
      "becker624.online",
      "beeasaze.top",
      "beetly.online",
      "benefitsredington.ddns.net",
      "beparas.com",
      "berozkhodro.com",
      "besatoo.online",
      "best85best.online",
      "bestshopu.online",
      "besvision.top",
      "beta-man.info",
      "bilal1com.com",
      "biolinksystems.azurewebsites.net",
      "birngthemhomenow.co.il",
      "bitly.org.il",
      "black-friday-store.online",
      "blackturtle.hopto.org",
      "blognewsalphaapijson.azurewebsites.net",
      "blogvolleyballstatus.azurewebsites.net",
      "blogvolleyballstatusapi.azurewebsites.net",
      "bloom-flatter-affably.top",
      "bmw.amg-car-ger.info",
      "bnt2.live",
      "bodywellnessbycynthia.com",
      "boeing-careers.com",
      "boeinginformation.onlyoffice.com",
      "boeingspace.com",
      "boeisurveyapplications.azurewebsites.net",
      "bonny-marvels-authentic.top",
      "book-archivecenter.bid",
      "book-handwrite.online",
      "book.anna-blog.info",
      "book.kuret-live.online",
      "booking.microsoftcalendars.com",
      "booking.mountainsgate.com",
      "booking.virtualdeskflowr.com",
      "bookings.hcpassociation.com.au",
      "bookmenow.info",
      "books-archivecenter.bid",
      "books-archivecenter.club",
      "books-google.books-archivecenter.bid",
      "books-view.com",
      "bookstoragestore.com",
      "boom-boom.ga",
      "bootstrap.serveftp.com",
      "bouncer.qc.to",
      "boundary.cfd",
      "bq-ledmagic.online",
      "bracs-lion.online",
      "brannew-home.info",
      "britishnews.com.co",
      "britishnews.org",
      "briview.online",
      "broadcastbritishnews.com",
      "broadcastnews.pro",
      "brookings-edu.in",
      "brookings.email",
      "browsercheckap.azurewebsites.net",
      "browsercheckingapi.azurewebsites.net",
      "browsercheckjson.azurewebsites.net",
      "budgetingscheduler.pages.dev",
      "buisness-centeral-transportation.azurewebsites.net",
      "buisness-centeral-transportation.com",
      "buisness-centeral.azurewebsites.net",
      "bulk-approach.site",
      "business-deegital.azurewebsites.net",
      "business-deegital.com",
      "business-startup.azurewebsites.net",
      "business-startup.org",
      "businessdeegital.azurewebsites.net",
      "businessinssider.org",
      "businesslnsider.org",
      "businesslocked.com",
      "businessmixture.com",
      "businessstartup.azurewebsites.net",
      "bvio85.info",
      "bytli.ink",
      "bytli.us",
      "cacademy-update.com",
      "cache-cleaner-check-111.azurewebsites.net",
      "cache-cleaner-check-805.azurewebsites.net",
      "cache-cleaner-check-926.azurewebsites.net",
      "cache-cleaner-check.azurewebsites.net",
      "cache-managment.northeurope.cloudapp.azure.com",
      "calendar-cn8.pages.dev",
      "calendar.fractionalleverage.com",
      "callfeedback.duia.ro",
      "canvas-life.me",
      "cardiomedspecialists.azurewebsites.net",
      "cards.ohana-village.org",
      "carebytesolutions.azurewebsites.net",
      "careers-finder.com",
      "careers-hub.org",
      "careers-portal.org",
      "careers2find.com",
      "careersworld.org",
      "carservices.dns-dynamic.net",
      "cashcloudservices.com",
      "cavinet.org",
      "cc-newton.info",
      "ccreservoir.info",
      "cdn-workspacestudio.redirectme.net",
      "cdn.careers2find.com",
      "cdsa.xyz",
      "centrallibrary.bounceme.net",
      "centrallibrary.info",
      "chakracleansetherapy.com",
      "challengechampions.ddns.net",
      "change-mail-account-nodes-permision.com",
      "change-mail-accounting-register-single.com",
      "change-permission-mail-user-managment.com",
      "change-user-account-mail-permission.com",
      "changequestionstypeapi.azurewebsites.net",
      "changequestionstypejsonapi.azurewebsites.net",
      "changequestiontypes.azurewebsites.net",
      "changequestiontypesapi.azurewebsites.net",
      "channel-shop.manage-tech.club",
      "chapter1.cc-newton.info",
      "chatsynctransfer.info",
      "cheap-case.site",
      "check-backup-service-179.azurewebsites.net",
      "check-backup-service-288.azurewebsites.net",
      "check-backup-service-736.azurewebsites.net",
      "check-backup-service.azurewebsites.net",
      "check-control-panel.live",
      "check-fa-pane.live",
      "check-online-panel.live",
      "check-pabnel-status.live",
      "check-panel-account.icu",
      "check-panel-live.icu",
      "check-panel-status.live",
      "check-reload-page.live",
      "check-reload-page.xyz",
      "check-security-update.azurewebsites.net",
      "check-short-panel.live",
      "checkapicountryquestions.azurewebsites.net",
      "checkapicountryquestionsjson.azurewebsites.net",
      "checking-paneling.live",
      "checkservicecustomerapi.azurewebsites.net",
      "checkup.webredirect.org",
      "cholyicker.ddns.net",
      "chrome-up.date",
      "city-splash.online",
      "clame-rade.online",
      "clarification.network",
      "cld-global.com",
      "clearmindhealthandwellness.com",
      "click-choose-figured.cfd",
      "click-manage-room.cfd",
      "clinichaven.azurewebsites.net",
      "cloth-model.blog",
      "clothes-show.online",
      "cloud-document-edit.onrender.com",
      "cloud.qc.to",
      "cloudarchive.info",
      "cloudaskingquestioning.azurewebsites.net",
      "cloudaskingquestioning.azurewebsites.net.net",
      "cloudaskingquestions.azurewebsites.net.net",
      "cloudaskingquestions.eastus.cloudapp.azure.com",
      "cloudaskingquestions.eastus.cloudapp.azure.com.net",
      "cloudaskquestionanswers.azurewebsites.net",
      "cloudaskquestionanswers.azurewebsites.net.net",
      "cloudaskquestionanswers.com",
      "cloudaskquestionanswers.com.net",
      "cloudaskquestioning.eastus.cloudapp.azure.com",
      "cloudaskquestioning.eastus.cloudapp.azure.com.net",
      "cloudcomputing.webredirect.org",
      "cloudgoogle.co",
      "cloudregionpages.info",
      "cloudtools.duia.eu",
      "cloudtransferfile.info",
      "cloudviewer.site",
      "cnt-worth.online",
      "codeconfirm-recovery.bid",
      "codeconfirm-recovery.club",
      "codzienniefita.info",
      "codzienniefity.info",
      "coffeeonlineshop.azurewebsites.net",
      "coffeeonlineshoping.azurewebsites.net",
      "coldwarehexahash.dns-dynamic.net",
      "collab.vaf.ai",
      "collaboromarketing.com",
      "com-254514785965.site",
      "com-3654623478192.site",
      "com-5464825879854.site",
      "com-account-login.com",
      "com-accountidentifier.info",
      "com-accountrecovery.bid",
      "com-accountsecure-recovery.name",
      "com-accountsrecovery.name",
      "com-activities.site",
      "com-apk-6712qw123asd8awf7.site",
      "com-archive.site",
      "com-archivecenter.work",
      "com-customeradduser.bid",
      "com-customerservice.bid",
      "com-customerservice.name",
      "com-customerservices.name",
      "com-customersuperuser.bid",
      "com-download.ml",
      "com-identifier-servicelog.info",
      "com-identifier-servicelog.name",
      "com-identifier-servlcelog.name",
      "com-identifier.site",
      "com-mailbox.com",
      "com-manage-accountuser.club",
      "com-messagecenter.bid",
      "com-messengerservice.bid",
      "com-messengerservice.work",
      "com-microsoftonline.club",
      "com-myaccuants.com",
      "com-mychannel.bid",
      "com-orginal-links.ga",
      "com-posts6712qw12387.site",
      "com-privacy-help.info",
      "com-recoversessions.bid",
      "com-recovery.com",
      "com-recovery.site",
      "com-recoveryadduser.bid",
      "com-recoveryidentifier.bid",
      "com-recoveryidentifier.name",
      "com-recoveryidentifiers.bid",
      "com-recoverymail.bid",
      "com-recoverysecureuser.club",
      "com-recoverysecureusers.club",
      "com-recoveryservice.bid",
      "com-recoveryservice.info",
      "com-recoverysessions.bid",
      "com-recoverysubusers.bid",
      "com-recoverysuperuser.bid",
      "com-recoverysuperuser.club",
      "com-recoverysuperuser.name",
      "com-recoverysuperusers.bid",
      "com-recoverysupport.bid",
      "com-recoverysupport.club",
      "com-service.gq",
      "com-service.net",
      "com-servicecustomer.bid",
      "com-servicecustomer.name",
      "com-servicemail.bid",
      "com-servicerecovery.bid",
      "com-servicerecovery.club",
      "com-servicerecovery.info",
      "com-servicerecovery.name",
      "com-servicescustomer.name",
      "com-serviceslogin.com",
      "com-session.site",
      "com-sessionidentifier.info",
      "com-sessions.site",
      "com-showvideo.ga",
      "com-showvideo.gq",
      "com-statistics.com",
      "com-stats.com",
      "com-useraccount.info",
      "com-users.net",
      "com-verifications.site",
      "com-video.net",
      "com-videoservice.work",
      "com-viewchannel.club",
      "comidentifier-servicelog.name",
      "commercialstudio.ddns.net",
      "compact-miracle-abounds.top",
      "complete-telecom-operation.top",
      "computerlearning.ddns.net",
      "conferencecall.live",
      "configtools.linkpc.net",
      "confirm-direction.ddns.net",
      "confirm-identity.info",
      "confirm-identity.site",
      "confirm-integrity.ddns.net",
      "confirm-session-identification.info",
      "confirm-session-identifier.info",
      "confirm-sessionidentification.info",
      "confirm-validation.ddns.net",
      "confirm-validation.mywire.org",
      "confirm-validity.hopto.org",
      "confirm-verify.servepics.com",
      "confirmation-process.top",
      "confirmation-recoveryoptions.info",
      "confirmation-service.info",
      "confirmation-users-service.info",
      "confirmation-users-servlee.info",
      "confirmation-verify.hopto.org",
      "confirrnation.info",
      "conn-ectionor.cfd",
      "connect-room.online",
      "connectairapijson.azurewebsites.net",
      "connection-view.online",
      "connectionhandlerapi.azurewebsites.net",
      "consistent-provisioned.accesscam.org",
      "contentpreview.redirectme.net",
      "continue-recognized.ddns.net",
      "continue-recognized.hopto.org",
      "continue-recognized.online",
      "continue-session-identifier.info",
      "continue-sesslon-identifier.info",
      "continue-short.ddns.net",
      "continue-to-your-account.000webhostapp.com",
      "continue.duia.eu",
      "continueresource.forumz.info",
      "continuetogo.me",
      "continueworkflow.onthewifi.com",
      "conveniente-sharefile.info",
      "cook-tips.info",
      "coordinate.icu",
      "coral-polydactyl-dragonfruit.glitch.me",
      "correction.verify.rsession.site",
      "cortanaservice.com",
      "cortanaupdate.co",
      "countrybasedquestions.azurewebsites.net",
      "course-math.info",
      "cover-home-page.xyz",
      "cover-home-panel.xyz",
      "covi19questionaire.000webhostapp.com",
      "covid19questionnaire.freesite.vip",
      "cpanel-services.site",
      "cppsg.online",
      "crcperss.com",
      "createformquestionshelper.com",
      "createformquestionshelper.com.net",
      "creating-loceer.ddns.net",
      "cresearch-storage.com",
      "crimson-peaks.com",
      "crysus-h.info",
      "crysus-p.info",
      "csearchfilterapp.info",
      "csm-group.org",
      "cspvpn.duckdns.org",
      "css-ethz.ch",
      "cstoddart-meeting-scheduler.firebaseapp.com",
      "currentpageeditor.dns-dynamic.net",
      "customer-certificate.com",
      "customer-identifier.site",
      "customer-recovery.info",
      "customer-reminder.info",
      "customer-session.site",
      "customercareservice.azurewebsites.net",
      "customercareserviceapi.azurewebsites.net",
      "customers-activities.info",
      "customers-activities.site",
      "customers-activity.site",
      "customers-manager.info",
      "customers-recovery.site",
      "customers-reminder.info",
      "customers-service.ddns.net",
      "customers-services.info",
      "customize-identity.info",
      "cutly.biz",
      "cutly.vip",
      "cvcreate.org",
      "cvisiion.online",
      "cybercourt.io",
      "cyberflood.io",
      "cyberlattice.pro",
      "d75.site",
      "daemon-mailer.co",
      "daemon-mailer.com",
      "daemon-mailer.info",
      "damavand-hr.me",
      "damkahill.com",
      "darakeh.me",
      "dash.shortoni.live",
      "data.live-meet.blog",
      "datasheet96.azurewebsites.net",
      "dazedebtor.com",
      "db.qc.to",
      "de-ma.online",
      "decorous-super-blender.glitch.me",
      "deepspaceocean.info",
      "deepthinkingroom.ddns.net",
      "deersharpfork.info",
      "defenderupdate.ddns.net",
      "demo-meeting.captello.com",
      "demo.cheap-case.site",
      "destinationreferrer.serveirc.com",
      "destinationzone.duia.eu",
      "deutcshewelle.com",
      "deutcshewelle.org",
      "dev.cheap-case.site",
      "developer-app.xyz",
      "dhs-us.org",
      "differentintegrated.ddns.net",
      "digicura.azurewebsites.net",
      "digitalpufferfish.ddns.net",
      "digitalqlobe.com",
      "digithealthplatform.azurewebsites.net",
      "direct-access.info",
      "direct-view-check.live",
      "direct-view-panel.xyz",
      "directfileinternal.info",
      "direction-check.online",
      "direction-session-verify.site",
      "direction-veracity.ddns.net",
      "directpathfellow.zapto.org",
      "discovery-protocol.ml",
      "display-error-runtime.com",
      "display-ganavaro-abrashimchi.com",
      "dloffice.buzz",
      "dloffice.top",
      "dmn-for-car.online",
      "dmn-for-hall.online",
      "dmn-inter.online",
      "dn.neexportfolio.com",
      "dnx.capital",
      "doc-viewer.com",
      "doceditor.duckdns.org",
      "docfileview.org",
      "docs-google.co",
      "docspace-twpf0e.onlyoffice.com",
      "docspace-y4cumb.onlyoffice.com",
      "doctorconsult-app.azurewebsites.net",
      "doctransfer.online",
      "document-share.info",
      "document-sharing.online",
      "document-supportsharing.bid",
      "documentcloudeditor.ddnsgeek.com",
      "documentofficupdate.info",
      "documents-supportsharing.bid",
      "documents-supportsharing.club",
      "documents.sytes.net",
      "documentsfilesharing.cloud",
      "documentsharing.info",
      "door-black-meter.online",
      "download-link.top",
      "download-teamspeak.info",
      "dr-sup.live",
      "dream-jobs.org",
      "dream-jobs.vip",
      "dreamy-job.com",
      "dreamy-jobs.com",
      "dreamycareer.com",
      "drhealthyrecommends.com",
      "drive-acconut.com",
      "drive-acconuts.com",
      "drive-account.com",
      "drive-accounts.com",
      "drive-file-share.site",
      "drive-login.cf",
      "drive-permission-user-account.com",
      "drive-useraccount-signin-mail.ga",
      "drives.googles.site",
      "droneflywell.com",
      "dronetechasia.org",
      "drop-box.vip",
      "dropebox.co",
      "duschedule.ibridgellc.com",
      "duuuumpy.click",
      "dynamiceventmanager.ddns.net",
      "dynamicrender.line.pm",
      "dynamicroute.serveirc.com",
      "dynamictranslator.ddnsgeek.com",
      "eand.cyvehx.com",
      "east-healthy-dress.glitch.me",
      "easymarketing101.com",
      "eatonthehotground.ddns.net",
      "ecomonist.org",
      "edge-cloudservices.com",
      "editioncloudfiles.dns-dynamic.net",
      "ehealthpsuluth.com",
      "elated-supportive-exultation.top",
      "elecresearch.org",
      "electrons-residingonthemoon.info",
      "elementshift.azurewebsites.net",
      "elitemaildelivery.info",
      "ell-safe.online",
      "em-payments-bot.duckdns.org",
      "email-daemon.biz",
      "email-daemon.biz.tinurls.com",
      "email-daemon.online",
      "email-daemon.online.tinurls.com",
      "email-daemon.site",
      "email-deiivery.info",
      "email-delivery.info",
      "email-protection.online",
      "embraer.co",
      "emiartas.com",
      "emiratescareers.org",
      "emiratescheckapi.azurewebsites.net",
      "emiratescheckapijson.azurewebsites.net",
      "emiratesgroup-careers.com",
      "empaymentsbot.duckdns.org",
      "emv1.allocationwithour.info",
      "emv1.brannew-home.info",
      "emv1.newsaboutecology.info",
      "emv1.short-jg934hw.live",
      "emv1.short-rigf.live",
      "emv1.statuss-short-join.live",
      "encryption-redirect.online",
      "endorsement-services.online",
      "enerflex.ddns.net",
      "enerflex.org",
      "engineeringrssfeed.azurewebsites.net",
      "engineeringssfeed.azurewebsites.net",
      "enhanceservicchecke.hopto.org",
      "enovation-affirm.theworkpc.com",
      "entrpreneur.org",
      "entryconfirmation.duckdns.org",
      "entrydirect.ddns.net",
      "eocnomist.com",
      "eom-microsoftonline.club",
      "eom-useraccount.info",
      "epibvgvoszemkwjnplyc.supabase.co",
      "error-exchange.com",
      "essential-guide.serveirc.com",
      "essential-overview.sytes.net",
      "essentialeditor.serveirc.com",
      "est5090.online",
      "etisalatonline.com",
      "eu-meeting.captello.com",
      "eursaia.org",
      "eustomers-activities.info",
      "eventer.ink",
      "everything-here.info",
      "exchtestchecking.azurewebsites.net",
      "exchtestcheckingapi.azurewebsites.net",
      "exchtestcheckingapihealth.azurewebsites.net",
      "exchtestcheckingapihealth.com",
      "exchtestcheckingapijson.azurewebsites.net",
      "exir-juice.online",
      "exnovin.org",
      "expandprocess.serveblog.net",
      "expressmarket.online",
      "exprogroup.org",
      "ez-calendar.vercel.app",
      "fanderfart22.xyz",
      "fardenfart2017.xyz",
      "fazadi.info",
      "fb-login.cf",
      "fbmro.com",
      "fdns1.duckdns.org",
      "featurespace.ooguy.com",
      "featurespace.serveblog.net",
      "file-access.com",
      "file-review.hopto.org",
      "filecloudmanager.site",
      "fileeditiontools.linkpc.net",
      "filemanager.theworkpc.com",
      "filereader.dns-dynamic.net",
      "filetransfer.club",
      "fileviewitems.myftp.org",
      "filevisitresult.site",
      "filterfiletransfer.hopto.org",
      "filtertransferfile.online",
      "finaledition.redirectme.net",
      "finance-usbnc.info",
      "first-course.online",
      "first-myshortel.ddns.net",
      "flash-adobe.org",
      "flashpointfarm.gotdns.ch",
      "flighthelicopterahtest.azurewebsites.net",
      "flow-exulltation-uplift.top",
      "flowerskindergarten.ddns.net",
      "flydubai-careers.com",
      "flydubaicareers.ae.org",
      "focusfusion.eastus.cloudapp.azure.com",
      "food-tips-blog.online",
      "foreiqnaffairs.com",
      "foreiqnaffairs.org",
      "forieqnaffairs.com",
      "form.redberyl.co",
      "form.ritwiksingh.com",
      "formcloud.redirectme.net",
      "fortune-retire-home.top",
      "frameforward.azurewebsites.net",
      "freahman.online",
      "freechess.live",
      "freeheadlines.top",
      "freshconnect.live",
      "friends.lizza-blog.info",
      "friends.thomas-mark.xyz",
      "front-cover-panel.xyz",
      "front-home-panel.xyz",
      "frostsullivan.org",
      "ftur-sher.online",
      "funeral-engineering-expression.top",
      "funnychess.online",
      "fuschia-rhinestone.cleverapps.io",
      "g-online.org",
      "g20saudi.000webhostapp.com",
      "gallery-shop.online",
      "gamershotel.pro",
      "gatestonelnstitute.org",
      "gc.n-e.kr",
      "gdrive-files.com",
      "geaviews.site",
      "germanywork.org",
      "get-ready.blog",
      "getadobe.ddns.net",
      "getadobe.net",
      "geticarefunds.com",
      "getsqldeveloper.com",
      "getsqldeveloper.it.com",
      "gettogether.quest",
      "giitials.tk",
      "gl-sup.online",
      "gle-mail.com",
      "global-careers.com",
      "global-check-business-it.azurewebsites.net",
      "global-check-itbusiness.azurewebsites.net",
      "global-it-checkbusiness.azurewebsites.net",
      "global-it-checkers.azurewebsites.net",
      "global-it-consultants.azurewebsites.net",
      "global-reds.com",
      "globalbusiness-checkers-it.azurewebsites.net",
      "globalit-consultants.azurewebsites.net",
      "globalitconsultants.azurewebsites.net",
      "globaltalent.in",
      "glory-uplift-vouch.online",
      "glorynewstoday.com",
      "gm-sup.com",
      "gmail-recovery.ml",
      "gmal.cf",
      "go-conversation.lol",
      "go-forward.quest",
      "go0gle.online",
      "gocareers.org",
      "golanjobs.me",
      "gomyfiles.info",
      "goo-gle.bid",
      "goo-gle.cloud",
      "goo-gle.mobi",
      "good-news.cfd",
      "good-news.fashion",
      "good-student.online",
      "goods-companies.online",
      "goog-le.bid",
      "google-mail-recovery.com",
      "google-mail.com.co",
      "google-profile.com",
      "google-profiles.com",
      "google-setting.com",
      "google-verification.com",
      "google-verify.com",
      "google-verify.net",
      "google.live-meet.blog",
      "google.live-meet.cfd",
      "google.live-meet.cloud",
      "google.live-meet.info",
      "google.network-show",
      "google.network-show.online",
      "google.onedriver-srv.ml",
      "googledomalns.com",
      "googlemails.co",
      "googles.site",
      "googleservices.co",
      "googleupdate.co",
      "green-light.bond",
      "group-google.com",
      "group-policy-update.azurewebsites.net",
      "grownehealth.eastus.cloudapp.azure.com",
      "gview.site",
      "happened.fun",
      "hardbookshelf.ooguy.com",
      "hardship-management.com",
      "hat-cast.com",
      "hb.pee5.me",
      "healsanctum.azurewebsites.net",
      "healthbodymonitoring.azurewebsites.net",
      "healthcare-azureapi.azurewebsites.net",
      "healthcarefluent.com",
      "healthcarezoom-centeral.azurewebsites.net",
      "healthcarezoomcenteral.azurewebsites.net",
      "healthcarezoomcenteral.org",
      "healthdataanalyticsrecord.azurewebsites.net",
      "healthiestmama.com",
      "healthinfusiontherapy.com",
      "healthy-lifestyle.fit",
      "heisonhisway.ddns.net",
      "helicopterahtest.azurewebsites.net",
      "helicopterahtests.azurewebsites.net",
      "helicoptersahtests.azurewebsites.net",
      "hello-planet.com",
      "help-recovery.com",
      "helpdesk-product.com",
      "helper.canvas-life.me",
      "highlightsreview.line.pm",
      "hiringarabicregion.azurewebsites.net",
      "hivemedtech.azurewebsites.net",
      "holyicker.ddns.net",
      "home-access.online",
      "home-reload-page.xyz",
      "homedirections.ddns.net",
      "homefurniture.azurewebsites.net",
      "homeinspections.ddns.net",
      "host-bulk-stack.cfd",
      "hot-mail.ml",
      "hotchichenfly.info",
      "hoticecream.ddns.net",
      "house-server-digital.xyz",
      "hrapplicationtest.azurewebsites.net",
      "hrd-dmn.info",
      "hu.yes1.me",
      "hugmefirstddd.ddns.net",
      "human-fly900.online",
      "humanresourcesapi.azurewebsites.net",
      "humanresourcesapijson.azurewebsites.net",
      "humanresourcesapiquiz.azurewebsites.net",
      "hyperv-heartbeat-service.azurewebsites.net",
      "i-love-tux.qc.to",
      "iaidevrssfeed.centralus.cloudapp.azure.com",
      "iaidevrssfeed.centrualus.cloudapp.azure.com",
      "iaidevrssfeed.cloudapp.azure.com",
      "iaidevrssfeedp.cloudapp.azure.com",
      "icegelato.ddns.net",
      "icenotebook.ddns.net",
      "id-bayan.com",
      "idccovid19questionaire.000webhostapp.com",
      "idea-home.online",
      "identifier-activities.info",
      "identifier-activities.online",
      "identifier-direct.ddns.net",
      "identifier-direction.site",
      "identifier-service-verify.site",
      "identifier-service.ddns.net",
      "identifier-services-session.site",
      "identifier-services-sessions.info",
      "identifier-session-recovery.site",
      "identifier-verify.ddns.net",
      "identify-user-session.info",
      "identifycheckapplication.azurewebsites.net",
      "identifycheckapplications.azurewebsites.net",
      "identifycheckingapplications.azurewebsites.net",
      "identity-session-recovery.site",
      "identity-session.ddns.net",
      "identity-verification-service.info",
      "ie.codzienniefita.info",
      "iforget-memail-user-account.com",
      "ifstate.page.link",
      "igsecurity.email",
      "il-cert.net",
      "ilengineeringrssfeed.azurewebsites.net",
      "implemen-tmeasures.myftp.org",
      "inbox-drive.info",
      "inbox-sharif.info",
      "indication-service.online",
      "infinit-world.info",
      "instagram-com.site",
      "integratedblognewfeed.azurewebsites.net",
      "integratedblognews.azurewebsites.net",
      "integratedblognewsapi.azurewebsites.com",
      "integratedblognewsapi.azurewebsites.net",
      "intel-update.com",
      "intelligence.live-meet.blog",
      "intelupdate.com",
      "intengineeringrssfeed.azurewebsites.net",
      "interactive-view.myftp.org",
      "interconnected-equipment-buildings.buzz",
      "intergratedblognewsapi.azurewebsites.net",
      "internationalbester.ddns.net",
      "into-support.online",
      "inztaqram.ga",
      "ip-194-11-226-29.rockhoster.net",
      "ipsss.000webhostapp.com",
      "ir-owa-accountservice.bid",
      "iranianuknews.com",
      "irnjobs.me",
      "isftyviliam.platinum-cnt.info",
      "isis-online.net",
      "islamicemojimaker.com",
      "ismywhs.com.de",
      "isra-help.org",
      "israel-talent.com",
      "israel-talent.xyz",
      "israelhayum.com",
      "it-service.men",
      "itemselectionmode.info",
      "jadehealthcenter.com",
      "jafferbrothers.developmint.xyz",
      "jamaat-ul-islam.com",
      "jamaatforallah.com",
      "jamaatforummah.com",
      "jamatapplication.com",
      "javaruntime.azurewebsites.net",
      "javaruntimestestapi.azurewebsites.net",
      "javaruntimetestapi.azurewebsites.net",
      "javaruntimeversionchecking.azurewebsites.net",
      "javaruntimeversioncheckingapi.azurewebsites.net",
      "javedpension.is-a-good.dev",
      "jewishjournal.us",
      "join-paneling.online",
      "joinboeing.com",
      "joincloud.duckdns.org",
      "joincloud.mypi.co",
      "joinoptimahr.com",
      "jomehjob.com",
      "jpost.press",
      "jpostpress.com",
      "jubilatesee.site",
      "jupyternotebookcollection.azurewebsites.net",
      "jupyternotebookcollections.azurewebsites.net",
      "jupyternotebookcollections.com",
      "jupyternotebookscollection.azurewebsites.net",
      "k2intelliqence.com",
      "kandovani.org",
      "kanplus.org",
      "kavkazru.press",
      "khaleejtimes.co",
      "khaleejtimes.org",
      "khalejtimes.org",
      "kia-customerservice.ddns.net",
      "kibanacore.com",
      "ksat20.000webhostapp.com",
      "ksview.top",
      "kuret-live.online",
      "kwhfibejjyxregxmnpcs.supabase.co",
      "last-check-leave.buzz",
      "lastfilterfile.info",
      "latest-tools.store",
      "latinoamericareporta.com",
      "launchmeetprofile.servehttp.com",
      "lenan-rex.online",
      "lensvisionary.azurewebsites.net",
      "leslettrespersanes.net",
      "lesson-first.info",
      "letsschedulethis.com",
      "lgupluscdn.com",
      "library-store.camdvr.org",
      "librarycollection.org",
      "licencemanagers.azurewebsites.net",
      "licencesupporting.azurewebsites.net",
      "licentiegegevens.ddns.net",
      "line-en.me",
      "lineeditor.001www.com",
      "lineeditor.32-b.it",
      "lineeditor.mypi.co",
      "linereview.duia.eu",
      "linkauthenticator.online",
      "linkedinz.me",
      "listen-books.com",
      "litby.us",
      "live-board.online",
      "live-coaching.online",
      "live-conn.online",
      "live-content.online",
      "live-gml.online",
      "live-join-short.online",
      "live-meet.blog",
      "live-meet.cfd",
      "live-meet.cloud",
      "live-meet.info",
      "live-meet.live",
      "live-message.online",
      "live-project-online.live",
      "live-projects-online.top",
      "live-redirect-system.top",
      "live.besatoo.online",
      "live.connect-room.online",
      "live.goods-companies.online",
      "live.live-coaching.online",
      "live.live-gml.online",
      "live.live-meet",
      "live.live-meet.cloud",
      "live.live-meet.info",
      "live.online-room.online",
      "live.platinum-cnt.info",
      "live.white-life-bl.info",
      "live.yamal-group.online",
      "lizza-blog.info",
      "load-panel.online",
      "loads-ideas.online",
      "localadmin.online",
      "localadmin.ru",
      "log-in-dropbox.com",
      "login-account-mail.com",
      "login-account.net",
      "login-again.ml",
      "login-gov.info",
      "login-required.ga",
      "login-users-account.site",
