{ "aliases": [ "CoreKit", "NimDoor", "RTV4", "cageychameleon", "cryptocore", "cryptomimic", "netchk", "ta444", "unc1069", "upl/tlgrm", "wslink" ], "attack_id": "G0082", "attack_name": "APT38", "attack_url": "https://attack.mitre.org/groups/G0082/", "counts": { "domain": 2058, "ipv4": 43, "url": 7, "url_path": 7 }, "first_seen": { "domain": { "02euweb.us": "2026-04-14", "02io.us": "2026-07-25", "02room.us": "2026-04-14", "02us.sbs": "2026-07-25", "02usweb.sbs": "2026-07-25", "02usweb.us": "2026-01-02", "02web-zoom.us": "2026-04-14", "02web.sbs": "2026-07-25", "02web.zoom.02webus.sbs": "2026-07-25", "02webus.sbs": "2026-07-25", "02webus.zoom.02us.sbs": "2026-07-25", "02webus.zoom.web02.sbs": "2026-07-25", "02webzoom.us": "2026-04-20", "03app.live": "2026-07-25", "03app.sbs": "2026-07-25", "04web.sbs": "2026-07-25", "05ie.live": "2026-07-25", "05in.one": "2026-07-25", "05live.biz": "2026-07-25", "05live.co": "2026-07-25", "05live.live": "2026-07-25", "05live.sbs": "2026-07-25", "05live.xyz": "2026-07-25", "05meet.am.in": "2026-07-25", "05meet.click": "2026-07-25", "05meet.co": "2026-07-25", "05meet.live": "2026-07-25", "05meet.sbs": "2026-07-25", "05meet.us": "2026-04-14", "05meetus.web05.uk": "2026-07-25", "05uk.us": "2026-04-14", "05ukweb.uk": "2026-04-14", "05us.live": "2026-07-25", "05us.sbs": "2026-07-25", "05us.zoom.05webus.sbs": "2026-07-25", "05us.zoom.web05.sbs": "2026-07-25", "05usweb.us": "2026-01-02", "05usweb.zoom.meet-05.sbs": "2026-04-14", "05web.us": "2026-04-14", "05webus.meet.05uk.us": "2026-04-14", "05webus.sbs": "2026-07-25", "06eu.us": "2026-07-25", "06in.us": "2026-07-25", "06ln.live": "2026-07-25", "06on.us": "2026-07-25", "06ukweb.uk": "2026-04-06", "06us.live": "2026-07-25", "06us.sbs": "2026-07-25", "06us.us": "2026-07-25", "06us.zoom.web06.eu": "2026-07-25", "06us.zoom.web06.sbs": "2026-07-25", "06usweb.us": "2026-04-06", "06usweb.zoom.us06.sbs": "2026-07-25", "06web.us06.in": "2026-07-25", "06web.zoomconnect.io": "2026-07-25", "06web.zoomlink.studio": "2026-07-25", "06webin.us": "2026-07-25", "07-web.us": "2026-04-14", "07usweb.site": "2026-04-06", "07web.zoom.uk07.pro": "2026-04-14", "07webus.zoom.us07.sbs": "2026-04-14", "163qiye.top": "2022-01-17", "1driv.org": "2020-06-24", "1drv.email": "2020-06-24", "1drvmail.work": "2020-06-24", "1ives.co": "2026-07-25", "256ventures.us": "2023-04-20", "31ventures.info": "2023-04-23", "32.ww-live.online": "2026-04-08", "3f.teams-meet.xyz": "2026-04-08", "5q.ms-meets.online": "2026-04-08", "a.mylkc.cloudns.ch": "2026-01-02", "a.updatesinfos.com": "2019-12-09", "abf-cap.co": "2022-12-30", "abf-cap.com": "2022-12-30", "abiesvc.com": "2022-01-17", "abiesvc.info": "2022-01-17", "abiesvc.jp.net": "2022-01-17", "account-googlemeet.com": "2026-04-06", "addressstore.space": "2026-06-07", "adiclas-nft.quest": "2024-04-24", "admin.unitpowergeneration.top": "2026-01-02", "adteam.am.in": "2026-07-25", "ai02n.sbs": "2026-07-25", "aidpartners.org": "2023-04-20", "ain01.sbs": "2026-07-25", "ajayplamingo.com": "2026-01-02", "aleslosev.workers.dev": "2026-01-02", "algozzoom.us006web.us": "2026-01-02", "altair-vc.co.uk": "2023-04-20", "altair-vc.com": "2023-04-20", "altair.linkpc.net": "2023-04-20", "amazonaws1.info": "2020-02-07", "amzonnews.club": "2020-06-24", "analysis.arkinvst.com": "2024-11-07", "angelbridge.capital": "2022-12-30", "angelbridge.jp": "2022-12-30", "ankanimatoka.com": "2024-11-07", "annaelsa.xyz": "2026-04-08", "anobaka.info": "2022-12-30", "anobaka.jp": "2022-12-30", "antcapital.us": "2021-03-23", "api.addressstore.space": "2026-06-07", "api.betterfun.space": "2026-01-02", "api.clearit.sbs": "2026-02-02", "api.flashstore.sbs": "2026-02-02", "api.zerodev.pro": "2026-01-02", "api.zoom-sdk.com": "2025-01-15", "apizoom.myfanshu.com": "2026-01-02", "app-wechat.xyz": "2026-01-02", "app.baiduweb.pro": "2025-01-15", "app.developcore.org": "2023-06-03", "app.republicrypto.vc": "2026-01-02", "app.thorwsap.finance": "2026-01-02", "app.us07webzoom.com": "2026-07-15", "app.zm-web.uno": "2026-04-14", "app06zoom.meet06us.net": "2026-07-25", "apple.cdsventure.xyz": "2026-07-25", "appleaccess.pro": "2024-11-07", "appleupdate.datauploader.site": "2024-04-24", "apps.teamms.live": "2026-07-25", "arbordeck.co.in": "2023-04-12", "arborventures.capital": "2023-05-13", "arkinvst.com": "2024-11-07", "armzon.onmypc.org": "2020-08-25", "association.linkpc.net": "2023-08-03", "atajerefoods.com": "2024-03-13", "atom.publicvm.com": "2022-01-17", "att.gdrvupload.xyz": "2022-01-17", "authenticate.azure-drive.com": "2021-06-19", "autodynamics.work.gd": "2023-08-10", "automatic-update.online": "2026-01-02", "autoprotect.com.de": "2023-01-25", "autoprotect.com.se": "2023-02-09", "autoprotect.gb.net": "2023-01-25", "autoupdate.online": "2026-01-02", "autoupdate.store": "2026-01-02", "autoupdatecheck.work.gd": "2023-05-13", "avid.lno-prima.lol": "2022-12-30", "awaitingfor.online": "2026-01-02", "awaitingfor.site": "2026-01-02", "azure-drive.com": "2021-06-09", "azure-service.com": "2022-01-17", "azure.doc-view.cloud": "2023-03-01", "azurehosting.co": "2023-01-25", "azureprotect.online": "2023-01-25", "azureprotect.xyz": "2022-01-17", "azureprotection.cloud": "2023-01-25", "azuresecurity.online": "2023-01-25", "azuresecurity.site": "2023-01-25", "azureword.com": "2022-01-17", "b.updatesinfos.com": "2019-12-09", "backup.163qiye.top": "2022-01-17", "baiduweb.pro": "2025-01-15", "bankofamerica.nyc": "2022-12-30", "bankofamerica.offerings.cloud": "2023-01-25", "bankofamerica.tel": "2022-12-30", "bankofamerica.us.org": "2022-12-30", "beenos.biz": "2022-01-17", "betterfun.space": "2026-01-02", "beyondnextventures.co": "2022-12-30", "beyondnextventures.com": "2022-12-30", "bhomes.cc": "2022-01-17", "biemflow.com": "2026-07-25", "bigbrain.group": "2026-01-02", "bigbrain.w04zoom.us": "2026-01-02", "bitcoinnews.mefound.com": "2022-01-17", "bitdefs.ignorelist.com": "2018-10-23", "bitflyer.team": "2022-01-17", "bizmeeting.online": "2026-01-02", "bizwebmeet.com": "2026-01-02", "blackwell.tekstar.us": "2020-08-25", "bli.us02we.us": "2026-01-02", "bli.us06we.us": "2026-01-02", "blockchaintransparency.institute": "2020-06-24", "blockstreet.w02zoom.us": "2026-01-02", "blockstreet.w04zoom.us": "2026-01-02", "blockstreet.w05zoom.us": "2026-01-02", "blog.cloudsecure.space": "2020-08-25", "bloomcloud.org": "2022-01-17", "bluewhale7.xyz": "2026-01-02", "bluyy.com": "2026-03-25", "bots.autoupdate.online": "2026-01-02", "breakdream.com": "2026-02-10", "btcprime.itsaol.com": "2020-08-25", "bugscrowd.com": "2020-06-24", "buidihub.com": "2022-01-17", "build-dream.com": "2026-02-11", "businesstalks.site": "2026-01-02", "busyqaz.com": "2026-07-15", "buy2x.com": "2024-08-17", "bycomsender.publicvm.com": "2026-04-06", "c-money.linkpc.net": "2023-08-03", "ca05web.com": "2026-02-23", "caladan.video": "2024-11-07", "calendly.caladan.video": "2024-11-07", "callnrwise.com": "2026-07-15", "callshere.com": "2026-04-08", "calltan.com": "2026-03-25", "cardiagnostic.net": "2024-11-07", "careers.bankofamerica.nyc": "2023-01-25", "careers.mizuhogroup.us": "2022-12-30", "careersbankofamerica.us": "2023-01-25", "carriebrigham-c.com": "2026-01-02", "ccx.capital": "2026-04-06", "cdnkit.io": "2026-01-02", "cdsventure.xyz": "2026-07-25", "cdsx.capital": "2026-04-14", "chaincapx.com": "2026-04-06", "chainverve.com": "2026-04-06", "check-address.xyz": "2026-01-02", "check.datatabletemplate.shop": "2026-01-02", "check02id.com": "2026-04-17", "checkdata.wiki": "2026-01-02", "chemistryworld.us": "2021-03-26", "chkactive.online": "2026-01-02", "chkstate.online": "2026-01-02", "chromeupdate.publicvm.com": "2020-08-25", "circlecapital.us": "2022-01-17", "clearit.sbs": "2026-01-02", "client.googleapis.online": "2022-01-17", "cloud-server.store": "2026-01-02", "cloud.anobaka.info": "2023-02-14", "cloud.azure-service.com": "2022-01-17", "cloud.azurehosting.co": "2023-04-20", "cloud.beyondnextventures.co": "2022-12-30", "cloud.daiwa.ventures": "2023-03-09", "cloud.dnx.capital": "2023-02-14", "cloud.espcapital.pro": "2023-02-14", "cloud.globalbrains.co": "2022-01-17", "cloud.globiscapital.co": "2023-01-25", "cloud.gpmtreit.co": "2023-02-14", "cloud.hedgehogvc.us": "2023-04-23", "cloud.inteam.live": "2026-07-25", "cloud.j-ic.co": "2023-02-14", "cloud.j-ic.com": "2023-02-14", "cloud.jumpshare.vip": "2022-01-17", "cloud.mekongcapital.net": "2023-02-14", "cloud.mufg.uk": "2023-01-25", "cloud.prosec.ink": "2022-12-20", "cloud.tptf.ltd": "2023-01-25", "cloud.venturelabo.co": "2021-05-06", "cloud.wpic.ink": "2023-01-25", "cloudfiles.club": "2020-03-31", "cloudmeet.works": "2026-07-15", "cloudocs.space": "2020-06-24", "cloudprotect.us.org": "2022-12-20", "cloudsecure.space": "2020-06-24", "cloudshare.jumpshare.vip": "2021-03-22", "cmailer.pro": "2026-02-10", "cmt.ventures": "2024-08-22", "cn-zoom.us": "2026-01-02", "coin-squad.co": "2022-01-17", "coinairbit.com": "2026-04-06", "coinbig.dev": "2022-01-17", "coinbigex.com": "2021-03-26", "coindeck.onmypc.org": "2020-08-25", "coinnews.onmypc.org": "2020-08-25", "coinomic.itsaol.com": "2020-08-25", "communicationhub.vip": "2026-01-02", "community.edwardcaputo.shop": "2024-11-07", "community.kevinaraujo.shop": "2024-11-07", "community.selincapital.com": "2024-11-07", "companydeck.cloud": "2023-05-13", "companydeck.online": "2023-05-13", "config-update.online": "2026-04-06", "config-update.site": "2026-04-06", "connsec.publicvm.com": "2020-08-25", "contract-research.blog": "2023-05-13", "contractresearch.blog": "2023-05-13", "craftiq.cloud": "2026-01-02", "cron-stage.usecrowdpay.xyz": "2026-01-02", "crypto.contract-research.blog": "2023-05-13", "crypto.contractresearch.blog": "2023-05-13", "cryptowave.capital": "2023-09-06", "customer-app.xyz": "2024-11-07", "daiwa-v.com": "2025-01-15", "daiwa.in-zoom.us": "2025-01-15", "daiwa.ventures": "2023-03-09", "databox.linkpc.net": "2026-04-06", "databoxes.linkpc.net": "2026-04-06", "datasend.fun": "2023-09-06", "datatabletemplate.shop": "2026-01-02", "datatabletemplate.xyz": "2026-01-02", "dataupload.store": "2026-01-02", "datauploader.online": "2024-04-24", "datauploader.site": "2024-04-24", "ddrive.publicvm.com": "2026-04-06", "ddsvr.itsaol.com": "2020-08-25", "decentryk.online": "2023-08-03", "deck.31ventures.info": "2023-04-23", "deck.altair-vc.co.uk": "2023-04-20", "deck.altair-vc.com": "2023-04-20", "deck.arbordeck.co.in": "2023-04-12", "deck.arbordeck.online": "2023-05-13", "deck.latest-report.cloud": "2023-05-23", "deck.toyota-ai.org": "2023-04-20", "decurret.site": "2020-06-24", "deepcore.v.entures": "2023-04-20", "deepmind.fund": "2022-01-17", "defactor.us002web.us": "2026-01-02", "dekryptcap.digital": "2022-01-17", "deliverypost.cloud": "2026-01-02", "delphidigital.org": "2024-11-07", "dencall.xyz": "2026-04-08", "dengmt.us": "2026-04-14", "dentmt.us": "2026-04-14", "desk-live.com": "2026-07-25", "desk.weventure.capital": "2026-07-25", "desktop.03app.sbs": "2026-07-25", "developcore.org": "2023-06-03", "devlab.locker": "2026-01-02", "devprocloud.com": "2021-07-10", "devstar.dnsrd.com": "2022-01-14", "dexalot.w03zoom.us": "2026-01-02", "dg01web.zoomconnector.com": "2026-01-02", "digifincx.com": "2020-06-24", "dllhost.xyz": "2022-01-14", "dma.linkpc.net": "2023-08-03", "doc-bridge.com": "2026-01-02", "doc-secure.it.com": "2026-01-02", "doc-secure.me": "2026-01-02", "doc-view.cloud": "2023-03-01", "doc.256ventures.us": "2023-04-20", "doc.apple.com.premienoe.aidl.eonw.line.pm": "2023-09-20", "doc.gdocshare.one": "2023-04-20", "doc.solanalab.org": "2024-11-07", "doc.venturelabo.co": "2022-01-17", "doc.youbicapital.cc": "2022-01-17", "doconline.top": "2022-01-17", "docs-send.cloud": "2023-05-13", "docs.azurehosting.co": "2023-01-25", "docs.azureword.com": "2022-01-17", "docs.coinbigex.com": "2022-01-17", "docs.gdriveshare.top": "2021-03-12", "docs.goglesheet.com": "2022-01-17", "docs.securedigitalmarkets.co": "2022-01-17", "docsend-cloud.espcap.fun": "2023-07-30", "docsend.com-pro.apple.cloud.line.pm": "2023-07-30", "docsend.com-proapple.cloud.line.pm": "2023-08-03", "docsend.me": "2023-04-20", "docstream.online": "2022-01-17", "document.antcapital.us": "2021-03-23", "document.bhomes.cc": "2022-01-17", "document.fastercapital.cc": "2022-01-17", "document.kraken-dev.com": "2022-01-17", "document.lundbergs.cc": "2022-01-17", "document.skandiafastigheter.cc": "2022-01-17", "documentprotect.live": "2021-03-21", "documentprotect.pro": "2021-03-21", "documents.antcapital.us": "2022-01-17", "docupload.bond": "2023-05-23", "docupload.lat": "2023-05-23", "docupload.site": "2023-05-13", "docupload.store": "2023-05-23", "docuserver.xyz": "2022-01-17", "domainhost.dynamic-dns.net": "2022-01-17", "dontdie.cfd": "2023-06-03", "dourolab.xyz": "2024-08-22", "down.aidpartners.org": "2023-04-20", "down.espcapital.co": "2023-04-20", "down.gpmtreit.co": "2023-02-14", "down.gpmtreit.us": "2023-02-14", "down.hedgehogvc.us": "2023-04-23", "down.j-ic.com": "2023-02-14", "down.protectedviewer.co": "2023-04-20", "down.tomming.us": "2023-02-14", "download.azure-safe.com": "2022-01-17", "download.azure-service.com": "2022-01-17", "download.datatabletemplate.xyz": "2026-01-02", "download.face-online.world": "2026-01-02", "download.gdriveupload.site": "2022-01-17", "downloadfile.icu": "2023-06-16", "drainer.bot": "2026-01-02", "dreamdie.com": "2026-02-10", "drive.sharegoogldrive.online": "2022-08-20", "drivebox.publicvm.com": "2026-04-06", "driveboxitem.publicvm.com": "2026-04-06", "drivegmail.top": "2020-06-24", "drivegoogle.org": "2020-06-24", "drivegoogle.publicvm.com": "2020-08-25", "drivegoogles.com": "2020-08-25", "drivegooglshare.xyz": "2020-06-24", "drivegooogle.publicvm.com": "2020-08-25", "drives.googldrive.xyz": "2022-01-17", "drives.googlecloud.live": "2022-01-17", "driveshare.googldrive.xyz": "2022-01-17", "drmariamaly.com": "2026-01-02", "drogueriasanjose.net": "2024-11-07", "dronefund.icu": "2022-01-17", "dropepe.cfd": "2024-04-24", "drw.capital": "2022-01-17", "dunamu.in-zoom.us": "2025-01-15", "dunamuventures.com": "2025-01-15", "e.ms-live.xyz": "2026-01-02", "e01i.co": "2026-07-25", "edgetunnel.leungkc.eu.org": "2026-01-02", "edwardcaputo.shop": "2024-11-07", "eii.world": "2022-01-17", "els.docupload.bond": "2023-05-23", "em-oujuit78ytserve.com": "2026-01-02", "em-oujuit78ytserve.net": "2026-01-02", "email.sellinicapital.com": "2024-11-07", "esosv.itemdb.com": "2020-08-25", "espcap.fun": "2023-07-30", "espcapital.pro": "2023-02-14", "etherscan.mrslove.com": "2022-01-17", "eu.web02meet.com": "2026-04-14", "eu.web03us.sbs": "2026-07-25", "eu.web06.us": "2026-07-25", "eu.zoom.04web.sbs": "2026-07-25", "eu02.us": "2026-07-25", "eu06.in": "2026-07-25", "eu06.us": "2026-07-25", "eu06web.app": "2026-07-25", "eu07webin.co": "2026-07-25", "euhub.ue06.us": "2026-07-25", "euprotect.net": "2020-06-24", "europegdprsec.onmypc.org": "2020-08-25", "eusharesrv.onmypc.org": "2020-08-25", "excinfo.itemdb.com": "2020-08-25", "ezqrn.top": "2026-01-02", "face-online.world": "2026-01-02", "faq78.faqserv.com": "2022-01-17", "fastdown.site": "2022-01-17", "fastercapital.cc": "2022-01-17", "fcloudshare.xyz": "2020-06-24", "file-server.store": "2026-01-02", "file.docupload.lat": "2023-05-23", "file.docupload.site": "2023-05-13", "file.docupload.store": "2023-05-23", "file.latest-report.online": "2023-06-03", "file.myfirmdocument.cloud": "2023-05-13", "file.myfirmdocument.online": "2023-05-13", "file.venturelabo.co": "2022-01-17", "filecloud.website": "2020-06-24", "filedrive.online": "2026-01-02", "filestream.download": "2022-01-17", "financialmarketing.live": "2020-06-24", "first.longlastfor.online": "2026-01-02", "first.system-update.xyz": "2024-04-24", "firstfromsep.online": "2026-01-02", "flashserve.store": "2026-01-02", "flashstore.sbs": "2026-01-02", "floriventurescapital.linkpc.net": "2023-07-09", "floriventuresfinance.linkpc.net": "2023-07-09", "floriventuresfund.linkpc.net": "2023-07-09", "foundico.mefound.com": "2022-01-17", "frameworks.ventures": "2024-11-07", "freetalks.work": "2026-07-15", "ftp.uswe05.us": "2026-01-02", "fxbet.linkpc.net": "2022-01-14", "g-call.net": "2026-04-17", "g-call.net.wildnextcard.com": "2026-04-17", "galaxydigital.cc": "2022-01-17", "galaxydigital.cloud": "2022-01-17", "gassist.publicvm.com": "2026-04-06", "gassists.run.place": "2026-04-06", "gdocsdown.com": "2022-04-16", "gdrive.onmypc.org": "2020-08-25", "gdrive.sharemailcontents.com": "2026-04-06", "gdriveemail.publicvm.com": "2026-04-06", "gdriverfileshare.com": "2020-06-24", "gdrives.best": "2020-06-24", "gdrives.top": "2020-06-24", "gdriveshare.com": "2022-12-14", "gdriveshare.publicvm.com": "2026-04-06", "gdriveshare.top": "2020-06-24", "gdriveshareslink.xyz": "2020-06-24", "gdriveupload.info": "2020-02-21", "gdriveupload.site": "2020-06-24", "gdrvauth.cloud": "2020-06-24", "gdrvcheck.co": "2020-06-24", "gdrvcloud.com": "2023-06-03", "gdrvshare.site": "2020-06-24", "gdrvup.xyz": "2020-02-07", "gdrvupload.xyz": "2020-06-24", "getfilefrom.site": "2023-06-16", "getfilefrom.store": "2023-06-16", "getwebconnection.buzz": "2023-05-23", "getwebconnection.cfd": "2023-06-03", "global-chat.live": "2026-07-25", "globalbrains.co": "2022-01-17", "globiscapital.co": "2023-01-25", "gmaildrive.info": "2020-06-24", "gmaildrive.site": "2020-02-07", "gmaildriver.info": "2020-06-24", "gmeet-private.com": "2026-04-06", "gmeet1.xyz": "2026-04-17", "godlike-visit.online": "2026-04-14", "gogleshare.xyz": "2020-06-24", "goglesheet.com": "2020-06-24", "gogoschip.online": "2026-04-14", "goog1e.us-meet.com": "2026-04-06", "googe-video-call.xyz": "2026-04-17", "googie.us-gmeet.com": "2026-04-06", "googie.us-meet.com": "2026-04-06", "googldocs.org": "2020-06-24", "googldrive.xyz": "2020-06-24", "google-meet-live.com": "2026-04-17", "google-meet.joins-video-call.com": "2026-04-17", "google-meet.video-call-now.live": "2026-04-17", "google-meeting.com": "2026-04-06", "google-meets-view.7-vs.com": "2026-04-17", "google-meets.2mydns.net": "2026-04-17", "google.meet21web.com": "2026-04-17", "google.us-meet.com": "2026-04-14", "google.xn--80aagm.beauty": "2026-01-02", "googleapis.online": "2020-06-24", "googleauth.pro": "2020-02-07", "googlecloud.live": "2020-06-24", "googleclouddrive.com": "2020-06-24", "googlecstorage.com": "2020-06-24", "googledocpage.com": "2021-05-11", "googledrive.download": "2020-06-24", "googledrive.dynu.net": "2020-04-18", "googledrive.email": "2020-06-24", "googledrive.linkpc.net": "2020-04-18", "googledrive.network": "2020-06-24", "googledrive.online": "2020-06-24", "googledrive.publicvm.com": "2020-08-25", "googledrive.services": "2022-12-14", "googledriver.info": "2020-02-07", "googledriver.net": "2020-06-24", "googledriver.xyz": "2020-06-24", "googledriveshare.com": "2020-06-24", "googledrv.com": "2020-06-24", "googleexplore.net": "2020-06-24", "googlefiledrive.com": "2020-06-24", "googlefileshare.com": "2020-06-24", "googlemeet-account.com": "2026-04-06", "googlemeet.syncn.cfd": "2026-06-27", "googlemeett.com": "2026-04-06", "googleservice.icu": "2022-01-17", "googleservice.xyz": "2020-09-10", "googleshare.org": "2020-06-24", "googlesheetpage.org": "2022-01-01", "googleupdate.publicvm.com": "2020-08-25", "googleupload.info": "2020-02-07", "gooqle-meet-live.my.id": "2026-04-17", "gooqle-meet-lives.f-a1.com": "2026-04-17", "gooqle-meet-lives.my.id": "2026-04-17", "gooqle-meet-lives.s-41.com": "2026-04-17", "gooqle-meet-online.com": "2026-04-17", "gooqle-meet-online.com.wildnextcard.com": "2026-04-17", "gooqle-meet.my.id": "2026-04-17", "gooqle-view.com": "2026-04-17", "gosats.us02we.us": "2026-01-02", "gost.run": "2026-01-02", "goweb.zoomconnector.com": "2026-01-02", "gphi-adhaswe.xyz": "2019-12-09", "gphi-gsaeyheq.top": "2019-12-09", "gphi.site": "2019-12-09", "gpmtreit.co": "2023-02-14", "gpmtreit.us": "2023-02-14", "greenweb.ink": "2026-07-15", "group.pro-tokyo.top": "2023-07-30", "gsheet.gdocsdown.com": "2022-01-17", "gumi-cryptos.us05web-zoom.pro": "2026-01-02", "gunosis.global": "2023-05-13", "hanaconference.xyz": "2026