      "login.loginto.me",
      "logsapimanagement.azurewebsites.net",
      "logsapimanagements.azurewebsites.net",
      "logupdatemanagementapi.azurewebsites.net",
      "logupdatemanagementapijson.azurewebsites.net",
      "lonelymanshadow.ddns.net",
      "longlivefreedom.ddns.net",
      "look-together-online.online",
      "loriginal.online",
      "loss-modification.site",
      "lovetoflight.com",
      "lst-accurate.com",
      "ltf.world",
      "lukoil.in",
      "lynda-tricks.online",
      "m.neexportfolio.com",
      "m85.online",
      "maadinglobal.com",
      "maariv.net",
      "magic-delivery.info",
      "mail-account-register-recovery.com",
      "mail-newyorker.com",
      "mail-update.info",
      "mail-updateservice.info",
      "mail-yahoo.com.co",
      "mail.brannew-home.info",
      "mail.bvio85.info",
      "mail.jewishjournal.us",
      "mail.smart-sight-hr.com",
      "mailer-daemon-message.co",
      "mailer-daemon.co",
      "mailer-daemon.info",
      "mailer-daemon.live",
      "mailer-daemon.me",
      "mailer-daemon.net",
      "mailer-daemon.online",
      "mailer-daemon.org",
      "mailer-daemon.site",
      "mailer-daemon.us",
      "mailer-support.online",
      "mailerdaemon.info",
      "mailerdaemon.online",
      "maill-support.com",
      "mails-account-signin-users-permssion.com",
      "mailssender.bid",
      "mailupdate.com",
      "mailupdate.info",
      "main-packages.strangled.net",
      "mainrepo10.azurewebsites.net",
      "make-host-solution.buzz",
      "make-house.online",
      "makeit.lat",
      "malcolmrifkind.site",
      "malebachhew2506090936.onlyoffice.com",
      "manage-accounts.info",
      "manage-tech.club",
      "managetools-platform.azurewebsites.net",
      "manpowerfeedapi.azurewebsites.net",
      "manpowerfeedapijson.azurewebsites.net",
      "marineblogapi.azurewebsites.net",
      "market-account-login.net",
      "market.dedyn.io",
      "market.vinam.me",
      "marketinglw.com",
      "marsoxygen.azurewebsites.net",
      "master-club.info",
      "masterflexiblecloud.azurewebsites.net",
      "mastergatevpn.com",
      "matchtomeet.ddns.net",
      "maydaymed.azurewebsites.net",
      "mccainlnstitute.org",
      "mediasylum.azurewebsites.net",
      "medical-deepresearch.azurewebsites.net",
      "medicalit-imaging.azurewebsites.net",
      "medicoreit.azurewebsites.net",
      "medicpathsolutions.azurewebsites.net",
      "meet-online.site",
      "meet-room.site",
      "meet-work.info",
      "meet.13bytes.de",
      "meet.azdava.online",
      "meet.dynamicsmind.in",
      "meet.ell-safe.online",
      "meet.fruitcakemedia.co.uk",
      "meet.go0gle.online",
      "meet.proof-video.online",
      "meet.thijsblom.app",
      "meet.thijsblom.dev",
      "meet.video-connect.online",
      "meet.webdeploy.dev",
      "meetime.info",
      "meeting-invite.live",
      "meeting-room.live",
      "meeting-schedular-flame.vercel.app",
      "meeting-schedular.aptc.ricoh.com",
      "meeting-scheduler-ui.pages.dev",
      "meeting-scheduler.cloud",
      "meeting-scheduler.co.uk",
      "meeting-scheduler.com",
      "meeting-scheduler.metal.kaldi.si",
      "meeting-scheduler.ncb.org",
      "meeting-scheduler.online",
      "meeting-scheduler.saetta.co.jp",
      "meeting-scheduler.tous33f.live",
      "meeting-scheduler.xyz",
      "meeting-scheduling.oldcountry.ai",
      "meeting-share.online",
      "meeting-space-scheduler-9946.taskade.app",
      "meeting-time.info",
      "meeting.captello.com",
      "meeting.dalqan.com",
      "meeting.ignsoftwares.in",
      "meeting.jackz.me",
      "meeting.wilawan.com",
      "meeting.xn--grnlund-b1a.net",
      "meetingonline.live",
      "meetings-demo.apigateway.co",
      "meetings-prod.apigateway.co",
      "meetings.dialexa.com",
      "meetings.fl2f.ca",
      "meetings.sabonzy.com",
      "meetings.xn--grnlund-b1a.net",
      "meetingscheduler.sandbox.aws.corp.cloud5.com",
      "meetingscheduler.servehttp.com",
      "meetingscheduler.thebeautymatcher.com",
      "meetingzone.info",
      "meetland.info",
      "meetonline.pro",
      "meetroomonlin1925.w3spaces.com",
      "meets.armankhan.me",
      "meets.armankhan.space",
      "mehrnews.info",
      "mentalhealth-support-portal.azurewebsites.net",
      "meot-roem.online",
      "message-live.online",
      "message-serviceprovider.info",
      "messagepending.info",
      "messageservice.bid",
      "messageservice.club",
      "metaemailsecurity.com",
      "metaemailsecurity.net",
      "metahelpservice.net",
      "metasecurityemail.org",
      "metasupportmail.co",
      "metasupportmail.com",
      "mfa-ic.ae",
      "mickel.besatoo.online",
      "mickel.connect-room.online",
      "mickel.goods-companies.online",
      "mickel.live-coaching.online",
      "mickel.platinum-cnt.info",
      "mickel.white-life-bl.info",
      "mickel.yamal-group.online",
      "microsoft-hotfix.com",
      "microsoft-update.bid",
      "microsoft-updateserver.cf",
      "microsoft-upgrade.mobi",
      "microsoft-utility.com",
      "microsoftcdn.co",
      "microsoftdefender.info",
      "microsoftedgesh.info",
      "microsoftexplorerservices.cloud",
      "microsoftinternetsafety.net",
      "microsoftsubsystem.com-adm.in",
      "mideasthiring.com",
      "mikel.yamal-group.online",
      "minascs.ddns.net",
      "minimumservicechek.ddns.net",
      "miniurl.duckdns.org",
      "mobile-activity-session.site",
      "mobile-airbnb.site",
      "mobile-check-activity.site",
      "mobile-messengerplus.network",
      "mobile-sessionid.customize-identity.info",
      "mobile-uber.site",
      "mobile.proctor-custodian.site",
      "mobile.shorten-abbreviate.site",
      "mobilecontinue.network",
      "mobiles-sessionid.customize-identity.info",
      "mobiletoolssdk.dns-dynamic.net",
      "modification-check.online",
      "modification-control.online",
      "modification-verify.ddns.net",
      "mofa-ic.ae",
      "mojavemassageandwellness.com",
      "monitor-ua.com",
      "moses-staff.io",
      "moses-staff.to",
      "mrz.fazadi.info",
      "ms.supermwario.com",
      "msn-center.uk",
      "msn-service.co",
      "msnapp.help",
      "msnapp.live",
      "msnclouds.com",
      "msnl.ink",
      "msnotetask-insights.azurewebsites.net",
      "msoffice-update.com",
      "msp.medatron.co",
      "mstrakcer-tools.azurewebsites.net",
      "mterview.site",
      "musalas.se",
      "mx0.jewishjournal.us",
      "my-healthequity.com",
      "my-mailcoil.ml",
      "my.abrdns.com",
      "myaccount-login.net",
      "myaccount-services.net",
      "myaccount-signin.com",
      "mychannel.ddns.net",
      "mycloudhosting.redirectme.net",
      "myconnect-support.com",
      "myprofileface.page.link",
      "myscreenname.bid",
      "myselfdatahistory.serveirc.com",
      "mywebdout.ddns.net",
      "nail-forward-valid.lol",
      "nanobreathe.azurewebsites.net",
      "nanomatrix.azurewebsites.net",
      "navigationtools.site",
      "ncgrassfed.com",
      "ndrrftqrlblfecpupppp.supabase.co",
      "neexportfolio.azurewebsites.net",
      "neexportfolio.com",
      "neexportfolio.eastus.cloudapp.azure.com",
      "network-game.xyz",
      "network-review.xyz",
      "network-show-a.online",
      "network-show.online",
      "neurocloudhq.azurewebsites.net",
      "news-onlines.info",
      "newsaboutecology.info",
      "newspedia.ddns.net",
      "nex1music.ml",
      "nextbox.line.pm",
      "nextcloud.duia.us",
      "nextcloudzone.dns-dynamic.net",
      "nextgenhealthtrack.azurewebsites.net",
      "niaconucil.org",
      "nice-goods.online",
      "node-dashboard.site",
      "node-panel.site",
      "normal-dmn.info",
      "notebooktextchecking.azurewebsites.net",
      "notebooktextcheckings.azurewebsites.net",
      "notebooktextcheckings.com",
      "notebooktexts.azurewebsites.net",
      "notification-accountrecovery.com",
      "notification-accountservice.com",
      "notification-accountservice.info",
      "notification-manager.info",
      "notification-managers.info",
      "notification-signal-agnecy.info",
      "notificationapp.info",
      "notifications-center.info",
      "notificatlon-signal-agnecy.info",
      "ns1.deutcshewelle.com",
      "ns1.jewishjournal.us",
      "ns2.allocationwithour.info",
      "ns2.brannew-home.info",
      "ns2.deutcshewelle.com",
      "ns2.freeheadlines.top",
      "ns2.jewishjournal.us",
      "ns2.newsaboutecology.info",
      "ns2.servicechecker.top",
      "nsdrive-phone.online",
      "nsim-pa.info",
      "nsim-ph.info",
      "nterview.site",
      "ntp-clock-h.info",
      "ntp-clock-p.info",
      "nvidia-support.com",
      "nvidia-update.com",
      "o5vdb.org",
      "oceanofinformation.ddns.net",
      "office-live-activity.icu",
      "office-shop.me",
      "office-updates.info",
      "office365calendar.com",
      "official-uploads.com",
      "officialswebsites.info",
      "ohana-village.org",
      "olemanage-dashboard.azurewebsites.net",
      "oletask-tracker.azurewebsites.net",
      "onedrive-signin.com",
      "onedrivelive.me",
      "onedriver-srv.ml",
      "onedriveupdate.net",
      "onequestions.azurewebsites.net",
      "onequestionsapi.azurewebsites.net",
      "onequestionsapicheck.azurewebsites.net",
      "onetimestorage.info",
      "online-access.live",
      "online-audible.com",
      "online-chess.live",
      "online-room.online",
      "online-speak.online",
      "online-supportaccount.com",
      "onlinecalendar.ddnsgeek.com",
      "onlinecloudzone.info",
      "onlinedocument.bid",
      "onlinedocuments.org",
      "onlinedrie-account-permission-verify.com",
      "onlinelive.info",
      "onlinereader.linkpc.net",
      "onlineserver.myftp.biz",
      "onwards-gerencia.ddns.net",
      "openapplicationcheck.azurewebsites.net",
      "opportunities2get.com",
      "opthrltd.me",
      "optima-hr.com",
      "optimac-hr.com",
      "optimax-hr.com",
      "optio-nalynk.online",
      "optionalapplication.azurewebsites.net",
      "oranus.albert-company.online",
      "oranus.besatoo.online",
      "oranus.connect-room.online",
      "oranus.human-fly900.online",
      "oranus.live-coaching.online",
      "oranus.platinum-cnt.info",
      "oranus.white-life-bl.info",
      "oranus.yamal-group.online",
      "orginal-links.com",
      "ourredbucket.ddns.net",
      "outlook-livecom.bid",
      "outlook-verify.net",
      "outlook.live.live-meet.cloud",
      "outlook.live.live-meet.info",
      "outlookde.live",
      "outlookdelivery.com",
      "outstanding.revstoragefile.site",
      "overall-continuing.site",
      "overflow.duia.eu",
      "overviewstatus.redirectme.net",
      "owa-insss-org-ill-owa-authen.ml",
      "owner-rate.online",
      "p-safe.online",
      "pa-crtdomain.info",
      "packctstormsccurity.com",
      "page-home-reload.xyz",
      "pagerender.duckdns.org",
      "pagerendercloud.linkpc.net",
      "pagerenderstatus.info",
      "pages.ultimatecartanddolly.com",
      "pageviewer.linkpc.net",
      "palaerospace.careers",
      "panel-check-live.live",
      "panel-check-short.live",
      "panel-live-check.online",
      "panel-meeting.info",
      "panel-network.online",
      "panel-redirect.online",
      "panel-review-check.live",
      "panel-short-check.live",
      "panel-status-join.live",
      "panel-status-joining.live",
      "panel-view-short.online",
      "panel-view.live",
      "panel-view.online",
      "panel-views-cheking.live",
      "panel.live-meet.blog",
      "panel.live-meet.cfd",
      "panel.live-meet.cloud",
      "panel.live-meet.info",
      "panel.live-meet.live",
      "panel.network-show.online",
      "panelchecking.live",
      "paneling-check-live.live",
      "paneling-checke.live",
      "paneling-cheking-df.live",
      "paneling-viewing.live",
      "panels-views-ckeck.live",
      "parasil.me",
      "pasmoiapp.com",
      "patch-provider-247.azurewebsites.net",
      "patch-provider-597.azurewebsites.net",
      "patch-provider-745.azurewebsites.net",
      "patch-provider.azurewebsites.net",
      "patchtheschool.ddns.net",
      "patient-azureportal.azurewebsites.net",
      "patientcare-portal.azurewebsites.net",
      "pay.entrpreneur.org",
      "pee5.me",
      "peerdistsvcmanagers.azurewebsites.net",
      "pencilbrush.ddns.net",
      "permission-data.online",
      "personalcloudparent.info",
      "personalitytestquestionapi.azurewebsites.net",
      "personalizationsurvey.azurewebsites.net",
      "personalstoragebox.linkpc.net",
      "personalwebview.info",
      "pfl.redirect-review.online",
      "ph-crtdomain.info",
      "ph-work.info",
      "pharmainfo.azurewebsites.net",
      "phonechallenges-submit.site",
      "picofile.xyz",
      "pinnaclegen.com",
      "pkglessplans.xyz",
      "planet-labs.site",
      "planner.croes.info",
      "planner.houseedge.co.za",
      "plans.pravd.in",
      "plansdev.pravd.in",
      "platinum-cnt.info",
      "plugin-adobe.com",
      "pnael-checking.live",
      "pnl-worth.online",
      "policy-facebook.com",
      "politica.in.ua",
      "populationnote.com",
      "ppmataro.com",
      "premier-healthadvisory.azurewebsites.net",
      "premierhealthadvisory.azurewebsites.net",
      "premierhealthadvisory.com",
      "preparingdestination.fixip.org",
      "prism-west-candy.glitch.me",
      "privacy-facebook.com",
      "privacy-gmail.com",
      "privacy-google.com",
      "privacy-yahoomail.com",
      "private-file-sharing.000webhostapp.com",
      "prj-pa.info",
      "prj-ph.info",
      "pro-today.org",
      "proceeddestination.dns-dynamic.net",
      "proctor-custodian.site",
      "procurement-inl-gov.us",
      "procurements-inl-gov.us",
      "products-services.network",
      "profile-facebook.co",
      "profile-verification.com",
      "profile.arizonaclub.me",
      "profile.best85best.online",
      "profilechangeruser.ddns.net",
      "profiles-facebook.com",
      "profivoda.slotig.cz",
      "program-indipendent-system.buzz",
      "progress-captivate-amply.top",
      "projectdrivevirtualcloud.co.uk",
      "proof-video.online",
      "prostozdrowo.info",
      "prostozdrowoa.info",
      "prt-max.online",
      "ptr-cc.online",
      "publicreservoir.info",
      "puredcmeeting.com",
      "qaquestionapi.azurewebsites.net",
      "qaquestions.azurewebsites.net",
      "qaquestionsapi.azurewebsites.net",
      "qaquestionsapijson.azurewebsites.net",
      "qet-adobe.com",
      "qmaiil.ml",
      "quantumweave.azurewebsites.net",
      "queryfindquestions.azurewebsites.net",
      "queryquestions.azurewebsites.net",
      "ques-tion-ing.xyz",
      "questionsapplicationapi.azurewebsites.net",
      "questionsapplicationapijson.azurewebsites.net",
      "questionsapplicationbackup.azurewebsites.net",
      "questionsdatabases.azurewebsites.net",
      "questionsurveyapp.azurewebsites.net",
      "questionsurveyappserver.azurewebsites.net",
      "quickmath-solver.site",
      "quiz.careers2find.com",
      "quiztestapplication.azurewebsites.net",
      "quomodocunquize.site",
      "rabot.pisrc.net",
      "radabala.com",
      "radio-m.cf",
      "radiofarda.site",
      "ramiltons-finance.azurewebsites.net",
      "ramiltonsfinance.azurewebsites.net",
      "ramiltonsfinance.com",
      "randcorp.onlyoffice.com",
      "randomworldcity.ddns.net",
      "rap-art.info",
      "raykiel.net",
      "rb1chesid8.ocry.com",
      "rb2chesid8.otzo.com",
      "rb4chesid8.serveuser.com",
      "rbconline-support.info",
      "re-brandly.store",
      "reactivate-disabled-accuonts.000webhostapp.com",
      "reading-course.online",
      "readquickarticle.dns-dynamic.net",
      "real-vision.redirectme.net",
      "realcdnworker.site",
      "realcloud.info",
      "realhealthshop.com",
      "realpage.redirectme.net",
      "recognize-validation.online",
      "recognize-validation.theworkpc.com",
      "recognize.site",
      "recognized-activity.info",
      "recognizedshare.site",
      "reconsider.site",
      "recover-customers-service.info",
      "recover-identity.site",
      "recover-session-service.site",
      "recovery-customer-service.site",
      "recovery-customerservice.com",
      "recovery-emailcustomer.com",
      "recovery-option.site",
      "recovery-options.site",
      "recovery-service.site",
      "recovery-services.info",
      "recovery-session-change.info",
      "recovery-session-service.site",
      "recovery-session.site",
      "recoverycodeconfirm.bid",
      "recoverysuperuser.bid",
      "recoverysuperuser.info",
      "recoveryusercustomer.info",
      "rectification.info",
      "recursivedns.site",
      "redfoxteeth.site",
      "redirect-b.online",
      "redirect-c.live",
      "redirect-d.online",
      "redirect-drive.online",
      "redirect-k.online",
      "redirect-l.online",
      "redirect-m.live",
      "redirect-o.online",
      "redirect-p.online",
      "redirect-q.online",
      "redirect-r.online",
      "redirect-review.online",
      "redirect-s.online",
      "redirect-t.online",
      "redirect-u.online",
      "refaeldevrssfeed.centralus.cloudapp.azure.com",
      "reg-d.info",
      "regionuaequestions.azurewebsites.net",
      "register-multiplay.ml",
      "registerinsurance.azurewebsites.net",
      "remgrogroup.com",
      "rendercomponents.site",
      "reproduce.outstanding.revstoragefile.site",
      "request-human-received.xyz",
      "research-storage.com",
      "researchdocument.info",
      "reset-account.com",
      "responsiblestatcraft.org",
      "review-continue-entered.cfd",
      "review-session.hopto.org",
      "review-status-plan.online",
      "review.validation.recognize.site",
      "reviewedition.duia.eu",
      "revistadcr.com",
      "revive-project-live.online",
      "revstoragefil.ddns.net",
      "revstoragefile.ddns.net",
      "revstoragefile.site",
      "rgud-group.com",
      "rgud-group.net",
      "rhealthylivingsolutions.com",
      "rheinmetall.careers-hub.org",
      "rheinmetall.careersworld.org",
      "rheinmetall.gocareers.org",
      "rheinmetall.theworldcareers.com",
      "rheinmetallcareer.com",
      "rheinmetallcareer.onlyoffice.com",
      "rheinmetallcareer.org",
      "rheinmetallcareers.com",
      "ricardo-mell.online",
      "richard-3th.online",
      "right.arrow-click.info",
      "roadmapselector.azurewebsites.net",
      "roadmapselectorapi.azurewebsites.net",
      "robinthing123.online",
      "rockhoster.net",
      "rohand63.xyz",
      "roland-cc.online",
      "room-meet-url.live",
      "room-online.one",
      "rostam-hr.vip",
      "royalsoul.online",
      "rozetka.dyndns.org",
      "rpcconnection.azurewebsites.net",
      "rsession.site",
      "rwccalendar.rwcsystems.net",
      "s1vega.dyndns.org",
      "s20.site",
      "s3api.shop",
      "s4api.shop",
      "s51.online",
      "s59.site",
      "sadashboard.com",
      "safe-lord.online",
      "safe-solution.site",
      "safeshortl.ink",
      "safrangroup-careers.com",
      "saipem.org",
      "salamjobs.me",
      "sandbox.live-meet.blog",
      "saudi-government.com",
      "saudi-haj.com",
      "saudiarabiadigitaldashboards.com",
      "sauditourismguide.com",
      "savemoneytrick.com",
      "schedule.gmta.nl",
      "scheduler.niced.cloud",
      "scheduler.scratchspace.dev",
      "scheduler.unionsavings.ca",
      "schoolofculture.ddns.net",
      "schoolofpinkmice.ddns.net",
      "screen-royall-in-corporate.com",
      "screen-shotuser-trash-green.com",
      "scribdinc.site",
      "searchfilterapp.info",
      "searchstatistics.duckdns.org",
      "secnetdc.com",
      "securelogicalrepository.com",
      "security-supportteams-mail-change.ga",
      "see-us.info",
      "seisolarpros.org",
      "sejoinu.cc",
      "selfpackage.info",
      "send-feedback-296.azurewebsites.net",
      "send-feedback-413.azurewebsites.net",
      "send-feedback-838.azurewebsites.net",
      "send-feedback.azurewebsites.net",
      "sendly-ink.shop",
      "sers-login.com",
      "serverbroadcast.info",
      "service-accountrecoverv.com",
      "service-accountrecovery.com",
      "service-activity-checkup.site",
      "service-broadcast.com",
      "service-issues.site",
      "service-logins.net",
      "service-management.tk",
      "service-recovery-session.info",
      "service-recovery.site",
      "service-recoveryaccount.com",
      "service-session-confirm.info",
      "service-session-continue.info",
      "service-session-recovery.site",
      "service-support.site",
      "service-verification.site",
      "servicechecker.top",
      "servicecustomer.bid",
      "servicemailbroadcast.bid",
      "servicepackupdate.info",
      "services-issue-notification.info",
      "services-sessionconfirmation.info",
      "services-update-check.azurewebsites.net",
      "servicesfiledrop.theworkpc.com",
      "servicesupdate.info",
      "servicesystem.serveirc.com",
      "session-confirmation.site",
      "session-customer-activity.site",
      "session-mail-customers.info",
      "session-management.info",
      "session-manager.info",
      "session-managment.info",
      "session-recovery-options.info",
      "session-review.hopto.org",
      "session-users-activities.com",
      "session-verify-user.info",
      "sessions-identifier-memberemailid.network",
      "sessions-identifiermemberemailid.network",
      "sessions-notification.info",
      "set-ymail-user-account-permission-challenge.com",
      "sh-tro.live",
      "shadow-network.best",
      "shaer-likn.store",
      "share.veracity-revision.info",
      "shared-access.com",
      "shared-files-access.live",
      "shared-login.com",
      "shared-permission.com",
      "sharedrive.ink",
      "sharedrive.webredirect.org",
      "sharefilesonline.live",
      "sharepointnotify.com",
      "sharestoredocs.theworkpc.com",
      "shebacenter.online",
      "shebacenter.org",
      "shirazicom.com",
      "sho-flu.live",
      "shooort.site",
      "shooourt.click",
      "shop-sellwear.info",
      "shopleta.ru",
      "shor-erier-f.xyz",
      "shor-fg.live",
      "shor-trv.live",
      "shoring-live.live",
      "short-abbreviate.info",
      "short-ion-per.live",
      "short-jg934hw.live",
      "short-join-live.online",
      "short-modification.site",
      "short-redirect.online",
      "short-rigf.live",
      "short-url.live",
      "short-urling.live",
      "short-view-url.online",
      "short-view.online",
      "shorten-abbreviate.ddns.net",
      "shorten-abbreviate.site",
      "shortener-abbreviate.info",
      "shortener.ddns.net",
      "shortenurl.online",
      "shorter.kozow.com",
      "shortfile-interactive.webredirect.org",
      "shorting-ce.live",
      "shorting-urling.live",
      "shortingurling.live",
      "shortlinkview.live",
      "shortlycc.site",
      "shortoni.live",
      "shortulonline.live",
      "shorturlbot.club",
      "shorturling.live",
      "shoting-urls.live",
      "show-verify.xyz",
      "show-video.info",
      "shr-r4yr93d.live",
      "shrtlink.space",
      "shrtlnk.info",
      "sht-rgtio9.live",
      "signin-acconut.com",
      "signin-accounts.com",
      "signin-identifi.com",
      "signin-mail.com",
      "signin-mails.com",
      "signin-myaccounts.com",
      "signin.dedyn.io",
      "simple-process-static.top",
      "sincerely-sensation-outdo.top",
      "sirc.travyfy.com",
      "sites.bounceme.net",
      "sky-writer.online",
      "skynevvs.com",
      "slmkhubi.ddns.net",
      "smaaaal.cfd",
      "smart-sight-hr.com",
      "smartapptools.azurewebsites.net",
      "smartconnect.azurewebsites.net",
      "smartmediq.azurewebsites.net",
      "smarttradingfast.com",
      "smartview.dns-dynamic.net",
      "smstagram.com",
      "smtp.amg-car-ger.info",
      "snap-short.online",
      "socks.beauty",
      "softservicetel.ddns.net",
      "software-updating-managers.site",
      "solofansapp.page.link",
      "sourceusedirection.mypi.co",
      "sparrowsgroup.org",
      "splitviewer.linkpc.net",
      "sportblogs.azurewebsites.net",
      "spring-club.info",
      "sprinqer.com",
      "stablis.online",
      "stadium-fresh.online",
      "staging-meeting.captello.com",
      "starmanblind.ddns.net",
      "stats.live-meet.blog",
      "status-short.live",
      "statuss-short-join.live",
      "stellar-roar-right.buzz",
      "stellar-stable-faith.top",
      "steve-brown.info",
      "storageprovider.duia.eu",
      "storagewiz.co.azurewebsites.net",
      "storm-wave.online",
      "strainitiatives.ddns.net",
      "streaml23.duia.eu",
      "stromectolonline.com",
      "student-rank-number.icu",
      "stylzdrowia.info",
      "stylzdrowiaa.info",
      "subinfralab.info",
      "sublimetxtcontent.serveblog.net",
      "submissiveness.online",
      "suite-moral.info",
      "sulumorbusinessservices.com",
      "summit-files.com",
      "superlite.online",
      "superset.sandbox.live-meet.blog",
      "supervisor-protector.online",
      "support-aasaam.bid",
      "support-aasaam.com",
      "support-account.xyz",
      "support-accountsrecovery.com",
      "support-google.co",
      "support-recoverycustomers.com",
      "support-servics.com",
      "support-servics.net",
      "support-verify-account-user.com",
      "support.services",
      "supportmailservice.info",
      "supports-recoverycustomers.com",
      "supportskype.com",
      "surveyappquery.azurewebsites.net",
      "surveyonlinetest.azurewebsites.net",
      "surveyonlinetestapi.azurewebsites.net",
      "sweet-pinnacle-readily.online",
      "symptom-recordchecker.azurewebsites.net",
      "synctimezone.dns-dynamic.net",
      "syrtime.me",
      "system-services.site",
      "systemmedicaleducation.azurewebsites.net",
      "systemupdate.info",
      "tacticalsnap.eastus.cloudapp.azure.com",
      "tadawul.com.co",
      "tai-tr.com",
      "talent-recruitment.org",
      "talenthumanresourcestalent.com",
      "talktalky.azurewebsites.net",
      "taskprocess.viewdns.net",
      "tb-meet.pages.dev",
      "tcvision.online",
      "team-speak.cf",
      "team-speak.ga",
      "team-speak.ml",
      "teammate-live.online",
      "teams.webredirect.org",
      "teamspeak-download.ml",
      "teamspeaks.cf",
      "technewsblogapi.azurewebsites.net",
      "technical-updates.info",
      "tecret.com",
      "telagram.cf",
      "telagram.net",
      "teledyneflir.com.de",
      "telehealthconnectpro.azurewebsites.net",
      "telespazio-careers.com",
      "tensore.online",
      "tepbit.site",
      "termite.nu",
      "terms-service-notification.info",
      "terms-service-notlfication.info",
      "termsstatement.duckdns.org",
      "teslator.online",
      "testecs48.ddns.net",
      "testmanagementapi1.azurewebsites.net",
      "testmanagementapis.azurewebsites.net",
      "testmanagementapisjson.azurewebsites.net",
      "testquestionapplicationapi.azurewebsites.net",
      "testtesttes.azurewebsites.net",
      "thecareershub.org",
      "thecloudappbox.azurewebsites.net",
      "thefireisburnt.ddns.net",
      "thefreemovies.net",
      "thehealth-life.com",
      "themedealine.org",
      "themesmanagers.azurewebsites.net",
      "themesprovidermanagers.azurewebsites.net",
      "therashelter.azurewebsites.net",
      "thetacticstore.com",
      "theush.uk",
      "theworldcareers.com",
      "thisismyapp.accesscam.org",
      "thisismydomain.chickenkiller.com",
      "thomas-mark.xyz",
      "threshold.tailba29da.ts.net",
      "tiappschecktest.azurewebsites.net",
      "timelinepage.dns-dynamic.net",
      "timesfisrael.com",
      "timezone-update.duckdns.org",
      "timezone.live",
      "timtechlab.duckdns.org",
      "tinyandjudy.com",
      "tinygo.duckdns.org",
      "tinyurl.co.il",
      "tinyurl.ink",
      "tinyurl.live",
      "titanium-hr.com",
      "title-flow-store.online",
      "tjconsultingservices.com",
      "tnlsowki.westus3.cloudapp.azure.com",
      "tnlsowkis.westus3.cloudapp.azure.com",
      "tnt200.mywire.org",
      "toadreport.azurewebsites.net",
      "token-ep.com",
      "tomas-company.online",
      "toolfare.online",
      "top-game.online",
      "topiranjobs.me",
      "topwor4u.com",
      "totalcaremedcenter.azurewebsites.net",
      "towerreseller.dns-dynamic.net",
      "tracedestination.duia.eu",
      "tracking.ns02.info",
      "transfer-filterless.ddns.net",
      "transfer.loss-modification.site",
      "translatorupdater.dns-dynamic.net",
      "travel-airbnb.site",
      "traveltipspage.com",
      "trnjobs.me",
      "trustedcarehub360.azurewebsites.net",
      "tuinpe.shop",
      "turbulencemd.azurewebsites.net",
      "turkairline.azurewebsites.net",
      "twision.top",
      "twittsupport.com",
      "two-step-checkup.site",
      "tymelinx.com",
      "uaeaircheckon.azurewebsites.net",
      "uaeairchecks.azurewebsites.net",
      "uani.us",
      "uavnodes.com",
      "ude-final.online",
      "uk-service.org",
      "ukborderhomeoffice-gov.org",
      "ukraine2day.com",
      "umberella.icu",
      "understandingthewar.org",
      "uniquethinksession.ddns.net",
      "unirsd.com",
      "unrisd.com",
      "update-checker.net",
      "update-driversonline.bid",
      "update-driversonline.club",
      "update-finder.com",
      "update-health-service.azurewebsites.net",
      "update-microsoft.bid",
      "update-system-driversonline.bid",
      "update.windows-driver.ml",
      "updateddns.ddns.net",
      "updatedefender.net",
      "updatedisplacement.ddns.net",
      "updatedns.ddns.net",
      "updater-driversonline.club",
      "updateservices.co",
      "upload-services.com",
      "uploaddata.info",
      "uploader.sytes.net",
      "uptime-timezone.dns-dynamic.net",
      "uptimezonemetadta.run.place",
      "uri.cab",
      "url-room-meet.live",
      "us2-mail-login-profile.site",
      "usa-careers.com",
      "usabilitystatus.servehttp.com",
      "user-activity-issues.info",
      "user-profile-credentials.com",
      "useridentity-confirm.info",
      "users-facebook.com",
      "users-issue-services.info",
      "users-login.com",
      "users-yahoomail.com",
      "usersettings.cf",
      "ush.team",
      "utopaisystems.net",
      "v4automaticreferrals.com",
      "validation-confirm.ddns.net",
      "validation.recognize.site",
      "validity-accredit.ddns.net",
      "validity.werifcattion.info",
      "vanityfaire.org",
      "vector.kozow.com",
      "vegas777.dyndns.org",
      "ventilateainest.azurewebsites.net",
      "veracity-revision.info",
      "verification-live.com",
      "verification-llve.com",
      "verification-services.info",
      "verificationlive.com",
      "verificationservice.online",
      "verifiy-account.net",
      "verifv-linkedin.net",
      "verify-account.services",
      "verify-accounts.info",
      "verify-corroborate.ddns.net",
      "verify-facebook.com",
      "verify-gmail.tk",
      "verify-linke.com",
      "verify-linkedin.net",
      "verify-person-entry.top",
      "verify-publisher.azurewebsites.net",
      "verify-session-service.site",
      "verify-user-session.info",
      "verify.rsession.site",
      "verifymeet.live",
      "video-connect.online",
      "video-youtube.cf",
      "videozoom.ddns.net",
      "view-cope-flow.online",
      "view-direct-panel.live",
      "view-direct-panel.xyz",
      "view-home-panel.xyz",
      "view-panel.live",
      "view-pool-cope.online",
      "view-total-step.online",
      "viewdestination.vpndns.net",
      "viewfileitems.info",
      "viewfileitems.myftp.org",
      "viewstand.online",
      "viewtop.online",
      "viliam-live-identity.online",
      "viliam.albert-company.online",
      "viliam.alpha-meet.online",
      "viliam.alpha-met.online",
      "viliam.arcanet.online",
      "viliam.azdava.online",
      "viliam.besatoo.online",
      "viliam.cnt-worth.online",
      "viliam.connect-room.online",
      "viliam.cppsg.online",
      "viliam.crysus-h.info",
      "viliam.dmn-for-car.online",
      "viliam.dmn-inter.online",
      "viliam.exir-juice.online",
      "viliam.goods-companies.online",
      "viliam.hrd-dmn.info",
      "viliam.human-fly900.online",
      "viliam.into-support.online",
      "viliam.kuret-live.online",
      "viliam.kuret-met.online",
      "viliam.live-board.online",
      "viliam.live-coaching.online",
      "viliam.live-conn.online",
      "viliam.look-together-online.online",
      "viliam.lynda-tricks.online",
      "viliam.meet-work.info",
      "viliam.message-live.online",
      "viliam.nsim-ph.info",
      "viliam.ntp-clock-h.info",
      "viliam.online-room.online",
      "viliam.online-speak.online",
      "viliam.owner-rate.online",
      "viliam.p-safe.online",
      "viliam.ph-crtdomain.info",
      "viliam.platinum-cnt.info",
      "viliam.prj-ph.info",
      "viliam.prt-max.online",
      "viliam.richard-3th.online",
      "viliam.robinthing123.online",
      "viliam.rohand63.xyz",
      "viliam.roland-cc.online",
      "viliam.safe-lord.online",
      "viliam.steve-brown.info",
      "viliam.superlite.online",
      "viliam.tensore.online",
      "viliam.teslator.online",
      "viliam.toolfare.online",
      "viliam.viliam-live-identity.online",
      "viliam.warning-d.info",
      "viliam.wer-d.info",
      "viliam.white-life-bl.info",
      "viliam.work-meeting.info",
      "viliam.yamal-group.online",
      "villiam.online-speak.online",
      "violet.backback.info",
      "vipjobsglobal.com",
      "virgomarketingsolutions.com",
      "virgomarketingsolutions.comtions.com",
      "virtual-notes.gotdns.ch",
      "virtualcliniczone.azurewebsites.net",
      "virtualphoneassistant.com",
      "virtue-regular-ready.online",
      "visioneditor.loseyourip.com",
      "visit-site-online.online",
      "vitatechlink.azurewebsites.net",
      "vitatechlinks.azurewebsites.net",
      "vote.nikosevag.gr",
      "vpncsp.duckdns.org",
      "vscodeupdater.azurewebsites.net",
      "vsliveagent.com",
      "vvincicivj-c-ssenrjais.tk",
      "w3-schools.org",
      "w3sch00ls.hopto.org",
      "w3school.hopto.org",
      "w3schools-html.com",
      "w3schools.hopto.org",
      "warning-d.info",
      "warplogic.pro",
      "wash-less.online",
      "washingtonlnstitute.org",
      "washinqtonpost.press",
      "watch-youtube.org.uk",
      "wazayif-halima.com",
      "wazayif-halima.org",
      "we-transfer.shop",
      "wearefirefighters.ddns.net",
      "web-getdata.site",
      "webdirecthost.site",
      "webemail.info",
      "webmaiil-tau-ac-il.ml",
      "webmail-tidhar-co-il.ml",
      "websites.freemyip.com",
      "webviewerpage.info",
      "wehatcast.com",
      "wellnessfirstgroup.azurewebsites.net",
      "wellnessglowluth.azurewebsites.net",
      "wer-d.info",
      "werifcattion.info",
      "wh1425239.ispot.cc",
      "whensy.ru",
      "white-car.online",
      "white-life-bl.info",
      "white-life.info",
      "win-ptf9aurtg8u.jewishjournal.us",
      "windows-driver.ml",
      "windows-update.systems",
      "wood-house.online",
      "word-course.online",
      "work-meeting.info",
      "workersquestions.azurewebsites.net",
      "workersquestionsapi.azurewebsites.net",
      "workersquestionsjson.azurewebsites.net",
      "workspaceconsole.servehttp.com",
      "workspaceviewers.com",
      "workstation2020.000webhostapp.com",
      "world-shop.online",
      "worldcareers.org",
      "worldstate.duia.us",
      "worried-eastern-salto.glitch.me",
      "wulpfsrqupnuqorhexiw.supabase.co",
      "www-myaccounts-support.000webhostapp.com",
      "wwwlmeetic.com",
      "wybieramzdrowie.info",
      "wybieramzdrowiea.info",
      "wysebeyond.gotdns.ch",
      "xboxapicenter.com",
      "xboxplayservice.com",
      "xn--facebook-06k.com",
      "xn--googe-q2e.ml",
      "xn--google-yri.com",
      "yah00.site",
      "yahoo-proflles.com",
      "yahoo-verification.net",
      "yahoo-verification.org",
      "yahoo-verify.net",
      "yahoomail.com.co",
      "yamal-group.online",
      "yes1.me",
      "ynetnews.press",
      "youetube.ga",
      "youna101.me",
      "younamesh.com",
      "yourfamilymdclinic.azurewebsites.net",
      "yourl.bid",
      "youronlineregister.com",
      "youtransfer.live",
      "youtransfer.online",
      "youttube.ga",
      "youttube.gq",
      "youtubbe.cf",
      "youtubbe.ml",
      "youtube-com.watch",
      "youtubee-videos.com",
      "youtuebe.co",
      "youtuobe.com.co",
      "youutube.cf",
      "yurl.bid",
      "zdrowaplaneta.info",
      "zdrowaplanetaa.info",
      "zdrowaplanetab.com",
      "zdrowaprzemiana.com",
      "zdrowaprzemianaa.com",
      "zdrowaprzemianab.com",
      "zdrowienapelnym.com",
      "zdrowienapelnyma.com",
      "zdrowienapelnymb.com",
      "zdrowykierunek.com",
      "zdrowykieruneka.com",
      "zdrowykierunekb.com",
      "zedisdead.duckdns.org",
      "zerogmed.azurewebsites.net",
      "zeusistalking.com",
      "zeusistalking.io",
      "zeusistalking.net",
      "zoomcloud.redirectme.net",
      "zra-roll.online",
      "zytonhealth.com"
    ],
    "ipv4": [
      "103.57.251.153:2000",
      "103.57.251.153:443",
      "136.243.108.10:10000",
      "136.243.108.10:22",
      "136.243.108.10:25",
      "136.243.108.10:4040",
      "136.243.108.10:443",
      "136.243.108.10:465",
      "136.243.108.10:587",
      "136.243.108.10:993",
      "136.243.108.10:995",
      "136.243.108.11:10000",
      "136.243.108.11:22",
      "136.243.108.11:25",
      "136.243.108.11:4040",
      "136.243.108.11:443",
      "136.243.108.11:465",
      "136.243.108.11:587",
      "136.243.108.11:993",
      "136.243.108.11:995",
      "136.243.108.12:10000",
      "136.243.108.12:22",
      "136.243.108.12:25",
      "136.243.108.12:4040",
      "136.243.108.12:443",
      "136.243.108.12:465",
      "136.243.108.12:587",
      "136.243.108.12:993",
      "136.243.108.12:995",
      "136.243.108.13:10000",
      "136.243.108.13:22",
      "136.243.108.13:25",
      "136.243.108.13:4040",
      "136.243.108.13:443",
      "136.243.108.13:465",
      "136.243.108.13:587",
      "136.243.108.13:993",
      "136.243.108.13:995",
      "136.243.108.14:10000",
      "136.243.108.14:22",
      "136.243.108.14:25",
      "136.243.108.14:4040",
      "136.243.108.14:443",
      "136.243.108.14:465",
      "136.243.108.14:587",
      "136.243.108.14:993",
      "136.243.108.14:995",
      "136.243.108.9:10000",
      "136.243.108.9:22",
      "136.243.108.9:25",
      "136.243.108.9:4040",
      "136.243.108.9:443",
      "136.243.108.9:465",
      "136.243.108.9:587",
      "136.243.108.9:993",
      "136.243.108.9:995",
      "137.184.212.205:4373",
      "144.217.139.155:4444",
      "159.69.105.181:2082",
      "159.69.105.181:2083",
      "159.69.105.181:2086",
      "159.69.105.181:2087",
      "159.69.105.181:21",
      "159.69.105.181:22",
      "159.69.105.181:443",
      "159.69.105.181:53",
      "169.51.60.221:1331",
      "173.209.51.54:5985",
      "179.43.177.130:3333",
      "188.165.174.199:18080",
      "190.2.150.50:443",
      "194.11.226.9:443",
      "194.4.49.175:443",
      "195.201.46.42:10000",
      "195.201.46.42:22",
      "195.201.46.42:25",
      "195.201.46.42:443",
      "195.201.46.42:465",
      "195.201.46.42:587",
      "195.201.46.42:993",
      "195.201.46.42:995",
      "212.175.168.58:443",
      "45.143.167.87:443",
      "45.77.76.158:23643",
      "46.249.58.136:4444",
      "46.249.58.136:8080",
      "51.38.87.253:3535",
      "51.89.181.64:443",
      "54.38.49.6:21",
      "58.158.177.102:5050",
      "78.47.90.60:10000",
      "78.47.90.60:110",
      "78.47.90.60:143",
      "78.47.90.60:2082",
      "78.47.90.60:2083",
      "78.47.90.60:2086",
      "78.47.90.60:2087",
      "78.47.90.60:21",
      "78.47.90.60:25",
      "78.47.90.60:443",
      "78.47.90.60:465",
      "78.47.90.60:53",
      "78.47.90.60:587",
      "78.47.90.60:993",
      "78.47.90.60:995",
      "85.17.172.180:5050",
      "94.156.128.60:5252"
    ],
    "url": [
      "http://136.243.108.10",
      "http://136.243.108.11",
      "http://136.243.108.12",
      "http://136.243.108.13",
      "http://136.243.108.14",
      "http://136.243.108.9",
      "http://148.251.71.182",
      "http://159.69.105.181",
      "http://162.55.136.233",
      "http://162.55.137.20",
      "http://173.209.51.54",
      "http://182.54.217.2",
      "http://185.132.176.240",
      "http://185.153.197.236",
      "http://190.2.150.50",
      "http://194.11.226.9",
      "http://194.4.49.175",
      "http://195.201.46.42",
      "http://212.175.168.58",
      "http://37.120.222.168",
      "http://45.143.167.87",
      "http://78.47.90.60",
      "http://88.80.148.162",
      "http://91.107.150.184",
      "https://community.emergingthreats.net/t/ruleset-update-summary-2024-05-06-v10590/1615"
    ],
    "url_path": [
      "/CkliPwaM",
      "/F53OQQkE",
      "/Gallery/Ref/FSaEM5gG",
      "/Gcollection/Ref/CkliPwaM",
      "/Lcollection/Ref/F53OQQkE",
      "/Ref/CkliPwaM",
      "/Ref/F53OQQkE",
      "/aliasauthG/autoref/vNSX6c2m",
      "/aspx_wkggiyvttmu.aspx",
      "/autoref/vNSX6c2m",
      "/dhvqx.aspx",
      "/ecp/auth/aspx_wkggiyvttmu.aspx",
      "/edfcvfgbhnjmkqwasderfgg",
      "/gadfTs55sghsSSS",
      "/gadfTs55sghsSSS/phppost.php",
      "/vNSX6c2m"
    ]
  },
  "last_modified": "2026-07-29T16:22:21+00:00",
  "maltrail_groups": [
    "CHARMINGKITTEN"
  ],
  "references": [
    "http://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/",
    "https://about.fb.com/wp-content/uploads/2022/04/Meta-Quarterly-Adversarial-Threat-Report_Q1-2022.pdf",
    "https://app.validin.com/axon?find=58.158.177.102&type=ip",
    "https://app.validin.com/detail?find=%3A%3A%22og%3Atitle%22%3A%22title%22%3A%22ShortURL%20-%20URL%20Shortener%22&type=raw&ref_id=9b9c611b5fd#tab=host_pairs (# 2025-09-17)",
    "https://app.validin.com/detail?find=135.181.203.1&type=ip4&ref_id=7bb26af05d1#tab=resolutions",
    "https://app.validin.com/detail?find=185.132.176.236&type=ip4&ref_id=1013ff6b648#tab=resolutions",
    "https://app.validin.com/detail?find=185.132.176.27&type=ip4&ref_id=1013ff6b648#tab=resolutions",
    "https://app.validin.com/detail?find=212.162.152.151&type=ip4&ref_id=ea7526bb584#tab=resolutions",
    "https://app.validin.com/detail?find=2c2951f9c795c19412bf900f8e0ea00e&type=hash#tab=host_pairs (# 2025-04-25)",
    "https://app.validin.com/detail?find=38.180.111.244&type=ip4&ref_id=86db3c91efa#tab=resolutions",
    "https://app.validin.com/detail?find=38.180.111.246&type=ip4&ref_id=c6b5b76ecdb#tab=resolutions",
    "https://app.validin.com/detail?find=38.180.121.133&type=ip4&ref_id=f79dde040dd#tab=resolutions",
    "https://app.validin.com/detail?find=38.180.91.175&type=ip4&ref_id=96da503d30d#tab=resolutions",
    "https://app.validin.com/detail?find=38.180.91.184&type=ip4&ref_id=96da503d30d#tab=resolutions",
    "https://app.validin.com/detail?find=38.180.91.190&type=ip4&ref_id=96da503d30d#tab=resolutions",
    "https://app.validin.com/detail?find=38.180.91.193&type=ip4&ref_id=96da503d30d#tab=resolutions",
    "https://app.validin.com/detail?find=38.180.91.195&type=ip4&ref_id=96da503d30d#tab=resolutions",
    "https://app.validin.com/detail?find=38.180.91.206&type=ip4&ref_id=96da503d30d#tab=resolutions",
    "https://app.validin.com/detail?find=66.151.40.83&type=ip4&ref_id=45cc7c174db#tab=resolutions",
    "https://app.validin.com/detail?find=66.151.40.84&type=ip4&ref_id=d413894d497#tab=resolutions",
    "https://app.validin.com/detail?find=6d7b0b16f0cbad033ee08e6b414f02fd&type=hash&ref_id=015842d48f4#tab=host_pairs_v2",
    "https://app.validin.com/detail?find=Thoughts%20and%20Reflections%20-%20A%20Personal%20Blog&type=raw&ref_id=b7e5679da39#tab=host_pairs (# 2025-05-07)",
    "https://app.validin.com/detail?find=URL%20Shortener&type=raw&ref_id=7eee58f2849#tab=host_pairs (# 2025-08-18)",
    "https://app.validin.com/detail?find=WIN-46MPMA44ISV&type=raw&ref_id=777b5254d85#tab=host_pairs",
    "https://app.validin.com/detail?type=ip&find=38.180.91.211#tab=resolutions",
    "https://blog.certfa.com/posts/charming-kitten-christmas-gift/",
    "https://blog.certfa.com/posts/fake-interview-the-new-activity-of-charming-kitten/",
    "https://blog.google/technology/safety-security/tool-of-first-resort-israel-hamas-war-in-cyber/",
    "https://blog.google/threat-analysis-group/iranian-backed-group-steps-up-phishing-campaigns-against-israel-us/",
    "https://blog.google/threat-analysis-group/new-iranian-apt-data-extraction-tool/ (# HYPERSCRAPE)",
    "https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/",
    "https://businessinsights.bitdefender.com/unpacking-bellaciao-a-closer-look-at-irans-latest-malware",
    "https://catalyst.prodaft.com/public/report/subtle-snail-expands-espionage-campaign-to-european-telecom-organizations",
    "https://cloud.google.com/blog/topics/threat-intelligence/uncovering-iranian-counterintelligence-operation",
    "https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations",
    "https://community.emergingthreats.net/t/ruleset-update-summary-2022-11-22-v10179/172",
    "https://community.emergingthreats.net/t/ruleset-update-summary-2022-11-30-v10185/185",
    "https://community.emergingthreats.net/t/ruleset-update-summary-2023-12-04-v10478/1178",
    "https://community.emergingthreats.net/t/ruleset-update-summary-2024-01-17-v10508/1292",
    "https://community.emergingthreats.net/t/ruleset-update-summary-2025-03-12-v10877/2511",
    "https://docs.google.com/document/d/1oYX3uN6KxIX_StzTH0s0yFNNoHDnV8VgmVqU5WoeErc (2018-06-12 Charming Kitten waterhole)",
    "https://docs.google.com/document/d/1oYX3uN6KxIX_StzTH0s0yFNNoHDnV8VgmVqU5WoeErc/",
    "https://docs.google.com/document/d/1oYX3uN6KxIX_StzTH0s0yFNNoHDnV8VgmVqU5WoeErc/edit#",
    "https://dti.domaintools.com/the-apt35-dump-episode-4-leaking-the-backstage-pass-to-an-iranian-intelligence-operation/",
    "https://dti.domaintools.com/threat-intelligence-report-apt35-internal-leak-of-hacking-campaigns-against-lebanon-kuwait-turkey-saudi-arabia-korea-and-domestic-iranian-targets/",
    "https://en.fofa.info/result?qbase64=dGl0bGU9PSJVUkwgU2hvcnRlbmVyIiAmJiBpY29uX2hhc2g9IjE5MDgxNDcxMjEi",
    "https://github.com/blackorbird/APT_REPORT/blob/master/Charming%20Kitten/2023-08-10-cyber-brief-no-01-2023.pdf",
    "https://github.com/google/threat-team/blob/main/2024/2024-02-14-tool-of-first-resort-israel-hamas-war-cyber/indicators.csv",
    "https://github.com/pan-unit42/iocs/blob/master/iran_linked_operators/MagicHound.csv",
    "https://github.com/prodaft/malware-ioc/tree/master/SubtleSnail",
    "https://go.recordedfuture.com/hubfs/reports/cta-ir-2024-0820.pdf",
    "https://harfanglab.io/insidethelab/cyclops-replacement-bellaciao/",
    "https://lists.emergingthreats.net/pipermail/emerging-sigs/2022-April/030630.html",
    "https://mp.weixin.qq.com/s/nY2Hyg6ZsM7ViXW1lhO2Ag",
    "https://mp.weixin.qq.com/s/oD1VQZBxgjL3rNeN72MJqg",
    "https://otx.alienvault.com/pulse/5c9bb407e5a06b014da016e3",
    "https://otx.alienvault.com/pulse/5d7e61f9aa517862e977cbad",
    "https://otx.alienvault.com/pulse/5d9b7a71f31df0e33eefab04",
    "https://otx.alienvault.com/pulse/5e3acf325495b5e504f82abc",
    "https://otx.alienvault.com/pulse/5e6ff05783c525e779904d69",
    "https://otx.alienvault.com/pulse/5f99808638696999cf7b109c",
    "https://otx.alienvault.com/pulse/5fff52390820519347e5f2d3",
    "https://otx.alienvault.com/pulse/6065f293e16c3e4e72044475",
    "https://otx.alienvault.com/pulse/620f76b08f1d06ea8646c0d3",
    "https://otx.alienvault.com/pulse/624f0d6039be61f29b5f463c",
    "https://otx.alienvault.com/pulse/638e5648107623c3429e8c21",
    "https://otx.alienvault.com/pulse/64499283c56cf14e277f9063",
    "https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/",
    "https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/",
    "https://research.checkpoint.com/2023/educated-manticore-iran-aligned-threat-actor-targeting-israel-via-improved-arsenal-of-tools/",
    "https://research.checkpoint.com/2024/wezrat-malware-deep-dive/",
    "https://research.checkpoint.com/2025/iranian-educated-manticore-targets-leading-tech-academics/",
    "https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/",
    "https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/",
    "https://securelist.com/mirage-kitten-new-tools/120811/",
    "https://services.google.com/fh/files/misc/tool-of-first-resort-israel-hamas-war-cyber.pdf",
    "https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/",
    "https://twitter.com/BaoshengbinCumt/status/1423577884615081992",
    "https://twitter.com/BaoshengbinCumt/status/1494478437960286208",
    "https://twitter.com/ChicagoCyber/status/1391819499872137225",
    "https://twitter.com/ChicagoCyber/status/1562047469126656001",
    "https://twitter.com/ClearskySec/status/1258432745891680256",
    "https://twitter.com/ET_Labs/status/1629278117071147008",
    "https://twitter.com/G60930953/status/1747821766074863690",
    "https://twitter.com/IronNetTR/status/1562913025350303744",
    "https://twitter.com/IronNetTR/status/1562913027951042561",
    "https://twitter.com/IronNetTR/status/1562913029620203520",
    "https://twitter.com/LukasStefanko/status/1569258418283905026",
    "https://twitter.com/MsftSecIntel/status/1747666342897963362",
    "https://twitter.com/ThreatBookLabs/status/1613825659582959617",
    "https://twitter.com/billyleonard/status/1757556382176313624",
    "https://twitter.com/blackorbird/status/1690994786415874048",
    "https://twitter.com/jfslowik/status/1347905935654539267",
    "https://twitter.com/k3yp0d/status/1572561485376950274",
    "https://twitter.com/k3yp0d/status/1650513653802708996",
    "https://twitter.com/k3yp0d/status/1764938541203612004",
    "https://twitter.com/k3yp0d/status/1764940785345089940",
    "https://twitter.com/kyleehmke/status/1328374352602144770",
    "https://twitter.com/kyleehmke/status/1334170023968051200",
    "https://twitter.com/kyleehmke/status/1339602993814102016",
    "https://twitter.com/kyleehmke/status/1346154845221384194",
    "https://twitter.com/malwrhunterteam/status/1762813636001570980",
    "https://unit42.paloaltonetworks.com/tracking-iran-apt-screening-serpens/",
    "https://www.bitdefender.com/en-us/blog/businessinsights/unpacking-bellaciao-a-closer-look-at-irans-latest-malware",
    "https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf",
    "https://www.clearskysec.com/charmingkitten/",
    "https://www.clearskysec.com/the-kittens-are-back-in-town/",
    "https://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf",
    "https://www.clearskysec.com/wp-content/uploads/2019/10/The-Kittens-Are-Back-in-Town-2.pdf",
    "https://www.clearskysec.com/wp-content/uploads/2024/11/Iranian-Dream-Job-ver1.pdf",
    "https://www.cybereason.com/blog/powerless-trojan-iranian-apt-phosphorus-adds-new-powershell-backdoor-for-espionage",
    "https://www.gov.il/BlobFolder/reports/alert_1803/he/ALERT-CERT-IL-W-1803.pdf",
    "https://www.ic3.gov/CSA/2024/241030.pdf",
    "https://www.ic3.gov/Media/News/2024/240927.pdf",
    "https://www.mandiant.com/media/17826",
    "https://www.mandiant.com/media/17826 (# apt42, crookedcharms)",
    "https://www.mandiant.com/resources/blog/suspected-iranian-unc1549-targets-israel-middle-east",
    "https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/",
    "https://www.nextron-systems.com/2026/06/01/detecting-nimbus-manticore-and-their-sideloading-infection-chains/",
    "https://www.proofpoint.com/us/blog/threat-insight/badblood-ta453-targets-us-and-israeli-medical-research-personnel-credential",
    "https://www.proofpoint.com/us/blog/threat-insight/best-laid-plans-ta453-targets-religious-figure-fake-podcast-invite-delivering",
    "https://www.proofpoint.com/us/blog/threat-insight/crossed-wires-case-study-iranian-espionage-and-attribution",
    "https://www.proofpoint.com/us/blog/threat-insight/welcome-new-york-exploring-ta453s-foray-lnks-and-mac-malware",
    "https://www.recordedfuture.com/suspected-iran-nexus-tag-56-uses-uae-forum-lure-for-credential-theft-against-us-think-tank",
    "https://www.resecurity.com/blog/article/iranian-cyber-actors-irgc-targeting-the-2024-us-presidential-election",
    "https://www.secureworks.com/blog/cobalt-illusion-masquerades-as-atlantic-council-employee",
    "https://www.sentinelone.com/labs/log4j2-in-the-wild-iranian-aligned-threat-actor-tunnelvision-actively-exploiting-vmware-horizon/",
    "https://www.shodan.io/host/136.243.108.10",
    "https://www.shodan.io/host/136.243.108.11",
    "https://www.shodan.io/host/136.243.108.12",
    "https://www.shodan.io/host/136.243.108.13",
    "https://www.shodan.io/host/136.243.108.14",
    "https://www.shodan.io/host/136.243.108.9",
    "https://www.shodan.io/host/173.209.51.54",
    "https://www.shodan.io/host/78.47.90.60",
    "https://www.stormshield.com/news/apt35-plays-same-music-again/",
    "https://www.validin.com/blog/expanding-apt42-intelligence-with-validin/",
    "https://www.virustotal.com/gui/domain/kia-customerservice.ddns.net/detection",
    "https://www.virustotal.com/gui/domain/recovery-service.site/detection",
    "https://www.virustotal.com/gui/file/0180f4f29c550aa1ffaa21af51711b29de99fb1d7c932d008a0e9356ae8a7d60/detection",
    "https://www.virustotal.com/gui/file/0596554b58c644d42d44ba24c7b6c31a7b8999f77672cb430e6f6a006c022bdc/detection",
    "https://www.virustotal.com/gui/file/0e51029ba28243b0a6a071713c17357a8eb024aa4298d1ccc9e2c4ac8916df4d/detection",
    "https://www.virustotal.com/gui/file/2b9c941150206d38a635620f2129660628f9b08dd2f674013cacda39bde7ae56/detection",
    "https://www.virustotal.com/gui/file/2be8c9591d9aab6d81e4dd4a7e04371c7b1577404fa9ead11372251afcd13059/detection",
    "https://www.virustotal.com/gui/file/2c92da2721466bfbdaff7fedd9f3e8334b688a88ee54d7cab491e1a9df41258f/detection",
    "https://www.virustotal.com/gui/file/3226b3e7d7fdaebfe7d7f06bdaf0cad08ea9792cd32843d01e6023f67cd0c889/detection",
    "https://www.virustotal.com/gui/file/4431b2a4d7758907f81fb1a0c1e36b2ce03e08d43123b1c398487770afd20727/detection",
    "https://www.virustotal.com/gui/file/48883dcbac14e1f57613f482ec69b1a50458c8fd59e78a5ce66b988bf4a06347/detection",
    "https://www.virustotal.com/gui/file/4e27556432464375a9016a410b6eef586f3a27377424ffc09f40eb252af144a2/detection",
    "https://www.virustotal.com/gui/file/5aa317d3682ff127e1e92d2016c08f94be60937a1b8a210876d931d072386336/detection",
    "https://www.virustotal.com/gui/file/5b1b7d9c5f08d67834dcb8d15a25941363441b235dd82bface19588ece8a9841/detection",
    "https://www.virustotal.com/gui/file/5d3ff202f20af915863eee45916412a271bae1ea3a0e20988309c16723ce4da5/detection",
    "https://www.virustotal.com/gui/file/6618051ea0c45d667c9d9594d676bc1f4adadd8cb30e0138489fee05ce91a9cb/detection",
    "https://www.virustotal.com/gui/file/734d9639fcfffef1a3c360269ccc1cda4f1d0e9dc857fa438f945e807b022c21/detection",
    "https://www.virustotal.com/gui/file/84366a894120d4a8c83411925ef04de52fa56da6fad0023a71f71a9bf21259ad/detection",
    "https://www.virustotal.com/gui/file/89c1d1b61d7f863f8a651726e29f2ae3de7958f36b49a756069021817947d06c/detection",
    "https://www.virustotal.com/gui/file/90e5fa3f382c5b15a85484c17c15338a6c8dbc2b0ca4fb73c521892bd853f226/detection",
    "https://www.virustotal.com/gui/file/9146f8c1e0a88d961e5d1b6ac4633506c6e904e4cdf4c36ac5c1b5bd44867628/detection",
    "https://www.virustotal.com/gui/file/918e70e3f5fdafad28effd512b2f2d21c86cb3d3f14ec14f7ff9e7f0760fd760/detection",
    "https://www.virustotal.com/gui/file/971c5b5396ee37827635badea90d26d395b08d17cbe9e8027dc87b120f8bc0a2/detection",
    "https://www.virustotal.com/gui/file/a624768f28ca66e82cb5d157e5ddd427644e903476099ef0d155ab1f426da8a3/detection",
    "https://www.virustotal.com/gui/file/a6b0c63b2aa25d5fe8ff5b9bd4d28636fbfa7f7af5db7c34d82459738243163a/detection",
    "https://www.virustotal.com/gui/file/a6dea088c9e2c9191e4c2fc4ece7b7b7bd3f034f444362d35c8765f6ec4bd279/detection",
    "https://www.virustotal.com/gui/file/a8c062846411d3fb8ceb0b2fe34389c4910a4887cd39552d30e6a03a02f4cc78/detection",
    "https://www.virustotal.com/gui/file/c2c1d804aeed1913f858df48bf89a58b1f9819d7276a70b50785cf91c9d34083/detection",
    "https://www.virustotal.com/gui/file/c67cd544a112cab1bb75b3c44df4caf2045ef0af51de9ece11261d6c504add32/detection",
    "https://www.virustotal.com/gui/file/c8baf145f2f586167ed108eca143ce4d2b86af8df050a226959fcb172462cd0a/detection",
    "https://www.virustotal.com/gui/file/ca4217b9d188cbe5fc6f4c7d5d696f93cc611dff1ffd323941f2a8b5e77284de/detection",
    "https://www.virustotal.com/gui/file/d4375a22c0f3fb36ab788c0a9d6e0479bd19f48349f6e192b10d83047a74c9d7/detection",
    "https://www.virustotal.com/gui/file/e0ba0cedd8a8624c75af29965e5fa7ab754fc0fcddbb330bb548dab4f2be333f/detection",
    "https://www.virustotal.com/gui/file/e37b95bb9bee64cc0313eaad8a0269493745f89413bd78b58bb3b479b36084ae/detection",