-01-02", "hanagroup.video": "2024-11-11", "hananetwork.video": "2024-11-07", "happyz.one": "2024-11-07", "health.weventure.capital": "2026-07-25", "hedgehogvc.us": "2023-04-23", "hiccup.shop": "2022-01-17", "honavolae.xyz": "2026-01-02", "hoststudio.org": "2023-01-25", "hotter.weventure.capital": "2026-07-25", "httpscalm-morning-viber.comhmirihansa909workersdev.workers.dev": "2026-01-02", "huspot.blog": "2024-11-07", "hwsrv-1225327.hostwindsdns.com": "2024-11-07", "hwsrv-1320779.hostwindsdns.com": "2026-07-15", "i06sn.co": "2026-07-25", "image-support.xyz": "2026-01-02", "imp-docs.digital": "2024-09-13", "in-zoom.us": "2025-01-15", "in06.us": "2026-07-25", "info.ankanimatoka.com": "2024-11-07", "info.anobaka.info": "2024-11-30", "info.customer-app.xyz": "2024-11-07", "inmsed.com": "2026-04-08", "innoenergy.info": "2021-03-26", "instant-update.online": "2026-01-02", "inteam.live": "2026-07-25", "inteams.us": "2026-04-14", "inter.gpmtreit.co": "2023-04-20", "interalliancemediagroups.cloud": "2023-05-13", "internal-document-he-gr-me.run.place": "2023-10-27", "internal-meeting.online": "2023-09-06", "internal.j-ic.co": "2023-02-14", "interweb.work": "2026-07-15", "invite-meet-call.com": "2026-04-17", "invite-meet-call.com.wildnextcard.com": "2026-04-17", "ip1.gphi-adhaswe.xyz": "2019-12-09", "ip1.gphi-gsaeyheq.top": "2019-12-09", "ip1.s.gphi.site": "2019-12-09", "ip2.s.gphi.site": "2019-12-09", "isosecurity.xyz": "2022-01-17", "iu03e.live": "2026-07-25", "j-ic.co": "2023-02-14", "j-ic.co.internal-document-he-gr-me.run.place": "2023-10-27", "j-ic.com": "2023-02-14", "jack710.club": "2022-01-17", "jdshare.com.de": "2023-04-02", "jobs.twosigmavc.capital": "2025-01-13", "jobs.twosigmaventures.us": "2025-01-13", "johnmichaelsesay.com": "2026-01-02", "join-meets.com": "2026-01-02", "join-uk.com": "2026-04-08", "joins-video-call.com": "2026-04-17", "jp-aprime.info": "2024-11-30", "jumpshare.vip": "2022-01-17", "kanga.us05we.us": "2026-01-02", "kevinaraujo.shop": "2024-11-07", "koreaair.tattoo": "2024-04-24", "kraken-dev.com": "2022-01-17", "krypitalvc.com": "2020-06-24", "laos.hedgehogvc.us": "2023-04-23", "laserdigital.xyz": "2026-01-02", "last-report.online": "2023-05-23", "latest-report.cloud": "2023-05-23", "latest-report.online": "2023-06-03", "ledgercloud.com": "2023-01-25", "ledgerservice.itsaol.com": "2020-08-25", "lemniscap.cc": "2022-01-17", "lievec.com": "2026-04-08", "liivoe.com": "2026-04-08", "linecall.app": "2026-07-15", "linelive.us": "2026-04-08", "liue.us": "2026-04-08", "liues.us": "2026-04-08", "liuesus.com": "2026-04-08", "liueus.com": "2026-04-08", "live-call.net": "2026-04-17", "live-call.net.wildnextcard.com": "2026-04-17", "live-chat.live": "2026-07-25", "live-com.xyz": "2026-07-25", "live-meet.app": "2026-07-25", "live-meet.online": "2026-04-08", "live-us.com": "2026-04-08", "live-video-call.me": "2026-04-17", "live-video-call.me.panelize.cloud": "2026-04-17", "live-workplace.com": "2026-07-25", "live.am.in": "2026-07-25", "live.desk-live.com": "2026-07-25", "live.miclesoft.com": "2026-07-25", "live.micrrosfts.com": "2026-07-25", "live.micrxsoft.com": "2026-07-25", "live.teamms-com.xyz": "2026-07-25", "live.teamsbrowser.com": "2026-07-25", "live.workplace.teams-com.live": "2026-07-25", "live02.co": "2026-07-25", "live05ms.us": "2026-04-08", "liveam.video": "2026-07-25", "livecall.team": "2026-07-25", "liveconference.eu06.us": "2026-07-25", "livehuddle01.us": "2026-04-08", "livemeetgooogle.com": "2026-04-17", "livemicrosft.center": "2026-07-25", "livemicrosft.com": "2026-04-21", "liveonedrvshare.xyz": "2020-02-07", "lives-com.com": "2026-07-25", "lives.microrrsoft.com": "2026-07-25", "lives.microsft02.com": "2026-07-25", "lives.microsoft-desk.com": "2026-07-25", "lives.ms.teams02.co": "2026-07-25", "lives.team-global.live": "2026-07-25", "lives.teamicrosoft.sbs": "2026-07-25", "lives.teamms.global-chat.live": "2026-07-25", "lives.teams-app.pro": "2026-07-25", "lives.teams-desk.live": "2026-07-25", "lives.teams-workplace.live": "2026-07-25", "lives.teams02.com": "2026-07-25", "lives.teams03.com": "2026-07-25", "lives.teamstunnel.com": "2026-07-25", "lives02.com": "2026-07-25", "lives02.run": "2026-07-25", "lives05.com": "2026-07-25", "lives06.com": "2026-07-25", "lives07.com": "2026-07-25", "livescall.us": "2026-04-08", "livescall.xyz": "2026-04-08", "livesmeet.us": "2026-04-08", "livesmeets.us": "2026-04-08", "livesmicrosft.com": "2026-07-25", "lno-prima.lol": "2022-12-30", "lodashmap.online": "2026-04-06", "longjourneycapital.publicvm.com": "2023-08-03", "longjourneyfund.publicvm.com": "2023-08-03", "longjourneyventure.publicvm.com": "2023-08-03", "longlastfor.online": "2026-01-02", "lservs.linkpc.net": "2022-01-14", "lundbergs.cc": "2022-01-17", "lzfvefl.com": "2026-07-15", "lzlovewxx.store": "2026-07-25", "m.ms-live.xyz": "2026-01-02", "macro.teams.live02.co": "2026-07-25", "maelstromfund.org": "2024-08-22", "maelstroms.fund": "2024-11-07", "mail.gdriveupload.info": "2022-01-17", "mail.gmaildrive.site": "2022-01-17", "mail.googleupload.info": "2022-01-17", "mail.teamsliues.com": "2026-07-15", "mail.w06zoom.us": "2026-01-02", "managedoc.us": "2026-04-06", "maskasd.com": "2026-07-15", "matrixpartners.theworkpc.com": "2020-08-25", "matuaner.com": "2024-11-07", "mc.tvdhoenn.net": "2024-08-22", "mclland.com": "2021-03-26", "mediazoom.us": "2026-01-02", "meejgoogle.com": "2026-04-06", "meelgoogle.com": "2026-04-06", "meet-05.sbs": "2026-04-14", "meet-app.cc": "2026-04-14", "meet-call.com": "2026-04-17", "meet-call.com.wildnextcard.com": "2026-04-17", "meet-client.xyz": "2026-01-02", "meet-googie.com": "2026-04-06", "meet-google.app": "2026-04-17", "meet-google.me": "2026-04-06", "meet-google.me.myprocloud.online": "2026-04-17", "meet-google.me.proxnginx.com": "2026-04-06", "meet-google.ru": "2026-04-06", "meet-live.me": "2026-04-17", "meet-live.me.wildnextcard.com": "2026-04-17", "meet-qoogle.com": "2026-04-06", "meet-video-call.com": "2026-04-06", "meet-video-chat.online": "2026-04-17", "meet-video-chat.online.wildnextcard.com": "2026-04-17", "meet-web.us": "2026-04-14", "meet-web3.eu": "2026-04-14", "meet.05uk.us": "2026-04-14", "meet.app.zm-web.uno": "2026-04-14", "meet.baiduweb.pro": "2025-01-15", "meet.caladan.video": "2024-11-07", "meet.coinairbit.com": "2026-04-06", "meet.daiwa-v.com": "2025-01-15", "meet.drmariamaly.com": "2026-01-02", "meet.dunamuventures.com": "2025-01-15", "meet.gmeet1.xyz": "2026-04-17", "meet.gooqle-view.com": "2026-04-17", "meet.hanagroup.video": "2024-11-11", "meet.hananetwork.video": "2024-11-07", "meet.mzweb3.fund": "2025-01-15", "meet.play-goog1es.com": "2026-04-06", "meet.playgroundvc.capital": "2025-01-15", "meet.playgroundventures.capital": "2025-01-15", "meet.saisoncapital.net": "2025-01-15", "meet.selinicapital.info": "2024-11-07", "meet.sellinicapital.com": "2024-11-07", "meet.teamicro.live": "2026-07-25", "meet.twosigmavc.capital": "2025-01-15", "meet.twosigmaventures.us": "2025-01-15", "meet.video-livechat.com": "2026-04-17", "meet.w02zoom.us": "2026-01-02", "meet.zoom.05live.live": "2026-07-25", "meet05.sbs": "2026-04-14", "meet06.live": "2026-07-25", "meet06.us": "2026-07-25", "meet06us.net": "2026-07-25", "meet21web.com": "2026-04-17", "meetapp.room.ain01.sbs": "2026-07-25", "meetgoogje.com": "2026-04-06", "meetgooglc.com": "2026-04-06", "meeting-chat.com": "2026-04-06", "meeting-hub.team": "2026-01-02", "meeting-zone.team": "2026-01-02", "meeting.zoom-client.com": "2024-11-07", "meetingapp.us": "2026-04-14", "meetingnow-goo-gle.com": "2026-04-17", "meets-qoogle.com": "2026-04-06", "meetsdk.online": "2026-07-25", "meettgoogle.com": "2026-04-06", "meetup-room.online": "2026-01-02", "meetuphub.online": "2026-01-02", "megabitcapital.com": "2026-04-14", "mekongcapital.net": "2023-02-14", "metamask.awaitingfor.site": "2024-04-24", "mg21.1056.uk": "2024-11-07", "miclesoft.com": "2026-07-25", "micrlive.online": "2026-04-08", "micro.com.in": "2026-07-25", "microb.click": "2026-04-08", "microc.click": "2026-04-08", "microca11.com": "2026-04-08", "microcal1.com": "2026-04-08", "microcall.us": "2026-04-08", "microcodf.com": "2026-04-08", "microcoll.com": "2026-04-08", "microcome.com": "2026-07-25", "microe.click": "2026-04-08", "microg.click": "2026-04-08", "microh.click": "2026-04-08", "microi.click": "2026-04-08", "micromeet.us": "2026-04-08", "microp.click": "2026-04-08", "micror.click": "2026-04-08", "microrrsoft.com": "2026-07-25", "microsall.com": "2026-04-08", "microscalls.com": "2026-04-08", "microscell.com": "2026-04-06", "microschats.com": "2026-04-08", "microsdb.com": "2026-04-08", "microselt.com": "2026-04-08", "microsft02.com": "2026-07-25", "microshen.com": "2026-04-08", "microshlop.com": "2026-04-08", "microsinfos.com": "2026-04-08", "microsmeet.com": "2026-04-08", "microsmeet.xyz": "2026-04-14", "microsoft-desk.com": "2026-07-25", "microsoft-rage.world": "2024-09-13", "microsoft-workspace.live": "2026-07-25", "microsoft.asn.lv": "2026-07-25", "microsoft.lives02.run": "2026-07-25", "microsoftapp.life": "2020-06-24", "microsofteam.app": "2026-07-25", "microsofts.live-workplace.com": "2026-07-25", "microsomeet.com": "2026-04-08", "microsorft.live.desk-live.com": "2026-07-25", "microsout.com": "2026-04-08", "microsslcheck.com": "2026-04-08", "microssoft.live": "2026-07-25", "microssoft.live-chat.live": "2026-07-25", "microstratgey.com": "2022-01-17", "microszlt.com": "2026-04-08", "microt.click": "2026-04-08", "microteam.live": "2026-07-25", "microvsoft.com": "2026-07-25", "micrrosfts.com": "2026-07-25", "micrusoft.us": "2026-04-08", "micrxsoft.com": "2026-07-25", "micstmeet.com": "2026-04-08", "minhhieu.xyz": "2026-04-17", "miscruft.us": "2026-04-08", "miss.outletalertsdaily.com": "2022-01-17", "mizuhogroup.us": "2022-12-30", "mmsreceive.linkpc.net": "2022-01-14", "mpksl.publicvm.com": "2020-08-25", "ms-live.com": "2026-01-02", "ms-live.site": "2026-04-08", "ms-live.team": "2026-04-08", "ms-live.us": "2026-01-02", "ms-live.xyz": "2026-01-02", "ms-meet.live": "2026-01-02", "ms-meet.xyz": "2026-04-08", "ms-meeting.us": "2026-04-08", "ms-meets.online": "2026-04-08", "ms-meets.us.com": "2026-04-08", "ms-meets.xyz": "2026-04-08", "ms-teams.live": "2026-04-08", "ms-teams.us.com": "2026-04-08", "ms-teams.xyz": "2026-04-08", "ms.teams02.co": "2026-07-25", "ms06teams.live-meet.app": "2026-07-25", "mskpupdate.publicvm.com": "2020-08-25", "mslivecall.com": "2026-04-08", "mslivecall.us": "2026-04-08", "mslivemeet.com": "2026-04-08", "msmeet.in": "2026-07-25", "msmeet.teamlv.vip": "2026-07-25", "msmeet.us": "2026-04-08", "msoffice.qooqle.download": "2022-01-17", "msquickcall.com": "2026-04-08", "msservices.hxxps443.org": "2022-01-14", "msteamcall.com": "2026-04-08", "msupdate.publicvm.com": "2020-08-25", "msupdatepms.xyz": "2020-06-24", "msweblive.us": "2026-07-15", "mufg.ink": "2023-01-25", "mufg.uk": "2023-01-25", "mufg.us.com": "2023-04-02", "mufg.us.org": "2023-01-25", "mufg.yokohama": "2023-02-28", "mughalfan.xyz": "2026-01-02", "mx.interalliancemediagroups.cloud": "2023-05-13", "myfirmdocument.cloud": "2023-05-13", "myfirmdocument.online": "2023-05-13", "mylingocoin.com": "2026-01-02", "mymeetgoogle.com": "2026-04-17", "mymeetgooogle.com": "2026-04-17", "mymeetinglive.com": "2026-04-17", "mymeetingnow.com": "2026-04-17", "mymeetingtoday.com": "2026-04-17", "mymeetlive.com": "2026-04-17", "mzweb3.fund": "2025-01-15", "n04i.one": "2026-07-25", "navicheck.xyz": "2020-06-24", "nbright.best": "2023-04-20", "neptune.tastebuds.buzz": "2026-01-02", "net.on05.eu": "2026-07-25", "netface.live": "2026-07-15", "newfromjune.shop": "2026-01-02", "newfromjune.site": "2026-01-02", "news.last-report.online": "2023-05-23", "newtribe.in-zoom.us": "2025-01-15", "newwebapi.us": "2026-01-02", "nexologin.xyz": "2026-01-02", "nicrft.site": "2026-01-02", "nicrosofm.com": "2026-04-08", "nicrosolf.com": "2026-04-08", "nicrosolt.com": "2026-04-08", "nisrosodf.com": "2026-04-08", "node.minhhieu.xyz": "2026-04-17", "nodnote.com": "2024-11-07", "note.onedocshare.com": "2022-01-17", "ns1.trytiponlineresult.com": "2023-04-20", "ns2.trytiponlineresult.com": "2023-04-20", "obituary2.redirectme.net": "2023-07-09", "offerings.cloud": "2022-12-30", "ok.docupload.store": "2023-05-23", "olafsven.xyz": "2026-04-08", "on05.eu": "2026-07-25", "on06.us": "2026-07-25", "oneasu.com": "2026-04-08", "onedrive.ms-live.com": "2026-01-02", "onedrive.syncn.cfd": "2026-06-27", "onedrivecloud.store": "2020-06-24", "onedriveglobal.com": "2020-06-24", "onedrivems.online": "2020-06-24", "onedriveupdate.publicvm.com": "2020-08-25", "onedrivrshares.xyz": "2020-06-24", "onedrvdn.co": "2020-06-24", "onedrvfile.site": "2020-06-24", "online-conference.online": "2026-01-02", "online-conference.pro": "2026-01-02", "online-conference.site": "2026-01-02", "online-conference.store": "2026-01-02", "online-conference.xyz": "2026-01-02", "online-meets.cloud": "2026-01-02", "online-meets.store": "2026-01-02", "online.selinicapital.info": "2024-11-07", "online.zoom-client.com": "2024-11-07", "onlinedoc.dev": "2022-01-01", "onlinedocpage.org": "2022-01-17", "onlinemeet.video": "2026-01-02", "onlineshoping.publicvm.com": "2022-01-14", "onlivecall.com": "2026-04-08", "onlivemeet.com": "2026-04-06", "onmsed.com": "2026-04-08", "onreallive.com": "2026-04-08", "onteam.business.in": "2026-07-25", "onwebcall.us": "2026-07-15", "onweblive.org": "2026-07-15", "onwebmeet.us": "2026-07-15", "ortjc.com": "2026-01-02", "os-live.com": "2026-04-08", "os-live.online": "2026-04-08", "os-live.us": "2026-04-08", "os-live.xyz": "2026-04-08", "outletalertsdaily.com": "2022-01-17", "outms.com": "2026-04-08", "ovalln.top": "2026-01-02", "ownemail.me": "2020-05-14", "pacificyouth.club": "2026-01-02", "page.googledocpage.com": "2022-01-17", "palconshop.linkpc.net": "2022-01-14", "panda95sg.asia": "2024-08-22", "parafi.w03zoom.us": "2026-01-02", "parafi.wbzoom.us": "2026-01-02", "partner.deepcore.v.entures": "2023-04-20", "periqi.com": "2026-01-02", "perseus.bond": "2022-12-30", "pet.hedgehogvc.us": "2023-04-23", "piprotocol.w03zoom.us": "2026-01-02", "pixelmonmmo.net": "2024-08-22", "pixleon.net": "2024-08-22", "play-goog1es.com": "2026-04-06", "playgroundvc.capital": "2025-01-15", "playgroundventures.capital": "2025-01-15", "pokersonic.publicvm.com": "2022-01-14", "pre.alwayswait.site": "2023-09-20", "premium-business.live": "2026-04-14", "premium.03app.live": "2026-07-25", "premuims.live": "2026-04-08", "press.linkpc.net": "2022-01-14", "prismlab.xyz": "2024-08-22", "privacyshield.services": "2020-06-24", "pro-tokyo.top": "2023-07-30", "product.onlinedoc.dev": "2022-01-01", "productnews.online": "2026-01-02", "prosec.ink": "2022-12-20", "protect.antcapital.us": "2021-03-23", "protect.azure-drive.com": "2021-06-09", "protect.venturelabo.co": "2022-01-17", "protectedviewer.co": "2023-04-20", "protectoffice.club": "2021-04-11", "protectsh.online": "2023-08-03", "provemail.net": "2020-06-24", "prvservice.com": "2026-02-06", "pvset.itsaol.com": "2022-01-17", "qooqle.download": "2021-03-26", "qoqle.online": "2022-01-17", "quick-meeting.online": "2026-01-02", "raizerverify.online": "2023-08-03", "rd.ww-live.uk": "2026-04-08", "readysafe.xyz": "2026-01-02", "real-update.xyz": "2026-01-02", "real.automatic-update.online": "2026-01-02", "reallivecall.us": "2026-04-08", "refogevc.web08zoom.us": "2026-01-02", "reforge.w02zoom.us": "2026-01-02", "reforge.web099zoom.us": "2026-01-02", "reforgevc.web08zoom.us": "2026-01-02", "regcnlab.com": "2022-01-17", "reit.live": "2022-01-17", "remoteorder.shop": "2026-01-02", "renaworkshard.xyz": "2026-04-08", "rentyourmac.xyz": "2026-01-02", "republicrypto.vc": "2026-01-02", "room-meeting.online": "2026-01-02", "room.ain01.sbs": "2026-07-25", "room.in06.us": "2026-07-25", "root.chkstate.online": "2026-01-02", "root.security-update.xyz": "2026-01-02", "root.system-update.cloud": "2024-04-24", "rubbishshop.linkpc.net": "2022-01-14", "rubbishshop.publicvm.com": "2022-01-14", "rwa.wbzoom.us": "2026-01-02", "rxamia.com": "2026-01-02", "safe.arborventures.capital": "2023-05-13", "safe.doc-share.pro": "2023-04-20", "safe.doc-share.top": "2023-04-20", "safe.gunosis.global": "2023-05-13", "safe.job-description.online": "2023-05-13", "safe.nextera.capital": "2023-05-13", "safe.shared-document.cloud": "2023-04-12", "safe.smart-contracts.blog": "2023-05-13", "safefor.xyz": "2026-01-02", "safeup.online": "2026-01-02", "safeup.store": "2026-01-02", "safeupload.online": "2026-01-02", "saisoncapital.net": "2025-01-15", "sarahbeery.docsend.me": "2023-04-20", "sdk.w22zoom.us": "2026-01-02", "second.awaitingfor.online": "2026-01-02", "second.systemupdate.cloud": "2026-01-02", "secondshop.online": "2026-01-02", "secondshop.store": "2026-01-02", "secure-meeting.cloud": "2026-01-02", "secure-meeting.xyz": "2026-01-02", "secure.inteam.live": "2026-07-25", "securedigitalmarkets.ca": "2022-01-17", "securedigitalmarkets.co": "2022-01-17", "secureshares.online": "2020-02-07", "securesmtp.interalliancemediagroups.cloud": "2023-05-13", "securetech.fun": "2026-01-02", "security-update.xyz": "2026-01-02", "selincapital.com": "2024-11-07", "selinicapital.info": "2024-11-07", "selinicapital.network": "2024-11-07", "sendbrevo.com": "2026-02-11", "sendcontents.linkpc.net": "2026-04-06", "sendhosting.pro": "2026-01-02", "sendmailed.com": "2024-08-22", "sendmailer.org": "2024-11-07", "sendspace.buzz": "2020-06-24", "sevicebill.itemdb.com": "2020-08-25", "sevrrhst.com": "2026-02-06", "sfrclak.com": "2026-07-15", "sg05web.us": "2026-01-02", "share.anobaka.info": "2023-01-25", "share.bloomcloud.org": "2022-01-17", "share.dedesignanddev.com": "2023-03-13", "share.devprocloud.com": "2021-07-10", "share.docuserver.xyz": "2022-01-17", "share.stablemarket.org": "2022-01-07", "sharebusiness.xyz": "2021-07-10", "shared-document.cloud": "2023-04-12", "sharedocs.xyz": "2022-01-17", "sharedrivegght.xyz": "2020-06-24", "sharegoogldrive.online": "2020-06-24", "sharemailcontents.publicvm.com": "2026-04-06", "sharesdown.xyz": "2020-06-24", "shh5.baranftw.xyz": "2024-11-07", "show-pdf-document.com": "2024-09-13", "showprice.xyz": "2020-06-24", "sidezoom.us": "2026-01-02", "signsafe.site": "2026-01-02", "signsafe.xyz": "2026-01-02", "signverydn.sharebusiness.xyz": "2021-07-10", "silver.web08zoom.us": "2026-01-02", "singular.w03zoom.us": "2026-01-02", "singulardex.wbzoom.us": "2026-01-02", "sinovationventures.co": "2022-01-17", "site.siteshare.me": "2023-04-20", "siteshare.me": "2023-04-20", "skandiafastigheter.cc": "2022-01-17", "skyweb.work": "2026-07-15", "slot0.regcnlab.com": "2022-01-17", "smbc-vc.com": "2022-12-30", "smbc.ltd": "2022-12-30", "smbcgroup.us": "2022-12-30", "smtps.interalliancemediagroups.cloud": "2023-05-13", "socialsuport.com": "2026-01-02", "socins.publicvm.com": "2022-01-14", "solana.w05zoom.us": "2026-01-02", "solanalab.org": "2024-11-07", "solayer.us002web.us": "2026-01-02", "solidbitcapital.xyz": "2026-04-06", "spirtblockchain.com": "2023-04-12", "stablemarket.org": "2022-01-07", "stabucksiren.fun": "2024-04-24", "stalelive.us": "2026-07-15", "star-bucks.life": "2024-04-24", "starbucksevent.pics": "2024-04-24", "static.cdnkit.io": "2026-01-02", "stomcs.com": "2026-02-06", "sts.interalliancemediagroups.cloud": "2023-06-03", "suport.ms-live.com": "2026-01-02", "support-gmeet.com": "2026-01-02", "support-google.co.im": "2026-01-02", "support-google.co.in": "2026-01-02", "support-google.us": "2026-01-02", "support-google.ws": "2026-01-02", "support-zoom.us": "2026-01-02", "support.ms-live.com": "2026-01-02", "support.ms-live.us": "2026-02-02", "support.ms-meet.live": "2026-01-02", "support.teams-live.org": "2026-01-02", "support.teams-live.us": "2026-01-02", "support.us05web-zoom.biz": "2026-01-02", "support.us05web-zoom.cloud": "2026-01-02", "support.us05web-zoom.forum": "2026-01-02", "support.us05web-zoom.pro": "2026-01-02", "support.us06web-zoom.online": "2026-01-02", "supportzm.com": "2026-02-10", "suweb05.us": "2026-01-02", "svr04.faqserv.com": "2022-01-17", "syncn.cfd": "2026-06-27", "syncroom.u06h.lat": "2026-07-25", "system-update.cloud": "2024-04-24", "system-update.xyz": "2024-04-24", "systemupdate.cloud": "2026-01-02", "table1.cdsventure.xyz": "2026-07-25", "tastebuds.buzz": "2026-01-02", "tattomc.com": "2026-02-06", "team-global.live": "2026-07-25", "team-live.us.com": "2026-01-02", "team-meets.cloud": "2026-01-02", "team-meets.online": "2026-01-02", "team-meets.site": "2026-01-02", "team-meets.store": "2026-01-02", "team-meets.xyz": "2026-01-02", "team.asn.lv": "2026-07-25", "team.micro.com.in": "2026-07-25", "team.msmeet.in": "2026-07-25", "team.weblink.contact": "2026-07-25", "teamapp.live": "2026-07-25", "teames.lives-com.com": "2026-07-25", "teamicro.live": "2026-07-25", "teamicrosoft.sbs": "2026-07-25", "teamlive.vip": "2026-07-25", "teamlv.us": "2026-07-25", "teamlv.vip": "2026-07-25", "teamms-com.xyz": "2026-07-25", "teamms.global-chat.live": "2026-07-25", "teamms.live": "2026-07-25", "teamms.live-com.xyz": "2026-07-25", "teamms.live.miclesoft.com": "2026-07-25", "teamms.microcome.com": "2026-07-25", "teamms.microssoft.live": "2026-07-25", "teams-app.liveam.video": "2026-07-25", "teams-app.pro": "2026-07-25", "teams-com.live": "2026-07-25", "teams-desk.live": "2026-07-25", "teams-live-meet.carriebrigham-c.com": "2026-01-02", "teams-live.biz": "2026-01-02", "teams-live.cn.com": "2026-01-02", "teams-live.com.co": "2026-04-08", "teams-live.org": "2026-01-02", "teams-live.us": "2026-01-02", "teams-live.us.com": "2026-01-02", "teams-meet.online": "2026-04-08", "teams-meet.us": "2026-01-02", "teams-meet.us.com": "2026-04-08", "teams-meet.xyz": "2026-04-08", "teams-us.live": "2026-04-08", "teams-workplace.live": "2026-07-25", "teams.1ives.co": "2026-07-25", "teams.cloudmeet.works": "2026-07-15", "teams.freetalks.work": "2026-07-15", "teams.greenweb.ink": "2026-07-15", "teams.interweb.work": "2026-07-15", "teams.linecall.app": "2026-07-15", "teams.live.am.in": "2026-07-25", "teams.live.miclesoft.com": "2026-07-25", "teams.live02.co": "2026-07-25", "teams.lives02.com": "2026-07-25", "teams.microscell.com": "2026-04-06", "teams.microsoft.lives02.run": "2026-07-25", "teams.microsofts.live-workplace.com": "2026-07-25", "teams.ms-meet.live": "2026-01-02", "teams.msweblive.us": "2026-07-15", "teams.netface.live": "2026-07-15", "teams.onlivemeet.com": "2026-04-06", "teams.onwebcall.us": "2026-07-15", "teams.onweblive.org": "2026-07-15", "teams.onwebmeet.us": "2026-07-15", "teams.skyweb.work": "2026-07-15", "teams.stalelive.us": "2026-07-15", "teams.web-lives.com": "2026-04-14", "teams.web.lives06.com": "2026-07-25", "teams.webtalk.work": "2026-07-15", "teams02.co": "2026-07-25", "teams02.com": "2026-07-25", "teams02.lives05.com": "2026-07-25", "teams03.com": "2026-07-25", "teams05web.lives07.com": "2026-07-25", "teams07.lives07.com": "2026-07-25", "teams07.web07microsoft.live": "2026-07-25", "teams08.run": "2026-07-25", "teamsbrowser.com": "2026-07-25", "teamsiiwe.com": "2026-04-08", "teamsliues.com": "2026-07-15", "teamslivc.com": "2026-04-08", "teamsliveo.com": "2026-04-08", "teamslivex.com": "2026-04-08", "teamslivos.com": "2026-04-08", "teamslivs.com": "2026-04-08", "teamsliwe.com": "2026-04-08", "teamstunnel.com": "2026-07-25", "teamsupport.live": "2026-04-14", "teamsync.live": "2026-04-08", "techevent.us": "2026-01-02", "techopscentral.com": "2023-09-22", "teemsliivc.com": "2026-04-08", "teemslive.com": "2026-04-08", "teemslivo.com": "2026-04-08", "tele-app.minhhieu.xyz": "2026-04-17", "termsofservice.onmypc.org": "2020-08-25", "tet.dnx.capital": "2023-02-14", "thai.hedgehogvc.us": "2023-04-23", "thanhthienai.com": "2026-01-02", "thefirststore.bond": "2024-04-24", "thorwsap.finance": "2026-01-02", "thriddata.com": "2026-05-01", "tokenhub.mefound.com": "2022-01-17", "tokenomic.itsaol.com": "2020-08-25", "tokentrack.mrbasic.com": "2022-01-17", "tomming.us": "2023-02-14", "toyota-ai.org": "2023-04-20", "tp-globa.xyz": "2023-09-20", "tptf.co": "2022-12-30", "tptf.fund": "2023-01-25", "tptf.ltd": "2022-12-30", "tptf.us": "2022-12-30", "trytiponlineresult.com": "2023-04-20", "tu.live-us.com": "2026-04-08", "tvdhoenn.net": "2024-08-22", "twosigma.publicvm.com": "2020-08-25", "twosigmacap.com": "2026-01-02", "twosigmateam.info": "2020-08-25", "twosigmavc.capital": "2025-01-13", "twosigmaventures.us": "2025-01-13", "u06h.lat": "2026-07-25", "u07ei.biz": "2026-07-25", "ua02webzoom.us": "2026-01-02", "ua03webzoom.us": "2026-01-24", "ua04webzoom.us": "2026-01-29", "ua05webzoom.us": "2026-01-02", "ua06webzoom.us": "2026-01-24", "uae04webzoom.us": "2026-04-08", "uc01web.us": "2026-04-08", "uc01webzoom.us": "2026-01-24", "uc02web.us": "2026-04-08", "uc02websoom.us": "2026-04-08", "uc02webzoom.us": "2026-01-02", "uc03web.us": "2026-04-08", "uc03webzoom.us": "2026-01-24", "uc04web.us": "2026-04-08", "uc04webzoom.us": "2026-01-02", "uc05websoom.us": "2026-04-08", "uc05webzoom.us": "2026-01-02", "uc06web.us": "2026-04-08", "uc06webzoom.us": "2026-01-24", "uc07webzoom.us": "2026-01-02", "uco4webzoom.us": "2026-04-08", "uco5webzoom.us": "2026-04-08", "uco6webzoom.us": "2026-04-08", "ucweb05.us": "2026-04-08", "ue01web.us": "2026-04-08", "ue01webzoom.us": "2026-01-02", "ue02web.us": "2026-04-08", "ue02webzoom.us": "2026-01-02", "ue03web.us": "2026-04-08", "ue03webzoom.us": "2026-01-02", "ue04web.us": "2026-04-08", "ue04webzoom.us": "2026-01-02", "ue05.us": "2026-07-25", "ue05webzoom.us": "2026-01-02", "ue06.us": "2026-07-25", "ue06web.us": "2026-04-08", "ue06webzoom.us": "2026-01-02", "ue07webzoom.us": "2026-01-02", "ue08webzoom.us": "2026-01-02", "ue09webzoom.us": "2026-01-02", "ueo4webzoom.us": "2026-04-08", "ui01webzoom.us": "2026-01-29", "ui02webzoom.us": "2026-01-29", "ui03webzoom.us": "2026-01-29", "ui04webzoom.us": "2026-01-29", "ui05webzoom.us": "2026-01-29", "ui06webzoom.us": "2026-01-29", "ui07webzoom.us": "2026-02-03", "uk01webzoom.us": "2026-01-02", "uk02webzoom.us": "2026-01-02", "uk03webzoom.us": "2026-01-02", "uk04webzoom.us": "2026-01-02", "uk05live.us": "2026-04-07", "uk05webzoom.us": "2026-01-02", "uk06.zoom.eu06web.app": "2026-07-25", "uk06webzoom.us": "2026-01-02", "uk07.pro": "2026-04-14", "uk07.us": "2026-04-14", "uk07webzoom.us": "2026-01-02", "ukweb08.us": "2026-01-02", "um02webzoom.us": "2026-01-02", "um03webzoom.us": "2026-01-24", "um04webzoom.us": "2026-01-02", "um05webzoom.us": "2026-01-02", "um06webzoom.us": "2026-01-02", "un01web.us": "2026-04-08", "un01webzoom.us": "2026-01-24", "un02webzoom.us": "2026-01-02", "un03webzoom.us": "2026-01-24", "un04webzoom.us": "2026-01-02", "un05webzoom.us": "2026-01-24", "un06webzoom.us": "2026-01-24", "unchainedcapital.co": "2023-01-25", "unitpowergeneration.top": "2026-01-02", "uo01web.us": "2026-04-08", "uo01webzoom.us": "2026-01-24", "uo02webzoom.us": "2026-01-24", "uo03webzoom.us": "2026-01-24", "uo04webzoom.us": "2026-01-24", "uo05web.us": "2026-04-08", "uo05webzoom.us": "2026-01-24", "uo06webzoom.us": "2026-01-24", "up.digifincx.com": "2021-03-12", "update-assist.org": "2026-01-02", "update-teams.live": "2026-04-14", "updatecheck.v6.rocks": "2026-01-02", "updatepool.online": "2022-01-17", "updatesinfos.com": "2019-12-09", "updatezone.org": "2023-01-25", "upload-test.xyz": "2026-01-02", "upload.gdrives.best": "2022-01-17", "uploadfiles.website": "2024-09-13", "uploadmefiles.site": "2024-09-13", "uploadmefiles.space": "2024-09-13", "uploadmefiles.tech": "2024-09-13", "uploadmefiles.xyz": "2024-09-13", "uploadmyfile.space": "2024-09-13", "uploadmyfile.tech": "2024-09-13", "uploadsfiles.xyz": "2020-06-24", "uq01webzoom.us": "2026-02-03", "uq02webzoom.us": "2026-02-03", "uq03webzoom.us": "2026-02-03", "uq05webzoom.us": "2026-02-03", "uq06webzoom.us": "2026-02-03", "uq08webzoom.us": "2026-02-03", "ur01webzoom.us": "2026-01-24", "ur02webzoom.us": "2026-01-24", "ur03webzoom.us": "2026-01-24", "ur04webzoom.us": "2026-01-24", "ur05webzoom.us": "2026-01-02", "ur06webzoom.us": "2026-01-24", "urgent-update.cloud": "2026-01-02", "us-05.in": "2026-07-25", "us-meet.com": "2026-04-20", "us-playground.vc": "2026-01-02", "us.meet06.live": "2026-07-25", "us.web.06zoom.us": "2026-07-25", "us.web02meet.com": "2026-04-14", "us.zoom.02usweb.sbs": "2026-07-25", "us.zoom.06web.us": "2026-07-25", "us.zoom.06webin.us": "2026-07-25", "us001web.us": "2026-01-02", "us002web.us": "2026-01-02", "us004web.us": "2026-01-02", "us004zoom.com": "2026-01-02", "us004zoom.us": "2026-02-26", "us005office.us": "2026-01-02", "us005webzoom.us": "2026-01-24", "us005zoom.com": "2026-01-02", "us005zoom.us": "2026-02-26", "us006web.us": "2026-01-02", "us007web.us": "2026-01-02", "us00web-zoom.us": "2026-01-02", "us01web-zoom.cloud": "2026-01-02", "us01web-zoom.com": "2026-01-02", "us01web-zoom.info": "2026-01-02", "us01web-zoom.org": "2026-01-02", "us01web-zoom.site": "2026-01-02", "us01web-zoom.store": "2026-01-02", "us01web-zoom.xyz": "2026-01-02", "us01web.com": "2026-01-02", "us01webinar.zoom.e01i.co": "2026-07-25", "us01webzoom.us": "2026-01-29", "us02.sbs": "2026-07-25", "us02.us": "2026-04-14", "us02.zoomin.web02eu.live": "2026-07-25", "us02biz-zoom.us": "2026-01-02", "us02cam-zoom.us": "2026-01-02", "us02we.us": "2026-01-02", "us02web-zoom.com": "2026-01-02", "us02web-zoom.info": "2026-01-02", "us02web-zoom.live": "2026-01-02", "us02web-zoom.org": "2026-01-02", "us02web-zoom.xyz": "2026-01-02", "us02web.zoom.us02.us": "2026-04-14", "us02web.zoomconnector.com": "2026-01-02", "us02web.zoomweb.org": "2026-07-15", "us02webs.us": "2026-02-23", "us02websoom.us": "2026-04-08", "us02webzoom.us": "2026-01-29", "us02www-zoom.us": "2026-01-02", "us03.meet-web.us": "2026-04-14", "us03.zoom.meet-web.us": "2026-04-14", "us03biz-zoom.us": "2026-01-02", "us03live.com": "2026-04-08", "us03web-zoom.biz": "2026-01-02", "us03web-zoom.cc": "2026-01-02", "us03web-zoom.com": "2026-01-02", "us03web-zoom.info": "2026-01-02", "us03web-zoom.org": "2026-01-02", "us03web-zoom.site": "2026-01-02", "us03web-zoom.store": "2026-01-02", "us03web-zoom.top": "2026-01-02", "us03web-zoom.xyz": "2026-01-02", "us03websoom.us": "2026-04-08", "us03webuoom.us": "2026-04-08", "us03www-zoom.us": "2026-01-02", "us04meet.web04.sbs": "2026-07-25", "us04web-zoom.info": "2026-01-02", "us04web-zoom.live": "2026-01-02", "us04web-zoom.org": "2026-01-02", "us04web-zoom.xyz": "2026-01-02", "us04web.buszoom.us": "2026-01-02", "us04web.com": "2026-01-02", "us04web.zoom04web.run": "2026-07-25", "us04webs.us": "2026-02-23", "us04webzoom.us": "2026-01-29", "us04wezoom.us": "2026-01-02", "us04www-zoom.us": "2026-01-02", "us05-web.us": "2026-01-22", "us05-zoom.com": "2026-01-02", "us05-zoom.forum": "2026-01-02", "us05-zoom.uk": "2026-01-02", "us05-zoom.us": "2026-01-02", "us05.eu": "2026-07-25", "us05.sbs": "2026-04-14", "us05.us": "2026-04-14", "us05.web.meet05.sbs": "2026-04-14", "us05.webzoom.work": "2026-07-15", "us05.zoom.web04.us": "2026-04-14", "us05.zoom.web05.uk": "2026-07-25", "us05ad-zoom.us": "2026-01-02", "us05biz-zoom.us": "2026-01-02", "us05cc-zoom.us": "2026-01-02", "us05pro-zoom.us": "2026-01-02", "us05vip-zoom.us": "2026-01-02", "us05we.us": "2026-01-02", "us05web-zoom.biz": "2026-01-02", "us05web-zoom.cc": "2026-01-02", "us05web-zoom.click": "2026-01-02", "us05web-zoom.cloud": "2026-01-02", "us05web-zoom.forum": "2026-01-02", "us05web-zoom.fun": "2026-01-02", "us05web-zoom.guru": "2026-01-02", "us05web-zoom.help": "2026-01-02", "us05web-zoom.info": "2026-01-02", "us05web-zoom.ink": "2026-01-02", "us05web-zoom.live": "2026-01-02", "us05web-zoom.org": "2026-01-02", "us05web-zoom.pro": "2026-01-02", "us05web-zoom.site": "2026-01-02", "us05web-zoom.space": "2026-01-02", "us05web-zoom.store": "2026-01-02", "us05web-zoom.top": "2026-01-02", "us05web-zoom.uk": "2026-01-02", "us05web-zoom.watch": "2026-01-02", "us05web-zoom.work": "2026-01-02", "us05web-zoom.xyz": "2026-01-02", "us05web.buszoom.us": "2026-01-02", "us05web.site": "2026-04-08", "us05web.us": "2026-01-02", "us05web.zoom.us05.us": "2026-04-14", "us05webs.com": "2026-02-23", "us05websoom.us": "2026-04-08", "us05webszoom.us": "2026-04-08", "us05webxoom.us": "2026-04-08", "us05webzoom.link": "2026-01-02", "us05webzoom.us": "2026-01-29", "us05www-zoom.us": "2026-01-02", "us05zoom.com": "2026-01-02", "us05zoom.meet-web3.eu": "2026-04-14", "us05zoom.us.com": "2026-01-02", "us06-zoom.forum": "2026-01-02", "us06-zoom.uk": "2026-01-02", "us06-zoom.us": "2026-01-02", "us06.in": "2026-07-25", "us06.sbs": "2026-07-25", "us06we.us": "2026-01-02", "us06web-zoom.cc": "2026-01-02", "us06web-zoom.info": "2026-01-02", "us06web-zoom.live": "2026-01-02", "us06web-zoom.online": "2026-01-02", "us06web-zoom.org": "2026-01-02", "us06web-zoom.space": "2026-01-02", "us06web-zoom.syncn.cfd": "2026-06-27", "us06web-zoom.xyz": "2026-01-02", "us06web.zoom.06us.sbs": "2026-07-25", "us06web.zoomconnector.com": "2026-01-02", "us06webs.us": "2026-02-23", "us06websoom.us": "2026-04-08", "us06webzoom.us": "2026-01-29", "us06www-zoom.com": "2026-01-02", "us06www-zoom.us": "2026-01-02", "us06zoom.syncn.cfd": "2026-06-27", "us07-web.us": "2026-01-26", "us07.sbs": "2026-04-14", "us07biz-zoom.us": "2026-01-02", "us07office.us": "2026-01-02", "us07web-zoom.biz": "2026-01-02", "us07web-zoom.cc": "2026-01-02", "us07web-zoom.com": "2026-01-02", "us07web-zoom.live": "2026-01-02", "us07web.me": "2026-04-08", "us07web.zoomconnector.com": "2026-01-02", "us07webs.us": "2026-02-23", "us07webzoom.com": "2026-07-15", "us07webzoom.us": "2026-01-29", "us07zoom.meetingapp.us": "2026-04-14", "us08web-zoom.cc": "2026-01-02", "us08web-zoom.online": "2026-01-02", "us08webs.us": "2026-02-23", "us08www-zoom.us": "2026-01-02", "us09web-zoom.live": "2026-01-02", "us09webzoom.us": "2026-01-29", "us09www-zoom.us": "2026-01-02", "us0lwebzoom.us": "2026-04-08", "us10webzoom.us": "2026-01-02", "us11webzoom.us": "2026-01-02", "us12web-zoom.us": "2026-01-02", "us12webzoom.us": "2026-01-02", "us13webzoom.us": "2026-01-02", "us14webzoom.us": "2026-01-02", "us15web.com": "2026-02-23", "us15webs.us": "2026-02-23", "us15webzoom.us": "2026-01-02", "us16webzoom.us": "2026-01-24", "us17web-zoom.us": "2026-01-02", "us17webzoom.us": "2026-01-02", "us19webzoom.us": "2026-01-02", "us21webzoom.us": "2026-01-02", "us22webzoom.us": "2026-01-24", "us24webzoom.us": "2026-01-02", "us25webs.us": "2026-02-23", "us25webzoom.us": "2026-01-02", "us26webzoom.us": "2026-01-02", "us27webzoom.us": "2026-01-02", "us28webzoom.us": "2026-01-02", "us29webzoom.us": "2026-01-24", "us30webzoom.us": "2026-01-29", "us31webzoom.us": "2026-02-03", "us41webzoom.us": "2026-01-24", "us45webzoom.us": "2026-01-02", "us4web.us": "2026-01-02", "us50webzoom.us": "2026-01-02", "us51webzoom.us": "2026-01-02", "us52webzoom.us": "2026-01-24", "us53webzoom.us": "2026-01-02", "us54webzoom.us": "2026-01-24", "us55web.com": "2026-02-23", "us57webzoom.us": "2026-01-24", "us60webzoom.us": "2026-01-02", "us72webzoom.us": "2026-01-24", "us81webzoom.us": "2026-01-24", "us95webs.us": "2026-02-23", "usa01webzoom.us": "2026-02-03", "usa02webzoom.us": "2026-02-03", "usa04webzoom.us": "2026-04-08", "usa05webzoom.us": "2026-02-03", "usa06webzoom.us": "2026-04-08", "usdxchange.org": "2026-04-17", "use05webzoom.us": "2026-04-08", "usecrowdpay.xyz": "2026-01-02", "usewebin.room.in06.us": "2026-07-25", "usezoom.net.on05.eu": "2026-07-25", "usezoom.webin.n04i.one": "2026-07-25", "usezoomin.06in.us": "2026-07-25", "ushub.syncroom.u06h.lat": "2026-07-25", "usinroomweeb.i06sn.co": "2026-07-25", "uso04webzoom.us": "2026-04-08", "uso05webzoom.us": "2026-04-08", "uso06webzoom.us": "2026-04-08", "uso1webzoom.us": "2026-02-03", "uso3webzoom.us": "2026-02-03", "uso4web.us": "2026-04-08", "uso7webzoom.us": "2026-02-03", "usobweb.us": "2026-04-08", "uswe01.us": "2026-01-02", "uswe03.us": "2026-01-02", "uswe04.us": "2026-01-02", "uswe05.us": "2026-01-02", "uswe06.us": "2026-01-02", "uswe07.us": "2026-01-02", "uswe08.us": "2026-01-02", "uswe20.us": "2026-01-02", "usweb.02room.us": "2026-04-14", "usweb.05meet.us": "2026-04-14", "usweb.07-web.us": "2026-04-14", "usweb.eu02.us": "2026-07-25", "usweb.zoom.02io.us": "2026-07-25", "usweb.zoom.05meet.sbs": "2026-07-25", "usweb.zoom.05us.live": "2026-07-25", "usweb.zoom.05us.sbs": "2026-07-25", "usweb.zoom.06ln.live": "2026-07-25", "usweb.zoom.06us.live": "2026-07-25", "usweb.zoom.us02.sbs": "2026-07-25", "usweb.zoom.us05.sbs": "2026-04-14", "usweb0.us": "2026-01-02", "usweb005.us": "2026-01-02", "usweb01.us": "2026-01-02", "usweb04.com": "2026-01-02", "usweb05.us": "2026-04-14", "usweb06.zoom.meet06.us": "2026-07-25", "usweb08.us": "2026-01-02", "usweb09.us": "2026-01-02", "usweb0b.us": "2026-04-08", "usweb0l.us": "2026-04-08", "usweb5.us": "2026-01-02", "uswebob.com": "2026-04-08", "uswebob.us": "2026-04-08", "uswebr.zoomin.on06.us": "2026-07-25", "uszoom.web.05live.sbs": "2026-07-25", "uszoom.web.eu06.in": "2026-07-25", "uszoomhub.iu03e.live": "2026-07-25", "uszoomsweb.ue05.us": "2026-07-25", "ut01webzoom.us": "2026-01-29", "ut02webzoom.us": "2026-01-29", "ut03webzoom.us": "2026-01-29", "ut04webzoom.us": "2026-01-29", "ut05webzoom.us": "2026-01-29", "ut06webzoom.us": "2026-01-29", "uu01webzoom.us": "2026-01-24", "uu02webzoom.us": "2026-01-29", "uu03webzoom.us": "2026-01-24", "uv01webzoom.us": "2026-01-24", "uv02webzoom.us": "2026-01-24", "uv03webzoom.us": "2026-01-24", "uv04webzoom.us": "2026-01-24", "uv05webzoom.us": "2026-01-24", "uv06webzoom.us": "2026-01-24", "uv07webzoom.us": "2026-02-03", "uw01webzoom.us": "2026-01-24", "uw02webzoom.us": "2026-01-24", "uw03webzoom.us": "2026-01-24", "uw04webzoom.us": "2026-01-24", "uw05webzoom.us": "2026-01-24", "uw06webzoom.us": "2026-01-24", "ux01web.us": "2026-04-08", "ux01webzoom.us": "2026-01-24", "ux02web.us": "2026-04-08", "ux02webzoom.us": "2026-01-02", "ux03web.us": "2026-04-08", "ux03webzoom.us": "2026-01-24", "ux04webzoom.us": "2026-01-02", "ux05webzoom.us": "2026-01-02", "ux06webzoom.us": "2026-01-24", "uy01webzoom.us": "2026-02-03", "uy02webzoom.us": "2026-02-03", "uy04webzoom.us": "2026-02-03", "uz01web.us": "2026-04-08", "uz01webzoom.us": "2026-01-02", "uz02webzoom.us": "2026-01-02", "uz03web.us": "2026-04-08", "uz03webzoom.us": "2026-01-24", "uz04webzoom.us": "2026-01-02", "uz05webzoom.us": "2026-01-02", "uz06webzoom.us": "2026-01-02", "uz07webzoom.us": "2026-01-02", "vcallsdk.online": "2026-07-25", "venture-meeting.online": "2026-01-02", "venturelabo.co": "2021-05-06", "verify.googleauth.pro": "2022-01-17", "verify.selinicapital.info": "2024-11-07", "versionupdate.dns.army": "2024-08-22", "video-call-now.live": "2026-04-17", "video-call.0-1h.com": "2026-04-17", "video-chat-live.one": "2026-04-06", "video-chat-live.online": "2026-04-06", "video-chat-live.online.devto.cloud": "2026-04-06", "video-conference.cloud": "2026-01-02", "video-conference.pro": "2026-01-02", "video-conference.site": "2026-01-02", "video-conference.store": "2026-01-02", "video-conference.xyz": "2026-01-02", "video-livechat.com": "2026-04-17", "video-meet.xyz": "2023-09-06", "video-meeting.store": "2026-01-02", "videocall.bloomup.app": "2026-04-06", "videotalks.xyz": "2026-01-02", "vipocapital.com": "2026-01-02", "vless.goowen-f5e.workers.dev": "2026-01-02", "vote.anobaka.info": "2022-12-30", "vps-7880c010.vps.ovh.ca": "2026-01-02", "vpset.onmypc.org": "2020-08-25", "vpsfree.linkpc.net": "2020-08-25", "w02zoom.us": "2026-01-02", "w03zoom.us": "2026-01-02", "w04zoom.us": "2026-01-02", "w05zoom.us": "2026-01-02", "w06zoom.us": "2026-01-02", "w07zoom.us": "2026-01-02", "w12zoom.us": "2026-01-02", "w21zoom.us": "2026-01-02", "w22zoom.us": "2026-01-02", "w3bitcapital.com": "2026-04-06", "w41zoom.us": "2026-01-02", "walleyecapital.org": "2026-04-06", "walleyecapital.xyz": "2026-04-06", "walleyevc.capital": "2026-04-06", "walleyeventure.xyz": "2026-04-14", "wbzoom.us": "2026-01-02", "web-lives.com": "2026-04-14", "web-meet.live": "2026-04-08", "web-teams.microvsoft.com": "2026-07-25", "web-zoom.uk": "2026-04-08", "web.05ie.live": "2026-07-25", "web.05live.sbs": "2026-07-25", "web.05live.xyz": "2026-07-25", "web.06us.us": "2026-07-25", "web.06zoom.us": "2026-07-25", "web.eu06.in": "2026-07-25", "web.lives06.com": "2026-07-25", "web.meet05.sbs": "2026-04-14", "web.zoomapp.05meet.am.in": "2026-07-25", "web.zoomapp.05meet.live": "2026-07-25", "web01zoom.com": "2026-01-02", "web02.sbs": "2026-07-25", "web02meet.com": "2026-04-14", "web02teams.com": "2026-04-20", "web02us.zoom.02io.us": "2026-07-25", "web02zoom.us": "2026-01-02", "web031zoom.us": "2026-01-02", "web03us.sbs": "2026-07-25", "web04.sbs": "2026-07-25", "web04.us": "2026-04-14", "web041zoom.us": "2026-01-02", "web04meet.top": "2026-04-20", "web04zoom.us": "2026-04-20", "web05.sbs": "2026-07-25", "web05.uk": "2026-07-25", "web05.zoom.us-05.in": "2026-07-25", "web05meet.us": "2026-04-14", "web05us.online": "2026-04-08", "web06.eu": "2026-07-25", "web06.sbs": "2026-07-25", "web06zoom.us": "2026-01-02", "web07.premium-business.live": "2026-04-14", "web07.zoom.meet-app.cc": "2026-04-14", "web071zoom.us": "2026-01-02", "web07microsoft.live": "2026-07-25", "web07us.uk07.us": "2026-04-14", "web07zoom.us": "2026-04-20", "web08.teams08.run": "2026-07-25", "web082zoom.us": "2026-01-02", "web08zoom.us": "2026-01-02", "web091zoom.us": "2026-01-02", "web099zoom.us": "2026-01-02", "web12teams.com": "2026-04-20", "web21zoom.com": "2026-04-20", "web21zoom.us": "2026-01-02", "web22n.us": "2026-04-08", "web2meet.net": "2026-04-20", "web3-support.xyz": "2026-01-02", "web3fund.us": "2026-01-02", "web3insider.forum": "2026-01-02", "web3journal.io": "2026-01-02", "web3journal.xyz": "2026-01-02", "web3meet.live": "2026-04-20", "web3meet.xyz": "2026-04-20", "web3signal.xyz": "2026-01-02", "web3zoom.xyz": "2026-04-20", "web71meet.shop": "2026-04-20", "web86meet.shop": "2026-04-20", "webapp.zoom.05live.co": "2026-07-25", "webhostwatto.work.gd": "2023-05-13", "webin.n04i.one": "2026-07-25", "webinaroom.05in.one": "2026-07-25", "webine.zoom.eu07webin.co": "2026-07-25", "weblink.contact": "2026-07-25", "webmeet.zoom.05live.biz": "2026-07-25", "webmeetapi.us": "2026-01-02", "webmeetoffice.us": "2026-01-02", "webtalk.work": "2026-07-15", "webthreefinance.club": "2026-01-02", "webus.zoom.02web.sbs": "2026-07-25", "webus.zoom.05live.us": "2026-07-25", "webus.zoom.05meet.co": "2026-07-25", "webus04.us": "2026-01-02", "webus05.us": "2026-01-02", "webus06.us": "2026-01-02", "webzoom.work": "2026-07-15", "wechart.org": "2020-06-24", "werfaultserver.com": "2024-11-13", "wesco-distributors.com": "2026-01-02", "weventure.capital": "2026-04-14", "whisperroom.forum": "2026-01-02", "windrvupdate.kozow.com": "2020-08-25", "wirexapp.app": "2022-12-14", "woodcastpro.com": "2026-05-07", "word.anobaka.info": "2024-11-30", "word.azureword.com": "2022-01-17", "workflowin.sbs": "2026-07-25", "workplace.teams-com.live": "2026-07-25", "world.linkpc.net": "2023-08-03", "writeup.live": "2026-01-02", "ww-live.com": "2026-04-08", "ww-live.online": "2026-04-08", "ww-live.uk": "2026-04-08", "ww-live.us": "2026-04-08", "ww-live.xyz": "2026-04-08", "ww1.us04web.com": "2026-01-02", "ww12.web3journal.io": "2026-01-02", "ww25.amazon.co.jp-aprime.info": "2024-11-30", "ww25.co.jp-aprime.info": "2024-11-30", "ww25.jp-aprime.info": "2024-11-30", "ww25.login-service.amazon.co.jp-aprime.info": "2024-11-30", "ww25.mail.jp-aprime.info": "2024-11-30", "ww25.webmail.jp-aprime.info": "2024-11-30", "ww38.jp-aprime.info": "2024-11-30", "www-live.us": "2026-04-08", "www-live.xyz": "2026-04-08", "xn--80aagm.beauty": "2026-01-02", "xu10.1056.uk": "2024-11-07", "yoannturp.xyz": "2024-08-22", "yorst.linkpc.net": "2023-07-09", "youbicapital.cc": "2022-01-17", "zerodev.pro": "2026-01-02", "zm-meeting.com": "2026-01-02", "zm-web.uno": "2026-04-14", "zmsupport.com": "2026-02-10", "zmtest.weventure.capital": "2026-07-25", "zoom-client.com": "2024-11-07", "zoom-meet-live.carriebrigham-c.com": "2026-01-02", "zoom-ru.github.io": "2026-01-02", "zoom-sdk.com": "2025-01-15", "zoom-support.com": "2026-01-02", "zoom-tech.us": "2026-01-02", "zoom-web07.meet-app.cc": "2026-04-14", "zoom.02euweb.us": "2026-04-14", "zoom.02io.us": "2026-07-25", "zoom.02us.sbs": "2026-07-25", "zoom.02usweb.sbs": "2026-07-25", "zoom.02usweb.us": "2026-01-02", "zoom.02web.sbs": "2026-07-25", "zoom.02webus.sbs": "2026-07-25", "zoom.05live.biz": "2026-07-25", "zoom.05live.co": "2026-07-25", "zoom.05live.live": "2026-07-25", "zoom.05live.us": "2026-07-25", "zoom.05meet.click": "2026-07-25", "zoom.05meet.co": "2026-07-25", "zoom.05meet.sbs": "2026-07-25", "zoom.05ukweb.uk": "2026-04-14", "zoom.05us.live": "2026-07-25", "zoom.05us.sbs": "2026-07-25", "zoom.05usweb.us": "2026-01-02", "zoom.05web.us": "2026-04-14", "zoom.05webus.sbs": "2026-07-25", "zoom.06ln.live": "2026-07-25", "zoom.06ukweb.uk": "2026-04-06", "zoom.06us.live": "2026-07-25", "zoom.06us.sbs": "2026-07-25", "zoom.06usweb.us": "2026-04-06", "zoom.06web.us": "2026-07-25", "zoom.06web.us06.in": "2026-07-25", "zoom.06webin.us": "2026-07-25", "zoom.07usweb.site": "2026-04-06", "zoom.ca05web.com": "2026-02-23", "zoom.desktop.03app.sbs": "2026-07-25", "zoom.e01i.co": "2026-07-25", "zoom.eu07webin.co": "2026-07-25", "zoom.join-meets.com": "2026-01-02", "zoom.meet-05.sbs": "2026-04-14", "zoom.meet-app.cc": "2026-04-14", "zoom.meet-web.us": "2026-04-14", "zoom.meet06.us": "2026-07-25", "zoom.premium.03app.live": "2026-07-25", "zoom.suweb05.us": "2026-01-02", "zoom.ua03webzoom.us": "2026-02-23", "zoom.ua04webzoom.us": "2026-02-23", "zoom.ua06webzoom.us": "2026-02-23", "zoom.uc01webzoom.us": "2026-02-23", "zoom.uc03webzoom.us": "2026-02-23", "zoom.uc06webzoom.us": "2026-02-23", "zoom.ui01webzoom.us": "2026-02-23", "zoom.ui02webzoom.us": "2026-02-23", "zoom.ui03webzoom.us": "2026-02-23", "zoom.ui04webzoom.us": "2026-02-23", "zoom.ui05webzoom.us": "2026-02-23", "zoom.ui06webzoom.us": "2026-02-23", "zoom.ui07webzoom.us": "2026-02-23", "zoom.uk07.pro": "2026-04-14", "zoom.um03webzoom.us": "2026-02-23", "zoom.un01webzoom.us": "2026-02-23", "zoom.un03webzoom.us": "2026-02-23", "zoom.un05webzoom.us": "2026-02-23", "zoom.un06webzoom.us": "2026-02-23", "zoom.uo01webzoom.us": "2026-02-23", "zoom.uo02webzoom.us": "2026-02-23", "zoom.uo03webzoom.us": "2026-02-23", "zoom.uo04webzoom.us": "2026-02-23", "zoom.uo05webzoom.us": "2026-02-23", "zoom.uo06webzoom.us": "2026-02-23", "zoom.uq01webzoom.us": "2026-02-23", "zoom.uq02webzoom.us": "2026-02-23", "zoom.uq03webzoom.us": "2026-02-23", "zoom.uq05webzoom.us": "2026-02-23", "zoom.uq06webzoom.us": "2026-02-23", "zoom.uq08webzoom.us": "2026-02-23", "zoom.ur01webzoom.us": "2026-02-23", "zoom.ur02webzoom.us": "2026-02-23", "zoom.ur03webzoom.us": "2026-02-23", "zoom.ur04webzoom.us": "2026-02-23", "zoom.ur06webzoom.us": "2026-02-23", "zoom.us-05.in": "2026-07-25", "zoom.us.meet06.live": "2026-07-25", "zoom.us002web.us": "2026-01-02", "zoom.us005office.us": "2026-01-02", "zoom.us005webzoom.us": "2026-02-23", "zoom.us006web.us": "2026-01-02", "zoom.us007web.us": "2026-01-02", "zoom.us01web.com": "2026-01-02", "zoom.us01webzoom.us": "2026-02-23", "zoom.us02.sbs": "2026-07-25", "zoom.us02.us": "2026-04-14", "zoom.us02we.us": "2026-01-02", "zoom.us02webs.us": "2026-02-23", "zoom.us02webzoom.us": "2026-02-23", "zoom.us04webs.us": "2026-02-23", "zoom.us04webzoom.us": "2026-02-23", "zoom.us05-web.us": "2026-01-22", "zoom.us05.sbs": "2026-04-14", "zoom.us05.us": "2026-04-14", "zoom.us05we.us": "2026-01-02", "zoom.us05web.us": "2026-01-02", "zoom.us05webs.com": "2026-02-23", "zoom.us05webzoom.us": "2026-02-23", "zoom.us06.sbs": "2026-07-25", "zoom.us06webs.us": "2026-02-23", "zoom.us06webzoom.us": "2026-02-23", "zoom.us07-web.us": "2026-01-26", "zoom.us07.sbs": "2026-04-14", "zoom.us07office.us": "2026-01-02", "zoom.us07webs.us": "2026-02-23", "zoom.us07webzoom.us": "2026-02-23", "zoom.us08webs.us": "2026-02-23", "zoom.us09webzoom.us": "2026-02-23", "zoom.us15web.com": "2026-02-23", "zoom.us15webs.us": "2026-02-23", "zoom.us16webzoom.us": "2026-02-23", "zoom.us22webzoom.us": "2026-02-23", "zoom.us25webs.us": "2026-02-23", "zoom.us29webzoom.us": "2026-02-23", "zoom.us30webzoom.us": "2026-02-23", "zoom.us31webzoom.us": "2026-02-23", "zoom.us41webzoom.us": "2026-02-23", "zoom.us4web.us": "2026-01-02", "zoom.us52webzoom.us": "2026-02-23", "zoom.us54webzoom.us": "2026-02-23", "zoom.us55web.com": "2026-02-23", "zoom.us57webzoom.us": "2026-02-23", "zoom.us72webzoom.us": "2026-02-23", "zoom.us81webzoom.us": "2026-02-23", "zoom.us95webs.us": "2026-02-23", "zoom.usa01webzoom.us": "2026-02-23", "zoom.usa02webzoom.us": "2026-02-23", "zoom.usa05webzoom.us": "2026-02-23", "zoom.uso1webzoom.us": "2026-02-23", "zoom.uso3webzoom.us": "2026-02-23", "zoom.uso7webzoom.us": "2026-02-23", "zoom.uswe04.us": "2026-01-02", "zoom.uswe05.us": "2026-01-02", "zoom.uswe06.us": "2026-01-02", "zoom.uswe07.us": "2026-01-02", "zoom.uswe08.us": "2026-01-02", "zoom.uswe20.us": "2026-01-02", "zoom.usweb.05meet.us": "2026-04-14", "zoom.usweb0.us": "2026-01-02", "zoom.usweb04.com": "2026-01-02", "zoom.ut01webzoom.us": "2026-02-23", "zoom.ut02webzoom.us": "2026-02-23", "zoom.ut03webzoom.us": "2026-02-23", "zoom.ut04webzoom.us": "2026-02-23", "zoom.ut05webzoom.us": "2026-02-23", "zoom.ut06webzoom.us": "2026-02-23", "zoom.uu01webzoom.us": "2026-02-23", "zoom.uu02webzoom.us": "2026-02-23", "zoom.uu03webzoom.us": "2026-02-23", "zoom.uv01webzoom.us": "2026-02-23", "zoom.uv02webzoom.us": "2026-02-23", "zoom.uv03webzoom.us": "2026-02-23", "zoom.uv04webzoom.us": "2026-02-23", "zoom.uv05webzoom.us": "2026-02-23", "zoom.uv06webzoom.us": "2026-02-23", "zoom.uv07webzoom.us": "2026-02-23", "zoom.uw01webzoom.us": "2026-02-23", "zoom.uw02webzoom.us": "2026-02-23", "zoom.uw03webzoom.us": "2026-02-23", "zoom.uw04webzoom.us": "2026-02-23", "zoom.uw05webzoom.us": "2026-02-23", "zoom.uw06webzoom.us": "2026-02-23", "zoom.ux01webzoom.us": "2026-02-23", "zoom.ux03webzoom.us": "2026-02-23", "zoom.ux06webzoom.us": "2026-02-23", "zoom.uy01webzoom.us": "2026-02-23", "zoom.uy02webzoom.us": "2026-02-23", "zoom.uy04webzoom.us": "2026-02-23", "zoom.uz03webzoom.us": "2026-02-23", "zoom.web.06us.us": "2026-07-25", "zoom.web02.sbs": "2026-07-25", "zoom.web02meet.com": "2026-04-14", "zoom.web04.us": "2026-04-14", "zoom.web05.sbs": "2026-07-25", "zoom.web05.uk": "2026-07-25", "zoom.web05meet.us": "2026-04-14", "zoom.web06.eu": "2026-07-25", "zoom.web06.sbs": "2026-07-25", "zoom.web07.premium-business.live": "2026-04-14", "zoom.webus04.us": "2026-01-02", "zoom01us.workflowin.sbs": "2026-07-25", "zoom04web.run": "2026-07-25", "zoomapp.05meet.am.in": "2026-07-25", "zoomapp.05meet.live": "2026-07-25", "zoomapp.web.05ie.live": "2026-07-25", "zoomapp.web.05live.xyz": "2026-07-25", "zoomconnect.io": "2026-07-25", "zoomeuweb.u07ei.biz": "2026-07-25", "zoomin.on06.us": "2026-07-25", "zoomin.web02eu.live": "2026-07-25", "zoomlink.studio": "2026-07-25", "zoommeetplace.com": "2026-01-02", "zoomus.eu.web03us.sbs": "2026-07-25", "zoomus05web.com": "2026-01-02", "zoomuseb.ai02n.sbs": "2026-07-25", "zoomweb.06eu.us": "2026-07-25", "zoomweb.org": "2026-07-15", "zoomweb.uswe05.us": "2026-01-02", "zoomwebinar.06on.us": "2026-07-25", "zoonn-platform.com": "2026-01-02" }, "ipv4": { "104.145.210.107:6783": "2026-04-17", "104.168.145.52:8080": "2026-01-02", "104.168.151.70:8080": "2026-01-02", "104.168.198.145:8080": "2026-01-02", "109.248.163.127:3000": "2026-04-20", "118.70.116.154:8080": "2022-01-14", "139.150.73.123:3000": "2026-04-20", "140.117.91.22:8080": "2020-08-25", "140.136.134.201:8080": "2020-08-25", "142.11.196.106:8000": "2026-07-15", "142.11.196.106:8080": "2026-07-15", "142.11.206.73:8000": "2026-07-15", "144.172.114.220:443": "2026-04-21", "144.172.116.143:3000": "2026-07-16", "163.25.24.44:443": "2022-01-14", "163.5.254.70:3000": "2026-01-02", "172.86.91.195:443": "2026-04-21", "186.183.185.94:8080": "2022-01-14", "23.254.164.123:443": "2026-07-15", "23.254.164.61:8000": "2026-07-15", "23.254.164.61:9000": "2026-07-15", "23.254.164.92:443": "2026-07-15", "23.254.164.92:8000": "2026-07-15", "23.254.164.92:9000": "2026-07-15", "23.254.167.216:8000": "2026-07-15", "23.254.202.223:8080": "2026-01-02", "23.254.203.244:8000": "2026-07-15", "23.254.203.244:9000": "2026-07-15", "38.110.228.52:3000": "2026-04-20", "41.85.145.164:8080": "2020-08-25", "45.238.25.2:443": "2022-01-14", "45.61.129.29:3000": "2026-04-14", "45.61.140.26:3389": "2024-08-22", "45.61.148.134:3000": "2026-07-16", "45.61.157.248:3000": "2026-04-14", "45.61.163.100:8090": "2026-07-25", "45.61.163.100:8888": "2026-07-25", "59.152.103.205:3000": "2026-04-20", "66.181.166.15:8080": "2022-01-14", "83.136.208.246:6783": "2026-04-17", "83.136.208.48:443": "2026-04-17", "83.136.209.22:8444": "2026-04-17", "83.136.210.180:5202": "2026-04-17" }, "url": { "ecoferros.com/wp-content/plugins/elementor/core/page-assets/captcha/controller.php": "2026-03-19", "http://104.255.172.56": "2023-04-20", "http://163.25.24.44": "2022-01-14", "http://172.86.89.213": "2026-07-25", "http://172.86.91.195": "2026-04-21", "http://23.254.164.92": "2026-07-15", "http://45.238.25.2": "2022-01-14" }, "url_path": { "/4SqSYtx%2B/": "2024-08-17", "/ABcTDInKWw/": "2024-08-17", "/EKfP7saoiP/": "2024-08-17", "/OcMySY5QNkY/": "2024-08-17", "/OcMySY5QNkY/ABcTDInKWw/4SqSYtx%2B/EKfP7saoiP/": "2024-08-17", "/OcMySY5QNkY/ABcTDInKWw/4SqSYtx%2B/EKfP7saoiP/BcA%3D%3D": "2024-08-17", "/update/49890878": "2026-07-15" } }, "first_seen_precision": { "domain": { "02usweb.us": "at-or-before", "05usweb.us": "at-or-before", "a.mylkc.cloudns.ch": "at-or-before", "admin.unitpowergeneration.top": "at-or-before", "ajayplamingo.com": "at-or-before", "aleslosev.workers.dev": "at-or-before", "algozzoom.us006web.us": "at-or-before", "api.betterfun.space": "at-or-before", "api.zerodev.pro": "at-or-before", "apizoom.myfanshu.com": "at-or-before", "app-wechat.xyz": "at-or-before", "app.republicrypto.vc": "at-or-before", "app.thorwsap.finance": "at-or-before", "automatic-update.online": "at-or-before", "autoupdate.online": "at-or-before", "autoupdate.store": "at-or-before", "awaitingfor.online": "at-or-before", "awaitingfor.site": "at-or-before", "betterfun.space": "at-or-before", "bigbrain.group": "at-or-before", "bigbrain.w04zoom.us": "at-or-before", "bizmeeting.online": "at-or-before", "bizwebmeet.com": "at-or-before", "bli.us02we.us": "at-or-before", "bli.us06we.us": "at-or-before", "blockstreet.w02zoom.us": "at-or-before", "blockstreet.w04zoom.us": "at-or-before", "blockstreet.w05zoom.us": "at-or-before", "bluewhale7.xyz": "at-or-before", "bots.autoupdate.online": "at-or-before", "businesstalks.site": "at-or-before", "carriebrigham-c.com": "at-or-before", "cdnkit.io": "at-or-before", "check-address.xyz": "at-or-before", "check.datatabletemplate.shop": "at-or-before", "checkdata.wiki": "at-or-before", "chkactive.online": "at-or-before", "chkstate.online": "at-or-before", "clearit.sbs": "at-or-before", "cloud-server.store": "at-or-before", "cn-zoom.us": "at-or-before", "communicationhub.vip": "at-or-before", "craftiq.cloud": "at-or-before", "cron-stage.usecrowdpay.xyz": "at-or-before", "datatabletemplate.shop": "at-or-before", "datatabletemplate.xyz": "at-or-before", "dataupload.store": "at-or-before", "defactor.us002web.us": "at-or-before", "deliverypost.cloud": "at-or-before", "devlab.locker": "at-or-before", "dexalot.w03zoom.us": "at-or-before", "dg01web.zoomconnector.com": "at-or-before", "doc-bridge.com": "at-or-before", "doc-secure.it.com": "at-or-before", "doc-secure.me": "at-or-before", "download.datatabletemplate.xyz": "at-or-before", "download.face-online.world": "at-or-before", "drainer.bot": "at-or-before", "drmariamaly.com": "at-or-before", "e.ms-live.xyz": "at-or-before", "edgetunnel.leungkc.eu.org": "at-or-before", "em-oujuit78ytserve.com": "at-or-before", "em-oujuit78ytserve.net": "at-or-before", "ezqrn.top": "at-or-before", "face-online.world": "at-or-before", "file-server.store": "at-or-before", "filedrive.online": "at-or-before", "first.longlastfor.online": "at-or-before", "firstfromsep.online": "at-or-before", "flashserve.store": "at-or-before", "flashstore.sbs": "at-or-before", "ftp.uswe05.us": "at-or-before", "google.xn--80aagm.beauty": "at-or-before", "gosats.us02we.us": "at-or-before", "gost.run": "at-or-before", "goweb.zoomconnector.com": "at-or-before", "gumi-cryptos.us05web-zoom.pro": "at-or-before", "hanaconference.xyz": "at-or-before", "honavolae.xyz": "at-or-before", "httpscalm-morning-viber.comhmirihansa909workersdev.workers.dev": "at-or-before", "image-support.xyz": "at-or-before", "instant-update.online": "at-or-before", "johnmichaelsesay.com": "at-or-before", "join-meets.com": "at-or-before", "kanga.us05we.us": "at-or-before", "laserdigital.xyz": "at-or-before", "longlastfor.online": "at-or-before", "m.ms-live.xyz": "at-or-before", "mail.w06zoom.us": "at-or-before", "mediazoom.us": "at-or-before", "meet-client.xyz": "at-or-before", "meet.drmariamaly.com": "at-or-before", "meet.w02zoom.us": "at-or-before", "meeting-hub.team": "at-or-before", "meeting-zone.team": "at-or-before", "meetup-room.online": "at-or-before", "meetuphub.online": "at-or-before", "ms-live.com": "at-or-before", "ms-live.us": "at-or-before", "ms-live.xyz": "at-or-before", "ms-meet.live": "at-or-before", "mughalfan.xyz": "at-or-before", "mylingocoin.com": "at-or-before", "neptune.tastebuds.buzz": "at-or-before", "newfromjune.shop": "at-or-before", "newfromjune.site": "at-or-before", "newwebapi.us": "at-or-before", "nexologin.xyz": "at-or-before", "nicrft.site": "at-or-before", "onedrive.ms-live.com": "at-or-before", "online-conference.online": "at-or-before", "online-conference.pro": "at-or-before", "online-conference.site": "at-or-before", "online-conference.store": "at-or-before", "online-conference.xyz": "at-or-before", "online-meets.cloud": "at-or-before", "online-meets.store": "at-or-before", "onlinemeet.video": "at-or-before", "ortjc.com": "at-or-before", "ovalln.top": "at-or-before", "pacificyouth.club": "at-or-before", "parafi.w03zoom.us": "at-or-before", "parafi.wbzoom.us": "at-or-before", "periqi.com": "at-or-before", "piprotocol.w03zoom.us": "at-or-before", "productnews.online": "at-or-before", "quick-meeting.online": "at-or-before", "readysafe.xyz": "at-or-before", "real-update.xyz": "at-or-before", "real.automatic-update.online": "at-or-before", "refogevc.web08zoom.us": "at-or-before", "reforge.w02zoom.us": "at-or-before", "reforge.web099zoom.us": "at-or-before", "reforgevc.web08zoom.us": "at-or-before", "remoteorder.shop": "at-or-before", "rentyourmac.xyz": "at-or-before", "republicrypto.vc": "at-or-before", "room-meeting.online": "at-or-before", "root.chkstate.online": "at-or-before", "root.security-update.xyz": "at-or-before", "rwa.wbzoom.us": "at-or-before", "rxamia.com": "at-or-before", "safefor.xyz": "at-or-before", "safeup.online": "at-or-before", "safeup.store": "at-or-before", "safeupload.online": "at-or-before", "sdk.w22zoom.us": "at-or-before", "second.awaitingfor.online": "at-or-before", "second.systemupdate.cloud": "at-or-before", "secondshop.online": "at-or-before", "secondshop.store": "at-or-before", "secure-meeting.cloud": "at-or-before", "secure-meeting.xyz": "at-or-before", "securetech.fun": "at-or-before", "security-update.xyz": "at-or-before", "sendhosting.pro": "at-or-before", "sg05web.us": "at-or-before", "sidezoom.us": "at-or-before", "signsafe.site": "at-or-before", "signsafe.xyz": "at-or-before", "silver.web08zoom.us": "at-or-before", "singular.w03zoom.us": "at-or-before", "singulardex.wbzoom.us": "at-or-before", "socialsuport.com": "at-or-before", "solana.w05zoom.us": "at-or-before", "solayer.us002web.us": "at-or-before", "static.cdnkit.io": "at-or-before", "suport.ms-live.com": "at-or-before", "support-gmeet.com": "at-or-before", "support-google.co.im": "at-or-before", "support-google.co.in": "at-or-before", "support-google.us": "at-or-before", "support-google.ws": "at-or-before", "support-zoom.us": "at-or-before", "support.ms-live.com": "at-or-before", "support.ms-meet.live": "at-or-before", "support.teams-live.org": "at-or-before", "support.teams-live.us": "at-or-before", "support.us05web-zoom.biz": "at-or-before