    "https://www.virustotal.com/gui/file/e7b2cc236af9edbe44307d293a7d7fcbb199a286f7eec864f363fcb725c7ef70/detection",
    "https://www.virustotal.com/gui/file/f1819b6aed24b81e6432a6d738206a388c266f72dbde4a8f4a4b9b6e3c55e609/detection",
    "https://www.virustotal.com/gui/file/f54dc4b91383d84e0a51fee2e232916da8899a7b7b39f91a782af8ef17f15d02/detection",
    "https://www.virustotal.com/gui/file/f83e2b3be2e6db20806a4b9b216edc7508fa81ce60bf59436d53d3ae435b6060/detection",
    "https://www.virustotal.com/gui/ip-address/144.202.123.86/relations",
    "https://www.virustotal.com/gui/ip-address/144.217.129.176/relations",
    "https://www.virustotal.com/gui/ip-address/185.132.176.240/relations",
    "https://www.virustotal.com/gui/ip-address/185.132.176.27/relations",
    "https://www.virustotal.com/gui/ip-address/185.182.194.175/relations",
    "https://www.virustotal.com/gui/ip-address/185.182.194.50/relations",
    "https://www.virustotal.com/gui/ip-address/31.42.176.171/relations",
    "https://www.virustotal.com/gui/ip-address/38.180.111.244/relations",
    "https://www.virustotal.com/gui/ip-address/45.143.167.87/relations",
    "https://www.virustotal.com/gui/ip-address/54.39.143.120/relations",
    "https://www.virustotal.com/gui/ip-address/78.159.117.175/relations",
    "https://www.virustotal.com/gui/ip-address/78.159.117.177/relations",
    "https://www.virustotal.com/gui/ip-address/79.132.131.184/relations",
    "https://www.virustotal.com/gui/ip-address/84.200.193.20/relations",
    "https://www.virustotal.com/gui/ip-address/91.107.155.179/relations",
    "https://www.virustotal.com/gui/ip-address/91.214.124.143/relations",
    "https://www.volexity.com/blog/2024/02/13/charmingcypress-innovating-persistence/",
    "https://www.welivesecurity.com/en/eset-research/sponsor-batch-filed-whiskers-ballistic-bobcats-scan-strike-backdoor/",
    "https://x.com/4rchib4ld/status/1972582381275275498",
    "https://x.com/ClearskySec/status/1856268257734410647",
    "https://x.com/Cyberteam008/status/1866677248587337914",
    "https://x.com/Cyberteam008/status/1868875414510485876",
    "https://x.com/Cyberteam008/status/1919571782983356563",
    "https://x.com/Cyberteam008/status/1927915406288695626",
    "https://x.com/HostileSpectrum/status/1722628312013660665",
    "https://x.com/RecordedFuture/status/1825867926043312398",
    "https://x.com/StrikeReadyLabs/status/1851438224834433154",
    "https://x.com/ThreatBookLabs/status/1957276288944918620",
    "https://x.com/ThreatBookLabs/status/1968132855827181901",
    "https://x.com/ThreatBookLabs/status/2010540242932269492",
    "https://x.com/ValidinLLC/status/1867193831612985822",
    "https://x.com/asdasd13asbz/status/1851513587967078410",
    "https://x.com/blackorbird/status/1840667306583572653",
    "https://x.com/blackorbird/status/1920061952459518406",
    "https://x.com/blackorbird/status/1992075483836744154",
    "https://x.com/k3yp0d/status/1828699405056180664",
    "https://x.com/k3yp0d/status/1840762048826728893",
    "https://x.com/k3yp0d/status/1852051018181452143",
    "https://x.com/nextronresearch/status/2078037561667142042",
    "https://x.com/salmanvsf/status/1930185668560597209",
    "https://x.com/skocherhan/status/1932952171122737290",
    "https://x.com/skocherhan/status/1973278284906635640",
    "https://x.com/volrant136/status/1971653625274683671",
    "https://x.com/volrant136/status/1971654091656122835"
  ],
  "related": [
    {
      "evidence": [
        {
          "detail": "2 shared indicators",
          "kind": "infrastructure",
          "weight": 2.0
        },
        {
          "detail": "2 reports cite both",
          "kind": "reporting",
          "weight": 2.0
        }
      ],
      "slug": "G0040"
    },
    {
      "evidence": [
        {
          "detail": "1 shared indicator",
          "kind": "infrastructure",
          "weight": 1.0
        }
      ],
      "slug": "SHAMOON"
    },
    {
      "evidence": [
        {
          "detail": "1 shared indicator",
          "kind": "infrastructure",
          "weight": 1.0
        }
      ],
      "slug": "G0007"
    },
    {
      "evidence": [
        {
          "detail": "4 reports cite both",
          "kind": "reporting",
          "weight": 4.0
        }
      ],
      "slug": "G0081"
    }
  ],
  "slug": "G0058",
  "timeline": [
    {
      "counts": {
        "domain": 29,
        "url_path": 1
      },
      "first_seen": "2026-07-29",
      "indicators": {
        "domain": [
          "aecert.org",
          "api.neexportfolio.com",
          "app.neexportfolio.com",
          "business-deegital.azurewebsites.net",
          "business-deegital.com",
          "businessdeegital.azurewebsites.net",
          "businesslocked.com",
          "businessmixture.com",
          "cards.ohana-village.org",
          "cld-global.com",
          "dn.neexportfolio.com",
          "drhealthyrecommends.com",
          "global-reds.com",
          "healthcarezoom-centeral.azurewebsites.net",
          "healthcarezoomcenteral.azurewebsites.net",
          "healthcarezoomcenteral.org",
          "m.neexportfolio.com",
          "maadinglobal.com",
          "neexportfolio.azurewebsites.net",
          "neexportfolio.com",
          "neexportfolio.eastus.cloudapp.azure.com",
          "ohana-village.org",
          "realhealthshop.com",
          "smartconnect.azurewebsites.net",
          "thehealth-life.com",
          "tinyandjudy.com",
          "tjconsultingservices.com",
          "toadreport.azurewebsites.net",
          "tuinpe.shop"
        ],
        "url_path": [
          "/edfcvfgbhnjmkqwasderfgg"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/mirage-kitten-new-tools/120811/"
      ],
      "total": 30
    },
    {
      "counts": {
        "domain": 102
      },
      "first_seen": "2026-07-17",
      "indicators": {
        "domain": [
          "30min-ergmeeting.com",
          "30min-ergmeeting.net",
          "30min-smartsight-hr.com",
          "30min-smartsight.com",
          "30min-ziprecruiter.com",
          "30min-ziprecruiterhr.com",
          "30minmeeting-quality.com",
          "30minmeetinghr.com",
          "30minziprecruiterhr.net",
          "8475.freelancedeveloper.site",
          "anymediaapp.com",
          "app.hostedlayer.com",
          "bc-app.orgdatasolutions.com",
          "booking.microsoftcalendars.com",
          "booking.mountainsgate.com",
          "booking.virtualdeskflowr.com",
          "bookings.hcpassociation.com.au",
          "bookmenow.info",
          "budgetingscheduler.pages.dev",
          "calendar-cn8.pages.dev",
          "calendar.fractionalleverage.com",
          "collab.vaf.ai",
          "crimson-peaks.com",
          "cstoddart-meeting-scheduler.firebaseapp.com",
          "demo-meeting.captello.com",
          "duschedule.ibridgellc.com",
          "eand.cyvehx.com",
          "eu-meeting.captello.com",
          "ez-calendar.vercel.app",
          "form.redberyl.co",
          "form.ritwiksingh.com",
          "geticarefunds.com",
          "jafferbrothers.developmint.xyz",
          "letsschedulethis.com",
          "mail.smart-sight-hr.com",
          "meet.13bytes.de",
          "meet.dynamicsmind.in",
          "meet.fruitcakemedia.co.uk",
          "meet.thijsblom.app",
          "meet.thijsblom.dev",
          "meet.webdeploy.dev",
          "meeting-schedular-flame.vercel.app",
          "meeting-schedular.aptc.ricoh.com",
          "meeting-scheduler-ui.pages.dev",
          "meeting-scheduler.cloud",
          "meeting-scheduler.co.uk",
          "meeting-scheduler.com",
          "meeting-scheduler.metal.kaldi.si",
          "meeting-scheduler.ncb.org",
          "meeting-scheduler.online",
          "meeting-scheduler.saetta.co.jp",
          "meeting-scheduler.tous33f.live",
          "meeting-scheduler.xyz",
          "meeting-scheduling.oldcountry.ai",
          "meeting-space-scheduler-9946.taskade.app",
          "meeting.captello.com",
          "meeting.dalqan.com",
          "meeting.ignsoftwares.in",
          "meeting.jackz.me",
          "meeting.wilawan.com",
          "meeting.xn--grnlund-b1a.net",
          "meetings-demo.apigateway.co",
          "meetings-prod.apigateway.co",
          "meetings.dialexa.com",
          "meetings.fl2f.ca",
          "meetings.sabonzy.com",
          "meetings.xn--grnlund-b1a.net",
          "meetingscheduler.sandbox.aws.corp.cloud5.com",
          "meetingscheduler.servehttp.com",
          "meetingscheduler.thebeautymatcher.com",
          "meets.armankhan.me",
          "meets.armankhan.space",
          "ms.supermwario.com",
          "msp.medatron.co",
          "office365calendar.com",
          "pages.ultimatecartanddolly.com",
          "planner.croes.info",
          "planner.houseedge.co.za",
          "plans.pravd.in",
          "plansdev.pravd.in",
          "profivoda.slotig.cz",
          "puredcmeeting.com",
          "rabot.pisrc.net",
          "rwccalendar.rwcsystems.net",
          "schedule.gmta.nl",
          "scheduler.niced.cloud",
          "scheduler.scratchspace.dev",
          "scheduler.unionsavings.ca",
          "sirc.travyfy.com",
          "smart-sight-hr.com",
          "staging-meeting.captello.com",
          "tb-meet.pages.dev",
          "theush.uk",
          "threshold.tailba29da.ts.net",
          "tymelinx.com",
          "ush.team",
          "v4automaticreferrals.com",
          "virtualphoneassistant.com",
          "vote.nikosevag.gr",
          "wh1425239.ispot.cc",
          "whensy.ru",
          "workspaceviewers.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/nextronresearch/status/2078037561667142042",
        "https://www.nextron-systems.com/2026/06/01/detecting-nimbus-manticore-and-their-sideloading-infection-chains/"
      ],
      "total": 102
    },
    {
      "counts": {
        "domain": 35
      },
      "first_seen": "2026-07-17",
      "indicators": {
        "domain": [
          "codzienniefita.info",
          "codzienniefity.info",
          "getsqldeveloper.com",
          "getsqldeveloper.it.com",
          "global-check-business-it.azurewebsites.net",
          "global-check-itbusiness.azurewebsites.net",
          "global-it-checkbusiness.azurewebsites.net",
          "global-it-checkers.azurewebsites.net",
          "global-it-consultants.azurewebsites.net",
          "globalbusiness-checkers-it.azurewebsites.net",
          "globalit-consultants.azurewebsites.net",
          "globalitconsultants.azurewebsites.net",
          "hb.pee5.me",
          "hu.yes1.me",
          "ie.codzienniefita.info",
          "pee5.me",
          "prostozdrowo.info",
          "prostozdrowoa.info",
          "stylzdrowia.info",
          "stylzdrowiaa.info",
          "wybieramzdrowie.info",
          "wybieramzdrowiea.info",
          "yes1.me",
          "zdrowaplaneta.info",
          "zdrowaplanetaa.info",
          "zdrowaplanetab.com",
          "zdrowaprzemiana.com",
          "zdrowaprzemianaa.com",
          "zdrowaprzemianab.com",
          "zdrowienapelnym.com",
          "zdrowienapelnyma.com",
          "zdrowienapelnymb.com",
          "zdrowykierunek.com",
          "zdrowykieruneka.com",
          "zdrowykierunekb.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://unit42.paloaltonetworks.com/tracking-iran-apt-screening-serpens/",
        "https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"
      ],
      "total": 35
    },
    {
      "counts": {
        "domain": 22
      },
      "first_seen": "2026-05-23",
      "indicators": {
        "domain": [
          "buisness-centeral-transportation.azurewebsites.net",
          "buisness-centeral-transportation.com",
          "buisness-centeral.azurewebsites.net",
          "business-startup.azurewebsites.net",
          "business-startup.org",
          "businessstartup.azurewebsites.net",
          "docspace-twpf0e.onlyoffice.com",
          "docspace-y4cumb.onlyoffice.com",
          "elementshift.azurewebsites.net",
          "licencemanagers.azurewebsites.net",
          "licencesupporting.azurewebsites.net",
          "nanomatrix.azurewebsites.net",
          "peerdistsvcmanagers.azurewebsites.net",
          "premier-healthadvisory.azurewebsites.net",
          "premierhealthadvisory.azurewebsites.net",
          "premierhealthadvisory.com",
          "quantumweave.azurewebsites.net",
          "ramiltons-finance.azurewebsites.net",
          "ramiltonsfinance.azurewebsites.net",
          "ramiltonsfinance.com",
          "themesmanagers.azurewebsites.net",
          "themesprovidermanagers.azurewebsites.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://unit42.paloaltonetworks.com/tracking-iran-apt-screening-serpens/",
        "https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"
      ],
      "total": 22
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-13",
      "indicators": {
        "domain": [
          "baochinhphu.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/ThreatBookLabs/status/2010540242932269492",
        "https://www.virustotal.com/gui/file/e7b2cc236af9edbe44307d293a7d7fcbb199a286f7eec864f363fcb725c7ef70/detection",
        "https://www.virustotal.com/gui/file/a6b0c63b2aa25d5fe8ff5b9bd4d28636fbfa7f7af5db7c34d82459738243163a/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 150
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "accounts.google.live-meet.blog",
          "accounts.google.live-meet.cfd",
          "accounts.google.live-meet.cloud",
          "accounts.google.live-meet.info",
          "accounts.google.network-show.online",
          "actor.rap-art.info",
          "albert-company.online",
          "all-for-city.info",
          "amg-car-ger.info",
          "anna-blog.info",
          "apple.beta-man.info",
          "april.spring-club.info",
          "arizonaclub.me",
          "arrow-click.info",
          "backback.info",
          "best85best.online",
          "beta-man.info",
          "bmw.amg-car-ger.info",
          "book.anna-blog.info",
          "bvio85.info",
          "cc-newton.info",
          "chapter1.cc-newton.info",
          "cnt-worth.online",
          "connect-room.online",
          "crysus-h.info",
          "data.live-meet.blog",
          "dmn-for-car.online",
          "exir-juice.online",
          "friends.lizza-blog.info",
          "friends.thomas-mark.xyz",
          "good-student.online",
          "goods-companies.online",
          "google.live-meet.blog",
          "google.live-meet.cfd",
          "google.live-meet.cloud",
          "google.live-meet.info",
          "google.network-show",
          "google.network-show.online",
          "hrd-dmn.info",
          "human-fly900.online",
          "intelligence.live-meet.blog",
          "ip-194-11-226-29.rockhoster.net",
          "isftyviliam.platinum-cnt.info",
          "live-coaching.online",
          "live-conn.online",
          "live-gml.online",
          "live-meet.blog",
          "live-meet.cfd",
          "live-meet.cloud",
          "live-meet.info",
          "live-meet.live",
          "live.connect-room.online",
          "live.goods-companies.online",
          "live.live-coaching.online",
          "live.live-gml.online",
          "live.live-meet",
          "live.live-meet.cloud",
          "live.live-meet.info",
          "live.online-room.online",
          "live.platinum-cnt.info",
          "live.white-life-bl.info",
          "live.yamal-group.online",
          "lizza-blog.info",
          "lynda-tricks.online",
          "mail.bvio85.info",
          "meet-work.info",
          "message-live.online",
          "mickel.connect-room.online",
          "mickel.goods-companies.online",
          "mickel.live-coaching.online",
          "mickel.platinum-cnt.info",
          "mickel.white-life-bl.info",
          "mickel.yamal-group.online",
          "mikel.yamal-group.online",
          "network-show.online",
          "nsim-ph.info",
          "ntp-clock-h.info",
          "online-room.online",
          "oranus.albert-company.online",
          "oranus.connect-room.online",
          "oranus.human-fly900.online",
          "oranus.live-coaching.online",
          "oranus.platinum-cnt.info",
          "oranus.white-life-bl.info",
          "oranus.yamal-group.online",
          "outlook.live.live-meet.cloud",
          "outlook.live.live-meet.info",
          "panel.live-meet.blog",
          "panel.live-meet.cfd",
          "panel.live-meet.cloud",
          "panel.live-meet.info",
          "panel.live-meet.live",
          "panel.network-show.online",
          "pfl.redirect-review.online",
          "ph-crtdomain.info",
          "platinum-cnt.info",
          "prj-ph.info",
          "profile.arizonaclub.me",
          "profile.best85best.online",
          "prt-max.online",
          "rap-art.info",
          "rbconline-support.info",
          "redirect-review.online",
          "richard-3th.online",
          "right.arrow-click.info",
          "rockhoster.net",
          "roland-cc.online",
          "sandbox.live-meet.blog",
          "shadow-network.best",
          "smtp.amg-car-ger.info",
          "spring-club.info",
          "stats.live-meet.blog",
          "steve-brown.info",
          "superset.sandbox.live-meet.blog",
          "thomas-mark.xyz",
          "viliam.albert-company.online",
          "viliam.cnt-worth.online",
          "viliam.connect-room.online",
          "viliam.crysus-h.info",
          "viliam.dmn-for-car.online",
          "viliam.exir-juice.online",
          "viliam.goods-companies.online",
          "viliam.hrd-dmn.info",
          "viliam.human-fly900.online",
          "viliam.live-coaching.online",
          "viliam.live-conn.online",
          "viliam.lynda-tricks.online",
          "viliam.meet-work.info",
          "viliam.message-live.online",
          "viliam.nsim-ph.info",
          "viliam.ntp-clock-h.info",
          "viliam.online-room.online",
          "viliam.ph-crtdomain.info",
          "viliam.platinum-cnt.info",
          "viliam.prj-ph.info",
          "viliam.prt-max.online",
          "viliam.richard-3th.online",
          "viliam.roland-cc.online",
          "viliam.steve-brown.info",
          "viliam.warning-d.info",
          "viliam.wer-d.info",
          "viliam.white-life-bl.info",
          "viliam.work-meeting.info",
          "viliam.yamal-group.online",
          "violet.backback.info",
          "warning-d.info",
          "wer-d.info",
          "white-life-bl.info",
          "work-meeting.info",
          "yamal-group.online"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/Cyberteam008/status/1927915406288695626"
      ],
      "total": 150
    },
    {
      "counts": {
        "domain": 123
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "activehealthlab.azurewebsites.net",
          "activespiritluth.eastus.cloudapp.azure.com",
          "acupuncturebentonville.com",
          "aeroclinicit.azurewebsites.net",
          "airbus.careers-portal.org",
          "airbus.careersworld.org",
          "airbus.germanywork.org",
          "airbus.global-careers.com",
          "airbus.usa-careers.com",
          "airmdsolutions.azurewebsites.net",
          "airtravellog.com",
          "arabiccountriestalent.azurewebsites.net",
          "arabiccountriestalent.com",
          "arabiccountriestalenthr.azurewebsites.net",
          "arabiccountriestalents.azurewebsites.net",
          "arabiccountriestalentshr.azurewebsites.net",
          "asylimed.azurewebsites.net",
          "backsrv66.azurewebsites.net",
          "backsrv74.azurewebsites.net",
          "biolinksystems.azurewebsites.net",
          "boeing-careers.com",
          "cardiomedspecialists.azurewebsites.net",
          "carebytesolutions.azurewebsites.net",
          "careers-hub.org",
          "careers-portal.org",
          "careersworld.org",
          "check-backup-service-179.azurewebsites.net",
          "check-backup-service-288.azurewebsites.net",
          "check-backup-service-736.azurewebsites.net",
          "check-backup-service.azurewebsites.net",
          "clinichaven.azurewebsites.net",
          "cloudaskingquestioning.azurewebsites.net",
          "cloudaskingquestioning.azurewebsites.net.net",
          "cloudaskingquestions.azurewebsites.net.net",
          "cloudaskingquestions.eastus.cloudapp.azure.com",
          "cloudaskingquestions.eastus.cloudapp.azure.com.net",
          "cloudaskquestionanswers.azurewebsites.net",
          "cloudaskquestionanswers.azurewebsites.net.net",
          "cloudaskquestionanswers.com",
          "cloudaskquestionanswers.com.net",
          "cloudaskquestioning.eastus.cloudapp.azure.com",
          "cloudaskquestioning.eastus.cloudapp.azure.com.net",
          "collaboromarketing.com",
          "createformquestionshelper.com",
          "createformquestionshelper.com.net",
          "datasheet96.azurewebsites.net",
          "digicura.azurewebsites.net",
          "digithealthplatform.azurewebsites.net",
          "doctorconsult-app.azurewebsites.net",
          "ehealthpsuluth.com",
          "exchtestchecking.azurewebsites.net",
          "exchtestcheckingapihealth.com",
          "exchtestcheckingapijson.azurewebsites.net",
          "flydubaicareers.ae.org",
          "focusfusion.eastus.cloudapp.azure.com",
          "frameforward.azurewebsites.net",
          "germanywork.org",
          "global-careers.com",
          "gocareers.org",
          "grownehealth.eastus.cloudapp.azure.com",
          "healsanctum.azurewebsites.net",
          "healthbodymonitoring.azurewebsites.net",
          "healthcare-azureapi.azurewebsites.net",
          "healthdataanalyticsrecord.azurewebsites.net",
          "hivemedtech.azurewebsites.net",
          "lensvisionary.azurewebsites.net",
          "mainrepo10.azurewebsites.net",
          "managetools-platform.azurewebsites.net",
          "marsoxygen.azurewebsites.net",
          "masterflexiblecloud.azurewebsites.net",
          "maydaymed.azurewebsites.net",
          "mediasylum.azurewebsites.net",
          "medical-deepresearch.azurewebsites.net",
          "medicalit-imaging.azurewebsites.net",
          "medicoreit.azurewebsites.net",
          "medicpathsolutions.azurewebsites.net",
          "mentalhealth-support-portal.azurewebsites.net",
          "mojavemassageandwellness.com",
          "msnotetask-insights.azurewebsites.net",
          "mstrakcer-tools.azurewebsites.net",
          "nanobreathe.azurewebsites.net",
          "neurocloudhq.azurewebsites.net",
          "nextgenhealthtrack.azurewebsites.net",
          "olemanage-dashboard.azurewebsites.net",
          "oletask-tracker.azurewebsites.net",
          "patient-azureportal.azurewebsites.net",
          "patientcare-portal.azurewebsites.net",
          "pharmainfo.azurewebsites.net",
          "rheinmetall.careers-hub.org",
          "rheinmetall.careersworld.org",
          "rheinmetall.gocareers.org",
          "rheinmetall.theworldcareers.com",
          "rheinmetallcareer.com",
          "rheinmetallcareer.org",
          "rpcconnection.azurewebsites.net",
          "smartapptools.azurewebsites.net",
          "smartmediq.azurewebsites.net",
          "storagewiz.co.azurewebsites.net",
          "sulumorbusinessservices.com",
          "symptom-recordchecker.azurewebsites.net",
          "systemmedicaleducation.azurewebsites.net",
          "tacticalsnap.eastus.cloudapp.azure.com",
          "talenthumanresourcestalent.com",
          "telehealthconnectpro.azurewebsites.net",
          "thecloudappbox.azurewebsites.net",
          "therashelter.azurewebsites.net",
          "thetacticstore.com",
          "theworldcareers.com",
          "totalcaremedcenter.azurewebsites.net",
          "traveltipspage.com",
          "trustedcarehub360.azurewebsites.net",
          "turbulencemd.azurewebsites.net",
          "usa-careers.com",
          "ventilateainest.azurewebsites.net",
          "virgomarketingsolutions.com",
          "virgomarketingsolutions.comtions.com",
          "virtualcliniczone.azurewebsites.net",
          "vitatechlink.azurewebsites.net",
          "vitatechlinks.azurewebsites.net",
          "wellnessfirstgroup.azurewebsites.net",
          "wellnessglowluth.azurewebsites.net",
          "yourfamilymdclinic.azurewebsites.net",
          "zerogmed.azurewebsites.net"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"
      ],
      "total": 123
    },
    {
      "counts": {
        "domain": 80
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "adams-cooling.online",
          "alex-mendez-fire.info",
          "alison624.online",
          "alpha-man.info",
          "becker624.online",
          "bestshopu.online",
          "black-friday-store.online",
          "book-handwrite.online",
          "bracs-lion.online",
          "city-splash.online",
          "clame-rade.online",
          "cloth-model.blog",
          "clothes-show.online",
          "conn-ectionor.cfd",
          "cook-tips.info",
          "course-math.info",
          "crysus-p.info",
          "cyberlattice.pro",
          "dmn-for-hall.online",
          "door-black-meter.online",
          "encryption-redirect.online",
          "est5090.online",
          "everything-here.info",
          "expressmarket.online",
          "first-course.online",
          "food-tips-blog.online",
          "gallery-shop.online",
          "good-news.cfd",
          "good-news.fashion",
          "healthy-lifestyle.fit",
          "idea-home.online",
          "infinit-world.info",
          "lenan-rex.online",
          "lesson-first.info",
          "live-content.online",
          "live-message.online",
          "loads-ideas.online",
          "make-house.online",
          "master-club.info",
          "network-game.xyz",
          "network-review.xyz",
          "network-show-a.online",
          "nice-goods.online",
          "normal-dmn.info",
          "nsim-pa.info",
          "ntp-clock-p.info",
          "optio-nalynk.online",
          "pa-crtdomain.info",
          "panel-meeting.info",
          "panel-network.online",
          "panel-redirect.online",
          "ph-work.info",
          "pnl-worth.online",
          "prj-pa.info",
          "ptr-cc.online",
          "ques-tion-ing.xyz",
          "reading-course.online",
          "reg-d.info",
          "ricardo-mell.online",
          "royalsoul.online",
          "sendly-ink.shop",
          "shaer-likn.store",
          "show-verify.xyz",
          "sky-writer.online",
          "socks.beauty",
          "stadium-fresh.online",
          "storm-wave.online",
          "suite-moral.info",
          "teammate-live.online",
          "tomas-company.online",
          "top-game.online",
          "ude-final.online",
          "warplogic.pro",
          "wash-less.online",
          "white-car.online",
          "white-life.info",
          "wood-house.online",
          "word-course.online",
          "world-shop.online",
          "zra-roll.online"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://research.checkpoint.com/2025/iranian-educated-manticore-targets-leading-tech-academics/"
      ],
      "total": 80
    },
    {
      "counts": {
        "domain": 59
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "alpha-meet.online",
          "alpha-met.online",
          "arcanet.online",
          "azdava.online",
          "besatoo.online",
          "book.kuret-live.online",
          "cppsg.online",
          "dmn-inter.online",
          "ell-safe.online",
          "go0gle.online",
          "into-support.online",
          "kuret-live.online",
          "live-board.online",
          "live.besatoo.online",
          "look-together-online.online",
          "meet.azdava.online",
          "meet.ell-safe.online",
          "meet.go0gle.online",
          "meet.proof-video.online",
          "meet.video-connect.online",
          "mickel.besatoo.online",
          "online-speak.online",
          "oranus.besatoo.online",
          "owner-rate.online",
          "p-safe.online",
          "proof-video.online",
          "robinthing123.online",
          "rohand63.xyz",
          "safe-lord.online",
          "superlite.online",
          "tensore.online",
          "teslator.online",
          "toolfare.online",
          "video-connect.online",
          "viliam-live-identity.online",
          "viliam.alpha-meet.online",
          "viliam.alpha-met.online",
          "viliam.arcanet.online",
          "viliam.azdava.online",
          "viliam.besatoo.online",
          "viliam.cppsg.online",
          "viliam.dmn-inter.online",
          "viliam.into-support.online",
          "viliam.kuret-live.online",
          "viliam.kuret-met.online",
          "viliam.live-board.online",
          "viliam.look-together-online.online",
          "viliam.online-speak.online",
          "viliam.owner-rate.online",
          "viliam.p-safe.online",
          "viliam.robinthing123.online",
          "viliam.rohand63.xyz",
          "viliam.safe-lord.online",
          "viliam.superlite.online",
          "viliam.tensore.online",
          "viliam.teslator.online",
          "viliam.toolfare.online",
          "viliam.viliam-live-identity.online",
          "villiam.online-speak.online"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/4rchib4ld/status/1972582381275275498",
        "https://www.stormshield.com/news/apt35-plays-same-music-again/",
        "https://www.virustotal.com/gui/ip-address/79.132.131.184/relations",
        "https://www.virustotal.com/gui/ip-address/84.200.193.20/relations"
      ],
      "total": 59
    },
    {
      "counts": {
        "domain": 40
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "accountroyal.com",
          "airbus-careers.onlyoffice.com",
          "airbus-survay.onlyoffice.com",
          "airbusaerodefence.com",
          "airbusaerodefence.nl",
          "airbusgroup-careers.com",
          "airbushiring.com",
          "alwayslivehealthy.com",
          "anteromarketing.com",
          "asiandefenses.com",
          "bodywellnessbycynthia.com",
          "boeinginformation.onlyoffice.com",
          "boeingspace.com",
          "chakracleansetherapy.com",
          "clearmindhealthandwellness.com",
          "droneflywell.com",
          "dronetechasia.org",
          "easymarketing101.com",
          "emiratescareers.org",
          "emiratesgroup-careers.com",
          "flydubai-careers.com",
          "healthiestmama.com",
          "healthinfusiontherapy.com",
          "jadehealthcenter.com",
          "joinboeing.com",
          "kibanacore.com",
          "malebachhew2506090936.onlyoffice.com",
          "marketinglw.com",
          "msnapp.help",
          "msnapp.live",
          "msnclouds.com",
          "opportunities2get.com",
          "palaerospace.careers",
          "randcorp.onlyoffice.com",
          "rheinmetallcareer.onlyoffice.com",
          "rheinmetallcareers.com",
          "thecareershub.org",
          "uavnodes.com",
          "worldcareers.org",
          "zytonhealth.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.proofpoint.com/us/blog/threat-insight/crossed-wires-case-study-iranian-espionage-and-attribution"
      ],
      "total": 40
    },
    {
      "counts": {
        "domain": 31
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "agm-rto-ewi.com",
          "brannew-home.info",
          "dazedebtor.com",
          "emv1.brannew-home.info",
          "emv1.newsaboutecology.info",
          "get-ready.blog",
          "ismywhs.com.de",
          "mail.brannew-home.info",
          "meet-online.site",
          "meet-room.site",
          "meetime.info",
          "meeting-invite.live",
          "meeting-room.live",
          "meeting-time.info",
          "meetingonline.live",
          "meetingzone.info",
          "meetland.info",
          "meetonline.pro",
          "meot-roem.online",
          "newsaboutecology.info",
          "ns2.brannew-home.info",
          "ns2.newsaboutecology.info",
          "populationnote.com",
          "room-online.one",
          "sejoinu.cc",
          "shrtlink.space",
          "shrtlnk.info",
          "snap-short.online",
          "stablis.online",
          "verifymeet.live",
          "wwwlmeetic.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/Cyberteam008/status/1919571782983356563"
      ],
      "total": 31
    },
    {
      "counts": {
        "domain": 25
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "1stl.ink",
          "ace-capitalpartners.ddns.net",
          "beetly.online",
          "bytli.ink",
          "centrallibrary.bounceme.net",
          "consistent-provisioned.accesscam.org",
          "electrons-residingonthemoon.info",
          "enovation-affirm.theworkpc.com",
          "eventer.ink",
          "filevisitresult.site",
          "implemen-tmeasures.myftp.org",
          "internationalbester.ddns.net",
          "mobile.proctor-custodian.site",
          "mobile.shorten-abbreviate.site",
          "msnl.ink",
          "outstanding.revstoragefile.site",
          "proctor-custodian.site",
          "reproduce.outstanding.revstoragefile.site",
          "revstoragefil.ddns.net",
          "revstoragefile.ddns.net",
          "revstoragefile.site",
          "short-abbreviate.info",
          "shorten-abbreviate.site",
          "shortlycc.site",
          "supervisor-protector.online"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/ThreatBookLabs/status/1957276288944918620",
        "https://app.validin.com/detail?find=WIN-46MPMA44ISV&type=raw&ref_id=777b5254d85#tab=host_pairs",
        "https://app.validin.com/detail?find=185.132.176.236&type=ip4&ref_id=1013ff6b648#tab=resolutions",
        "https://app.validin.com/detail?find=185.132.176.27&type=ip4&ref_id=1013ff6b648#tab=resolutions"
      ],
      "total": 25
    },
    {
      "counts": {
        "domain": 23
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "auto-updater.azurewebsites.net",
          "background-update.azurewebsites.net",
          "cache-cleaner-check-111.azurewebsites.net",
          "cache-cleaner-check-805.azurewebsites.net",
          "cache-cleaner-check-926.azurewebsites.net",
          "cache-cleaner-check.azurewebsites.net",
          "cache-managment.northeurope.cloudapp.azure.com",
          "check-security-update.azurewebsites.net",
          "group-policy-update.azurewebsites.net",
          "hyperv-heartbeat-service.azurewebsites.net",
          "patch-provider-247.azurewebsites.net",
          "patch-provider-597.azurewebsites.net",
          "patch-provider-745.azurewebsites.net",
          "patch-provider.azurewebsites.net",
          "safrangroup-careers.com",
          "send-feedback-296.azurewebsites.net",
          "send-feedback-413.azurewebsites.net",
          "send-feedback-838.azurewebsites.net",
          "send-feedback.azurewebsites.net",
          "services-update-check.azurewebsites.net",
          "telespazio-careers.com",
          "update-health-service.azurewebsites.net",
          "verify-publisher.azurewebsites.net"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://catalyst.prodaft.com/public/report/subtle-snail-expands-espionage-campaign-to-european-telecom-organizations",
        "https://github.com/prodaft/malware-ioc/tree/master/SubtleSnail"
      ],
      "total": 23
    },
    {
      "counts": {
        "domain": 20
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "bdroyer.webredirect.org",
          "bouncer.qc.to",
          "cloud.qc.to",
          "continue-short.ddns.net",
          "db.qc.to",
          "fdns1.duckdns.org",
          "gc.n-e.kr",
          "i-love-tux.qc.to",
          "miniurl.duckdns.org",
          "my.abrdns.com",
          "rb1chesid8.ocry.com",
          "rb2chesid8.otzo.com",
          "shortener.ddns.net",
          "shorter.kozow.com",
          "sites.bounceme.net",
          "tinygo.duckdns.org",
          "tracking.ns02.info",
          "updatedisplacement.ddns.net",
          "viewfileitems.myftp.org",
          "websites.freemyip.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://app.validin.com/detail?find=URL%20Shortener&type=raw&ref_id=7eee58f2849#tab=host_pairs (# 2025-08-18)"
      ],
      "total": 20
    },
    {
      "counts": {
        "domain": 14,
        "url": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "academy-update.com",
          "bookstoragestore.com",
          "cloudtransferfile.info",
          "commercialstudio.ddns.net",
          "computerlearning.ddns.net",
          "creating-loceer.ddns.net",
          "holyicker.ddns.net",
          "lastfilterfile.info",
          "publicreservoir.info",
          "research-storage.com",
          "searchfilterapp.info",
          "starmanblind.ddns.net",
          "tepbit.site",
          "timtechlab.duckdns.org"
        ],
        "url": [
          "http://185.153.197.236"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/blackorbird/status/1920061952459518406",
        "https://mp.weixin.qq.com/s/nY2Hyg6ZsM7ViXW1lhO2Ag",
        "https://app.validin.com/detail?find=2c2951f9c795c19412bf900f8e0ea00e&type=hash#tab=host_pairs (# 2025-04-25)",
        "https://app.validin.com/detail?find=Thoughts%20and%20Reflections%20-%20A%20Personal%20Blog&type=raw&ref_id=b7e5679da39#tab=host_pairs (# 2025-05-07)",
        "https://www.virustotal.com/gui/ip-address/185.182.194.175/relations",
        "https://www.virustotal.com/gui/ip-address/31.42.176.171/relations",
        "https://www.virustotal.com/gui/ip-address/78.159.117.177/relations",
        "https://www.virustotal.com/gui/ip-address/78.159.117.175/relations",
        "https://www.virustotal.com/gui/ip-address/91.107.155.179/relations"
      ],
      "total": 15
    },
    {
      "counts": {
        "domain": 11
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "file-review.hopto.org",
          "fileviewitems.myftp.org",
          "first-myshortel.ddns.net",
          "interactive-view.myftp.org",
          "javedpension.is-a-good.dev",
          "licentiegegevens.ddns.net",
          "onwards-gerencia.ddns.net",
          "rb4chesid8.serveuser.com",
          "shorten-abbreviate.ddns.net",
          "shortfile-interactive.webredirect.org",
          "videozoom.ddns.net"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/ThreatBookLabs/status/1968132855827181901",
        "https://www.virustotal.com/gui/ip-address/185.132.176.27/relations",
        "https://www.virustotal.com/gui/ip-address/185.182.194.50/relations",
        "https://app.validin.com/detail?find=%3A%3A%22og%3Atitle%22%3A%22title%22%3A%22ShortURL%20-%20URL%20Shortener%22&type=raw&ref_id=9b9c611b5fd#tab=host_pairs (# 2025-09-17)"
      ],
      "total": 11
    },
    {
      "counts": {
        "domain": 9,
        "ipv4": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "ameen-alkhalij.com",
          "ameen-alkhalij.is",
          "ameen-alkhalij.nu",
          "ameen-alkhalij.org",
          "ameen-alkhalij.se",
          "musalas.se",
          "quickmath-solver.site",
          "redfoxteeth.site",
          "shopleta.ru"
        ],
        "ipv4": [
          "179.43.177.130:3333"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/skocherhan/status/1973278284906635640",
        "https://www.virustotal.com/gui/file/0596554b58c644d42d44ba24c7b6c31a7b8999f77672cb430e6f6a006c022bdc/detection",
        "https://www.virustotal.com/gui/file/48883dcbac14e1f57613f482ec69b1a50458c8fd59e78a5ce66b988bf4a06347/detection",
        "https://www.virustotal.com/gui/file/5b1b7d9c5f08d67834dcb8d15a25941363441b235dd82bface19588ece8a9841/detection",
        "https://www.virustotal.com/gui/file/c8baf145f2f586167ed108eca143ce4d2b86af8df050a226959fcb172462cd0a/detection"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 10
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "bbmovements.com",
          "cavinet.org",
          "israel-talent.com",
          "israel-talent.xyz",
          "kanplus.org",
          "moses-staff.io",
          "moses-staff.to",
          "secnetdc.com",
          "tecret.com",
          "termite.nu"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://dti.domaintools.com/the-apt35-dump-episode-4-leaking-the-backstage-pass-to-an-iranian-intelligence-operation/"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "cacademy-update.com",
          "ccreservoir.info",
          "cholyicker.ddns.net",
          "cresearch-storage.com",
          "csearchfilterapp.info"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/skocherhan/status/1932952171122737290"
      ],
      "total": 5
    },
    {
      "counts": {
        "ipv4": 3,
        "url": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "ipv4": [
          "103.57.251.153:2000",
          "103.57.251.153:443",
          "212.175.168.58:443"
        ],
        "url": [
          "http://212.175.168.58"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/blackorbird/status/1992075483836744154",
        "https://dti.domaintools.com/threat-intelligence-report-apt35-internal-leak-of-hacking-campaigns-against-lebanon-kuwait-turkey-saudi-arabia-korea-and-domestic-iranian-targets/"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "acconut-mail.com",
          "entrpreneur.org",
          "pay.entrpreneur.org",
          "signin-identifi.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.validin.com/blog/expanding-apt42-intelligence-with-validin/"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "share.veracity-revision.info",
          "shortener-abbreviate.info",
          "veracity-revision.info"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://app.validin.com/detail?find=%3A%3A%22og%3Atitle%22%3A%22title%22%3A%22ShortURL%20-%20URL%20Shortener%22&type=raw&ref_id=9b9c611b5fd#tab=host_pairs (# 2025-09-17)"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1,
        "url": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "mywebdout.ddns.net"
        ],
        "url": [
          "http://185.132.176.240"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/salmanvsf/status/1930185668560597209",
        "https://www.virustotal.com/gui/ip-address/185.132.176.240/relations",
        "https://www.virustotal.com/gui/file/f54dc4b91383d84e0a51fee2e232916da8899a7b7b39f91a782af8ef17f15d02/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "drives.googles.site",
          "googles.site"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://community.emergingthreats.net/t/ruleset-update-summary-2025-03-12-v10877/2511"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "hotchichenfly.info"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1971653625274683671",
        "https://x.com/volrant136/status/1971654091656122835"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "ipv4": [
          "94.156.128.60:5252"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/file/9146f8c1e0a88d961e5d1b6ac4633506c6e904e4cdf4c36ac5c1b5bd44867628/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "healthcarefluent.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/",
        "https://www.proofpoint.com/us/blog/threat-insight/crossed-wires-case-study-iranian-espionage-and-attribution"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2025-01-11",
      "indicators": {
        "domain": [
          "rhealthylivingsolutions.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.proofpoint.com/us/blog/threat-insight/crossed-wires-case-study-iranian-espionage-and-attribution"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2025-01-04",
      "indicators": {
        "domain": [
          "apple-ads-metric.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.certfa.com/posts/fake-interview-the-new-activity-of-charming-kitten/",
        "https://otx.alienvault.com/pulse/5e3acf325495b5e504f82abc",
        "https://www.virustotal.com/gui/ip-address/144.202.123.86/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1,
        "url": 1
      },
      "first_seen": "2024-12-27",
      "indicators": {
        "ipv4": [
          "188.165.174.199:18080"
        ],
        "url": [
          "http://88.80.148.162"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.bitdefender.com/en-us/blog/businessinsights/unpacking-bellaciao-a-closer-look-at-irans-latest-malware"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 35
      },
      "first_seen": "2024-12-17",
      "indicators": {
        "domain": [
          "dash.shortoni.live",
          "emv1.short-jg934hw.live",
          "emv1.short-rigf.live",
          "emv1.statuss-short-join.live",
          "fazadi.info",
          "ftur-sher.online",
          "live-join-short.online",
          "mrz.fazadi.info",
          "redirect-b.online",
          "redirect-c.live",
          "redirect-d.online",
          "redirect-k.online",
          "redirect-l.online",
          "redirect-m.live",
          "redirect-o.online",
          "redirect-p.online",
          "redirect-q.online",
          "redirect-r.online",
          "redirect-s.online",
          "redirect-t.online",
          "redirect-u.online",
          "room-meet-url.live",
          "sh-tro.live",
          "sho-flu.live",
          "shor-erier-f.xyz",
          "shor-fg.live",
          "shor-trv.live",
          "short-join-live.online",
          "short-redirect.online",
          "short-view-url.online",
          "shr-r4yr93d.live",
          "sht-rgtio9.live",
          "statuss-short-join.live",
          "url-room-meet.live",
          "visit-site-online.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/Cyberteam008/status/1868875414510485876"
      ],
      "total": 35
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-12-14",
      "indicators": {
        "domain": [
          "transfer-filterless.ddns.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/Cyberteam008/status/1866677248587337914",
        "https://x.com/ValidinLLC/status/1867193831612985822",
        "https://en.fofa.info/result?qbase64=dGl0bGU9PSJVUkwgU2hvcnRlbmVyIiAmJiBpY29uX2hhc2g9IjE5MDgxNDcxMjEi"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 10
      },
      "first_seen": "2024-12-11",
      "indicators": {
        "domain": [
          "allocationwithour.info",
          "conveniente-sharefile.info",
          "emv1.allocationwithour.info",
          "filterfiletransfer.hopto.org",
          "filtertransferfile.online",
          "loss-modification.site",
          "ns2.allocationwithour.info",
          "recognizedshare.site",
          "transfer.loss-modification.site",
          "viewfileitems.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/Cyberteam008/status/1866677248587337914",
        "https://x.com/ValidinLLC/status/1867193831612985822",
        "https://en.fofa.info/result?qbase64=dGl0bGU9PSJVUkwgU2hvcnRlbmVyIiAmJiBpY29uX2hhc2g9IjE5MDgxNDcxMjEi"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 5,
        "url": 3
      },
      "first_seen": "2024-11-18",
      "indicators": {
        "domain": [
          "gamershotel.pro"
        ],
        "ipv4": [
          "194.11.226.9:443",
          "194.4.49.175:443",
          "45.143.167.87:443",
          "46.249.58.136:4444",
          "46.249.58.136:8080"
        ],
        "url": [
          "http://194.11.226.9",
          "http://194.4.49.175",
          "http://45.143.167.87"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/HostileSpectrum/status/1722628312013660665",
        "https://x.com/k3yp0d/status/1852051018181452143",
        "https://www.virustotal.com/gui/ip-address/45.143.167.87/relations",
        "https://www.ic3.gov/CSA/2024/241030.pdf",
        "https://research.checkpoint.com/2024/wezrat-malware-deep-dive/",
        "https://www.virustotal.com/gui/file/4431b2a4d7758907f81fb1a0c1e36b2ce03e08d43123b1c398487770afd20727/detection",
        "https://www.virustotal.com/gui/file/e37b95bb9bee64cc0313eaad8a0269493745f89413bd78b58bb3b479b36084ae/detection",
        "https://www.virustotal.com/gui/file/a624768f28ca66e82cb5d157e5ddd427644e903476099ef0d155ab1f426da8a3/detection",
        "https://www.virustotal.com/gui/file/84366a894120d4a8c83411925ef04de52fa56da6fad0023a71f71a9bf21259ad/detection"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 9
      },
      "first_seen": "2024-10-31",
      "indicators": {
        "domain": [
          "cybercourt.io",
          "il-cert.net",
          "onlinelive.info",
          "pro-today.org",
          "rgud-group.com",
          "rgud-group.net",
          "zeusistalking.com",
          "zeusistalking.io",
          "zeusistalking.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/HostileSpectrum/status/1722628312013660665",
        "https://x.com/k3yp0d/status/1852051018181452143",
        "https://www.virustotal.com/gui/ip-address/45.143.167.87/relations",
        "https://www.ic3.gov/CSA/2024/241030.pdf",
        "https://research.checkpoint.com/2024/wezrat-malware-deep-dive/",
        "https://www.virustotal.com/gui/file/4431b2a4d7758907f81fb1a0c1e36b2ce03e08d43123b1c398487770afd20727/detection",
        "https://www.virustotal.com/gui/file/e37b95bb9bee64cc0313eaad8a0269493745f89413bd78b58bb3b479b36084ae/detection",
        "https://www.virustotal.com/gui/file/a624768f28ca66e82cb5d157e5ddd427644e903476099ef0d155ab1f426da8a3/detection",
        "https://www.virustotal.com/gui/file/84366a894120d4a8c83411925ef04de52fa56da6fad0023a71f71a9bf21259ad/detection"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2024-10-30",
      "indicators": {
        "domain": [
          "careers2find.com",
          "cdn.careers2find.com",
          "quiz.careers2find.com",
          "xboxapicenter.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1851438224834433154",
        "https://x.com/ClearskySec/status/1856268257734410647",
        "https://x.com/asdasd13asbz/status/1851513587967078410",
        "https://www.clearskysec.com/wp-content/uploads/2024/11/Iranian-Dream-Job-ver1.pdf",
        "https://www.virustotal.com/gui/file/4e27556432464375a9016a410b6eef586f3a27377424ffc09f40eb252af144a2/detection",
        "https://www.virustotal.com/gui/file/918e70e3f5fdafad28effd512b2f2d21c86cb3d3f14ec14f7ff9e7f0760fd760/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 52
      },
      "first_seen": "2024-09-30",
      "indicators": {
        "domain": [
          "3dconfirrnation.com",
          "accesscheckout.online",
          "accessverification.online",
          "accunt-loqin.ml",
          "accurateprivacy.online",
          "atlantic-council.com",
          "boom-boom.ga",
          "bytli.us",
          "continue-to-your-account.000webhostapp.com",
          "covi19questionaire.000webhostapp.com",
          "covid19questionnaire.freesite.vip",
          "css-ethz.ch",
          "cutly.vip",
          "daemon-mailer.com",
          "direct-access.info",
          "discovery-protocol.ml",
          "docfileview.org",
          "doctransfer.online",
          "dr-sup.live",
          "email-protection.online",
          "file-access.com",
          "filetransfer.club",
          "freahman.online",
          "freshconnect.live",
          "gdrive-files.com",
          "gettogether.quest",
          "gl-sup.online",
          "gm-sup.com",
          "idccovid19questionaire.000webhostapp.com",
          "ipsss.000webhostapp.com",
          "linkauthenticator.online",
          "lovetoflight.com",
          "lst-accurate.com",
          "ltf.world",
          "mailer-daemon.site",
          "mailer-support.online",
          "mailerdaemon.info",
          "mfa-ic.ae",
          "mofa-ic.ae",
          "private-file-sharing.000webhostapp.com",
          "qmaiil.ml",
          "reactivate-disabled-accuonts.000webhostapp.com",
          "redirect-drive.online",
          "shared-files-access.live",
          "sharefilesonline.live",
          "summit-files.com",
          "tinyurl.co.il",
          "tinyurl.live",
          "uani.us",
          "verificationservice.online",
          "workstation2020.000webhostapp.com",
          "www-myaccounts-support.000webhostapp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/blackorbird/status/1840667306583572653",
        "https://www.ic3.gov/Media/News/2024/240927.pdf",
        "https://www.resecurity.com/blog/article/iranian-cyber-actors-irgc-targeting-the-2024-us-presidential-election"
      ],
      "total": 52
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2024-09-30",
      "indicators": {
        "domain": [
          "destinationreferrer.serveirc.com",
          "essential-overview.sytes.net",
          "featurespace.ooguy.com",
          "featurespace.serveblog.net",
          "pagerenderstatus.info",
          "usabilitystatus.servehttp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?find=38.180.91.190&type=ip4&ref_id=96da503d30d#tab=resolutions"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2024-09-30",
      "indicators": {
        "domain": [
          "cloudviewer.site",
          "directpathfellow.zapto.org",
          "formcloud.redirectme.net",
          "launchmeetprofile.servehttp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/k3yp0d/status/1840762048826728893",
        "https://app.validin.com/detail?type=ip&find=38.180.91.211#tab=resolutions",
        "https://www.gov.il/BlobFolder/reports/alert_1803/he/ALERT-CERT-IL-W-1803.pdf"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2024-09-30",
      "indicators": {
        "domain": [
          "cloudcomputing.webredirect.org",
          "matchtomeet.ddns.net",
          "mycloudhosting.redirectme.net",
          "zoomcloud.redirectme.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?find=38.180.91.195&type=ip4&ref_id=96da503d30d#tab=resolutions"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2024-09-30",
      "indicators": {
        "domain": [
          "flashpointfarm.gotdns.ch",
          "main-packages.strangled.net",
          "navigationtools.site"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?find=38.180.91.193&type=ip4&ref_id=96da503d30d#tab=resolutions"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2024-09-30",
      "indicators": {
        "domain": [
          "hardbookshelf.ooguy.com",
          "myselfdatahistory.serveirc.com",
          "realcdnworker.site"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?find=38.180.91.184&type=ip4&ref_id=96da503d30d#tab=resolutions"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2024-09-30",
      "indicators": {
        "domain": [
          "sublimetxtcontent.serveblog.net",
          "virtual-notes.gotdns.ch",
          "workspaceconsole.servehttp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?find=38.180.91.175&type=ip4&ref_id=96da503d30d#tab=resolutions"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-09-30",
      "indicators": {
        "domain": [
          "entrydirect.ddns.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?find=38.180.91.206&type=ip4&ref_id=96da503d30d#tab=resolutions"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 9
      },
      "first_seen": "2024-09-05",
      "indicators": {
        "domain": [
          "autoupdate.uk",
          "freeheadlines.top",
          "mail-update.info",
          "ns2.freeheadlines.top",
          "ns2.servicechecker.top",
          "servicechecker.top",
          "servicepackupdate.info",
          "servicesupdate.info",
          "systemupdate.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://harfanglab.io/insidethelab/cyclops-replacement-bellaciao/"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 35
      },
      "first_seen": "2024-08-29",
      "indicators": {
        "domain": [
          "azadijobs.me",
          "beparas.com",
          "bilal1com.com",
          "damavand-hr.me",
          "damkahill.com",
          "darakeh.me",
          "dream-jobs.org",
          "dream-jobs.vip",
          "dreamy-job.com",
          "dreamy-jobs.com",
          "dreamycareer.com",
          "golanjobs.me",
          "hat-cast.com",
          "irnjobs.me",
          "joinoptimahr.com",
          "jomehjob.com",
          "kandovani.org",
          "opthrltd.me",
          "optima-hr.com",
          "parasil.me",
          "radabala.com",
          "rostam-hr.vip",
          "salamjobs.me",
          "shirazicom.com",
          "syrtime.me",
          "titanium-hr.com",
          "topiranjobs.me",
          "topwor4u.com",
          "trnjobs.me",
          "vipjobsglobal.com",
          "wazayif-halima.com",
          "wazayif-halima.org",
          "wehatcast.com",
          "youna101.me",
          "younamesh.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/k3yp0d/status/1650513653802708996",
        "https://cloud.google.com/blog/topics/threat-intelligence/uncovering-iranian-counterintelligence-operation"
      ],
      "total": 35
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2024-08-28",
      "indicators": {
        "domain": [
          "cspvpn.duckdns.org",
          "em-payments-bot.duckdns.org",
          "empaymentsbot.duckdns.org",
          "vpncsp.duckdns.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/k3yp0d/status/1828699405056180664",