", "support.us05web-zoom.cloud": "at-or-before", "support.us05web-zoom.forum": "at-or-before", "support.us05web-zoom.pro": "at-or-before", "support.us06web-zoom.online": "at-or-before", "suweb05.us": "at-or-before", "systemupdate.cloud": "at-or-before", "tastebuds.buzz": "at-or-before", "team-live.us.com": "at-or-before", "team-meets.cloud": "at-or-before", "team-meets.online": "at-or-before", "team-meets.site": "at-or-before", "team-meets.store": "at-or-before", "team-meets.xyz": "at-or-before", "teams-live-meet.carriebrigham-c.com": "at-or-before", "teams-live.biz": "at-or-before", "teams-live.cn.com": "at-or-before", "teams-live.org": "at-or-before", "teams-live.us": "at-or-before", "teams-live.us.com": "at-or-before", "teams-meet.us": "at-or-before", "teams.ms-meet.live": "at-or-before", "techevent.us": "at-or-before", "thanhthienai.com": "at-or-before", "thorwsap.finance": "at-or-before", "twosigmacap.com": "at-or-before", "ua02webzoom.us": "at-or-before", "ua05webzoom.us": "at-or-before", "uc02webzoom.us": "at-or-before", "uc04webzoom.us": "at-or-before", "uc05webzoom.us": "at-or-before", "uc07webzoom.us": "at-or-before", "ue01webzoom.us": "at-or-before", "ue02webzoom.us": "at-or-before", "ue03webzoom.us": "at-or-before", "ue04webzoom.us": "at-or-before", "ue05webzoom.us": "at-or-before", "ue06webzoom.us": "at-or-before", "ue07webzoom.us": "at-or-before", "ue08webzoom.us": "at-or-before", "ue09webzoom.us": "at-or-before", "uk01webzoom.us": "at-or-before", "uk02webzoom.us": "at-or-before", "uk03webzoom.us": "at-or-before", "uk04webzoom.us": "at-or-before", "uk05webzoom.us": "at-or-before", "uk06webzoom.us": "at-or-before", "uk07webzoom.us": "at-or-before", "ukweb08.us": "at-or-before", "um02webzoom.us": "at-or-before", "um04webzoom.us": "at-or-before", "um05webzoom.us": "at-or-before", "um06webzoom.us": "at-or-before", "un02webzoom.us": "at-or-before", "un04webzoom.us": "at-or-before", "unitpowergeneration.top": "at-or-before", "update-assist.org": "at-or-before", "updatecheck.v6.rocks": "at-or-before", "upload-test.xyz": "at-or-before", "ur05webzoom.us": "at-or-before", "urgent-update.cloud": "at-or-before", "us-playground.vc": "at-or-before", "us001web.us": "at-or-before", "us002web.us": "at-or-before", "us004web.us": "at-or-before", "us004zoom.com": "at-or-before", "us005office.us": "at-or-before", "us005zoom.com": "at-or-before", "us006web.us": "at-or-before", "us007web.us": "at-or-before", "us00web-zoom.us": "at-or-before", "us01web-zoom.cloud": "at-or-before", "us01web-zoom.com": "at-or-before", "us01web-zoom.info": "at-or-before", "us01web-zoom.org": "at-or-before", "us01web-zoom.site": "at-or-before", "us01web-zoom.store": "at-or-before", "us01web-zoom.xyz": "at-or-before", "us01web.com": "at-or-before", "us02biz-zoom.us": "at-or-before", "us02cam-zoom.us": "at-or-before", "us02we.us": "at-or-before", "us02web-zoom.com": "at-or-before", "us02web-zoom.info": "at-or-before", "us02web-zoom.live": "at-or-before", "us02web-zoom.org": "at-or-before", "us02web-zoom.xyz": "at-or-before", "us02web.zoomconnector.com": "at-or-before", "us02www-zoom.us": "at-or-before", "us03biz-zoom.us": "at-or-before", "us03web-zoom.biz": "at-or-before", "us03web-zoom.cc": "at-or-before", "us03web-zoom.com": "at-or-before", "us03web-zoom.info": "at-or-before", "us03web-zoom.org": "at-or-before", "us03web-zoom.site": "at-or-before", "us03web-zoom.store": "at-or-before", "us03web-zoom.top": "at-or-before", "us03web-zoom.xyz": "at-or-before", "us03www-zoom.us": "at-or-before", "us04web-zoom.info": "at-or-before", "us04web-zoom.live": "at-or-before", "us04web-zoom.org": "at-or-before", "us04web-zoom.xyz": "at-or-before", "us04web.buszoom.us": "at-or-before", "us04web.com": "at-or-before", "us04wezoom.us": "at-or-before", "us04www-zoom.us": "at-or-before", "us05-zoom.com": "at-or-before", "us05-zoom.forum": "at-or-before", "us05-zoom.uk": "at-or-before", "us05-zoom.us": "at-or-before", "us05ad-zoom.us": "at-or-before", "us05biz-zoom.us": "at-or-before", "us05cc-zoom.us": "at-or-before", "us05pro-zoom.us": "at-or-before", "us05vip-zoom.us": "at-or-before", "us05we.us": "at-or-before", "us05web-zoom.biz": "at-or-before", "us05web-zoom.cc": "at-or-before", "us05web-zoom.click": "at-or-before", "us05web-zoom.cloud": "at-or-before", "us05web-zoom.forum": "at-or-before", "us05web-zoom.fun": "at-or-before", "us05web-zoom.guru": "at-or-before", "us05web-zoom.help": "at-or-before", "us05web-zoom.info": "at-or-before", "us05web-zoom.ink": "at-or-before", "us05web-zoom.live": "at-or-before", "us05web-zoom.org": "at-or-before", "us05web-zoom.pro": "at-or-before", "us05web-zoom.site": "at-or-before", "us05web-zoom.space": "at-or-before", "us05web-zoom.store": "at-or-before", "us05web-zoom.top": "at-or-before", "us05web-zoom.uk": "at-or-before", "us05web-zoom.watch": "at-or-before", "us05web-zoom.work": "at-or-before", "us05web-zoom.xyz": "at-or-before", "us05web.buszoom.us": "at-or-before", "us05web.us": "at-or-before", "us05webzoom.link": "at-or-before", "us05www-zoom.us": "at-or-before", "us05zoom.com": "at-or-before", "us05zoom.us.com": "at-or-before", "us06-zoom.forum": "at-or-before", "us06-zoom.uk": "at-or-before", "us06-zoom.us": "at-or-before", "us06we.us": "at-or-before", "us06web-zoom.cc": "at-or-before", "us06web-zoom.info": "at-or-before", "us06web-zoom.live": "at-or-before", "us06web-zoom.online": "at-or-before", "us06web-zoom.org": "at-or-before", "us06web-zoom.space": "at-or-before", "us06web-zoom.xyz": "at-or-before", "us06web.zoomconnector.com": "at-or-before", "us06www-zoom.com": "at-or-before", "us06www-zoom.us": "at-or-before", "us07biz-zoom.us": "at-or-before", "us07office.us": "at-or-before", "us07web-zoom.biz": "at-or-before", "us07web-zoom.cc": "at-or-before", "us07web-zoom.com": "at-or-before", "us07web-zoom.live": "at-or-before", "us07web.zoomconnector.com": "at-or-before", "us08web-zoom.cc": "at-or-before", "us08web-zoom.online": "at-or-before", "us08www-zoom.us": "at-or-before", "us09web-zoom.live": "at-or-before", "us09www-zoom.us": "at-or-before", "us10webzoom.us": "at-or-before", "us11webzoom.us": "at-or-before", "us12web-zoom.us": "at-or-before", "us12webzoom.us": "at-or-before", "us13webzoom.us": "at-or-before", "us14webzoom.us": "at-or-before", "us15webzoom.us": "at-or-before", "us17web-zoom.us": "at-or-before", "us17webzoom.us": "at-or-before", "us19webzoom.us": "at-or-before", "us21webzoom.us": "at-or-before", "us24webzoom.us": "at-or-before", "us25webzoom.us": "at-or-before", "us26webzoom.us": "at-or-before", "us27webzoom.us": "at-or-before", "us28webzoom.us": "at-or-before", "us45webzoom.us": "at-or-before", "us4web.us": "at-or-before", "us50webzoom.us": "at-or-before", "us51webzoom.us": "at-or-before", "us53webzoom.us": "at-or-before", "us60webzoom.us": "at-or-before", "usecrowdpay.xyz": "at-or-before", "uswe01.us": "at-or-before", "uswe03.us": "at-or-before", "uswe04.us": "at-or-before", "uswe05.us": "at-or-before", "uswe06.us": "at-or-before", "uswe07.us": "at-or-before", "uswe08.us": "at-or-before", "uswe20.us": "at-or-before", "usweb0.us": "at-or-before", "usweb005.us": "at-or-before", "usweb01.us": "at-or-before", "usweb04.com": "at-or-before", "usweb08.us": "at-or-before", "usweb09.us": "at-or-before", "usweb5.us": "at-or-before", "ux02webzoom.us": "at-or-before", "ux04webzoom.us": "at-or-before", "ux05webzoom.us": "at-or-before", "uz01webzoom.us": "at-or-before", "uz02webzoom.us": "at-or-before", "uz04webzoom.us": "at-or-before", "uz05webzoom.us": "at-or-before", "uz06webzoom.us": "at-or-before", "uz07webzoom.us": "at-or-before", "venture-meeting.online": "at-or-before", "video-conference.cloud": "at-or-before", "video-conference.pro": "at-or-before", "video-conference.site": "at-or-before", "video-conference.store": "at-or-before", "video-conference.xyz": "at-or-before", "video-meeting.store": "at-or-before", "videotalks.xyz": "at-or-before", "vipocapital.com": "at-or-before", "vless.goowen-f5e.workers.dev": "at-or-before", "vps-7880c010.vps.ovh.ca": "at-or-before", "w02zoom.us": "at-or-before", "w03zoom.us": "at-or-before", "w04zoom.us": "at-or-before", "w05zoom.us": "at-or-before", "w06zoom.us": "at-or-before", "w07zoom.us": "at-or-before", "w12zoom.us": "at-or-before", "w21zoom.us": "at-or-before", "w22zoom.us": "at-or-before", "w41zoom.us": "at-or-before", "wbzoom.us": "at-or-before", "web01zoom.com": "at-or-before", "web02zoom.us": "at-or-before", "web031zoom.us": "at-or-before", "web041zoom.us": "at-or-before", "web06zoom.us": "at-or-before", "web071zoom.us": "at-or-before", "web082zoom.us": "at-or-before", "web08zoom.us": "at-or-before", "web091zoom.us": "at-or-before", "web099zoom.us": "at-or-before", "web21zoom.us": "at-or-before", "web3-support.xyz": "at-or-before", "web3fund.us": "at-or-before", "web3insider.forum": "at-or-before", "web3journal.io": "at-or-before", "web3journal.xyz": "at-or-before", "web3signal.xyz": "at-or-before", "webmeetapi.us": "at-or-before", "webmeetoffice.us": "at-or-before", "webthreefinance.club": "at-or-before", "webus04.us": "at-or-before", "webus05.us": "at-or-before", "webus06.us": "at-or-before", "wesco-distributors.com": "at-or-before", "whisperroom.forum": "at-or-before", "writeup.live": "at-or-before", "ww1.us04web.com": "at-or-before", "ww12.web3journal.io": "at-or-before", "xn--80aagm.beauty": "at-or-before", "zerodev.pro": "at-or-before", "zm-meeting.com": "at-or-before", "zoom-meet-live.carriebrigham-c.com": "at-or-before", "zoom-ru.github.io": "at-or-before", "zoom-support.com": "at-or-before", "zoom-tech.us": "at-or-before", "zoom.02usweb.us": "at-or-before", "zoom.05usweb.us": "at-or-before", "zoom.join-meets.com": "at-or-before", "zoom.suweb05.us": "at-or-before", "zoom.us002web.us": "at-or-before", "zoom.us005office.us": "at-or-before", "zoom.us006web.us": "at-or-before", "zoom.us007web.us": "at-or-before", "zoom.us01web.com": "at-or-before", "zoom.us02we.us": "at-or-before", "zoom.us05we.us": "at-or-before", "zoom.us05web.us": "at-or-before", "zoom.us07office.us": "at-or-before", "zoom.us4web.us": "at-or-before", "zoom.uswe04.us": "at-or-before", "zoom.uswe05.us": "at-or-before", "zoom.uswe06.us": "at-or-before", "zoom.uswe07.us": "at-or-before", "zoom.uswe08.us": "at-or-before", "zoom.uswe20.us": "at-or-before", "zoom.usweb0.us": "at-or-before", "zoom.usweb04.com": "at-or-before", "zoom.webus04.us": "at-or-before", "zoommeetplace.com": "at-or-before", "zoomus05web.com": "at-or-before", "zoomweb.uswe05.us": "at-or-before", "zoonn-platform.com": "at-or-before" }, "ipv4": { "104.168.145.52:8080": "at-or-before", "104.168.151.70:8080": "at-or-before", "104.168.198.145:8080": "at-or-before", "163.5.254.70:3000": "at-or-before", "23.254.202.223:8080": "at-or-before" }, "url": {}, "url_path": {} }, "first_seen_range": { "earliest": "2018-10-23", "latest": "2026-07-25" }, "generated_at": "2026-08-08T03:26:30+00:00", "indicators": { "domain": [ "02euweb.us", "02io.us", "02room.us", "02us.sbs", "02usweb.sbs", "02usweb.us", "02web-zoom.us", "02web.sbs", "02web.zoom.02webus.sbs", "02webus.sbs", "02webus.zoom.02us.sbs", "02webus.zoom.web02.sbs", "02webzoom.us", "03app.live", "03app.sbs", "04web.sbs", "05ie.live", "05in.one", "05live.biz", "05live.co", "05live.live", "05live.sbs", "05live.xyz", "05meet.am.in", "05meet.click", "05meet.co", "05meet.live", "05meet.sbs", "05meet.us", "05meetus.web05.uk", "05uk.us", "05ukweb.uk", "05us.live", "05us.sbs", "05us.zoom.05webus.sbs", "05us.zoom.web05.sbs", "05usweb.us", "05usweb.zoom.meet-05.sbs", "05web.us", "05webus.meet.05uk.us", "05webus.sbs", "06eu.us", "06in.us", "06ln.live", "06on.us", "06ukweb.uk", "06us.live", "06us.sbs", "06us.us", "06us.zoom.web06.eu", "06us.zoom.web06.sbs", "06usweb.us", "06usweb.zoom.us06.sbs", "06web.us06.in", "06web.zoomconnect.io", "06web.zoomlink.studio", "06webin.us", "07-web.us", "07usweb.site", "07web.zoom.uk07.pro", "07webus.zoom.us07.sbs", "163qiye.top", "1driv.org", "1drv.email", "1drvmail.work", "1ives.co", "256ventures.us", "31ventures.info", "32.ww-live.online", "3f.teams-meet.xyz", "5q.ms-meets.online", "a.mylkc.cloudns.ch", "a.updatesinfos.com", "abf-cap.co", "abf-cap.com", "abiesvc.com", "abiesvc.info", "abiesvc.jp.net", "account-googlemeet.com", "addressstore.space", "adiclas-nft.quest", "admin.unitpowergeneration.top", "adteam.am.in", "ai02n.sbs", "aidpartners.org", "ain01.sbs", "ajayplamingo.com", "aleslosev.workers.dev", "algozzoom.us006web.us", "altair-vc.co.uk", "altair-vc.com", "altair.linkpc.net", "amazonaws1.info", "amzonnews.club", "analysis.arkinvst.com", "angelbridge.capital", "angelbridge.jp", "ankanimatoka.com", "annaelsa.xyz", "anobaka.info", "anobaka.jp", "antcapital.us", "api.addressstore.space", "api.betterfun.space", "api.clearit.sbs", "api.flashstore.sbs", "api.zerodev.pro", "api.zoom-sdk.com", "apizoom.myfanshu.com", "app-wechat.xyz", "app.baiduweb.pro", "app.developcore.org", "app.republicrypto.vc", "app.thorwsap.finance", "app.us07webzoom.com", "app.zm-web.uno", "app06zoom.meet06us.net", "apple.cdsventure.xyz", "appleaccess.pro", "appleupdate.datauploader.site", "apps.teamms.live", "arbordeck.co.in", "arborventures.capital", "arkinvst.com", "armzon.onmypc.org", "association.linkpc.net", "atajerefoods.com", "atom.publicvm.com", "att.gdrvupload.xyz", "authenticate.azure-drive.com", "autodynamics.work.gd", "automatic-update.online", "autoprotect.com.de", "autoprotect.com.se", "autoprotect.gb.net", "autoupdate.online", "autoupdate.store", "autoupdatecheck.work.gd", "avid.lno-prima.lol", "awaitingfor.online", "awaitingfor.site", "azure-drive.com", "azure-service.com", "azure.doc-view.cloud", "azurehosting.co", "azureprotect.online", "azureprotect.xyz", "azureprotection.cloud", "azuresecurity.online", "azuresecurity.site", "azureword.com", "b.updatesinfos.com", "backup.163qiye.top", "baiduweb.pro", "bankofamerica.nyc", "bankofamerica.offerings.cloud", "bankofamerica.tel", "bankofamerica.us.org", "beenos.biz", "betterfun.space", "beyondnextventures.co", "beyondnextventures.com", "bhomes.cc", "biemflow.com", "bigbrain.group", "bigbrain.w04zoom.us", "bitcoinnews.mefound.com", "bitdefs.ignorelist.com", "bitflyer.team", "bizmeeting.online", "bizwebmeet.com", "blackwell.tekstar.us", "bli.us02we.us", "bli.us06we.us", "blockchaintransparency.institute", "blockstreet.w02zoom.us", "blockstreet.w04zoom.us", "blockstreet.w05zoom.us", "blog.cloudsecure.space", "bloomcloud.org", "bluewhale7.xyz", "bluyy.com", "bots.autoupdate.online", "breakdream.com", "btcprime.itsaol.com", "bugscrowd.com", "buidihub.com", "build-dream.com", "businesstalks.site", "busyqaz.com", "buy2x.com", "bycomsender.publicvm.com", "c-money.linkpc.net", "ca05web.com", "caladan.video", "calendly.caladan.video", "callnrwise.com", "callshere.com", "calltan.com", "cardiagnostic.net", "careers.bankofamerica.nyc", "careers.mizuhogroup.us", "careersbankofamerica.us", "carriebrigham-c.com", "ccx.capital", "cdnkit.io", "cdsventure.xyz", "cdsx.capital", "chaincapx.com", "chainverve.com", "check-address.xyz", "check.datatabletemplate.shop", "check02id.com", "checkdata.wiki", "chemistryworld.us", "chkactive.online", "chkstate.online", "chromeupdate.publicvm.com", "circlecapital.us", "clearit.sbs", "client.googleapis.online", "cloud-server.store", "cloud.anobaka.info", "cloud.azure-service.com", "cloud.azurehosting.co", "cloud.beyondnextventures.co", "cloud.daiwa.ventures", "cloud.dnx.capital", "cloud.espcapital.pro", "cloud.globalbrains.co", "cloud.globiscapital.co", "cloud.gpmtreit.co", "cloud.hedgehogvc.us", "cloud.inteam.live", "cloud.j-ic.co", "cloud.j-ic.com", "cloud.jumpshare.vip", "cloud.mekongcapital.net", "cloud.mufg.uk", "cloud.prosec.ink", "cloud.tptf.ltd", "cloud.venturelabo.co", "cloud.wpic.ink", "cloudfiles.club", "cloudmeet.works", "cloudocs.space", "cloudprotect.us.org", "cloudsecure.space", "cloudshare.jumpshare.vip", "cmailer.pro", "cmt.ventures", "cn-zoom.us", "coin-squad.co", "coinairbit.com", "coinbig.dev", "coinbigex.com", "coindeck.onmypc.org", "coinnews.onmypc.org", "coinomic.itsaol.com", "communicationhub.vip", "community.edwardcaputo.shop", "community.kevinaraujo.shop", "community.selincapital.com", "companydeck.cloud", "companydeck.online", "config-update.online", "config-update.site", "connsec.publicvm.com", "contract-research.blog", "contractresearch.blog", "craftiq.cloud", "cron-stage.usecrowdpay.xyz", "crypto.contract-research.blog", "crypto.contractresearch.blog", "cryptowave.capital", "customer-app.xyz", "daiwa-v.com", "daiwa.in-zoom.us", "daiwa.ventures", "databox.linkpc.net", "databoxes.linkpc.net", "datasend.fun", "datatabletemplate.shop", "datatabletemplate.xyz", "dataupload.store", "datauploader.online", "datauploader.site", "ddrive.publicvm.com", "ddsvr.itsaol.com", "decentryk.online", "deck.31ventures.info", "deck.altair-vc.co.uk", "deck.altair-vc.com", "deck.arbordeck.co.in", "deck.arbordeck.online", "deck.latest-report.cloud", "deck.toyota-ai.org", "decurret.site", "deepcore.v.entures", "deepmind.fund", "defactor.us002web.us", "dekryptcap.digital", "deliverypost.cloud", "delphidigital.org", "dencall.xyz", "dengmt.us", "dentmt.us", "desk-live.com", "desk.weventure.capital", "desktop.03app.sbs", "developcore.org", "devlab.locker", "devprocloud.com", "devstar.dnsrd.com", "dexalot.w03zoom.us", "dg01web.zoomconnector.com", "digifincx.com", "dllhost.xyz", "dma.linkpc.net", "doc-bridge.com", "doc-secure.it.com", "doc-secure.me", "doc-view.cloud", "doc.256ventures.us", "doc.apple.com.premienoe.aidl.eonw.line.pm", "doc.gdocshare.one", "doc.solanalab.org", "doc.venturelabo.co", "doc.youbicapital.cc", "doconline.top", "docs-send.cloud", "docs.azurehosting.co", "docs.azureword.com", "docs.coinbigex.com", "docs.gdriveshare.top", "docs.goglesheet.com", "docs.securedigitalmarkets.co", "docsend-cloud.espcap.fun", "docsend.com-pro.apple.cloud.line.pm", "docsend.com-proapple.cloud.line.pm", "docsend.me", "docstream.online", "document.antcapital.us", "document.bhomes.cc", "document.fastercapital.cc", "document.kraken-dev.com", "document.lundbergs.cc", "document.skandiafastigheter.cc", "documentprotect.live", "documentprotect.pro", "documents.antcapital.us", "docupload.bond", "docupload.lat", "docupload.site", "docupload.store", "docuserver.xyz", "domainhost.dynamic-dns.net", "dontdie.cfd", "dourolab.xyz", "down.aidpartners.org", "down.espcapital.co", "down.gpmtreit.co", "down.gpmtreit.us", "down.hedgehogvc.us", "down.j-ic.com", "down.protectedviewer.co", "down.tomming.us", "download.azure-safe.com", "download.azure-service.com", "download.datatabletemplate.xyz", "download.face-online.world", "download.gdriveupload.site", "downloadfile.icu", "drainer.bot", "dreamdie.com", "drive.sharegoogldrive.online", "drivebox.publicvm.com", "driveboxitem.publicvm.com", "drivegmail.top", "drivegoogle.org", "drivegoogle.publicvm.com", "drivegoogles.com", "drivegooglshare.xyz", "drivegooogle.publicvm.com", "drives.googldrive.xyz", "drives.googlecloud.live", "driveshare.googldrive.xyz", "drmariamaly.com", "drogueriasanjose.net", "dronefund.icu", "dropepe.cfd", "drw.capital", "dunamu.in-zoom.us", "dunamuventures.com", "e.ms-live.xyz", "e01i.co", "edgetunnel.leungkc.eu.org", "edwardcaputo.shop", "eii.world", "els.docupload.bond", "em-oujuit78ytserve.com", "em-oujuit78ytserve.net", "email.sellinicapital.com", "esosv.itemdb.com", "espcap.fun", "espcapital.pro", "etherscan.mrslove.com", "eu.web02meet.com", "eu.web03us.sbs", "eu.web06.us", "eu.zoom.04web.sbs", "eu02.us", "eu06.in", "eu06.us", "eu06web.app", "eu07webin.co", "euhub.ue06.us", "euprotect.net", "europegdprsec.onmypc.org", "eusharesrv.onmypc.org", "excinfo.itemdb.com", "ezqrn.top", "face-online.world", "faq78.faqserv.com", "fastdown.site", "fastercapital.cc", "fcloudshare.xyz", "file-server.store", "file.docupload.lat", "file.docupload.site", "file.docupload.store", "file.latest-report.online", "file.myfirmdocument.cloud", "file.myfirmdocument.online", "file.venturelabo.co", "filecloud.website", "filedrive.online", "filestream.download", "financialmarketing.live