        "https://www.virustotal.com/gui/ip-address/38.180.111.244/relations",
        "https://app.validin.com/detail?find=38.180.111.244&type=ip4&ref_id=86db3c91efa#tab=resolutions"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-08-28",
      "indicators": {
        "domain": [
          "zedisdead.duckdns.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?find=38.180.111.246&type=ip4&ref_id=c6b5b76ecdb#tab=resolutions"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-08-27",
      "indicators": {
        "domain": [
          "app-engage-station.help",
          "re-brandly.store"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.google/threat-analysis-group/iranian-backed-group-steps-up-phishing-campaigns-against-israel-us/",
        "https://app.validin.com/detail?find=135.181.203.1&type=ip4&ref_id=7bb26af05d1#tab=resolutions",
        "https://app.validin.com/detail?find=212.162.152.151&type=ip4&ref_id=ea7526bb584#tab=resolutions",
        "https://app.validin.com/detail?find=38.180.121.133&type=ip4&ref_id=f79dde040dd#tab=resolutions",
        "https://app.validin.com/detail?find=66.151.40.83&type=ip4&ref_id=45cc7c174db#tab=resolutions",
        "https://app.validin.com/detail?find=66.151.40.84&type=ip4&ref_id=d413894d497#tab=resolutions",
        "https://www.virustotal.com/gui/file/f83e2b3be2e6db20806a4b9b216edc7508fa81ce60bf59436d53d3ae435b6060/detection",
        "https://www.virustotal.com/gui/file/f1819b6aed24b81e6432a6d738206a388c266f72dbde4a8f4a4b9b6e3c55e609/detection",
        "https://www.virustotal.com/gui/file/89c1d1b61d7f863f8a651726e29f2ae3de7958f36b49a756069021817947d06c/detection",
        "https://www.virustotal.com/gui/file/0180f4f29c550aa1ffaa21af51711b29de99fb1d7c932d008a0e9356ae8a7d60/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "ipv4": 1,
        "url": 1
      },
      "first_seen": "2024-08-23",
      "indicators": {
        "ipv4": [
          "190.2.150.50:443"
        ],
        "url": [
          "http://190.2.150.50"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/c67cd544a112cab1bb75b3c44df4caf2045ef0af51de9ece11261d6c504add32/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-08-23",
      "indicators": {
        "domain": [
          "s4api.shop"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.google/threat-analysis-group/iranian-backed-group-steps-up-phishing-campaigns-against-israel-us/",
        "https://app.validin.com/detail?find=135.181.203.1&type=ip4&ref_id=7bb26af05d1#tab=resolutions",
        "https://app.validin.com/detail?find=212.162.152.151&type=ip4&ref_id=ea7526bb584#tab=resolutions",
        "https://app.validin.com/detail?find=38.180.121.133&type=ip4&ref_id=f79dde040dd#tab=resolutions",
        "https://app.validin.com/detail?find=66.151.40.83&type=ip4&ref_id=45cc7c174db#tab=resolutions",
        "https://app.validin.com/detail?find=66.151.40.84&type=ip4&ref_id=d413894d497#tab=resolutions",
        "https://www.virustotal.com/gui/file/f83e2b3be2e6db20806a4b9b216edc7508fa81ce60bf59436d53d3ae435b6060/detection",
        "https://www.virustotal.com/gui/file/f1819b6aed24b81e6432a6d738206a388c266f72dbde4a8f4a4b9b6e3c55e609/detection",
        "https://www.virustotal.com/gui/file/89c1d1b61d7f863f8a651726e29f2ae3de7958f36b49a756069021817947d06c/detection",
        "https://www.virustotal.com/gui/file/0180f4f29c550aa1ffaa21af51711b29de99fb1d7c932d008a0e9356ae8a7d60/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2024-08-21",
      "indicators": {
        "domain": [
          "deepspaceocean.info",
          "hoticecream.ddns.net",
          "pencilbrush.ddns.net",
          "pinnaclegen.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.proofpoint.com/us/blog/threat-insight/best-laid-plans-ta453-targets-religious-figure-fake-podcast-invite-delivering",
        "https://app.validin.com/detail?find=6d7b0b16f0cbad033ee08e6b414f02fd&type=hash&ref_id=015842d48f4#tab=host_pairs_v2",
        "https://www.virustotal.com/gui/ip-address/54.39.143.120/relations"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 100
      },
      "first_seen": "2024-08-20",
      "indicators": {
        "domain": [
          "activeeditor.info",
          "admin.cheap-case.site",
          "api.cheap-case.site",
          "api.overall-continuing.site",
          "app.cheap-case.site",
          "backend.cheap-case.site",
          "callfeedback.duia.ro",
          "carservices.dns-dynamic.net",
          "chatsynctransfer.info",
          "cheap-case.site",
          "cloudarchive.info",
          "cloudregionpages.info",
          "cloudtools.duia.eu",
          "coldwarehexahash.dns-dynamic.net",
          "configtools.linkpc.net",
          "contentpreview.redirectme.net",
          "continue.duia.eu",
          "continueresource.forumz.info",
          "currentpageeditor.dns-dynamic.net",
          "demo.cheap-case.site",
          "destinationzone.duia.eu",
          "dev.cheap-case.site",
          "directfileinternal.info",
          "doceditor.duckdns.org",
          "documentcloudeditor.ddnsgeek.com",
          "dynamicrender.line.pm",
          "dynamictranslator.ddnsgeek.com",
          "editioncloudfiles.dns-dynamic.net",
          "entryconfirmation.duckdns.org",
          "fileeditiontools.linkpc.net",
          "filereader.dns-dynamic.net",
          "finaledition.redirectme.net",
          "highlightsreview.line.pm",
          "hugmefirstddd.ddns.net",
          "icegelato.ddns.net",
          "icenotebook.ddns.net",
          "itemselectionmode.info",
          "joincloud.duckdns.org",
          "joincloud.mypi.co",
          "lineeditor.001www.com",
          "lineeditor.32-b.it",
          "lineeditor.mypi.co",
          "linereview.duia.eu",
          "longlivefreedom.ddns.net",
          "messagepending.info",
          "minascs.ddns.net",
          "mobiletoolssdk.dns-dynamic.net",
          "nextbox.line.pm",
          "nextcloud.duia.us",
          "nextcloudzone.dns-dynamic.net",
          "onetimestorage.info",
          "onlinecalendar.ddnsgeek.com",
          "onlinecloudzone.info",
          "onlinereader.linkpc.net",
          "overall-continuing.site",
          "overflow.duia.eu",
          "pagerender.duckdns.org",
          "pagerendercloud.linkpc.net",
          "pageviewer.linkpc.net",
          "personalcloudparent.info",
          "personalstoragebox.linkpc.net",
          "personalwebview.info",
          "pkglessplans.xyz",
          "preparingdestination.fixip.org",
          "proceeddestination.dns-dynamic.net",
          "projectdrivevirtualcloud.co.uk",
          "readquickarticle.dns-dynamic.net",
          "realcloud.info",
          "realpage.redirectme.net",
          "researchdocument.info",
          "reviewedition.duia.eu",
          "rozetka.dyndns.org",
          "s1vega.dyndns.org",
          "searchstatistics.duckdns.org",
          "selfpackage.info",
          "servicesfiledrop.theworkpc.com",
          "sharestoredocs.theworkpc.com",
          "smartview.dns-dynamic.net",
          "softservicetel.ddns.net",
          "sourceusedirection.mypi.co",
          "splitviewer.linkpc.net",
          "storageprovider.duia.eu",
          "streaml23.duia.eu",
          "synctimezone.dns-dynamic.net",
          "termsstatement.duckdns.org",
          "testecs48.ddns.net",
          "thisismyapp.accesscam.org",
          "thisismydomain.chickenkiller.com",
          "timelinepage.dns-dynamic.net",
          "timezone-update.duckdns.org",
          "towerreseller.dns-dynamic.net",
          "tracedestination.duia.eu",
          "translatorupdater.dns-dynamic.net",
          "uptime-timezone.dns-dynamic.net",
          "uptimezonemetadta.run.place",
          "vector.kozow.com",
          "vegas777.dyndns.org",
          "viewdestination.vpndns.net",
          "webviewerpage.info",
          "worldstate.duia.us"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/RecordedFuture/status/1825867926043312398",
        "https://go.recordedfuture.com/hubfs/reports/cta-ir-2024-0820.pdf"
      ],
      "total": 100
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-08-16",
      "indicators": {
        "domain": [
          "essential-guide.serveirc.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.google/threat-analysis-group/iranian-backed-group-steps-up-phishing-campaigns-against-israel-us/",
        "https://app.validin.com/detail?find=135.181.203.1&type=ip4&ref_id=7bb26af05d1#tab=resolutions",
        "https://app.validin.com/detail?find=212.162.152.151&type=ip4&ref_id=ea7526bb584#tab=resolutions",
        "https://app.validin.com/detail?find=38.180.121.133&type=ip4&ref_id=f79dde040dd#tab=resolutions",
        "https://app.validin.com/detail?find=66.151.40.83&type=ip4&ref_id=45cc7c174db#tab=resolutions",
        "https://app.validin.com/detail?find=66.151.40.84&type=ip4&ref_id=d413894d497#tab=resolutions",
        "https://www.virustotal.com/gui/file/f83e2b3be2e6db20806a4b9b216edc7508fa81ce60bf59436d53d3ae435b6060/detection",
        "https://www.virustotal.com/gui/file/f1819b6aed24b81e6432a6d738206a388c266f72dbde4a8f4a4b9b6e3c55e609/detection",
        "https://www.virustotal.com/gui/file/89c1d1b61d7f863f8a651726e29f2ae3de7958f36b49a756069021817947d06c/detection",
        "https://www.virustotal.com/gui/file/0180f4f29c550aa1ffaa21af51711b29de99fb1d7c932d008a0e9356ae8a7d60/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 65,
        "url": 1,
        "url_path": 10
      },
      "first_seen": "2024-08-15",
      "indicators": {
        "domain": [
          "accredit-navigation.online",
          "accredit.validity.werifcattion.info",
          "boundary.cfd",
          "brookings.email",
          "cdn-workspacestudio.redirectme.net",
          "check-fa-pane.live",
          "checking-paneling.live",
          "click-choose-figured.cfd",
          "click-manage-room.cfd",
          "complete-telecom-operation.top",
          "confirrnation.info",
          "continueworkflow.onthewifi.com",
          "correction.verify.rsession.site",
          "duuuumpy.click",
          "dynamicroute.serveirc.com",
          "essentialeditor.serveirc.com",
          "expandprocess.serveblog.net",
          "filecloudmanager.site",
          "flow-exulltation-uplift.top",
          "green-light.bond",
          "happened.fun",
          "host-bulk-stack.cfd",
          "house-server-digital.xyz",
          "interconnected-equipment-buildings.buzz",
          "make-host-solution.buzz",
          "makeit.lat",
          "meetroomonlin1925.w3spaces.com",
          "modification-control.online",
          "nail-forward-valid.lol",
          "overviewstatus.redirectme.net",
          "panel-check-live.live",
          "panel-status-joining.live",
          "paneling-checke.live",
          "program-indipendent-system.buzz",
          "real-vision.redirectme.net",
          "recognize.site",
          "rectification.info",
          "recursivedns.site",
          "rendercomponents.site",
          "request-human-received.xyz",
          "review-continue-entered.cfd",
          "review.validation.recognize.site",
          "rsession.site",
          "s3api.shop",
          "sharedrive.webredirect.org",
          "shooort.site",
          "shooourt.click",
          "shoring-live.live",
          "short-ion-per.live",
          "short-jg934hw.live",
          "short-rigf.live",
          "smaaaal.cfd",
          "submissiveness.online",
          "taskprocess.viewdns.net",
          "teams.webredirect.org",
          "umberella.icu",
          "understandingthewar.org",
          "validation.recognize.site",
          "validity.werifcattion.info",
          "verify.rsession.site",
          "visioneditor.loseyourip.com",
          "webdirecthost.site",
          "werifcattion.info",
          "wysebeyond.gotdns.ch",
          "youtransfer.online"
        ],
        "url": [
          "http://91.107.150.184"
        ],
        "url_path": [
          "/CkliPwaM",
          "/F53OQQkE",
          "/Gallery/Ref/FSaEM5gG",
          "/Gcollection/Ref/CkliPwaM",
          "/Lcollection/Ref/F53OQQkE",
          "/Ref/CkliPwaM",
          "/Ref/F53OQQkE",
          "/aliasauthG/autoref/vNSX6c2m",
          "/autoref/vNSX6c2m",
          "/vNSX6c2m"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.google/threat-analysis-group/iranian-backed-group-steps-up-phishing-campaigns-against-israel-us/",
        "https://app.validin.com/detail?find=135.181.203.1&type=ip4&ref_id=7bb26af05d1#tab=resolutions",
        "https://app.validin.com/detail?find=212.162.152.151&type=ip4&ref_id=ea7526bb584#tab=resolutions",
        "https://app.validin.com/detail?find=38.180.121.133&type=ip4&ref_id=f79dde040dd#tab=resolutions",
        "https://app.validin.com/detail?find=66.151.40.83&type=ip4&ref_id=45cc7c174db#tab=resolutions",
        "https://app.validin.com/detail?find=66.151.40.84&type=ip4&ref_id=d413894d497#tab=resolutions",
        "https://www.virustotal.com/gui/file/f83e2b3be2e6db20806a4b9b216edc7508fa81ce60bf59436d53d3ae435b6060/detection",
        "https://www.virustotal.com/gui/file/f1819b6aed24b81e6432a6d738206a388c266f72dbde4a8f4a4b9b6e3c55e609/detection",
        "https://www.virustotal.com/gui/file/89c1d1b61d7f863f8a651726e29f2ae3de7958f36b49a756069021817947d06c/detection",
        "https://www.virustotal.com/gui/file/0180f4f29c550aa1ffaa21af51711b29de99fb1d7c932d008a0e9356ae8a7d60/detection"
      ],
      "total": 76
    },
    {
      "counts": {
        "domain": 2,
        "url": 1
      },
      "first_seen": "2024-05-07",
      "indicators": {
        "domain": [
          "decorous-super-blender.glitch.me",
          "wulpfsrqupnuqorhexiw.supabase.co"
        ],
        "url": [
          "https://community.emergingthreats.net/t/ruleset-update-summary-2024-05-06-v10590/1615"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/9146f8c1e0a88d961e5d1b6ac4633506c6e904e4cdf4c36ac5c1b5bd44867628/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 65
      },
      "first_seen": "2024-05-03",
      "indicators": {
        "domain": [
          "3dauth.live",
          "account-drive.com",
          "account-siqnin.com",
          "accredit-validity.ddns.net",
          "accredit.network",
          "africanblackwidow.ddns.net",
          "atlanticconucil.org",
          "atlanticcuoncil.com",
          "businessinssider.org",
          "centrallibrary.info",
          "clarification.network",
          "conferencecall.live",
          "confirm-direction.ddns.net",
          "confirm-integrity.ddns.net",
          "confirm-validation.ddns.net",
          "confirm-validation.mywire.org",
          "confirm-validity.hopto.org",
          "confirm-verify.servepics.com",
          "confirmation-verify.hopto.org",
          "continue-recognized.ddns.net",
          "continue-recognized.hopto.org",
          "digitalpufferfish.ddns.net",
          "direction-check.online",
          "direction-session-verify.site",
          "direction-veracity.ddns.net",
          "drive-acconut.com",
          "drive-acconuts.com",
          "drive-account.com",
          "eatonthehotground.ddns.net",
          "elated-supportive-exultation.top",
          "flowerskindergarten.ddns.net",
          "gatestonelnstitute.org",
          "identifier-direct.ddns.net",
          "identifier-service.ddns.net",
          "identifier-verify.ddns.net",
          "identity-session.ddns.net",
          "jubilatesee.site",
          "meeting-share.online",
          "modification-check.online",
          "modification-verify.ddns.net",
          "oceanofinformation.ddns.net",
          "ourredbucket.ddns.net",
          "panel-status-join.live",
          "paneling-check-live.live",
          "paneling-cheking-df.live",
          "permission-data.online",
          "pnael-checking.live",
          "products-services.network",
          "recognize-validation.theworkpc.com",
          "responsiblestatcraft.org",
          "review-session.hopto.org",
          "safeshortl.ink",
          "schoolofpinkmice.ddns.net",
          "session-review.hopto.org",
          "short-modification.site",
          "short-urling.live",
          "shorting-urling.live",
          "shortoni.live",
          "shorturling.live",
          "strainitiatives.ddns.net",
          "thefireisburnt.ddns.net",
          "validation-confirm.ddns.net",
          "validity-accredit.ddns.net",
          "verify-corroborate.ddns.net",
          "web-getdata.site"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.validin.com/blog/expanding-apt42-intelligence-with-validin/"
      ],
      "total": 65
    },
    {
      "counts": {
        "domain": 126
      },
      "first_seen": "2024-05-02",
      "indicators": {
        "domain": [
          "acconut-signin.com",
          "account-signin.com",
          "accounts-mails.com",
          "accredit-validity.online",
          "accurate-sprout-porpoise.glitch.me",
          "admin-stable-right.top",
          "admiscion.online",
          "admit-roar-frame.top",
          "advission.online",
          "affect-fist-ton.online",
          "aspenlnstitute.org",
          "avid-striking-eagerness.online",
          "azadlliq.info",
          "beaviews.online",
          "besvision.top",
          "bloom-flatter-affably.top",
          "bq-ledmagic.online",
          "briview.online",
          "businesslnsider.org",
          "check-online-panel.live",
          "check-pabnel-status.live",
          "check-panel-status.live",
          "check-short-panel.live",
          "confirmation-process.top",
          "connection-view.online",
          "continue-recognized.online",
          "coordinate.icu",
          "cvisiion.online",
          "d75.site",
          "daemon-mailer.info",
          "dloffice.buzz",
          "dloffice.top",
          "ecomonist.org",
          "email-daemon.biz",
          "email-daemon.biz.tinurls.com",
          "email-daemon.online",
          "email-daemon.online.tinurls.com",
          "email-daemon.site",
          "endorsement-services.online",
          "eocnomist.com",
          "foreiqnaffairs.com",
          "foreiqnaffairs.org",
          "forieqnaffairs.com",
          "fortune-retire-home.top",
          "g-online.org",
          "geaviews.site",
          "glory-uplift-vouch.online",
          "go-conversation.lol",
          "go-forward.quest",
          "gview.site",
          "identifier-direction.site",
          "indication-service.online",
          "israelhayum.com",
          "join-paneling.online",
          "jpost.press",
          "jpostpress.com",
          "khaleejtimes.org",
          "khalejtimes.org",
          "last-check-leave.buzz",
          "live-project-online.live",
          "live-projects-online.top",
          "loriginal.online",
          "m85.online",
          "maariv.net",
          "mailer-daemon.info",
          "mailer-daemon.us",
          "mccainlnstitute.org",
          "mterview.site",
          "myaccount-signin.com",
          "nterview.site",
          "online-access.live",
          "panel-check-short.live",
          "panel-live-check.online",
          "panel-short-check.live",
          "panel-view-short.online",
          "panel-view.live",
          "panel-view.online",
          "panel-views-cheking.live",
          "panelchecking.live",
          "paneling-viewing.live",
          "panels-views-ckeck.live",
          "quomodocunquize.site",
          "recognize-validation.online",
          "reconsider.site",
          "revive-project-live.online",
          "s20.site",
          "s51.online",
          "s59.site",
          "short-url.live",
          "short-view.online",
          "shortenurl.online",
          "shorting-ce.live",
          "shortingurling.live",
          "shortlinkview.live",
          "shortulonline.live",
          "shoting-urls.live",
          "signin-acconut.com",
          "signin-accounts.com",
          "signin-mail.com",
          "signin-mails.com",
          "signin-myaccounts.com",
          "simple-process-static.top",
          "status-short.live",
          "stellar-roar-right.buzz",
          "support-account.xyz",
          "sweet-pinnacle-readily.online",
          "tcvision.online",
          "themedealine.org",
          "timesfisrael.com",
          "title-flow-store.online",
          "tnt200.mywire.org",
          "twision.top",
          "vanityfaire.org",
          "verify-person-entry.top",
          "view-cope-flow.online",
          "view-panel.live",
          "view-pool-cope.online",
          "view-total-step.online",
          "viewstand.online",
          "viewtop.online",
          "virtue-regular-ready.online",
          "washinqtonpost.press",
          "we-transfer.shop",
          "ynetnews.press",
          "youronlineregister.com",
          "youtransfer.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"
      ],
      "total": 126
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-03-05",
      "indicators": {
        "domain": [
          "drive-file-share.site",
          "worried-eastern-salto.glitch.me"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/k3yp0d/status/1764938541203612004",
        "https://twitter.com/k3yp0d/status/1764940785345089940",
        "https://www.volexity.com/blog/2024/02/13/charmingcypress-innovating-persistence/",
        "https://www.virustotal.com/gui/file/3226b3e7d7fdaebfe7d7f06bdaf0cad08ea9792cd32843d01e6023f67cd0c889/detection",
        "https://www.virustotal.com/gui/file/0e51029ba28243b0a6a071713c17357a8eb024aa4298d1ccc9e2c4ac8916df4d/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 136
      },
      "first_seen": "2024-02-28",
      "indicators": {
        "domain": [
          "1stemployer.com",
          "airconnectionapi.azurewebsites.net",
          "airconnectionsapi.azurewebsites.net",
          "airconnectionsapijson.azurewebsites.net",
          "airgadgetsolution.azurewebsites.net",
          "airgadgetsolutions.azurewebsites.net",
          "altnametestapi.azurewebsites.net",
          "answerssurveytest.azurewebsites.net",
          "apphrquestion.azurewebsites.net",
          "apphrquestions.azurewebsites.net",
          "apphrquizapi.azurewebsites.net",
          "arquestions.azurewebsites.net",
          "arquestionsapi.azurewebsites.net",
          "audiomanagerapi.azurewebsites.net",
          "audioservicetestapi.azurewebsites.net",
          "birngthemhomenow.co.il",
          "blognewsalphaapijson.azurewebsites.net",
          "blogvolleyballstatus.azurewebsites.net",
          "blogvolleyballstatusapi.azurewebsites.net",
          "boeisurveyapplications.azurewebsites.net",
          "browsercheckap.azurewebsites.net",
          "browsercheckingapi.azurewebsites.net",
          "browsercheckjson.azurewebsites.net",
          "cashcloudservices.com",
          "changequestionstypeapi.azurewebsites.net",
          "changequestionstypejsonapi.azurewebsites.net",
          "changequestiontypes.azurewebsites.net",
          "changequestiontypesapi.azurewebsites.net",
          "checkapicountryquestions.azurewebsites.net",
          "checkapicountryquestionsjson.azurewebsites.net",
          "checkservicecustomerapi.azurewebsites.net",
          "coffeeonlineshop.azurewebsites.net",
          "coffeeonlineshoping.azurewebsites.net",
          "connectairapijson.azurewebsites.net",
          "connectionhandlerapi.azurewebsites.net",
          "countrybasedquestions.azurewebsites.net",
          "customercareservice.azurewebsites.net",
          "customercareserviceapi.azurewebsites.net",
          "emiratescheckapi.azurewebsites.net",
          "emiratescheckapijson.azurewebsites.net",
          "engineeringrssfeed.azurewebsites.net",
          "engineeringssfeed.azurewebsites.net",
          "exchtestcheckingapi.azurewebsites.net",
          "exchtestcheckingapihealth.azurewebsites.net",
          "flighthelicopterahtest.azurewebsites.net",
          "helicopterahtest.azurewebsites.net",
          "helicopterahtests.azurewebsites.net",
          "helicoptersahtests.azurewebsites.net",
          "hiringarabicregion.azurewebsites.net",
          "homefurniture.azurewebsites.net",
          "hrapplicationtest.azurewebsites.net",
          "humanresourcesapi.azurewebsites.net",
          "humanresourcesapijson.azurewebsites.net",
          "humanresourcesapiquiz.azurewebsites.net",
          "iaidevrssfeed.centralus.cloudapp.azure.com",
          "iaidevrssfeed.centrualus.cloudapp.azure.com",
          "iaidevrssfeed.cloudapp.azure.com",
          "iaidevrssfeedp.cloudapp.azure.com",
          "identifycheckapplication.azurewebsites.net",
          "identifycheckapplications.azurewebsites.net",
          "identifycheckingapplications.azurewebsites.net",
          "ilengineeringrssfeed.azurewebsites.net",
          "integratedblognewfeed.azurewebsites.net",
          "integratedblognews.azurewebsites.net",
          "integratedblognewsapi.azurewebsites.com",
          "integratedblognewsapi.azurewebsites.net",
          "intengineeringrssfeed.azurewebsites.net",
          "intergratedblognewsapi.azurewebsites.net",
          "javaruntime.azurewebsites.net",
          "javaruntimestestapi.azurewebsites.net",
          "javaruntimetestapi.azurewebsites.net",
          "javaruntimeversionchecking.azurewebsites.net",
          "javaruntimeversioncheckingapi.azurewebsites.net",
          "jupyternotebookcollection.azurewebsites.net",
          "jupyternotebookcollections.azurewebsites.net",
          "jupyternotebookcollections.com",
          "jupyternotebookscollection.azurewebsites.net",
          "logsapimanagement.azurewebsites.net",
          "logsapimanagements.azurewebsites.net",
          "logupdatemanagementapi.azurewebsites.net",
          "logupdatemanagementapijson.azurewebsites.net",
          "manpowerfeedapi.azurewebsites.net",
          "manpowerfeedapijson.azurewebsites.net",
          "marineblogapi.azurewebsites.net",
          "notebooktextchecking.azurewebsites.net",
          "notebooktextcheckings.azurewebsites.net",
          "notebooktextcheckings.com",
          "notebooktexts.azurewebsites.net",
          "onequestions.azurewebsites.net",
          "onequestionsapi.azurewebsites.net",
          "onequestionsapicheck.azurewebsites.net",
          "openapplicationcheck.azurewebsites.net",
          "optionalapplication.azurewebsites.net",
          "personalitytestquestionapi.azurewebsites.net",
          "personalizationsurvey.azurewebsites.net",
          "qaquestionapi.azurewebsites.net",
          "qaquestions.azurewebsites.net",
          "qaquestionsapi.azurewebsites.net",
          "qaquestionsapijson.azurewebsites.net",
          "queryfindquestions.azurewebsites.net",
          "queryquestions.azurewebsites.net",
          "questionsapplicationapi.azurewebsites.net",
          "questionsapplicationapijson.azurewebsites.net",
          "questionsapplicationbackup.azurewebsites.net",
          "questionsdatabases.azurewebsites.net",
          "questionsurveyapp.azurewebsites.net",
          "questionsurveyappserver.azurewebsites.net",
          "quiztestapplication.azurewebsites.net",
          "refaeldevrssfeed.centralus.cloudapp.azure.com",
          "regionuaequestions.azurewebsites.net",
          "registerinsurance.azurewebsites.net",
          "roadmapselector.azurewebsites.net",
          "roadmapselectorapi.azurewebsites.net",
          "sportblogs.azurewebsites.net",
          "surveyappquery.azurewebsites.net",
          "surveyonlinetest.azurewebsites.net",
          "surveyonlinetestapi.azurewebsites.net",
          "technewsblogapi.azurewebsites.net",
          "teledyneflir.com.de",
          "testmanagementapi1.azurewebsites.net",
          "testmanagementapis.azurewebsites.net",
          "testmanagementapisjson.azurewebsites.net",
          "testquestionapplicationapi.azurewebsites.net",
          "testtesttes.azurewebsites.net",
          "tiappschecktest.azurewebsites.net",
          "tnlsowki.westus3.cloudapp.azure.com",
          "tnlsowkis.westus3.cloudapp.azure.com",
          "turkairline.azurewebsites.net",
          "uaeaircheckon.azurewebsites.net",
          "uaeairchecks.azurewebsites.net",
          "vscodeupdater.azurewebsites.net",
          "vsliveagent.com",
          "workersquestions.azurewebsites.net",
          "workersquestionsapi.azurewebsites.net",
          "workersquestionsjson.azurewebsites.net",
          "xboxplayservice.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/malwrhunterteam/status/1762813636001570980",