", "first.longlastfor.online", "first.system-update.xyz", "firstfromsep.online", "flashserve.store", "flashstore.sbs", "floriventurescapital.linkpc.net", "floriventuresfinance.linkpc.net", "floriventuresfund.linkpc.net", "foundico.mefound.com", "frameworks.ventures", "freetalks.work", "ftp.uswe05.us", "fxbet.linkpc.net", "g-call.net", "g-call.net.wildnextcard.com", "galaxydigital.cc", "galaxydigital.cloud", "gassist.publicvm.com", "gassists.run.place", "gdocsdown.com", "gdrive.onmypc.org", "gdrive.sharemailcontents.com", "gdriveemail.publicvm.com", "gdriverfileshare.com", "gdrives.best", "gdrives.top", "gdriveshare.com", "gdriveshare.publicvm.com", "gdriveshare.top", "gdriveshareslink.xyz", "gdriveupload.info", "gdriveupload.site", "gdrvauth.cloud", "gdrvcheck.co", "gdrvcloud.com", "gdrvshare.site", "gdrvup.xyz", "gdrvupload.xyz", "getfilefrom.site", "getfilefrom.store", "getwebconnection.buzz", "getwebconnection.cfd", "global-chat.live", "globalbrains.co", "globiscapital.co", "gmaildrive.info", "gmaildrive.site", "gmaildriver.info", "gmeet-private.com", "gmeet1.xyz", "godlike-visit.online", "gogleshare.xyz", "goglesheet.com", "gogoschip.online", "goog1e.us-meet.com", "googe-video-call.xyz", "googie.us-gmeet.com", "googie.us-meet.com", "googldocs.org", "googldrive.xyz", "google-meet-live.com", "google-meet.joins-video-call.com", "google-meet.video-call-now.live", "google-meeting.com", "google-meets-view.7-vs.com", "google-meets.2mydns.net", "google.meet21web.com", "google.us-meet.com", "google.xn--80aagm.beauty", "googleapis.online", "googleauth.pro", "googlecloud.live", "googleclouddrive.com", "googlecstorage.com", "googledocpage.com", "googledrive.download", "googledrive.dynu.net", "googledrive.email", "googledrive.linkpc.net", "googledrive.network", "googledrive.online", "googledrive.publicvm.com", "googledrive.services", "googledriver.info", "googledriver.net", "googledriver.xyz", "googledriveshare.com", "googledrv.com", "googleexplore.net", "googlefiledrive.com", "googlefileshare.com", "googlemeet-account.com", "googlemeet.syncn.cfd", "googlemeett.com", "googleservice.icu", "googleservice.xyz", "googleshare.org", "googlesheetpage.org", "googleupdate.publicvm.com", "googleupload.info", "gooqle-meet-live.my.id", "gooqle-meet-lives.f-a1.com", "gooqle-meet-lives.my.id", "gooqle-meet-lives.s-41.com", "gooqle-meet-online.com", "gooqle-meet-online.com.wildnextcard.com", "gooqle-meet.my.id", "gooqle-view.com", "gosats.us02we.us", "gost.run", "goweb.zoomconnector.com", "gphi-adhaswe.xyz", "gphi-gsaeyheq.top", "gphi.site", "gpmtreit.co", "gpmtreit.us", "greenweb.ink", "group.pro-tokyo.top", "gsheet.gdocsdown.com", "gumi-cryptos.us05web-zoom.pro", "gunosis.global", "hanaconference.xyz", "hanagroup.video", "hananetwork.video", "happyz.one", "health.weventure.capital", "hedgehogvc.us", "hiccup.shop", "honavolae.xyz", "hoststudio.org", "hotter.weventure.capital", "httpscalm-morning-viber.comhmirihansa909workersdev.workers.dev", "huspot.blog", "hwsrv-1225327.hostwindsdns.com", "hwsrv-1320779.hostwindsdns.com", "i06sn.co", "image-support.xyz", "imp-docs.digital", "in-zoom.us", "in06.us", "info.ankanimatoka.com", "info.anobaka.info", "info.customer-app.xyz", "inmsed.com", "innoenergy.info", "instant-update.online", "inteam.live", "inteams.us", "inter.gpmtreit.co", "interalliancemediagroups.cloud", "internal-document-he-gr-me.run.place", "internal-meeting.online", "internal.j-ic.co", "interweb.work", "invite-meet-call.com", "invite-meet-call.com.wildnextcard.com", "ip1.gphi-adhaswe.xyz", "ip1.gphi-gsaeyheq.top", "ip1.s.gphi.site", "ip2.s.gphi.site", "isosecurity.xyz", "iu03e.live", "j-ic.co", "j-ic.co.internal-document-he-gr-me.run.place", "j-ic.com", "jack710.club", "jdshare.com.de", "jobs.twosigmavc.capital", "jobs.twosigmaventures.us", "johnmichaelsesay.com", "join-meets.com", "join-uk.com", "joins-video-call.com", "jp-aprime.info", "jumpshare.vip", "kanga.us05we.us", "kevinaraujo.shop", "koreaair.tattoo", "kraken-dev.com", "krypitalvc.com", "laos.hedgehogvc.us", "laserdigital.xyz", "last-report.online", "latest-report.cloud", "latest-report.online", "ledgercloud.com", "ledgerservice.itsaol.com", "lemniscap.cc", "lievec.com", "liivoe.com", "linecall.app", "linelive.us", "liue.us", "liues.us", "liuesus.com", "liueus.com", "live-call.net", "live-call.net.wildnextcard.com", "live-chat.live", "live-com.xyz", "live-meet.app", "live-meet.online", "live-us.com", "live-video-call.me", "live-video-call.me.panelize.cloud", "live-workplace.com", "live.am.in", "live.desk-live.com", "live.miclesoft.com", "live.micrrosfts.com", "live.micrxsoft.com", "live.teamms-com.xyz", "live.teamsbrowser.com", "live.workplace.teams-com.live", "live02.co", "live05ms.us", "liveam.video", "livecall.team", "liveconference.eu06.us", "livehuddle01.us", "livemeetgooogle.com", "livemicrosft.center", "livemicrosft.com", "liveonedrvshare.xyz", "lives-com.com", "lives.microrrsoft.com", "lives.microsft02.com", "lives.microsoft-desk.com", "lives.ms.teams02.co", "lives.team-global.live", "lives.teamicrosoft.sbs", "lives.teamms.global-chat.live", "lives.teams-app.pro", "lives.teams-desk.live", "lives.teams-workplace.live", "lives.teams02.com", "lives.teams03.com", "lives.teamstunnel.com", "lives02.com", "lives02.run", "lives05.com", "lives06.com", "lives07.com", "livescall.us", "livescall.xyz", "livesmeet.us", "livesmeets.us", "livesmicrosft.com", "lno-prima.lol", "lodashmap.online", "longjourneycapital.publicvm.com", "longjourneyfund.publicvm.com", "longjourneyventure.publicvm.com", "longlastfor.online", "lservs.linkpc.net", "lundbergs.cc", "lzfvefl.com", "lzlovewxx.store", "m.ms-live.xyz", "macro.teams.live02.co", "maelstromfund.org", "maelstroms.fund", "mail.gdriveupload.info", "mail.gmaildrive.site", "mail.googleupload.info", "mail.teamsliues.com", "mail.w06zoom.us", "managedoc.us", "maskasd.com", "matrixpartners.theworkpc.com", "matuaner.com", "mc.tvdhoenn.net", "mclland.com", "mediazoom.us", "meejgoogle.com", "meelgoogle.com", "meet-05.sbs", "meet-app.cc", "meet-call.com", "meet-call.com.wildnextcard.com", "meet-client.xyz", "meet-googie.com", "meet-google.app", "meet-google.me", "meet-google.me.myprocloud.online", "meet-google.me.proxnginx.com", "meet-google.ru", "meet-live.me", "meet-live.me.wildnextcard.com", "meet-qoogle.com", "meet-video-call.com", "meet-video-chat.online", "meet-video-chat.online.wildnextcard.com", "meet-web.us", "meet-web3.eu", "meet.05uk.us", "meet.app.zm-web.uno", "meet.baiduweb.pro", "meet.caladan.video", "meet.coinairbit.com", "meet.daiwa-v.com", "meet.drmariamaly.com", "meet.dunamuventures.com", "meet.gmeet1.xyz", "meet.gooqle-view.com", "meet.hanagroup.video", "meet.hananetwork.video", "meet.mzweb3.fund", "meet.play-goog1es.com", "meet.playgroundvc.capital", "meet.playgroundventures.capital", "meet.saisoncapital.net", "meet.selinicapital.info", "meet.sellinicapital.com", "meet.teamicro.live", "meet.twosigmavc.capital", "meet.twosigmaventures.us", "meet.video-livechat.com", "meet.w02zoom.us", "meet.zoom.05live.live", "meet05.sbs", "meet06.live", "meet06.us", "meet06us.net", "meet21web.com", "meetapp.room.ain01.sbs", "meetgoogje.com", "meetgooglc.com", "meeting-chat.com", "meeting-hub.team", "meeting-zone.team", "meeting.zoom-client.com", "meetingapp.us", "meetingnow-goo-gle.com", "meets-qoogle.com", "meetsdk.online", "meettgoogle.com", "meetup-room.online", "meetuphub.online", "megabitcapital.com", "mekongcapital.net", "metamask.awaitingfor.site", "mg21.1056.uk", "miclesoft.com", "micrlive.online", "micro.com.in", "microb.click", "microc.click", "microca11.com", "microcal1.com", "microcall.us", "microcodf.com", "microcoll.com", "microcome.com", "microe.click", "microg.click", "microh.click", "microi.click", "micromeet.us", "microp.click", "micror.click", "microrrsoft.com", "microsall.com", "microscalls.com", "microscell.com", "microschats.com", "microsdb.com", "microselt.com", "microsft02.com", "microshen.com", "microshlop.com", "microsinfos.com", "microsmeet.com", "microsmeet.xyz", "microsoft-desk.com", "microsoft-rage.world", "microsoft-workspace.live", "microsoft.asn.lv", "microsoft.lives02.run", "microsoftapp.life", "microsofteam.app", "microsofts.live-workplace.com", "microsomeet.com", "microsorft.live.desk-live.com", "microsout.com", "microsslcheck.com", "microssoft.live", "microssoft.live-chat.live", "microstratgey.com", "microszlt.com", "microt.click", "microteam.live", "microvsoft.com", "micrrosfts.com", "micrusoft.us", "micrxsoft.com", "micstmeet.com", "minhhieu.xyz", "miscruft.us", "miss.outletalertsdaily.com", "mizuhogroup.us", "mmsreceive.linkpc.net", "mpksl.publicvm.com", "ms-live.com", "ms-live.site", "ms-live.team", "ms-live.us", "ms-live.xyz", "ms-meet.live", "ms-meet.xyz", "ms-meeting.us", "ms-meets.online", "ms-meets.us.com", "ms-meets.xyz", "ms-teams.live", "ms-teams.us.com", "ms-teams.xyz", "ms.teams02.co", "ms06teams.live-meet.app", "mskpupdate.publicvm.com", "mslivecall.com", "mslivecall.us", "mslivemeet.com", "msmeet.in", "msmeet.teamlv.vip", "msmeet.us", "msoffice.qooqle.download", "msquickcall.com", "msservices.hxxps443.org", "msteamcall.com", "msupdate.publicvm.com", "msupdatepms.xyz", "msweblive.us", "mufg.ink", "mufg.uk", "mufg.us.com", "mufg.us.org", "mufg.yokohama", "mughalfan.xyz", "mx.interalliancemediagroups.cloud", "myfirmdocument.cloud", "myfirmdocument.online", "mylingocoin.com", "mymeetgoogle.com", "mymeetgooogle.com", "mymeetinglive.com", "mymeetingnow.com", "mymeetingtoday.com", "mymeetlive.com", "mzweb3.fund", "n04i.one", "navicheck.xyz", "nbright.best", "neptune.tastebuds.buzz", "net.on05.eu", "netface.live", "newfromjune.shop", "newfromjune.site", "news.last-report.online", "newtribe.in-zoom.us", "newwebapi.us", "nexologin.xyz", "nicrft.site", "nicrosofm.com", "nicrosolf.com", "nicrosolt.com", "nisrosodf.com", "node.minhhieu.xyz", "nodnote.com", "note.onedocshare.com", "ns1.trytiponlineresult.com", "ns2.trytiponlineresult.com", "obituary2.redirectme.net", "offerings.cloud", "ok.docupload.store", "olafsven.xyz", "on05.eu", "on06.us", "oneasu.com", "onedrive.ms-live.com", "onedrive.syncn.cfd", "onedrivecloud.store", "onedriveglobal.com", "onedrivems.online", "onedriveupdate.publicvm.com", "onedrivrshares.xyz", "onedrvdn.co", "onedrvfile.site", "online-conference.online", "online-conference.pro", "online-conference.site", "online-conference.store", "online-conference.xyz", "online-meets.cloud", "online-meets.store", "online.selinicapital.info", "online.zoom-client.com", "onlinedoc.dev", "onlinedocpage.org", "onlinemeet.video", "onlineshoping.publicvm.com", "onlivecall.com", "onlivemeet.com", "onmsed.com", "onreallive.com", "onteam.business.in", "onwebcall.us", "onweblive.org", "onwebmeet.us", "ortjc.com", "os-live.com", "os-live.online", "os-live.us", "os-live.xyz", "outletalertsdaily.com", "outms.com", "ovalln.top", "ownemail.me", "pacificyouth.club", "page.googledocpage.com", "palconshop.linkpc.net", "panda95sg.asia", "parafi.w03zoom.us", "parafi.wbzoom.us", "partner.deepcore.v.entures", "periqi.com", "perseus.bond", "pet.hedgehogvc.us", "piprotocol.w03zoom.us", "pixelmonmmo.net", "pixleon.net", "play-goog1es.com", "playgroundvc.capital", "playgroundventures.capital", "pokersonic.publicvm.com", "pre.alwayswait.site", "premium-business.live", "premium.03app.live", "premuims.live", "press.linkpc.net", "prismlab.xyz", "privacyshield.services", "pro-tokyo.top", "product.onlinedoc.dev", "productnews.online", "prosec.ink", "protect.antcapital.us", "protect.azure-drive.com", "protect.venturelabo.co", "protectedviewer.co", "protectoffice.club", "protectsh.online", "provemail.net", "prvservice.com", "pvset.itsaol.com", "qooqle.download", "qoqle.online", "quick-meeting.online", "raizerverify.online", "rd.ww-live.uk", "readysafe.xyz", "real-update.xyz", "real.automatic-update.online", "reallivecall.us", "refogevc.web08zoom.us", "reforge.w02zoom.us", "reforge.web099zoom.us", "reforgevc.web08zoom.us", "regcnlab.com", "reit.live", "remoteorder.shop", "renaworkshard.xyz", "rentyourmac.xyz", "republicrypto.vc", "room-meeting.online", "room.ain01.sbs", "room.in06.us", "root.chkstate.online", "root.security-update.xyz", "root.system-update.cloud", "rubbishshop.linkpc.net", "rubbishshop.publicvm.com", "rwa.wbzoom.us", "rxamia.com", "safe.arborventures.capital", "safe.doc-share.pro", "safe.doc-share.top", "safe.gunosis.global", "safe.job-description.online", "safe.nextera.capital", "safe.shared-document.cloud", "safe.smart-contracts.blog", "safefor.xyz", "safeup.online", "safeup.store", "safeupload.online", "saisoncapital.net", "sarahbeery.docsend.me", "sdk.w22zoom.us", "second.awaitingfor.online", "second.systemupdate.cloud", "secondshop.online", "secondshop.store", "secure-meeting.cloud", "secure-meeting.xyz", "secure.inteam.live", "securedigitalmarkets.ca", "securedigitalmarkets.co", "secureshares.online", "securesmtp.interalliancemediagroups.cloud", "securetech.fun", "security-update.xyz", "selincapital.com", "selinicapital.info", "selinicapital.network", "sendbrevo.com", "sendcontents.linkpc.net", "sendhosting.pro", "sendmailed.com", "sendmailer.org", "sendspace.buzz", "sevicebill.itemdb.com", "sevrrhst.com", "sfrclak.com", "sg05web.us", "share.anobaka.info", "share.bloomcloud.org", "share.dedesignanddev.com", "share.devprocloud.com", "share.docuserver.xyz", "share.stablemarket.org", "sharebusiness.xyz", "shared-document.cloud", "sharedocs.xyz", "sharedrivegght.xyz", "sharegoogldrive.online", "sharemailcontents.publicvm.com", "sharesdown.xyz", "shh5.baranftw.xyz", "show-pdf-document.com", "showprice.xyz", "sidezoom.us", "signsafe.site", "signsafe.xyz", "signverydn.sharebusiness.xyz", "silver.web08zoom.us", "singular.w03zoom.us", "singulardex.wbzoom.us", "sinovationventures.co", "site.siteshare.me", "siteshare.me", "skandiafastigheter.cc", "skyweb.work", "slot0.regcnlab.com", "smbc-vc.com", "smbc.ltd", "smbcgroup.us", "smtps.interalliancemediagroups.cloud", "socialsuport.com", "socins.publicvm.com", "solana.w05zoom.us", "solanalab.org", "solayer.us002web.us", "solidbitcapital.xyz", "spirtblockchain.com", "stablemarket.org", "stabucksiren.fun", "stalelive.us", "star-bucks.life", "starbucksevent.pics", "static.cdnkit.io", "stomcs.com", "sts.interalliancemediagroups.cloud", "suport.ms-live.com", "support-gmeet.com", "support-google.co.im", "support-google.co.in", "support-google.us", "support-google.ws", "support-zoom.us", "support.ms-live.com", "support.ms-live.us", "support.ms-meet.live", "support.teams-live.org", "support.teams-live.us", "support.us05web-zoom.biz", "support.us05web-zoom.cloud", "support.us05web-zoom.forum", "support.us05web-zoom.pro", "support.us06web-zoom.online", "supportzm.com", "suweb05.us", "svr04.faqserv.com", "syncn.cfd", "syncroom.u06h.lat", "system-update.cloud", "system-update.xyz", "systemupdate.cloud", "table1.cdsventure.xyz", "tastebuds.buzz", "tattomc.com", "team-global.live", "team-live.us.com", "team-meets.cloud", "team-meets.online", "team-meets.site", "team-meets.store", "team-meets.xyz", "team.asn.lv", "team.micro.com.in", "team.msmeet.in", "team.weblink.contact", "teamapp.live", "teames.lives-com.com", "teamicro.live", "teamicrosoft.sbs", "teamlive.vip", "teamlv.us", "teamlv.vip", "teamms-com.xyz", "teamms.global-chat.live", "teamms.live", "teamms.live-com.xyz", "teamms.live.miclesoft.com", "teamms.microcome.com", "teamms.microssoft.live", "teams-app.liveam.video", "teams-app.pro", "teams-com.live", "teams-desk.live", "teams-live-meet.carriebrigham-c.com", "teams-live.biz", "teams-live.cn.com", "teams-live.com.co", "teams-live.org", "teams-live.us", "teams-live.us.com", "teams-meet.online", "teams-meet.us", "teams-meet.us.com", "teams-meet.xyz", "teams-us.live", "teams-workplace.live", "teams.1ives.co", "teams.cloudmeet.works", "teams.freetalks.work", "teams.greenweb.ink", "teams.interweb.work", "teams.linecall.app", "teams.live.am.in", "teams.live.miclesoft.com", "teams.live02.co", "teams.lives02.com", "teams.microscell.com", "teams.microsoft.lives02.run", "teams.microsofts.live-workplace.com", "teams.ms-meet.live", "teams.msweblive.us", "teams.netface.live", "teams.onlivemeet.com", "teams.onwebcall.us", "teams.onweblive.org", "teams.onwebmeet.us", "teams.skyweb.work", "teams.stalelive.us", "teams.web-lives.com", "teams.web.lives06.com", "teams.webtalk.work", "teams02.co", "teams02.com", "teams02.lives05.com", "teams03.com", "teams05web.lives07.com", "teams07.lives07.com", "teams07.web07microsoft.live", "teams08.run", "teamsbrowser.com", "teamsiiwe.com", "teamsliues.com", "teamslivc.com", "teamsliveo.com", "teamslivex.com", "teamslivos.com", "teamslivs.com", "teamsliwe.com", "teamstunnel.com", "teamsupport.live", "teamsync.live", "techevent.us", "techopscentral.com", "teemsliivc.com", "teemslive.com", "teemslivo.com", "tele-app.minhhieu.xyz", "termsofservice.onmypc.org", "tet.dnx.capital", "thai.hedgehogvc.us", "thanhthienai.com", "thefirststore.bond", "thorwsap.finance", "thriddata.com", "tokenhub.mefound.com", "tokenomic.itsaol.com", "tokentrack.mrbasic.com", "tomming.us", "toyota-ai.org", "tp-globa.xyz", "tptf.co", "tptf.fund", "tptf.ltd", "tptf.us", "trytiponlineresult.com", "tu.live-us.com", "tvdhoenn.net", "twosigma.publicvm.com", "twosigmacap.com", "twosigmateam.info", "twosigmavc.capital", "twosigmaventures.us", "u06h.lat", "u07ei.biz", "ua02webzoom.us", "ua03webzoom.us", "ua04webzoom.us", "ua05webzoom.us", "ua06webzoom.us", "uae04webzoom.us", "uc01web.us", "uc01webzoom.us", "uc02web.us", "uc02websoom.us", "uc02webzoom.us", "uc03web.us", "uc03webzoom.us", "uc04web.us", "uc04webzoom.us", "uc05websoom.us", "uc05webzoom.us", "uc06web.us", "uc06webzoom.us", "uc07webzoom.us", "uco4webzoom.us", "uco5webzoom.us", "uco6webzoom.us", "ucweb05.us", "ue01web.us", "ue01webzoom.us", "ue02web.us", "ue02webzoom.us", "ue03web.us", "ue03webzoom.us", "ue04web.us", "ue04webzoom.us", "ue05.us", "ue05webzoom.us", "ue06.us", "ue06web.us", "ue06webzoom.us", "ue07webzoom.us", "ue08webzoom.us", "ue09webzoom.us", "ueo4webzoom.us", "ui01webzoom.us", "ui02webzoom.us", "ui03webzoom.us", "ui04webzoom.us", "ui05webzoom.us", "ui06webzoom.us", "ui07webzoom.us", "uk01webzoom.us", "uk02webzoom.us", "uk03webzoom.us", "uk04webzoom.us", "uk05live.us", "uk05webzoom.us", "uk06.zoom.eu06web.app", "uk06webzoom.us", "uk07.pro", "uk07.us", "uk07webzoom.us", "ukweb08.us", "um02webzoom.us", "um03webzoom.us", "um04webzoom.us", "um05webzoom.us", "um06webzoom.us", "un01web.us", "un01webzoom.us", "un02webzoom.us", "un03webzoom.us", "un04webzoom.us", "un05webzoom.us", "un06webzoom.us", "unchainedcapital.co", "unitpowergeneration.top", "uo01web.us", "uo01webzoom.us", "uo02webzoom.us", "uo03webzoom.us", "uo04webzoom.us", "uo05web.us", "uo05webzoom.us", "uo06webzoom.us", "up.digifincx.com", "update-assist.org", "update-teams.live", "updatecheck.v6.rocks", "updatepool.online", "updatesinfos.com", "updatezone.org", "upload-test.xyz", "upload.gdrives.best", "uploadfiles.website", "uploadmefiles.site", "uploadmefiles.space", "uploadmefiles.tech", "uploadmefiles.xyz", "uploadmyfile.space", "uploadmyfile.tech", "uploadsfiles.xyz", "uq01webzoom.us", "uq02webzoom.us", "uq03webzoom.us", "uq05webzoom.us", "uq06webzoom.us", "uq08webzoom.us", "ur01webzoom.us", "ur02webzoom.us", "ur03webzoom.us", "ur04webzoom.us", "ur05webzoom.us", "ur06webzoom.us", "urgent-update.cloud", "us-05.in", "us-meet.com", "us-playground.vc", "us.meet06.live", "us.web.06zoom.us", "us.web02meet.com", "us.zoom.02usweb.sbs", "us.zoom.06web.us", "us.zoom.06webin.us", "us001web.us", "us002web.us", "us004web.us", "us004zoom.com", "us004zoom.us", "us005office.us", "us005webzoom.us", "us005zoom.com", "us005zoom.us", "us006web.us", "us007web.us", "us00web-zoom.us", "us01web-zoom.cloud", "us01web-zoom.com", "us01web-zoom.info", "us01web-zoom.org", "us01web-zoom.site", "us01web-zoom.store", "us01web-zoom.xyz", "us01web.com", "us01webinar.zoom.e01i.co", "us01webzoom.us", "us02.sbs", "us02.us", "us02.zoomin.web02eu.live", "us02biz-zoom.us", "us02cam-zoom.us", "us02we.us", "us