        "https://www.mandiant.com/resources/blog/suspected-iranian-unc1549-targets-israel-middle-east",
        "https://www.virustotal.com/gui/file/5aa317d3682ff127e1e92d2016c08f94be60937a1b8a210876d931d072386336/detection"
      ],
      "total": 136
    },
    {
      "counts": {
        "domain": 18
      },
      "first_seen": "2024-02-17",
      "indicators": {
        "domain": [
          "bitly.org.il",
          "cyberflood.io",
          "daemon-mailer.co",
          "fbmro.com",
          "glorynewstoday.com",
          "ifstate.page.link",
          "isra-help.org",
          "latest-tools.store",
          "mailer-daemon.co",
          "mailerdaemon.online",
          "myprofileface.page.link",
          "ncgrassfed.com",
          "pasmoiapp.com",
          "ppmataro.com",
          "shebacenter.online",
          "shebacenter.org",
          "solofansapp.page.link",
          "stromectolonline.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/billyleonard/status/1757556382176313624",
        "https://blog.google/technology/safety-security/tool-of-first-resort-israel-hamas-war-in-cyber/",
        "https://services.google.com/fh/files/misc/tool-of-first-resort-israel-hamas-war-cyber.pdf",
        "https://github.com/google/threat-team/blob/main/2024/2024-02-14-tool-of-first-resort-israel-hamas-war-cyber/indicators.csv"
      ],
      "total": 18
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-02-04",
      "indicators": {
        "domain": [
          "prism-west-candy.glitch.me"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/MsftSecIntel/status/1747666342897963362",
        "https://twitter.com/G60930953/status/1747821766074863690",
        "https://www.virustotal.com/gui/file/e0ba0cedd8a8624c75af29965e5fa7ab754fc0fcddbb330bb548dab4f2be333f/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2024-01-17",
      "indicators": {
        "domain": [
          "cloud-document-edit.onrender.com",
          "coral-polydactyl-dragonfruit.glitch.me",
          "east-healthy-dress.glitch.me",
          "epibvgvoszemkwjnplyc.supabase.co",
          "kwhfibejjyxregxmnpcs.supabase.co",
          "ndrrftqrlblfecpupppp.supabase.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/",
        "https://community.emergingthreats.net/t/ruleset-update-summary-2024-01-17-v10508/1292"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2023-12-06",
      "indicators": {
        "domain": [
          "igsecurity.email",
          "metaemailsecurity.com",
          "metaemailsecurity.net",
          "metahelpservice.net",
          "metasecurityemail.org",
          "metasupportmail.co",
          "metasupportmail.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://community.emergingthreats.net/t/ruleset-update-summary-2023-12-04-v10478/1178"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2023-11-12",
      "indicators": {
        "domain": [
          "canvas-life.me",
          "channel-shop.manage-tech.club",
          "flash-adobe.org",
          "helper.canvas-life.me",
          "lgupluscdn.com",
          "manage-tech.club"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/axon?find=58.158.177.102&type=ip"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-11-12",
      "indicators": {
        "domain": [
          "login.loginto.me",
          "nsdrive-phone.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.clearskysec.com/charmingkitten/",
        "https://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf",
        "https://www.virustotal.com/gui/file/d4375a22c0f3fb36ab788c0a9d6e0479bd19f48349f6e192b10d83047a74c9d7/detection",
        "https://www.virustotal.com/gui/file/971c5b5396ee37827635badea90d26d395b08d17cbe9e8027dc87b120f8bc0a2/detection",
        "https://www.virustotal.com/gui/file/2c92da2721466bfbdaff7fedd9f3e8334b688a88ee54d7cab491e1a9df41258f/detection",
        "https://www.virustotal.com/gui/file/734d9639fcfffef1a3c360269ccc1cda4f1d0e9dc857fa438f945e807b022c21/detection",
        "https://www.virustotal.com/gui/file/6618051ea0c45d667c9d9594d676bc1f4adadd8cb30e0138489fee05ce91a9cb/detection",
        "https://www.virustotal.com/gui/file/a6dea088c9e2c9191e4c2fc4ece7b7b7bd3f034f444362d35c8765f6ec4bd279/detection",
        "https://www.virustotal.com/gui/file/2b9c941150206d38a635620f2129660628f9b08dd2f674013cacda39bde7ae56/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2023-09-12",
      "indicators": {
        "url": [
          "http://37.120.222.168"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.welivesecurity.com/en/eset-research/sponsor-batch-filed-whiskers-ballistic-bobcats-scan-strike-backdoor/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 13
      },
      "first_seen": "2023-08-14",
      "indicators": {
        "domain": [
          "beape.live",
          "beasze.live",
          "beeasaze.top",
          "check-control-panel.live",
          "check-reload-page.live",
          "direct-view-check.live",
          "direct-view-panel.xyz",
          "ksview.top",
          "load-panel.online",
          "panel-review-check.live",
          "view-direct-panel.live",
          "view-direct-panel.xyz",
          "view-home-panel.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1690994786415874048",
        "https://github.com/blackorbird/APT_REPORT/blob/master/Charming%20Kitten/2023-08-10-cyber-brief-no-01-2023.pdf"
      ],
      "total": 13
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2023-07-07",
      "indicators": {
        "domain": [
          "checkup.webredirect.org",
          "filemanager.theworkpc.com",
          "fuschia-rhinestone.cleverapps.io",
          "library-store.camdvr.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.proofpoint.com/us/blog/threat-insight/welcome-new-york-exploring-ta453s-foray-lnks-and-mac-malware",
        "https://www.virustotal.com/gui/ip-address/144.217.129.176/relations"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-06-07",
      "indicators": {
        "domain": [
          "mobile-activity-session.site"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.certfa.com/posts/charming-kitten-christmas-gift/",
        "https://otx.alienvault.com/pulse/5fff52390820519347e5f2d3"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2023-04-27",
      "indicators": {
        "domain": [
          "mail-updateservice.info",
          "maill-support.com",
          "mailupdate.com",
          "mailupdate.info",
          "msn-center.uk",
          "msn-service.co",
          "twittsupport.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://businessinsights.bitdefender.com/unpacking-bellaciao-a-closer-look-at-irans-latest-malware",
        "https://otx.alienvault.com/pulse/64499283c56cf14e277f9063"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2023-04-25",
      "indicators": {
        "domain": [
          "blackturtle.hopto.org",
          "deersharpfork.info",
          "subinfralab.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://research.checkpoint.com/2023/educated-manticore-iran-aligned-threat-actor-targeting-israel-via-improved-arsenal-of-tools/"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-04-24",
      "indicators": {
        "domain": [
          "optimac-hr.com",
          "optimax-hr.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/k3yp0d/status/1650513653802708996",
        "https://cloud.google.com/blog/topics/threat-intelligence/uncovering-iranian-counterintelligence-operation"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2023-03-09",
      "indicators": {
        "domain": [
          "bonny-marvels-authentic.top",
          "live-redirect-system.top",
          "progress-captivate-amply.top",
          "review-status-plan.online",
          "sincerely-sensation-outdo.top"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.secureworks.com/blog/cobalt-illusion-masquerades-as-atlantic-council-employee"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2023-02-26",
      "indicators": {
        "domain": [
          "compact-miracle-abounds.top",
          "funeral-engineering-expression.top",
          "node-dashboard.site",
          "node-panel.site",
          "stellar-stable-faith.top"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ET_Labs/status/1629278117071147008"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-01-13",
      "indicators": {
        "domain": [
          "cutly.biz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://community.emergingthreats.net/t/ruleset-update-summary-2022-11-30-v10185/185",
        "https://twitter.com/ThreatBookLabs/status/1613825659582959617"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-12-07",
      "indicators": {
        "domain": [
          "continuetogo.me",
          "mailer-daemon-message.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.recordedfuture.com/suspected-iran-nexus-tag-56-uses-uae-forum-lure-for-credential-theft-against-us-think-tank",
        "https://otx.alienvault.com/pulse/638e5648107623c3429e8c21"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2022-12-01",
      "indicators": {
        "domain": [
          "mailer-daemon.live",
          "mailer-daemon.me",
          "mailer-daemon.net",
          "mailer-daemon.online",
          "mailer-daemon.org",
          "tinyurl.ink"
        ]
      },
      "precision": "exact",
      "references": [
        "https://community.emergingthreats.net/t/ruleset-update-summary-2022-11-30-v10185/185",
        "https://twitter.com/ThreatBookLabs/status/1613825659582959617"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2022-11-23",
      "indicators": {
        "domain": [
          "dnx.capital",
          "sharedrive.ink",
          "washingtonlnstitute.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://community.emergingthreats.net/t/ruleset-update-summary-2022-11-22-v10179/172"
      ],
      "total": 3
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2022-11-17",
      "indicators": {
        "ipv4": [
          "51.89.181.64:443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/BaoshengbinCumt/status/1494478437960286208",
        "https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3,
        "ipv4": 2
      },
      "first_seen": "2022-10-11",
      "indicators": {
        "domain": [
          "cdsa.xyz",
          "hardship-management.com",
          "office-updates.info"
        ],
        "ipv4": [
          "137.184.212.205:4373",
          "51.38.87.253:3535"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/LukasStefanko/status/1569258418283905026",
        "https://www.mandiant.com/media/17826 (# apt42, crookedcharms)",
        "https://www.virustotal.com/gui/file/5d3ff202f20af915863eee45916412a271bae1ea3a0e20988309c16723ce4da5/detection",
        "https://www.virustotal.com/gui/file/c2c1d804aeed1913f858df48bf89a58b1f9819d7276a70b50785cf91c9d34083/detection",
        "https://www.virustotal.com/gui/file/a8c062846411d3fb8ceb0b2fe34389c4910a4887cd39552d30e6a03a02f4cc78/detection",
        "https://www.virustotal.com/gui/file/90e5fa3f382c5b15a85484c17c15338a6c8dbc2b0ca4fb73c521892bd853f226/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "ipv4": 2
      },
      "first_seen": "2022-10-11",
      "indicators": {
        "ipv4": [
          "58.158.177.102:5050",
          "85.17.172.180:5050"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.clearskysec.com/charmingkitten/",
        "https://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf",
        "https://www.virustotal.com/gui/file/d4375a22c0f3fb36ab788c0a9d6e0479bd19f48349f6e192b10d83047a74c9d7/detection",
        "https://www.virustotal.com/gui/file/971c5b5396ee37827635badea90d26d395b08d17cbe9e8027dc87b120f8bc0a2/detection",
        "https://www.virustotal.com/gui/file/2c92da2721466bfbdaff7fedd9f3e8334b688a88ee54d7cab491e1a9df41258f/detection",
        "https://www.virustotal.com/gui/file/734d9639fcfffef1a3c360269ccc1cda4f1d0e9dc857fa438f945e807b022c21/detection",
        "https://www.virustotal.com/gui/file/6618051ea0c45d667c9d9594d676bc1f4adadd8cb30e0138489fee05ce91a9cb/detection",
        "https://www.virustotal.com/gui/file/a6dea088c9e2c9191e4c2fc4ece7b7b7bd3f034f444362d35c8765f6ec4bd279/detection",
        "https://www.virustotal.com/gui/file/2b9c941150206d38a635620f2129660628f9b08dd2f674013cacda39bde7ae56/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-09-24",
      "indicators": {
        "domain": [
          "litby.us"
        ]
      },
      "precision": "exact",
      "references": [
        "https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-09-21",
      "indicators": {
        "domain": [
          "technical-updates.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/k3yp0d/status/1572561485376950274",
        "https://www.mandiant.com/media/17826",
        "https://www.virustotal.com/gui/file/2be8c9591d9aab6d81e4dd4a7e04371c7b1577404fa9ead11372251afcd13059/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 85,
        "url": 8
      },
      "first_seen": "2022-08-28",
      "indicators": {
        "ipv4": [
          "136.243.108.10:10000",
          "136.243.108.10:22",
          "136.243.108.10:25",
          "136.243.108.10:4040",
          "136.243.108.10:443",
          "136.243.108.10:465",
          "136.243.108.10:587",
          "136.243.108.10:993",
          "136.243.108.10:995",
          "136.243.108.11:10000",
          "136.243.108.11:22",
          "136.243.108.11:25",
          "136.243.108.11:4040",
          "136.243.108.11:443",
          "136.243.108.11:465",
          "136.243.108.11:587",
          "136.243.108.11:993",
          "136.243.108.11:995",
          "136.243.108.12:10000",
          "136.243.108.12:22",
          "136.243.108.12:25",
          "136.243.108.12:4040",
          "136.243.108.12:443",
          "136.243.108.12:465",
          "136.243.108.12:587",
          "136.243.108.12:993",
          "136.243.108.12:995",
          "136.243.108.13:10000",
          "136.243.108.13:22",
          "136.243.108.13:25",
          "136.243.108.13:4040",
          "136.243.108.13:443",
          "136.243.108.13:465",
          "136.243.108.13:587",
          "136.243.108.13:993",
          "136.243.108.13:995",
          "136.243.108.14:10000",
          "136.243.108.14:22",
          "136.243.108.14:25",
          "136.243.108.14:4040",
          "136.243.108.14:443",
          "136.243.108.14:465",
          "136.243.108.14:587",
          "136.243.108.14:993",
          "136.243.108.14:995",
          "136.243.108.9:10000",
          "136.243.108.9:22",
          "136.243.108.9:25",
          "136.243.108.9:4040",
          "136.243.108.9:443",
          "136.243.108.9:465",
          "136.243.108.9:587",
          "136.243.108.9:993",
          "136.243.108.9:995",
          "159.69.105.181:2082",
          "159.69.105.181:2083",
          "159.69.105.181:2086",
          "159.69.105.181:2087",
          "159.69.105.181:21",
          "159.69.105.181:22",
          "159.69.105.181:443",
          "159.69.105.181:53",
          "195.201.46.42:10000",
          "195.201.46.42:22",
          "195.201.46.42:25",
          "195.201.46.42:443",
          "195.201.46.42:465",
          "195.201.46.42:587",
          "195.201.46.42:993",
          "195.201.46.42:995",
          "78.47.90.60:10000",
          "78.47.90.60:110",
          "78.47.90.60:143",
          "78.47.90.60:2082",
          "78.47.90.60:2083",
          "78.47.90.60:2086",
          "78.47.90.60:2087",
          "78.47.90.60:21",
          "78.47.90.60:25",
          "78.47.90.60:443",
          "78.47.90.60:465",
          "78.47.90.60:53",
          "78.47.90.60:587",
          "78.47.90.60:993",
          "78.47.90.60:995"
        ],
        "url": [
          "http://136.243.108.10",
          "http://136.243.108.11",
          "http://136.243.108.12",
          "http://136.243.108.13",
          "http://136.243.108.9",
          "http://159.69.105.181",
          "http://195.201.46.42",
          "http://78.47.90.60"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/IronNetTR/status/1562913025350303744",
        "https://twitter.com/IronNetTR/status/1562913027951042561",
        "https://twitter.com/IronNetTR/status/1562913029620203520",
        "https://www.shodan.io/host/136.243.108.10",
        "https://www.shodan.io/host/136.243.108.11",
        "https://www.shodan.io/host/136.243.108.12",
        "https://www.shodan.io/host/136.243.108.13",
        "https://www.shodan.io/host/136.243.108.14",
        "https://www.shodan.io/host/136.243.108.9",
        "https://www.shodan.io/host/78.47.90.60"
      ],
      "total": 93
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2022-08-28",
      "indicators": {
        "ipv4": [
          "173.209.51.54:5985"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ChicagoCyber/status/1562047469126656001",
        "https://www.shodan.io/host/173.209.51.54",
        "https://blog.google/threat-analysis-group/new-iranian-apt-data-extraction-tool/ (# HYPERSCRAPE)"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2022-08-23",
      "indicators": {
        "url": [
          "http://136.243.108.14"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ChicagoCyber/status/1562047469126656001",
        "https://www.shodan.io/host/173.209.51.54",
        "https://blog.google/threat-analysis-group/new-iranian-apt-data-extraction-tool/ (# HYPERSCRAPE)",
        "https://twitter.com/IronNetTR/status/1562913025350303744",
        "https://twitter.com/IronNetTR/status/1562913027951042561",
        "https://twitter.com/IronNetTR/status/1562913029620203520",
        "https://www.shodan.io/host/136.243.108.10",
        "https://www.shodan.io/host/136.243.108.11",
        "https://www.shodan.io/host/136.243.108.12",
        "https://www.shodan.io/host/136.243.108.13",
        "https://www.shodan.io/host/136.243.108.14",
        "https://www.shodan.io/host/136.243.108.9",
        "https://www.shodan.io/host/78.47.90.60"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2022-08-23",
      "indicators": {
        "url": [
          "http://173.209.51.54"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ChicagoCyber/status/1562047469126656001",
        "https://www.shodan.io/host/173.209.51.54",
        "https://blog.google/threat-analysis-group/new-iranian-apt-data-extraction-tool/ (# HYPERSCRAPE)"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 66
      },
      "first_seen": "2022-04-07",
      "indicators": {
        "domain": [
          "alharbitelecom.co",
          "apply-jobs.com",
          "applytalents.com",
          "appslocallogin.online",
          "archery.dedyn.io",
          "bnt2.live",
          "careers-finder.com",
          "cloudgoogle.co",
          "cortanaservice.com",
          "cortanaupdate.co",
          "defenderupdate.ddns.net",
          "edge-cloudservices.com",
          "elecresearch.org",
          "enerflex.ddns.net",
          "enerflex.org",
          "etisalatonline.com",
          "exprogroup.org",
          "freechess.live",
          "funnychess.online",
          "getadobe.ddns.net",
          "getadobe.net",
          "globaltalent.in",
          "googleservices.co",
          "googleupdate.co",
          "helpdesk-product.com",
          "kavkazru.press",
          "khaleejtimes.co",
          "latinoamericareporta.com",
          "librarycollection.org",
          "linkedinz.me",
          "listen-books.com",
          "localadmin.online",
          "localadmin.ru",
          "lukoil.in",
          "market.dedyn.io",
          "market.vinam.me",
          "mastergatevpn.com",
          "microsoftcdn.co",
          "microsoftdefender.info",
          "microsoftedgesh.info",
          "mideasthiring.com",
          "monitor-ua.com",
          "office-shop.me",
          "onedrivelive.me",
          "onedriveupdate.net",
          "online-audible.com",
          "online-chess.live",
          "outlookde.live",
          "outlookdelivery.com",
          "politica.in.ua",
          "remgrogroup.com",
          "revistadcr.com",
          "saipem.org",
          "sauditourismguide.com",
          "savemoneytrick.com",
          "sharepointnotify.com",
          "signin.dedyn.io",
          "sparrowsgroup.org",
          "supportskype.com",
          "talent-recruitment.org",
          "talktalky.azurewebsites.net",
          "thefreemovies.net",
          "ukraine2day.com",
          "updateddns.ddns.net",
          "updatedefender.net",
          "updateservices.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://about.fb.com/wp-content/uploads/2022/04/Meta-Quarterly-Adversarial-Threat-Report_Q1-2022.pdf",
        "https://otx.alienvault.com/pulse/624f0d6039be61f29b5f463c",
        "https://lists.emergingthreats.net/pipermail/emerging-sigs/2022-April/030630.html"
      ],
      "total": 66
    },
    {
      "counts": {
        "url_path": 3
      },
      "first_seen": "2022-03-21",
      "indicators": {
        "url_path": [
          "/aspx_wkggiyvttmu.aspx",
          "/dhvqx.aspx",
          "/ecp/auth/aspx_wkggiyvttmu.aspx"
        ]
      },
      "precision": "exact",
      "references": [
        "https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-02-19",
      "indicators": {
        "domain": [
          "updatedns.ddns.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://about.fb.com/wp-content/uploads/2022/04/Meta-Quarterly-Adversarial-Threat-Report_Q1-2022.pdf",
        "https://otx.alienvault.com/pulse/624f0d6039be61f29b5f463c",
        "https://lists.emergingthreats.net/pipermail/emerging-sigs/2022-April/030630.html"
      ],
      "total": 1
    },
    {
      "counts": {
        "url_path": 1
      },
      "first_seen": "2022-02-18",
      "indicators": {
        "url_path": [
          "/gadfTs55sghsSSS"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.cybereason.com/blog/powerless-trojan-iranian-apt-phosphorus-adds-new-powershell-backdoor-for-espionage",
        "https://www.virustotal.com/gui/ip-address/91.214.124.143/relations",
        "https://www.virustotal.com/gui/file/ca4217b9d188cbe5fc6f4c7d5d696f93cc611dff1ffd323941f2a8b5e77284de/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2022-02-18",
      "indicators": {
        "url": [
          "http://182.54.217.2"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/BaoshengbinCumt/status/1494478437960286208",
        "https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-02-17",
      "indicators": {
        "domain": [
          "microsoft-updateserver.cf",
          "service-management.tk"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.sentinelone.com/labs/log4j2-in-the-wild-iranian-aligned-threat-actor-tunnelvision-actively-exploiting-vmware-horizon/",
        "https://otx.alienvault.com/pulse/620f76b08f1d06ea8646c0d3"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 4,
        "ipv4": 2,
        "url": 2,
        "url_path": 1
      },
      "first_seen": "2022-02-01",
      "indicators": {
        "domain": [
          "google.onedriver-srv.ml",
          "onedriver-srv.ml",
          "update.windows-driver.ml",
          "windows-driver.ml"
        ],
        "ipv4": [
          "169.51.60.221:1331",
          "45.77.76.158:23643"
        ],
        "url": [
          "http://162.55.136.233",
          "http://162.55.137.20"
        ],
        "url_path": [
          "/gadfTs55sghsSSS/phppost.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.cybereason.com/blog/powerless-trojan-iranian-apt-phosphorus-adds-new-powershell-backdoor-for-espionage",
        "https://www.virustotal.com/gui/ip-address/91.214.124.143/relations",
        "https://www.virustotal.com/gui/file/ca4217b9d188cbe5fc6f4c7d5d696f93cc611dff1ffd323941f2a8b5e77284de/detection"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 3,
        "ipv4": 2
      },
      "first_seen": "2022-01-11",
      "indicators": {
        "domain": [
          "0brandaeyes0.xyz",
          "0standavalue0.xyz",
          "0storageatools0.xyz"
        ],
        "ipv4": [
          "144.217.139.155:4444",
          "54.38.49.6:21"
        ]
      },
      "precision": "exact",
      "references": [
        "https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"
      ],
      "total": 5
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2021-12-22",
      "indicators": {
        "url": [
          "http://148.251.71.182"
        ]
      },
      "precision": "exact",
      "references": [
        "https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2021-08-06",
      "indicators": {
        "domain": [
          "jamaat-ul-islam.com",
          "jamaatforallah.com",
          "jamaatforummah.com",
          "jamatapplication.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/BaoshengbinCumt/status/1423577884615081992",
        "https://mp.weixin.qq.com/s/oD1VQZBxgjL3rNeN72MJqg"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-05-10",
      "indicators": {
        "domain": [
          "log-in-dropbox.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ChicagoCyber/status/1391819499872137225"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2021-04-01",
      "indicators": {
        "domain": [
          "1drv.casa",
          "1drv.cyou",
          "1drv.icu",
          "1drv.live",
          "1drv.online",
          "1drv.surf",
          "1drv.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.proofpoint.com/us/blog/threat-insight/badblood-ta453-targets-us-and-israeli-medical-research-personnel-credential",
        "https://otx.alienvault.com/pulse/6065f293e16c3e4e72044475"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 50
      },
      "first_seen": "2021-01-09",
      "indicators": {
        "domain": [
          "agentappservice.ddns.net",
          "archiverepositories.xyz",
          "basementofdarkness.ddns.net",
          "benefitsredington.ddns.net",
          "bulk-approach.site",
          "challengechampions.ddns.net",
          "com-254514785965.site",
          "com-3654623478192.site",
          "com-5464825879854.site",
          "com-apk-6712qw123asd8awf7.site",
          "com-archive.site",
          "com-posts6712qw12387.site",
          "confirm-identity.site",
          "customer-session.site",
          "deepthinkingroom.ddns.net",
          "differentintegrated.ddns.net",
          "dynamiceventmanager.ddns.net",
          "enhanceservicchecke.hopto.org",
          "heisonhisway.ddns.net",
          "hello-planet.com",
          "homedirections.ddns.net",
          "homeinspections.ddns.net",
          "identifier-service-verify.site",
          "identifier-session-recovery.site",
          "identity-session-recovery.site",
          "lonelymanshadow.ddns.net",
          "mail-newyorker.com",
          "minimumservicechek.ddns.net",
          "mobile-check-activity.site",
          "patchtheschool.ddns.net",
          "planet-labs.site",
          "profilechangeruser.ddns.net",
          "randomworldcity.ddns.net",
          "recover-identity.site",
          "recover-session-service.site",
          "recovery-customer-service.site",
          "recovery-session-service.site",
          "recovery-session.site",
          "reset-account.com",
          "schoolofculture.ddns.net",
          "securelogicalrepository.com",
          "service-recovery.site",
          "service-session-recovery.site",
          "service-support.site",
          "service-verification.site",
          "session-confirmation.site",
          "session-customer-activity.site",
          "uniquethinksession.ddns.net",
          "verify-session-service.site",
          "wearefirefighters.ddns.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.certfa.com/posts/charming-kitten-christmas-gift/",
        "https://otx.alienvault.com/pulse/5fff52390820519347e5f2d3"
      ],
      "total": 50
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2021-01-09",
      "indicators": {
        "domain": [
          "csm-group.org",
          "dhs-us.org",
          "procurement-inl-gov.us",
          "procurements-inl-gov.us",
          "ukborderhomeoffice-gov.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/jfslowik/status/1347905935654539267"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2021-01-04",
      "indicators": {
        "domain": [
          "check-panel-live.icu",
          "check-reload-page.xyz",
          "front-cover-panel.xyz",
          "front-home-panel.xyz",
          "office-live-activity.icu",