02web-zoom.com", "us02web-zoom.info", "us02web-zoom.live", "us02web-zoom.org", "us02web-zoom.xyz", "us02web.zoom.us02.us", "us02web.zoomconnector.com", "us02web.zoomweb.org", "us02webs.us", "us02websoom.us", "us02webzoom.us", "us02www-zoom.us", "us03.meet-web.us", "us03.zoom.meet-web.us", "us03biz-zoom.us", "us03live.com", "us03web-zoom.biz", "us03web-zoom.cc", "us03web-zoom.com", "us03web-zoom.info", "us03web-zoom.org", "us03web-zoom.site", "us03web-zoom.store", "us03web-zoom.top", "us03web-zoom.xyz", "us03websoom.us", "us03webuoom.us", "us03www-zoom.us", "us04meet.web04.sbs", "us04web-zoom.info", "us04web-zoom.live", "us04web-zoom.org", "us04web-zoom.xyz", "us04web.buszoom.us", "us04web.com", "us04web.zoom04web.run", "us04webs.us", "us04webzoom.us", "us04wezoom.us", "us04www-zoom.us", "us05-web.us", "us05-zoom.com", "us05-zoom.forum", "us05-zoom.uk", "us05-zoom.us", "us05.eu", "us05.sbs", "us05.us", "us05.web.meet05.sbs", "us05.webzoom.work", "us05.zoom.web04.us", "us05.zoom.web05.uk", "us05ad-zoom.us", "us05biz-zoom.us", "us05cc-zoom.us", "us05pro-zoom.us", "us05vip-zoom.us", "us05we.us", "us05web-zoom.biz", "us05web-zoom.cc", "us05web-zoom.click", "us05web-zoom.cloud", "us05web-zoom.forum", "us05web-zoom.fun", "us05web-zoom.guru", "us05web-zoom.help", "us05web-zoom.info", "us05web-zoom.ink", "us05web-zoom.live", "us05web-zoom.org", "us05web-zoom.pro", "us05web-zoom.site", "us05web-zoom.space", "us05web-zoom.store", "us05web-zoom.top", "us05web-zoom.uk", "us05web-zoom.watch", "us05web-zoom.work", "us05web-zoom.xyz", "us05web.buszoom.us", "us05web.site", "us05web.us", "us05web.zoom.us05.us", "us05webs.com", "us05websoom.us", "us05webszoom.us", "us05webxoom.us", "us05webzoom.link", "us05webzoom.us", "us05www-zoom.us", "us05zoom.com", "us05zoom.meet-web3.eu", "us05zoom.us.com", "us06-zoom.forum", "us06-zoom.uk", "us06-zoom.us", "us06.in", "us06.sbs", "us06we.us", "us06web-zoom.cc", "us06web-zoom.info", "us06web-zoom.live", "us06web-zoom.online", "us06web-zoom.org", "us06web-zoom.space", "us06web-zoom.syncn.cfd", "us06web-zoom.xyz", "us06web.zoom.06us.sbs", "us06web.zoomconnector.com", "us06webs.us", "us06websoom.us", "us06webzoom.us", "us06www-zoom.com", "us06www-zoom.us", "us06zoom.syncn.cfd", "us07-web.us", "us07.sbs", "us07biz-zoom.us", "us07office.us", "us07web-zoom.biz", "us07web-zoom.cc", "us07web-zoom.com", "us07web-zoom.live", "us07web.me", "us07web.zoomconnector.com", "us07webs.us", "us07webzoom.com", "us07webzoom.us", "us07zoom.meetingapp.us", "us08web-zoom.cc", "us08web-zoom.online", "us08webs.us", "us08www-zoom.us", "us09web-zoom.live", "us09webzoom.us", "us09www-zoom.us", "us0lwebzoom.us", "us10webzoom.us", "us11webzoom.us", "us12web-zoom.us", "us12webzoom.us", "us13webzoom.us", "us14webzoom.us", "us15web.com", "us15webs.us", "us15webzoom.us", "us16webzoom.us", "us17web-zoom.us", "us17webzoom.us", "us19webzoom.us", "us21webzoom.us", "us22webzoom.us", "us24webzoom.us", "us25webs.us", "us25webzoom.us", "us26webzoom.us", "us27webzoom.us", "us28webzoom.us", "us29webzoom.us", "us30webzoom.us", "us31webzoom.us", "us41webzoom.us", "us45webzoom.us", "us4web.us", "us50webzoom.us", "us51webzoom.us", "us52webzoom.us", "us53webzoom.us", "us54webzoom.us", "us55web.com", "us57webzoom.us", "us60webzoom.us", "us72webzoom.us", "us81webzoom.us", "us95webs.us", "usa01webzoom.us", "usa02webzoom.us", "usa04webzoom.us", "usa05webzoom.us", "usa06webzoom.us", "usdxchange.org", "use05webzoom.us", "usecrowdpay.xyz", "usewebin.room.in06.us", "usezoom.net.on05.eu", "usezoom.webin.n04i.one", "usezoomin.06in.us", "ushub.syncroom.u06h.lat", "usinroomweeb.i06sn.co", "uso04webzoom.us", "uso05webzoom.us", "uso06webzoom.us", "uso1webzoom.us", "uso3webzoom.us", "uso4web.us", "uso7webzoom.us", "usobweb.us", "uswe01.us", "uswe03.us", "uswe04.us", "uswe05.us", "uswe06.us", "uswe07.us", "uswe08.us", "uswe20.us", "usweb.02room.us", "usweb.05meet.us", "usweb.07-web.us", "usweb.eu02.us", "usweb.zoom.02io.us", "usweb.zoom.05meet.sbs", "usweb.zoom.05us.live", "usweb.zoom.05us.sbs", "usweb.zoom.06ln.live", "usweb.zoom.06us.live", "usweb.zoom.us02.sbs", "usweb.zoom.us05.sbs", "usweb0.us", "usweb005.us", "usweb01.us", "usweb04.com", "usweb05.us", "usweb06.zoom.meet06.us", "usweb08.us", "usweb09.us", "usweb0b.us", "usweb0l.us", "usweb5.us", "uswebob.com", "uswebob.us", "uswebr.zoomin.on06.us", "uszoom.web.05live.sbs", "uszoom.web.eu06.in", "uszoomhub.iu03e.live", "uszoomsweb.ue05.us", "ut01webzoom.us", "ut02webzoom.us", "ut03webzoom.us", "ut04webzoom.us", "ut05webzoom.us", "ut06webzoom.us", "uu01webzoom.us", "uu02webzoom.us", "uu03webzoom.us", "uv01webzoom.us", "uv02webzoom.us", "uv03webzoom.us", "uv04webzoom.us", "uv05webzoom.us", "uv06webzoom.us", "uv07webzoom.us", "uw01webzoom.us", "uw02webzoom.us", "uw03webzoom.us", "uw04webzoom.us", "uw05webzoom.us", "uw06webzoom.us", "ux01web.us", "ux01webzoom.us", "ux02web.us", "ux02webzoom.us", "ux03web.us", "ux03webzoom.us", "ux04webzoom.us", "ux05webzoom.us", "ux06webzoom.us", "uy01webzoom.us", "uy02webzoom.us", "uy04webzoom.us", "uz01web.us", "uz01webzoom.us", "uz02webzoom.us", "uz03web.us", "uz03webzoom.us", "uz04webzoom.us", "uz05webzoom.us", "uz06webzoom.us", "uz07webzoom.us", "vcallsdk.online", "venture-meeting.online", "venturelabo.co", "verify.googleauth.pro", "verify.selinicapital.info", "versionupdate.dns.army", "video-call-now.live", "video-call.0-1h.com", "video-chat-live.one", "video-chat-live.online", "video-chat-live.online.devto.cloud", "video-conference.cloud", "video-conference.pro", "video-conference.site", "video-conference.store", "video-conference.xyz", "video-livechat.com", "video-meet.xyz", "video-meeting.store", "videocall.bloomup.app", "videotalks.xyz", "vipocapital.com", "vless.goowen-f5e.workers.dev", "vote.anobaka.info", "vps-7880c010.vps.ovh.ca", "vpset.onmypc.org", "vpsfree.linkpc.net", "w02zoom.us", "w03zoom.us", "w04zoom.us", "w05zoom.us", "w06zoom.us", "w07zoom.us", "w12zoom.us", "w21zoom.us", "w22zoom.us", "w3bitcapital.com", "w41zoom.us", "walleyecapital.org", "walleyecapital.xyz", "walleyevc.capital", "walleyeventure.xyz", "wbzoom.us", "web-lives.com", "web-meet.live", "web-teams.microvsoft.com", "web-zoom.uk", "web.05ie.live", "web.05live.sbs", "web.05live.xyz", "web.06us.us", "web.06zoom.us", "web.eu06.in", "web.lives06.com", "web.meet05.sbs", "web.zoomapp.05meet.am.in", "web.zoomapp.05meet.live", "web01zoom.com", "web02.sbs", "web02meet.com", "web02teams.com", "web02us.zoom.02io.us", "web02zoom.us", "web031zoom.us", "web03us.sbs", "web04.sbs", "web04.us", "web041zoom.us", "web04meet.top", "web04zoom.us", "web05.sbs", "web05.uk", "web05.zoom.us-05.in", "web05meet.us", "web05us.online", "web06.eu", "web06.sbs", "web06zoom.us", "web07.premium-business.live", "web07.zoom.meet-app.cc", "web071zoom.us", "web07microsoft.live", "web07us.uk07.us", "web07zoom.us", "web08.teams08.run", "web082zoom.us", "web08zoom.us", "web091zoom.us", "web099zoom.us", "web12teams.com", "web21zoom.com", "web21zoom.us", "web22n.us", "web2meet.net", "web3-support.xyz", "web3fund.us", "web3insider.forum", "web3journal.io", "web3journal.xyz", "web3meet.live", "web3meet.xyz", "web3signal.xyz", "web3zoom.xyz", "web71meet.shop", "web86meet.shop", "webapp.zoom.05live.co", "webhostwatto.work.gd", "webin.n04i.one", "webinaroom.05in.one", "webine.zoom.eu07webin.co", "weblink.contact", "webmeet.zoom.05live.biz", "webmeetapi.us", "webmeetoffice.us", "webtalk.work", "webthreefinance.club", "webus.zoom.02web.sbs", "webus.zoom.05live.us", "webus.zoom.05meet.co", "webus04.us", "webus05.us", "webus06.us", "webzoom.work", "wechart.org", "werfaultserver.com", "wesco-distributors.com", "weventure.capital", "whisperroom.forum", "windrvupdate.kozow.com", "wirexapp.app", "woodcastpro.com", "word.anobaka.info", "word.azureword.com", "workflowin.sbs", "workplace.teams-com.live", "world.linkpc.net", "writeup.live", "ww-live.com", "ww-live.online", "ww-live.uk", "ww-live.us", "ww-live.xyz", "ww1.us04web.com", "ww12.web3journal.io", "ww25.amazon.co.jp-aprime.info", "ww25.co.jp-aprime.info", "ww25.jp-aprime.info", "ww25.login-service.amazon.co.jp-aprime.info", "ww25.mail.jp-aprime.info", "ww25.webmail.jp-aprime.info", "ww38.jp-aprime.info", "www-live.us", "www-live.xyz", "xn--80aagm.beauty", "xu10.1056.uk", "yoannturp.xyz", "yorst.linkpc.net", "youbicapital.cc", "zerodev.pro", "zm-meeting.com", "zm-web.uno", "zmsupport.com", "zmtest.weventure.capital", "zoom-client.com", "zoom-meet-live.carriebrigham-c.com", "zoom-ru.github.io", "zoom-sdk.com", "zoom-support.com", "zoom-tech.us", "zoom-web07.meet-app.cc", "zoom.02euweb.us", "zoom.02io.us", "zoom.02us.sbs", "zoom.02usweb.sbs", "zoom.02usweb.us", "zoom.02web.sbs", "zoom.02webus.sbs", "zoom.05live.biz", "zoom.05live.co", "zoom.05live.live", "zoom.05live.us", "zoom.05meet.click", "zoom.05meet.co", "zoom.05meet.sbs", "zoom.05ukweb.uk", "zoom.05us.live", "zoom.05us.sbs", "zoom.05usweb.us", "zoom.05web.us", "zoom.05webus.sbs", "zoom.06ln.live", "zoom.06ukweb.uk", "zoom.06us.live", "zoom.06us.sbs", "zoom.06usweb.us", "zoom.06web.us", "zoom.06web.us06.in", "zoom.06webin.us", "zoom.07usweb.site", "zoom.ca05web.com", "zoom.desktop.03app.sbs", "zoom.e01i.co", "zoom.eu07webin.co", "zoom.join-meets.com", "zoom.meet-05.sbs", "zoom.meet-app.cc", "zoom.meet-web.us", "zoom.meet06.us", "zoom.premium.03app.live", "zoom.suweb05.us", "zoom.ua03webzoom.us", "zoom.ua04webzoom.us", "zoom.ua06webzoom.us", "zoom.uc01webzoom.us", "zoom.uc03webzoom.us", "zoom.uc06webzoom.us", "zoom.ui01webzoom.us", "zoom.ui02webzoom.us", "zoom.ui03webzoom.us", "zoom.ui04webzoom.us", "zoom.ui05webzoom.us", "zoom.ui06webzoom.us", "zoom.ui07webzoom.us", "zoom.uk07.pro", "zoom.um03webzoom.us", "zoom.un01webzoom.us", "zoom.un03webzoom.us", "zoom.un05webzoom.us", "zoom.un06webzoom.us", "zoom.uo01webzoom.us", "zoom.uo02webzoom.us", "zoom.uo03webzoom.us", "zoom.uo04webzoom.us", "zoom.uo05webzoom.us", "zoom.uo06webzoom.us", "zoom.uq01webzoom.us", "zoom.uq02webzoom.us", "zoom.uq03webzoom.us", "zoom.uq05webzoom.us", "zoom.uq06webzoom.us", "zoom.uq08webzoom.us", "zoom.ur01webzoom.us", "zoom.ur02webzoom.us", "zoom.ur03webzoom.us", "zoom.ur04webzoom.us", "zoom.ur06webzoom.us", "zoom.us-05.in", "zoom.us.meet06.live", "zoom.us002web.us", "zoom.us005office.us", "zoom.us005webzoom.us", "zoom.us006web.us", "zoom.us007web.us", "zoom.us01web.com", "zoom.us01webzoom.us", "zoom.us02.sbs", "zoom.us02.us", "zoom.us02we.us", "zoom.us02webs.us", "zoom.us02webzoom.us", "zoom.us04webs.us", "zoom.us04webzoom.us", "zoom.us05-web.us", "zoom.us05.sbs", "zoom.us05.us", "zoom.us05we.us", "zoom.us05web.us", "zoom.us05webs.com", "zoom.us05webzoom.us", "zoom.us06.sbs", "zoom.us06webs.us", "zoom.us06webzoom.us", "zoom.us07-web.us", "zoom.us07.sbs", "zoom.us07office.us", "zoom.us07webs.us", "zoom.us07webzoom.us", "zoom.us08webs.us", "zoom.us09webzoom.us", "zoom.us15web.com", "zoom.us15webs.us", "zoom.us16webzoom.us", "zoom.us22webzoom.us", "zoom.us25webs.us", "zoom.us29webzoom.us", "zoom.us30webzoom.us", "zoom.us31webzoom.us", "zoom.us41webzoom.us", "zoom.us4web.us", "zoom.us52webzoom.us", "zoom.us54webzoom.us", "zoom.us55web.com", "zoom.us57webzoom.us", "zoom.us72webzoom.us", "zoom.us81webzoom.us", "zoom.us95webs.us", "zoom.usa01webzoom.us", "zoom.usa02webzoom.us", "zoom.usa05webzoom.us", "zoom.uso1webzoom.us", "zoom.uso3webzoom.us", "zoom.uso7webzoom.us", "zoom.uswe04.us", "zoom.uswe05.us", "zoom.uswe06.us", "zoom.uswe07.us", "zoom.uswe08.us", "zoom.uswe20.us", "zoom.usweb.05meet.us", "zoom.usweb0.us", "zoom.usweb04.com", "zoom.ut01webzoom.us", "zoom.ut02webzoom.us", "zoom.ut03webzoom.us", "zoom.ut04webzoom.us", "zoom.ut05webzoom.us", "zoom.ut06webzoom.us", "zoom.uu01webzoom.us", "zoom.uu02webzoom.us", "zoom.uu03webzoom.us", "zoom.uv01webzoom.us", "zoom.uv02webzoom.us", "zoom.uv03webzoom.us", "zoom.uv04webzoom.us", "zoom.uv05webzoom.us", "zoom.uv06webzoom.us", "zoom.uv07webzoom.us", "zoom.uw01webzoom.us", "zoom.uw02webzoom.us", "zoom.uw03webzoom.us", "zoom.uw04webzoom.us", "zoom.uw05webzoom.us", "zoom.uw06webzoom.us", "zoom.ux01webzoom.us", "zoom.ux03webzoom.us", "zoom.ux06webzoom.us", "zoom.uy01webzoom.us", "zoom.uy02webzoom.us", "zoom.uy04webzoom.us", "zoom.uz03webzoom.us", "zoom.web.06us.us", "zoom.web02.sbs", "zoom.web02meet.com", "zoom.web04.us", "zoom.web05.sbs", "zoom.web05.uk", "zoom.web05meet.us", "zoom.web06.eu", "zoom.web06.sbs", "zoom.web07.premium-business.live", "zoom.webus04.us", "zoom01us.workflowin.sbs", "zoom04web.run", "zoomapp.05meet.am.in", "zoomapp.05meet.live", "zoomapp.web.05ie.live", "zoomapp.web.05live.xyz", "zoomconnect.io", "zoomeuweb.u07ei.biz", "zoomin.on06.us", "zoomin.web02eu.live", "zoomlink.studio", "zoommeetplace.com", "zoomus.eu.web03us.sbs", "zoomus05web.com", "zoomuseb.ai02n.sbs", "zoomweb.06eu.us", "zoomweb.org", "zoomweb.uswe05.us", "zoomwebinar.06on.us", "zoonn-platform.com" ], "ipv4": [ "104.145.210.107:6783", "104.168.145.52:8080", "104.168.151.70:8080", "104.168.198.145:8080", "109.248.163.127:3000", "118.70.116.154:8080", "139.150.73.123:3000", "140.117.91.22:8080", "140.136.134.201:8080", "142.11.196.106:8000", "142.11.196.106:8080", "142.11.206.73:8000", "144.172.114.220:443", "144.172.116.143:3000", "163.25.24.44:443", "163.5.254.70:3000", "172.86.91.195:443", "186.183.185.94:8080", "23.254.164.123:443", "23.254.164.61:8000", "23.254.164.61:9000", "23.254.164.92:443", "23.254.164.92:8000", "23.254.164.92:9000", "23.254.167.216:8000", "23.254.202.223:8080", "23.254.203.244:8000", "23.254.203.244:9000", "38.110.228.52:3000", "41.85.145.164:8080", "45.238.25.2:443", "45.61.129.29:3000", "45.61.140.26:3389", "45.61.148.134:3000", "45.61.157.248:3000", "45.61.163.100:8090", "45.61.163.100:8888", "59.152.103.205:3000", "66.181.166.15:8080", "83.136.208.246:6783", "83.136.208.48:443", "83.136.209.22:8444", "83.136.210.180:5202" ], "url": [ "ecoferros.com/wp-content/plugins/elementor/core/page-assets/captcha/controller.php", "http://104.255.172.56", "http://163.25.24.44", "http://172.86.89.213", "http://172.86.91.195", "http://23.254.164.92", "http://45.238.25.2" ], "url_path": [ "/4SqSYtx%2B/", "/ABcTDInKWw/", "/EKfP7saoiP/", "/OcMySY5QNkY/", "/OcMySY5QNkY/ABcTDInKWw/4SqSYtx%2B/EKfP7saoiP/", "/OcMySY5QNkY/ABcTDInKWw/4SqSYtx%2B/EKfP7saoiP/BcA%3D%3D", "/update/49890878" ] }, "last_modified": "2026-07-25T13:23:55+00:00", "maltrail_groups": [ "38", "BLUENOROFF" ], "references": [ "https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/", "https://app.any.run/tasks/8d5e66c9-3942-4e00-bfdf-8f2c24054a92/", "https://app.garnet.ai/public/detections/6c823543-6d82-5677-8048-40b38527250a", "https://app.validin.com/detail?find=%3A%3A%22twitter%3Asite%22%3A%3A%22%40zoom%22&type=raw&ref_id=1a212fb7b37#tab=host_pairs (# 2025-07-07)", "https://app.validin.com/detail?find=1d398e3b572e906ecca28cc6fadc0fa6dcb0bd20&type=hash&ref_id=575dd0e9111#tab=host_pairs (# 2025-05-23)", "https://app.validin.com/detail?find=One%20platform%20to%20connect%20%7C%20Zoom&type=raw&ref_id=da1dd79bcfb&os.sortcol=3&res.sortcol=4&res.headers_a=Key&res.headers_a=Type&res.headers_a=Value&res.headers_a=First+Seen&res.headers_a=Last+Seen&atr.sortcol=4&sub.sortcol=0&dns.sortcol=4&dns.headers_a=Key&dns.headers_a=Type&dns.headers_a=Value&dns.headers_a=First+Seen&dns.headers_a=Last+Seen&hp.pagesize=1000&hp.filters.Value.text_search.prefix_match=&hp.filters.Value.text_search.suffix_match=%21.zoom.us%2C%21.zoom.com&hp.filters.Value.text_search.contains=&hp.filters.Type.types.Type_a=TITLE-HOST&hr.sortcol=5&hr.headers_a=Host%2FIP&hr.headers_a=Port&hr.headers_a=Response%2FPath&hr.headers_a=Bytes+Received&hr.headers_a=Title&hr.headers_a=Response+Date&crts.sortcol=4&rdap.sortcol=2&rdap.headers_a=Domain&rdap.headers_a=Registrar&rdap.headers_a=Registered&rdap.headers_a=Expires&rdap.headers_a=Changed&rdap.headers_a=Updated&rdap.headers_a=Count#tab=host_pairs", "https://app.validin.com/detail?find=One%20platform%20to%20connect%20%7C%20Zoom&type=raw&ref_id=ea83c6e2c8d#tab=host_pairs", "https://app.validin.com/detail?type=dom&find=panda95sg.asia#tab=host_pairs_v2", "https://app.validin.com/detail?type=hash&find=23c501daff7991f82a93d94a4f14bd68fb5f61d9#tab=host_pairs (# 2025-06-23)", "https://app.validin.com/detail?type=ip&find=45.61.140.26#tab=resolutions", "https://app.validin.com/detail?type=raw&find=herblin1112%40gmail.com#tab=host_pairs (# 2025-05-20)", "https://app.validin.com/lookalikes?lookback=90&depth=2&find=%2Fus%5B0-9%5D%7B2%7D%5Ba-z%5D%7B3%7D-zoom%5C.%5Ba-z%5D%7B2%2C5%7D%2F (# 2025-06-20)", "https://arcticwolf.com/resources/blog/bluenoroff-uses-clickfix-fileless-powershell-and-ai-generated-zoom-meetings-to-target-web3-sector/", "https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering?e=48754805", "https://community.emergingthreats.net/t/ruleset-update-summary-2022-12-19-v10199/212", "https://community.emergingthreats.net/t/ruleset-update-summary-2023-02-09-v10240/306", "https://community.emergingthreats.net/t/ruleset-update-summary-2023-08-10-v10391/855", "https://community.emergingthreats.net/t/ruleset-update-summary-2023-09-05-v10410/921", "https://community.emergingthreats.net/t/ruleset-update-summary-2023-09-20-v10421/970", "https://content.fireeye.com/apt/rpt-apt38", "https://darkatlas.io/blog/bluenoroff-apt38-live-infrastructure-hunting", "https://fieldeffect.com/blog/zoom-doom-bluenoroff-call-opens-the-door", "https://github.com/hagezi/dns-blocklists/issues/6545", "https://github.com/motuariki/IOCs/blob/main/DPRK%20Tracking/04-12-2025-DPRK-Fake-Meeting-Infrastructure", "https://github.com/rtkwlf/wolf-tools/blob/main/threat-intelligence/bluenoroff-fake-zoom-clickfix/Bluenoroff_Appendix_items.md", "https://huntability.tech/threat-note-2025-04-23-nk-zoom/", "https://otx.alienvault.com/pulse/5bb4bdccd63eeb0a87994870", "https://otx.alienvault.com/pulse/5ef36f8f63a7d8a11972ca54", "https://otx.alienvault.com/pulse/5f74bcb0be4abfe12d93d2bf", "https://otx.alienvault.com/pulse/63ac10d2a4d29d94a7766d7a", "https://radar.securityalliance.org/advisory-on-dprk-unc1069-fake-microsoft-teams-and-zoom-calls/", "https://research.jfrog.com/post/easy-day-js/", "https://securelist.com/bluenoroff-apt-campaigns-ghostcall-and-ghosthire/117842/", "https://securelist.com/bluenoroff-methods-bypass-motw/108383/", "https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/", "https://storage.pardot.com/838563/1676629189Mljyft19/CTI_Advisory_Undetected_North_Korean_Malware_A_Looming_Threat_to_Finan.pdf", "https://twitter.com/C0ryInTheHous3/status/1630551018084737027", "https://twitter.com/C0ryInTheHous3/status/1630991590176030738", "https://twitter.com/C0ryInTheHous3/status/1633897592806408192", "https://twitter.com/C0ryInTheHous3/status/1646159776177324044", "https://twitter.com/C0ryInTheHous3/status/1646161233458999297", "https://twitter.com/C0ryInTheHous3/status/1661075436783259649", "https://twitter.com/C0ryInTheHous3/status/1661076239614918660", "https://twitter.com/C0ryInTheHous3/status/1661756717355483137", "https://twitter.com/C0ryInTheHous3/status/1669422415309418496", "https://twitter.com/KSeznec/status/1678319191110082560", "https://twitter.com/MichalKoczwara/status/1783136320166023648", "https://twitter.com/StopMalvertisin/status/1625402506737250304", "https://twitter.com/StopMalvertisin/status/1625710611425554434", "https://twitter.com/StopMalvertisin/status/1642450636875898880", "https://twitter.com/StopMalvertisin/status/1642450639618973696", "https://twitter.com/TLP_R3D/status/1649147042680172571", "https://twitter.com/TLP_R3D/status/1664980484219084801", "https://twitter.com/TLP_R3D/status/1677617586349981696", "https://twitter.com/TLP_R3D/status/1685581711139102720", "https://twitter.com/TLP_R3D/status/1705211957941240212", "https://twitter.com/_re_fox/status/1232320036834025472", "https://twitter.com/_re_fox/status/1280138335214804995", "https://twitter.com/_re_fox/status/1298281770597654529", "https://twitter.com/behindbreach/status/1287961015506927616", "https://twitter.com/ccxsaber/status/1204007469053165570", "https://twitter.com/craiu/status/1625408594886762496", "https