          "page-home-reload.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/kyleehmke/status/1346154845221384194"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-12-17",
      "indicators": {
        "domain": [
          "home-reload-page.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/kyleehmke/status/1339602993814102016"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-12-12",
      "indicators": {
        "domain": [
          "developer-app.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/LukasStefanko/status/1569258418283905026",
        "https://www.mandiant.com/media/17826 (# apt42, crookedcharms)",
        "https://www.virustotal.com/gui/file/5d3ff202f20af915863eee45916412a271bae1ea3a0e20988309c16723ce4da5/detection",
        "https://www.virustotal.com/gui/file/c2c1d804aeed1913f858df48bf89a58b1f9819d7276a70b50785cf91c9d34083/detection",
        "https://www.virustotal.com/gui/file/a8c062846411d3fb8ceb0b2fe34389c4910a4887cd39552d30e6a03a02f4cc78/detection",
        "https://www.virustotal.com/gui/file/90e5fa3f382c5b15a85484c17c15338a6c8dbc2b0ca4fb73c521892bd853f226/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-12-02",
      "indicators": {
        "domain": [
          "cover-home-page.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/kyleehmke/status/1334170023968051200"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2020-11-16",
      "indicators": {
        "domain": [
          "check-panel-account.icu",
          "cover-home-panel.xyz",
          "it-service.men",
          "student-rank-number.icu"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/kyleehmke/status/1328374352602144770"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2020-10-28",
      "indicators": {
        "domain": [
          "de-ma.online",
          "g20saudi.000webhostapp.com",
          "ksat20.000webhostapp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/",
        "https://otx.alienvault.com/pulse/5f99808638696999cf7b109c"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2020-09-30",
      "indicators": {
        "domain": [
          "document-share.info",
          "kia-customerservice.ddns.net",
          "login-users-account.site",
          "manage-accounts.info",
          "recovery-service.site",
          "us2-mail-login-profile.site"
        ]
      },
      "precision": "exact",
      "references": [
        "https://docs.google.com/document/d/1oYX3uN6KxIX_StzTH0s0yFNNoHDnV8VgmVqU5WoeErc/",
        "https://www.virustotal.com/gui/domain/kia-customerservice.ddns.net/detection",
        "https://www.virustotal.com/gui/domain/recovery-service.site/detection"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 14
      },
      "first_seen": "2020-05-07",
      "indicators": {
        "domain": [
          "com-recovery.site",
          "com-sessions.site",
          "customer-identifier.site",
          "customer-reminder.info",
          "customers-activity.site",
          "identifier-services-session.site",
          "mobile-airbnb.site",
          "mobile-uber.site",
          "newspedia.ddns.net",
          "radiofarda.site",
          "recovery-option.site",
          "safe-solution.site",
          "scribdinc.site",
          "travel-airbnb.site"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ClearskySec/status/1258432745891680256"
      ],
      "total": 14
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-03-17",
      "indicators": {
        "domain": [
          "myconnect-support.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://docs.google.com/document/d/1oYX3uN6KxIX_StzTH0s0yFNNoHDnV8VgmVqU5WoeErc/edit#",
        "https://otx.alienvault.com/pulse/5e6ff05783c525e779904d69"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 15
      },
      "first_seen": "2020-02-05",
      "indicators": {
        "domain": [
          "accounts-drive.com",
          "cpanel-services.site",
          "customers-service.ddns.net",
          "finance-usbnc.info",
          "instagram-com.site",
          "inztaqram.ga",
          "malcolmrifkind.site",
          "phonechallenges-submit.site",
          "recovery-options.site",
          "service-activity-checkup.site",
          "service-issues.site",
          "software-updating-managers.site",
          "two-step-checkup.site",
          "unirsd.com",
          "yah00.site"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.certfa.com/posts/fake-interview-the-new-activity-of-charming-kitten/",
        "https://otx.alienvault.com/pulse/5e3acf325495b5e504f82abc",
        "https://www.virustotal.com/gui/ip-address/144.202.123.86/relations"
      ],
      "total": 15
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-01-26",
      "indicators": {
        "domain": [
          "microsoftexplorerservices.cloud"
        ]
      },
      "precision": "exact",
      "references": [
        "http://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/",
        "https://github.com/pan-unit42/iocs/blob/master/iran_linked_operators/MagicHound.csv"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 24
      },
      "first_seen": "2019-10-08",
      "indicators": {
        "domain": [
          "bailment.org",
          "com-activities.site",
          "com-identifier.site",
          "com-session.site",
          "com-verifications.site",
          "customers-recovery.site",
          "customers-reminder.info",
          "document-sharing.online",
          "gomyfiles.info",
          "home-access.online",
          "identifier-activities.online",
          "identity-verification-service.info",
          "inbox-drive.info",
          "inbox-sharif.info",
          "magic-delivery.info",
          "mobilecontinue.network",
          "recovery-services.info",
          "recoverysuperuser.info",
          "see-us.info",
          "sessions-identifier-memberemailid.network",
          "smarttradingfast.com",
          "telagram.net",
          "uploaddata.info",
          "verification-services.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.clearskysec.com/wp-content/uploads/2019/10/The-Kittens-Are-Back-in-Town-2.pdf",
        "https://otx.alienvault.com/pulse/5d9b7a71f31df0e33eefab04"
      ],
      "total": 24
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2019-10-08",
      "indicators": {
        "domain": [
          "bahaius.info",
          "customers-activities.site",
          "system-services.site"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.clearskysec.com/wp-content/uploads/2019/10/The-Kittens-Are-Back-in-Town-2.pdf",
        "https://otx.alienvault.com/pulse/5d9b7a71f31df0e33eefab04",
        "https://blog.certfa.com/posts/fake-interview-the-new-activity-of-charming-kitten/",
        "https://otx.alienvault.com/pulse/5e3acf325495b5e504f82abc",
        "https://www.virustotal.com/gui/ip-address/144.202.123.86/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2019-09-15",
      "indicators": {
        "domain": [
          "acconut-verify.com",
          "drive-accounts.com",
          "isis-online.net",
          "leslettrespersanes.net",
          "niaconucil.org",
          "seisolarpros.org",
          "skynevvs.com",
          "w3-schools.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.clearskysec.com/the-kittens-are-back-in-town/",
        "https://otx.alienvault.com/pulse/5d7e61f9aa517862e977cbad",
        "https://blog.certfa.com/posts/fake-interview-the-new-activity-of-charming-kitten/",
        "https://otx.alienvault.com/pulse/5e3acf325495b5e504f82abc",
        "https://www.virustotal.com/gui/ip-address/144.202.123.86/relations"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2019-09-15",
      "indicators": {
        "domain": [
          "exnovin.org",
          "islamicemojimaker.com",
          "unrisd.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.clearskysec.com/the-kittens-are-back-in-town/",
        "https://otx.alienvault.com/pulse/5d7e61f9aa517862e977cbad"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 121
      },
      "first_seen": "2019-03-27",
      "indicators": {
        "domain": [
          "account-profile-users.info",
          "account-servicemanagement.info",
          "account-servieemanagement.info",
          "account-verifiy.net",
          "accounts-apple.com",
          "accounts-manager.info",
          "accounts-support.services",
          "accounts-web-maii.com",
          "accounts-web-mail.com",
          "activities-recovery-options.info",
          "activities-servicesnotification.info",
          "activity-confirmationservice.info",
          "activity-session-recovery.info",
          "aeroconf2014.org",
          "aerospace2014.org",
          "appleid.com.co",
          "attacker-domain.com",
          "broadcastnews.pro",
          "com-accountidentifier.info",
          "com-identifier-servicelog.info",
          "com-identifier-servicelog.name",
          "com-identifier-servlcelog.name",
          "com-mailbox.com",
          "com-myaccuants.com",
          "com-privacy-help.info",
          "com-sessionidentifier.info",
          "com-useraccount.info",
          "com-users.net",
          "comidentifier-servicelog.name",
          "confirm-identity.info",
          "confirm-session-identification.info",
          "confirm-session-identifier.info",
          "confirm-sessionidentification.info",
          "confirmation-recoveryoptions.info",
          "confirmation-service.info",
          "confirmation-users-service.info",
          "confirmation-users-servlee.info",
          "continue-session-identifier.info",
          "continue-sesslon-identifier.info",
          "customer-certificate.com",
          "customer-recovery.info",
          "customers-activities.info",
          "customers-manager.info",
          "customers-services.info",
          "customize-identity.info",
          "documentofficupdate.info",
          "documentsharing.info",
          "download-teamspeak.info",
          "elitemaildelivery.info",
          "email-deiivery.info",
          "email-delivery.info",
          "eom-microsoftonline.club",
          "eom-useraccount.info",
          "eustomers-activities.info",
          "giitials.tk",
          "googledomalns.com",
          "identifier-services-sessions.info",
          "identify-user-session.info",
          "intel-update.com",
          "intelupdate.com",
          "login-gov.info",
          "message-serviceprovider.info",
          "mobile-sessionid.customize-identity.info",
          "mobiles-sessionid.customize-identity.info",
          "myaccount-services.net",
          "notification-accountservice.info",
          "notification-manager.info",
          "notification-managers.info",
          "notification-signal-agnecy.info",
          "notificationapp.info",
          "notifications-center.info",
          "notificatlon-signal-agnecy.info",
          "o5vdb.org",
          "outlook-verify.net",
          "packctstormsccurity.com",
          "plugin-adobe.com",
          "privacy-google.com",
          "recognized-activity.info",
          "recover-customers-service.info",
          "recovery-session-change.info",
          "recoveryusercustomer.info",
          "serverbroadcast.info",
          "service-accountrecoverv.com",
          "service-recovery-session.info",
          "service-session-confirm.info",
          "service-session-continue.info",
          "services-issue-notification.info",
          "services-sessionconfirmation.info",
          "session-mail-customers.info",
          "session-management.info",
          "session-manager.info",
          "session-managment.info",
          "session-recovery-options.info",
          "session-users-activities.com",
          "session-verify-user.info",
          "sessions-identifiermemberemailid.network",
          "sessions-notification.info",
          "shop-sellwear.info",
          "support-servics.com",
          "support-servics.net",
          "support.services",
          "supportmailservice.info",
          "terms-service-notification.info",
          "terms-service-notlfication.info",
          "user-activity-issues.info",
          "user-profile-credentials.com",
          "useridentity-confirm.info",
          "users-issue-services.info",
          "verification-live.com",
          "verification-llve.com",
          "verificationlive.com",
          "verifiy-account.net",
          "verifv-linkedin.net",
          "verify-linke.com",
          "verify-linkedin.net",
          "verify-user-session.info",
          "vvincicivj-c-ssenrjais.tk",
          "webemail.info",
          "xn--facebook-06k.com",
          "xn--google-yri.com",
          "yahoomail.com.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://otx.alienvault.com/pulse/5c9bb407e5a06b014da016e3"
      ],
      "total": 121
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2019-03-27",
      "indicators": {
        "domain": [
          "documentsfilesharing.cloud",
          "identifier-activities.info",
          "mobile-messengerplus.network",
          "notification-accountservice.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://otx.alienvault.com/pulse/5c9bb407e5a06b014da016e3",
        "https://www.clearskysec.com/wp-content/uploads/2019/10/The-Kittens-Are-Back-in-Town-2.pdf",
        "https://otx.alienvault.com/pulse/5d9b7a71f31df0e33eefab04"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 287
      },
      "first_seen": "2019-03-23",
      "indicators": {
        "domain": [
          "012mail-net-uwclogin.ml",
          "8ghefkwdvbfdsg3asdf1.com",
          "account-customerservice.com",
          "account-dropbox.net",
          "account-google.co",
          "account-log-user-verify-mail.com",
          "account-login.net",
          "account-logins.com",
          "account-permission-mail-user.com",
          "account-servicerecovery.com",
          "account-signin-myaccount-users.ga",
          "account-support-user.com",
          "account-user-permission-account.com",
          "account-user-verify-mail.com",
          "account-user.com",
          "account-users-mail.com",
          "accounts-googelmail.com",
          "accounts-googelmails.com",
          "accounts-logins.net",
          "accounts-service.support",
          "accounts-yahoo.us",
          "accountservice.support",
          "accountsrecovery.ddns.net",
          "accountsservice-support.com",
          "accountts-google.com",
          "acounts-qooqie-con.ml",
          "addons-mozilla.download",
          "aipak.org",
          "aiqac.org",
          "aol-mail-account.com",
          "apache-utility.com",
          "app-documents.com",
          "app-facebook.co",
          "araamco.com",
          "archive-center.com",
          "asus-support.net",
          "asus-update.com",
          "berozkhodro.com",
          "book-archivecenter.bid",
          "books-archivecenter.bid",
          "books-archivecenter.club",
          "books-google.books-archivecenter.bid",
          "books-view.com",
          "bootstrap.serveftp.com",
          "britishnews.com.co",
          "britishnews.org",
          "broadcastbritishnews.com",
          "brookings-edu.in",
          "change-mail-account-nodes-permision.com",
          "change-mail-accounting-register-single.com",
          "change-permission-mail-user-managment.com",
          "change-user-account-mail-permission.com",
          "codeconfirm-recovery.bid",
          "codeconfirm-recovery.club",
          "com-account-login.com",
          "com-accountrecovery.bid",
          "com-accountsecure-recovery.name",
          "com-accountsrecovery.name",
          "com-archivecenter.work",
          "com-customeradduser.bid",
          "com-customerservice.bid",
          "com-customerservice.name",
          "com-customerservices.name",
          "com-customersuperuser.bid",
          "com-download.ml",
          "com-manage-accountuser.club",
          "com-messagecenter.bid",
          "com-messengerservice.bid",
          "com-messengerservice.work",
          "com-mychannel.bid",
          "com-orginal-links.ga",
          "com-recoversessions.bid",
          "com-recovery.com",
          "com-recoveryadduser.bid",
          "com-recoveryidentifier.bid",
          "com-recoveryidentifier.name",
          "com-recoveryidentifiers.bid",
          "com-recoverymail.bid",
          "com-recoverysecureuser.club",
          "com-recoverysecureusers.club",
          "com-recoveryservice.bid",
          "com-recoveryservice.info",
          "com-recoverysessions.bid",
          "com-recoverysubusers.bid",
          "com-recoverysuperuser.bid",
          "com-recoverysuperuser.club",
          "com-recoverysuperuser.name",
          "com-recoverysuperusers.bid",
          "com-recoverysupport.bid",
          "com-recoverysupport.club",
          "com-service.gq",
          "com-service.net",
          "com-servicecustomer.bid",
          "com-servicecustomer.name",
          "com-servicemail.bid",
          "com-servicerecovery.bid",
          "com-servicerecovery.club",
          "com-servicerecovery.info",
          "com-servicerecovery.name",
          "com-servicescustomer.name",
          "com-serviceslogin.com",
          "com-showvideo.ga",
          "com-showvideo.gq",
          "com-statistics.com",
          "com-stats.com",
          "com-video.net",
          "com-videoservice.work",
          "com-viewchannel.club",
          "crcperss.com",
          "cvcreate.org",
          "digitalqlobe.com",
          "display-error-runtime.com",
          "display-ganavaro-abrashimchi.com",
          "doc-viewer.com",
          "docs-google.co",
          "document-supportsharing.bid",
          "documents-supportsharing.bid",
          "documents-supportsharing.club",
          "documents.sytes.net",
          "download-link.top",
          "drive-login.cf",
          "drive-permission-user-account.com",
          "drive-useraccount-signin-mail.ga",
          "drop-box.vip",
          "dropebox.co",
          "embraer.co",
          "emiartas.com",
          "error-exchange.com",
          "eursaia.org",
          "fanderfart22.xyz",
          "fardenfart2017.xyz",
          "fb-login.cf",
          "gle-mail.com",
          "gmail-recovery.ml",
          "gmal.cf",
          "goo-gle.bid",
          "goo-gle.cloud",
          "goo-gle.mobi",
          "goog-le.bid",
          "google-mail-recovery.com",
          "google-mail.com.co",
          "google-profile.com",
          "google-profiles.com",
          "google-setting.com",
          "google-verification.com",
          "google-verify.com",
          "google-verify.net",
          "googlemails.co",
          "group-google.com",
          "help-recovery.com",
          "hot-mail.ml",
          "id-bayan.com",
          "iforget-memail-user-account.com",
          "ir-owa-accountservice.bid",
          "iranianuknews.com",
          "k2intelliqence.com",
          "line-en.me",
          "login-account-mail.com",
          "login-account.net",
          "login-again.ml",
          "login-required.ga",
          "mail-account-register-recovery.com",
          "mail-yahoo.com.co",
          "mails-account-signin-users-permssion.com",
          "mailssender.bid",
          "market-account-login.net",
          "mehrnews.info",
          "messageservice.bid",
          "messageservice.club",
          "microsoft-hotfix.com",
          "microsoft-utility.com",
          "msoffice-update.com",
          "my-healthequity.com",
          "my-mailcoil.ml",
          "myaccount-login.net",
          "mychannel.ddns.net",
          "myscreenname.bid",
          "news-onlines.info",
          "nex1music.ml",
          "notification-accountrecovery.com",
          "nvidia-support.com",
          "nvidia-update.com",
          "official-uploads.com",
          "officialswebsites.info",
          "onedrive-signin.com",
          "online-supportaccount.com",
          "onlinedocument.bid",
          "onlinedocuments.org",
          "onlinedrie-account-permission-verify.com",
          "onlineserver.myftp.biz",
          "orginal-links.com",
          "owa-insss-org-ill-owa-authen.ml",
          "picofile.xyz",
          "policy-facebook.com",
          "privacy-facebook.com",
          "privacy-gmail.com",
          "privacy-yahoomail.com",
          "profile-facebook.co",
          "profile-verification.com",
          "profiles-facebook.com",
          "qet-adobe.com",
          "radio-m.cf",
          "raykiel.net",
          "recovery-customerservice.com",
          "recovery-emailcustomer.com",
          "recoverycodeconfirm.bid",
          "recoverysuperuser.bid",
          "register-multiplay.ml",
          "sadashboard.com",
          "saudi-government.com",
          "saudi-haj.com",
          "saudiarabiadigitaldashboards.com",
          "screen-royall-in-corporate.com",
          "screen-shotuser-trash-green.com",
          "security-supportteams-mail-change.ga",
          "sers-login.com",
          "service-accountrecovery.com",
          "service-broadcast.com",
          "service-logins.net",
          "service-recoveryaccount.com",
          "servicecustomer.bid",
          "servicemailbroadcast.bid",
          "set-ymail-user-account-permission-challenge.com",
          "shared-access.com",
          "shared-login.com",
          "shared-permission.com",
          "shorturlbot.club",
          "show-video.info",
          "slmkhubi.ddns.net",
          "smstagram.com",
          "sprinqer.com",
          "support-aasaam.bid",
          "support-aasaam.com",
          "support-accountsrecovery.com",
          "support-google.co",
          "support-recoverycustomers.com",
          "support-verify-account-user.com",
          "supports-recoverycustomers.com",
          "tadawul.com.co",
          "tai-tr.com",
          "team-speak.cf",
          "team-speak.ga",
          "team-speak.ml",
          "teamspeak-download.ml",
          "teamspeaks.cf",
          "telagram.cf",
          "token-ep.com",
          "uk-service.org",
          "update-checker.net",
          "update-driversonline.bid",
          "update-driversonline.club",
          "update-finder.com",
          "update-system-driversonline.bid",
          "updater-driversonline.club",
          "upload-services.com",
          "uri.cab",
          "users-login.com",
          "users-yahoomail.com",
          "usersettings.cf",
          "utopaisystems.net",
          "verify-account.services",
          "verify-accounts.info",
          "verify-facebook.com",
          "verify-gmail.tk",
          "video-youtube.cf",
          "w3sch00ls.hopto.org",
          "w3school.hopto.org",
          "w3schools-html.com",
          "w3schools.hopto.org",
          "watch-youtube.org.uk",
          "webmaiil-tau-ac-il.ml",
          "webmail-tidhar-co-il.ml",
          "windows-update.systems",
          "xn--googe-q2e.ml",
          "yahoo-proflles.com",
          "youetube.ga",
          "yourl.bid",
          "youttube.ga",
          "youttube.gq",
          "youtubbe.cf",
          "youtubbe.ml",
          "youtube-com.watch",
          "youtubee-videos.com",
          "youtuebe.co",
          "youtuobe.com.co",
          "youutube.cf",
          "yurl.bid"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.clearskysec.com/charmingkitten/",
        "https://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf",
        "https://www.virustotal.com/gui/file/d4375a22c0f3fb36ab788c0a9d6e0479bd19f48349f6e192b10d83047a74c9d7/detection",
        "https://www.virustotal.com/gui/file/971c5b5396ee37827635badea90d26d395b08d17cbe9e8027dc87b120f8bc0a2/detection",
        "https://www.virustotal.com/gui/file/2c92da2721466bfbdaff7fedd9f3e8334b688a88ee54d7cab491e1a9df41258f/detection",
        "https://www.virustotal.com/gui/file/734d9639fcfffef1a3c360269ccc1cda4f1d0e9dc857fa438f945e807b022c21/detection",
        "https://www.virustotal.com/gui/file/6618051ea0c45d667c9d9594d676bc1f4adadd8cb30e0138489fee05ce91a9cb/detection",
        "https://www.virustotal.com/gui/file/a6dea088c9e2c9191e4c2fc4ece7b7b7bd3f034f444362d35c8765f6ec4bd279/detection",
        "https://www.virustotal.com/gui/file/2b9c941150206d38a635620f2129660628f9b08dd2f674013cacda39bde7ae56/detection"
      ],
      "total": 287
    },
    {
      "counts": {
        "domain": 11
      },
      "first_seen": "2019-03-23",
      "indicators": {
        "domain": [
          "deutcshewelle.com",
          "deutcshewelle.org",
          "frostsullivan.org",
          "jewishjournal.us",
          "mail.jewishjournal.us",
          "mx0.jewishjournal.us",
          "ns1.deutcshewelle.com",
          "ns1.jewishjournal.us",
          "ns2.deutcshewelle.com",
          "ns2.jewishjournal.us",
          "win-ptf9aurtg8u.jewishjournal.us"
        ]
      },
      "precision": "exact",
      "references": [
        "https://docs.google.com/document/d/1oYX3uN6KxIX_StzTH0s0yFNNoHDnV8VgmVqU5WoeErc (2018-06-12 Charming Kitten waterhole)"
      ],
      "total": 11
    },
    {
      "counts": {
        "domain": 9
      },
      "first_seen": "2019-03-23",
      "indicators": {
        "domain": [
          "com-microsoftonline.club",
          "microsoft-update.bid",
          "microsoft-upgrade.mobi",
          "outlook-livecom.bid",
          "update-microsoft.bid",
          "users-facebook.com",
          "yahoo-verification.net",
          "yahoo-verification.org",
          "yahoo-verify.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.clearskysec.com/charmingkitten/",
        "https://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf",
        "https://www.virustotal.com/gui/file/d4375a22c0f3fb36ab788c0a9d6e0479bd19f48349f6e192b10d83047a74c9d7/detection",
        "https://www.virustotal.com/gui/file/971c5b5396ee37827635badea90d26d395b08d17cbe9e8027dc87b120f8bc0a2/detection",
        "https://www.virustotal.com/gui/file/2c92da2721466bfbdaff7fedd9f3e8334b688a88ee54d7cab491e1a9df41258f/detection",
        "https://www.virustotal.com/gui/file/734d9639fcfffef1a3c360269ccc1cda4f1d0e9dc857fa438f945e807b022c21/detection",
        "https://www.virustotal.com/gui/file/6618051ea0c45d667c9d9594d676bc1f4adadd8cb30e0138489fee05ce91a9cb/detection",
        "https://www.virustotal.com/gui/file/a6dea088c9e2c9191e4c2fc4ece7b7b7bd3f034f444362d35c8765f6ec4bd279/detection",
        "https://www.virustotal.com/gui/file/2b9c941150206d38a635620f2129660628f9b08dd2f674013cacda39bde7ae56/detection",
        "https://otx.alienvault.com/pulse/5c9bb407e5a06b014da016e3"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2017-04-13",
      "indicators": {
        "domain": [
          "analytics-google.org",
          "chrome-up.date",
          "microsoftsubsystem.com-adm.in",
          "servicesystem.serveirc.com",
          "timezone.live"
        ]
      },
      "precision": "exact",
      "references": [
        "http://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/",
        "https://github.com/pan-unit42/iocs/blob/master/iran_linked_operators/MagicHound.csv"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2017-03-30",
      "indicators": {
        "domain": [
          "uploader.sytes.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.clearskysec.com/charmingkitten/",
        "https://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf",
        "https://www.virustotal.com/gui/file/d4375a22c0f3fb36ab788c0a9d6e0479bd19f48349f6e192b10d83047a74c9d7/detection",
        "https://www.virustotal.com/gui/file/971c5b5396ee37827635badea90d26d395b08d17cbe9e8027dc87b120f8bc0a2/detection",
        "https://www.virustotal.com/gui/file/2c92da2721466bfbdaff7fedd9f3e8334b688a88ee54d7cab491e1a9df41258f/detection",
        "https://www.virustotal.com/gui/file/734d9639fcfffef1a3c360269ccc1cda4f1d0e9dc857fa438f945e807b022c21/detection",
        "https://www.virustotal.com/gui/file/6618051ea0c45d667c9d9594d676bc1f4adadd8cb30e0138489fee05ce91a9cb/detection",
        "https://www.virustotal.com/gui/file/a6dea088c9e2c9191e4c2fc4ece7b7b7bd3f034f444362d35c8765f6ec4bd279/detection",
        "https://www.virustotal.com/gui/file/2b9c941150206d38a635620f2129660628f9b08dd2f674013cacda39bde7ae56/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2016-03-09",
      "indicators": {
        "domain": [
          "microsoftinternetsafety.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.clearskysec.com/wp-content/uploads/2019/10/The-Kittens-Are-Back-in-Town-2.pdf",
        "https://otx.alienvault.com/pulse/5d9b7a71f31df0e33eefab04"
      ],
      "total": 1
    }
  ]
}