://twitter.com/craiu/status/1625408647508402176", "https://twitter.com/e_kaspersky/status/1481665686351106053", "https://twitter.com/greglesnewich/status/1717963704828915988", "https://twitter.com/k3yp0d/status/1650071119074844673", "https://twitter.com/malwrhunterteam/status/1602997656468754432", "https://twitter.com/philofishal/status/1767951302607151351", "https://twitter.com/souiten/status/1635210162805018624", "https://vblocalhost.com/conference/presentations/unveiling-the-cryptomimic/", "https://vblocalhost.com/uploads/VB2020-18.pdf", "https://vblocalhost.com/uploads/VB2020-Takai-etal.pdf", "https://www.clearskysec.com/wp-content/uploads/2020/06/CryptoCore_Group.pdf", "https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis", "https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/", "https://www.jumpsec.com/guides/inside-a-dprk-bluenoroff-clickfix-kit/", "https://www.kandji.io/blog/todoswift-disguises-malware-download-behind-bitcoin-pdf", "https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/", "https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/", "https://www.ox.security/blog/easy-day-js-supply-chain-attack-hits-mastra-ai-in-npm/", "https://www.proofpoint.com/us/blog/threat-insight/ta444-apt-startup-aimed-at-your-funds", "https://www.sentinelone.com/blog/bluenoroff-how-dprks-macos-rustbucket-seeks-to-evade-analysis-and-detection/", "https://www.sentinelone.com/labs/bluenoroff-hidden-risk-threat-actor-targets-macs-with-fake-crypto-news-and-novel-persistence/", "https://www.sentinelone.com/labs/macos-nimdoor-dprk-threat-actors-target-web3-and-crypto-platforms-with-nim-based-malware/", "https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan", "https://www.validin.com/blog/i_cant_hear_you_unc1069/", "https://www.validin.com/blog/pivots_revisited/#bluenoroff", "https://www.validin.com/blog/zooming_through_bluenoroff_pivots/", "https://www.virustotal.com/gui/file/02fdd3fd9d8f70ab1c3796617296bec8e2b7e3796fd2e2c220ddaa8625081230/detection", "https://www.virustotal.com/gui/file/083f949e4708098b624dca017e2c0294a18e9a581f92baa8348836d7d9ba06c7/detection", "https://www.virustotal.com/gui/file/0be79614938541a4cd85de1b6103f0fdeb3808aaba5856ba5bbd8ef6976cf8c3/detection", "https://www.virustotal.com/gui/file/14aba88b5f87ab9415bbca855d24abc3f151b819302930897e71e2626e823271/detection", "https://www.virustotal.com/gui/file/26e376fc80b090b2ee04e7d3104d308a150e58538580109a74f4ac49bf362423/detection", "https://www.virustotal.com/gui/file/2c0a66c6370b4aa88ab3805d520e868cbc513b43119958257a72c9ff58ef241c/detection", "https://www.virustotal.com/gui/file/2fbd34eed9dbf57a44cf1540941fb43a793be27e13e937299167b2b67cb84d6b/detection", "https://www.virustotal.com/gui/file/3b6f30369a4ee8bf9409d141b6d1b3fb4286c34984b5de005ed7431df549b17e/detection", "https://www.virustotal.com/gui/file/3e4d35903c51db3da8d4bd77491b5c181b7361aaf152609d03a1e2bb86faee43/detection", "https://www.virustotal.com/gui/file/41c83c80fa348d56ccb10fa48114bac52691c9778812547290d13b3214d98e8c/detection", "https://www.virustotal.com/gui/file/4d5efd08e66c394b025a57995a7065fcda45a982a16ded4cdfc4ed42bd142ea5/detection", "https://www.virustotal.com/gui/file/61b56c8c2df374861c8b23e6c555456f34e17e5638ea9965f721c3ffe77f57ca/detection", "https://www.virustotal.com/gui/file/66916b0dfd9956b4b74640a4feb9459ea7986b056b2cecd361e4402d44a445a1/detection", "https://www.virustotal.com/gui/file/755cc133ae0519accbcfdd5f8f0d9fe1aa08cbcb306c3e5f29ebcb6ac12d9323/detection", "https://www.virustotal.com/gui/file/7d2c8ccbbb60dc340811b641abfe2cda4e7e9fc5a4eca1c703d07b86bc1263ba/detection", "https://www.virustotal.com/gui/file/81c4ce82fe26e333a46e8a3d876e35b39725bda0a47f9c37ffc956d37da2d8fa/detection", "https://www.virustotal.com/gui/file/864f2a624a58cf460689d805e271fbffe24266933cc10166f4342e65143e019f/detection", "https://www.virustotal.com/gui/file/8949207761f3d09734aa716da1e6c182425bcde2a95dacb3320085f1fe66069c/detection", "https://www.virustotal.com/gui/file/9135fb9e74bdb39828bfecf7919430062ce482a523999bd7ff1a368038f32371/detection", "https://www.virustotal.com/gui/file/9526d8b337a176a76d960867b281bba06310e3ef58056904591c510e51d90839/detection", "https://www.virustotal.com/gui/file/952d0a1bf4a8e474ad043258e238d47753a5bb8ca138ed79d11e4cbd555d5fec/detection", "https://www.virustotal.com/gui/file/9a778d2b7919717e95072e4dec01c815a5fd81f574b538107652d73d8dc874b6/detection", "https://www.virustotal.com/gui/file/c24bb2b28d322faee5a0162675c0c579a5224149874742acdd0bdf0157359756/detection", "https://www.virustotal.com/gui/file/d235741256f05ad8ceb44c469f4471f17c6a669dbf192e9ccf8d11d99a6800ef/detection", "https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09/detection", "https://www.virustotal.com/gui/file/ed705e5bab5da0f62ddfca9eb3e91ade284355ced3ed0efb366d7c3b892065c6/detection", "https://www.virustotal.com/gui/file/f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd/detection", "https://www.virustotal.com/gui/file/ff8832355ae99ffd66d0fe9eda2d74efdf3ed87bb2a4c215b93ade93165f7c0b/detection", "https://www.virustotal.com/gui/ip-address/104.168.167.88/relations", "https://www.virustotal.com/gui/ip-address/104.168.198.145/relations", "https://www.virustotal.com/gui/ip-address/104.255.172.52/relations", "https://www.virustotal.com/gui/ip-address/134.45.83.95/relations", "https://www.virustotal.com/gui/ip-address/142.11.206.73/relations", "https://www.virustotal.com/gui/ip-address/147.79.103.251/relations", "https://www.virustotal.com/gui/ip-address/172.86.121.198/relations", "https://www.virustotal.com/gui/ip-address/172.93.193.219/relations", "https://www.virustotal.com/gui/ip-address/188.227.196.252/relations", "https://www.virustotal.com/gui/ip-address/188.227.197.32/relations", "https://www.virustotal.com/gui/ip-address/191.96.235.88/relations", "https://www.virustotal.com/gui/ip-address/192.119.64.43/relations", "https://www.virustotal.com/gui/ip-address/192.64.119.54/relations", "https://www.virustotal.com/gui/ip-address/216.107.136.11/relations", "https://www.virustotal.com/gui/ip-address/23.254.204.173/relations", "https://www.virustotal.com/gui/ip-address/23.254.226.83/relations", "https://www.virustotal.com/gui/ip-address/23.254.253.75/relations", "https://www.virustotal.com/gui/ip-address/45.61.157.78/relations", "https://www.virustotal.com/gui/ip-address/5.230.44.79/relations", "https://www.virustotal.com/gui/ip-address/83.136.210.87/relations", "https://x.com/AlvieriD/status/1938253401868976404", "https://x.com/Cyberteam008/status/1826585708376850744", "https://x.com/Cyberteam008/status/2040979630480638398", "https://x.com/IstaPee/status/1935788234468213130", "https://x.com/JRehbergCSK/status/1877800515871936822", "https://x.com/JohnHultquist/status/2020952923082195374", "https://x.com/L0Psec/status/2014100649391137165", "https://x.com/L0Psec/status/2014695975789691342", "https://x.com/L0Psec/status/2019773636647768330", "https://x.com/L0Psec/status/2034379795635548484", "https://x.com/L0Psec/status/2036815031283671284", "https://x.com/L0Psec/status/2052143672204906568", "https://x.com/LabsSentinel/status/1854550940243702083", "https://x.com/Merlax_/status/2044597897853825158", "https://x.com/StrikeReadyLabs/status/1834588185835286571", "https://x.com/TLP_R3D/status/1665014879151960065", "https://x.com/TLP_R3D/status/1826545317229015078", "https://x.com/TLP_R3D/status/1935782157454078277", "https://x.com/TLP_R3D/status/1935782161757749475", "https://x.com/TMJ0x/status/2014582284125421571", "https://x.com/ValidinLLC/status/1937089880439329047", "https://x.com/ValidinLLC/status/1943648048401244489", "https://x.com/_SEAL_Org/status/2040974920973197511", "https://x.com/_SEAL_Org/status/2041289021503005128", "https://x.com/_SEAL_Org/status/2041673724764569896", "https://x.com/_SEAL_Org/status/2041926956183076951", "https://x.com/birchb0y/status/1935436678602055682", "https://x.com/cosmonaut_joon/status/1879435681547858086", "https://x.com/cyberoverdrive/status/1879616942040125648", "https://x.com/malwrhunterteam/status/1992990780521124298", "https://x.com/malwrhunterteam/status/1992991375604781075", "https://x.com/malwrhunterteam/status/2014611676042039493", "https://x.com/malwrhunterteam/status/2070495990524621096", "https://x.com/moonlock_lab/status/1996304740410347890", "https://x.com/moonlock_lab/status/1996305744598110500", "https://x.com/moonlock_lab/status/2015857322963173657", "https://x.com/ramimacisabird/status/2038813850179449156", "https://x.com/silentpush/status/2021453755808731140", "https://x.com/tayvano_/status/1879611039953924592" ], "related": [ { "evidence": [ { "detail": "56 shared indicators", "kind": "infrastructure", "weight": 56.0 }, { "detail": "2 reports cite both", "kind": "reporting", "weight": 2.0 }, { "detail": "shares ECCENTRICBANDWAGON, HOPLIGHT", "kind": "software", "weight": 1.0 } ], "slug": "G0032" }, { "evidence": [ { "detail": "2 shared indicators", "kind": "infrastructure", "weight": 2.0 } ], "slug": "G0040" }, { "evidence": [ { "detail": "1 shared indicator", "kind": "infrastructure", "weight": 1.0 } ], "slug": "UNCLASSIFIED" }, { "evidence": [ { "detail": "shares KillDisk", "kind": "software", "weight": 0.5 } ], "slug": "G0034" }, { "evidence": [ { "detail": "shares DarkComet", "kind": "software", "weight": 0.5 } ], "slug": "G0134" } ], "slug": "G0082", "timeline": [ { "counts": { "domain": 320, "ipv4": 2, "url": 1 }, "first_seen": "2026-07-25", "indicators": { "domain": [ "02io.us", "02us.sbs", "02usweb.sbs", "02web.sbs", "02web.zoom.02webus.sbs", "02webus.sbs", "02webus.zoom.02us.sbs", "02webus.zoom.web02.sbs", "03app.live", "03app.sbs", "04web.sbs", "05ie.live", "05in.one", "05live.biz", "05live.co", "05live.live", "05live.sbs", "05live.xyz", "05meet.am.in", "05meet.click", "05meet.co", "05meet.live", "05meet.sbs", "05meetus.web05.uk", "05us.live", "05us.sbs", "05us.zoom.05webus.sbs", "05us.zoom.web05.sbs", "05webus.sbs", "06eu.us", "06in.us", "06ln.live", "06on.us", "06us.live", "06us.sbs", "06us.us", "06us.zoom.web06.eu", "06us.zoom.web06.sbs", "06usweb.zoom.us06.sbs", "06web.us06.in", "06web.zoomconnect.io", "06web.zoomlink.studio", "06webin.us", "1ives.co", "adteam.am.in", "ai02n.sbs", "ain01.sbs", "app06zoom.meet06us.net", "apple.cdsventure.xyz", "apps.teamms.live", "biemflow.com", "cdsventure.xyz", "cloud.inteam.live", "desk-live.com", "desk.weventure.capital", "desktop.03app.sbs", "e01i.co", "eu.web03us.sbs", "eu.web06.us", "eu.zoom.04web.sbs", "eu02.us", "eu06.in", "eu06.us", "eu06web.app", "eu07webin.co", "euhub.ue06.us", "global-chat.live", "health.weventure.capital", "hotter.weventure.capital", "i06sn.co", "in06.us", "inteam.live", "iu03e.live", "live-chat.live", "live-com.xyz", "live-meet.app", "live-workplace.com", "live.am.in", "live.desk-live.com", "live.miclesoft.com", "live.micrrosfts.com", "live.micrxsoft.com", "live.teamms-com.xyz", "live.teamsbrowser.com", "live.workplace.teams-com.live", "live02.co", "liveam.video", "livecall.team", "liveconference.eu06.us", "livemicrosft.center", "lives-com.com", "lives.microrrsoft.com", "lives.microsft02.com", "lives.microsoft-desk.com", "lives.ms.teams02.co", "lives.team-global.live", "lives.teamicrosoft.sbs", "lives.teamms.global-chat.live", "lives.teams-app.pro", "lives.teams-desk.live", "lives.teams-workplace.live", "lives.teams02.com", "lives.teams03.com", "lives.teamstunnel.com", "lives02.com", "lives02.run", "lives05.com", "lives06.com", "lives07.com", "livesmicrosft.com", "lzlovewxx.store", "macro.teams.live02.co", "meet.teamicro.live", "meet.zoom.05live.live", "meet06.live", "meet06.us", "meet06us.net", "meetapp.room.ain01.sbs", "meetsdk.online", "miclesoft.com", "micro.com.in", "microcome.com", "microrrsoft.com", "microsft02.com", "microsoft-desk.com", "microsoft-workspace.live", "microsoft.asn.lv", "microsoft.lives02.run", "microsofteam.app", "microsofts.live-workplace.com", "microsorft.live.desk-live.com", "microssoft.live", "microssoft.live-chat.live", "microteam.live", "microvsoft.com", "micrrosfts.com", "micrxsoft.com", "ms.teams02.co", "ms06teams.live-meet.app", "msmeet.in", "msmeet.teamlv.vip", "n04i.one", "net.on05.eu", "on05.eu", "on06.us", "onteam.business.in", "premium.03app.live", "room.ain01.sbs", "room.in06.us", "secure.inteam.live", "syncroom.u06h.lat", "table1.cdsventure.xyz", "team-global.live", "team.asn.lv", "team.micro.com.in", "team.msmeet.in", "team.weblink.contact", "teamapp.live", "teames.lives-com.com", "teamicro.live", "teamicrosoft.sbs", "teamlive.vip", "teamlv.us", "teamlv.vip", "teamms-com.xyz", "teamms.global-chat.live", "teamms.live", "teamms.live-com.xyz", "teamms.live.miclesoft.com", "teamms.microcome.com", "teamms.microssoft.live", "teams-app.liveam.video", "teams-app.pro", "teams-com.live", "teams-desk.live", "teams-workplace.live", "teams.1ives.co", "teams.live.am.in", "teams.live.miclesoft.com", "teams.live02.co", "teams.lives02.com", "teams.microsoft.lives02.run", "teams.microsofts.live-workplace.com", "teams.web.lives06.com", "teams02.co", "teams02.com", "teams02.lives05.com", "teams03.com", "teams05web.lives07.com", "teams07.lives07.com", "teams07.web07microsoft.live", "teams08.run", "teamsbrowser.com", "teamstunnel.com", "u06h.lat", "u07ei.biz", "ue05.us", "ue06.us", "uk06.zoom.eu06web.app", "us-05.in", "us.meet06.live", "us.web.06zoom.us", "us.zoom.02usweb.sbs", "us.zoom.06web.us", "us.zoom.06webin.us", "us01webinar.zoom.e01i.co", "us02.sbs", "us02.zoomin.web02eu.live", "us04meet.web04.sbs", "us04web.zoom04web.run", "us05.eu", "us05.zoom.web05.uk", "us06.in", "us06.sbs", "us06web.zoom.06us.sbs", "usewebin.room.in06.us", "usezoom.net.on05.eu", "usezoom.webin.n04i.one", "usezoomin.06in.us", "ushub.syncroom.u06h.lat", "usinroomweeb.i06sn.co", "usweb.eu02.us", "usweb.zoom.02io.us", "usweb.zoom.05meet.sbs", "usweb.zoom.05us.live", "usweb.zoom.05us.sbs", "usweb.zoom.06ln.live", "usweb.zoom.06us.live", "usweb.zoom.us02.sbs", "usweb06.zoom.meet06.us", "uswebr.zoomin.on06.us", "uszoom.web.05live.sbs", "uszoom.web.eu06.in", "uszoomhub.iu03e.live", "uszoomsweb.ue05.us", "vcallsdk.online", "web-teams.microvsoft.com", "web.05ie.live", "web.05live.sbs", "web.05live.xyz", "web.06us.us", "web.06zoom.us", "web.eu06.in", "web.lives06.com", "web.zoomapp.05meet.am.in", "web.zoomapp.05meet.live", "web02.sbs", "web02us.zoom.02io.us", "web03us.sbs", "web04.sbs", "web05.sbs", "web05.uk", "web05.zoom.us-05.in", "web06.eu", "web06.sbs", "web07microsoft.live", "web08.teams08.run", "webapp.zoom.05live.co", "webin.n04i.one", "webinaroom.05in.one", "webine.zoom.eu07webin.co", "weblink.contact", "webmeet.zoom.05live.biz", "webus.zoom.02web.sbs", "webus.zoom.05live.us", "webus.zoom.05meet.co", "workflowin.sbs", "workplace.teams-com.live", "zmtest.weventure.capital", "zoom.02io.us", "zoom.02us.sbs", "zoom.02usweb.sbs", "zoom.02web.sbs", "zoom.02webus.sbs", "zoom.05live.biz", "zoom.05live.co", "zoom.05live.live", "zoom.05live.us", "zoom.05meet.click", "zoom.05meet.co", "zoom.05meet.sbs", "zoom.05us.live", "zoom.05us.sbs", "zoom.05webus.sbs", "zoom.06ln.live", "zoom.06us.live", "zoom.06us.sbs", "zoom.06web.us", "zoom.06web.us06.in", "zoom.06webin.us", "zoom.desktop.03app.sbs", "zoom.e01i.co", "zoom.eu07webin.co", "zoom.meet06.us", "zoom.premium.03app.live", "zoom.us-05.in", "zoom.us.meet06.live", "zoom.us02.sbs", "zoom.us06.sbs", "zoom.web.06us.us", "zoom.web02.sbs", "zoom.web05.sbs", "zoom.web05.uk", "zoom.web06.eu", "zoom.web06.sbs", "zoom01us.workflowin.sbs", "zoom04web.run", "zoomapp.05meet.am.in", "zoomapp.05meet.live", "zoomapp.web.05ie.live", "zoomapp.web.05live.xyz", "zoomconnect.io", "zoomeuweb.u07ei.biz", "zoomin.on06.us", "zoomin.web02eu.live", "zoomlink.studio", "zoomus.eu.web03us.sbs", "zoomuseb.ai02n.sbs", "zoomweb.06eu.us", "zoomwebinar.06on.us" ], "ipv4": [ "45.61.163.100:8090", "45.61.163.100:8888" ], "url": [ "http://172.86.89.213" ] }, "precision": "exact", "references": [ "https://www.jumpsec.com/guides/inside-a-dprk-bluenoroff-clickfix-kit/" ], "total": 323 }, { "counts": { "ipv4": 2 }, "first_seen": "2026-07-16", "indicators": { "ipv4": [ "144.172.116.143:3000", "45.61.148.134:3000" ] }, "precision": "exact", "references": [ "https://www.validin.com/blog/i_cant_hear_you_unc1069/" ], "total": 2 }, { "counts": { "domain": 40, "ipv4": 12, "url": 1, "url_path": 1 }, "first_seen": "2026-07-15", "indicators": { "domain": [ "app.us07webzoom.com", "busyqaz.com", "callnrwise.com", "cloudmeet.works", "freetalks.work", "greenweb.ink", "hwsrv-1320779.hostwindsdns.com", "interweb.work", "linecall.app", "lzfvefl.com", "mail.teamsliues.com", "maskasd.com", "msweblive.us", "netface.live", "onwebcall.us", "onweblive.org", "onwebmeet.us", "sfrclak.com", "skyweb.work", "stalelive.us", "teams.cloudmeet.works", "teams.freetalks.work", "teams.greenweb.ink", "teams.interweb.work", "teams.linecall.app", "teams.msweblive.us", "teams.netface.live", "teams.onwebcall.us", "teams.onweblive.org", "teams.onwebmeet.us", "teams.skyweb.work", "teams.stalelive.us", "teams.webtalk.work", "teamsliues.com", "us02web.zoomweb.org", "us05.webzoom.work", "us07webzoom.com", "webtalk.work", "webzoom.work", "zoomweb.org" ], "ipv4": [ "142.11.196.106:8000", "142.11.196.106:8080", "142.11.206.73:8000", "23.254.164.123:443", "23.254.164.61:8000", "23.254.164.61:9000", "23.254.164.92:443", "23.254.164.92:8000", "23.254.164.92:9000", "23.254.167.216:8000", "23.254.203.244:8000", "23.254.203.244:9000" ], "url": [ "http://23.254.164.92" ], "url_path": [ "/update/49890878" ] }, "precision": "exact", "references": [ "https://x.com/ramimacisabird/status/2038813850179449156", "https://app.garnet.ai/public/detections/6c823543-6d82-5677-8048-40b38527250a", "https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan", "https://research.jfrog.com/post/easy-day-js/", "https://www.ox.security/blog/easy-day-js-supply-chain-attack-hits-mastra-ai-in-npm/", "https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/", "https://www.virustotal.com/gui/ip-address/142.11.206.73/relations", "https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09/detection", "https://www.virustotal.com/gui/file/f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd/detection" ], "total": 54 }, { "counts": { "domain": 5 }, "first_seen": "2026-06-27", "indicators": { "domain": [ "googlemeet.syncn.cfd", "onedrive.syncn.cfd", "syncn.cfd", "us06web-zoom.syncn.cfd", "us06zoom.syncn.cfd" ] }, "precision": "exact", "references": [ "https://x.com/malwrhunterteam/status/2070495990524621096" ], "total": 5 }, { "counts": { "domain": 2 }, "first_seen": "2026-06-07", "indicators": { "domain": [ "addressstore.space", "api.addressstore.space" ] }, "precision": "exact", "references": [ "https://x.com/birchb0y/status/1935436678602055682", "https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2026-05-07", "indicators": { "domain": [ "woodcastpro.com" ] }, "precision": "exact", "references": [ "https://x.com/L0Psec/status/2052143672204906568", "https://www.virustotal.com/gui/file/d235741256f05ad8ceb44c469f4471f17c6a669dbf192e9ccf8d11d99a6800ef/detection" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2026-05-01", "indicators": { "domain": [ "thriddata.com" ] }, "precision": "exact", "references": [ "https://x.com/ValidinLLC/status/1943648048401244489", "https://www.validin.com/blog/zooming_through_bluenoroff_pivots/", "https://arcticwolf.com/resources/blog/bluenoroff-uses-clickfix-fileless-powershell-and-ai-generated-zoom-meetings-to-target-web3-sector/", "https://github.com/rtkwlf/wolf-tools/blob/main/threat-intelligence/bluenoroff-fake-zoom-clickfix/Bluenoroff_Appendix_items.md", "https://www.virustotal.com/gui/ip-address/147.79.103.251/relations" ], "total": 1 }, { "counts": { "domain": 1, "ipv4": 2, "url": 1 }, "first_seen": "2026-04-21", "indicators": { "domain": [ "livemicrosft.com" ], "ipv4": [ "144.172.114.220:443", "172.86.91.195:443" ], "url": [ "http://172.86.91.195" ] }, "precision": "exact", "references": [ "https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/" ], "total": 4 }, { "counts": { "domain": 14, "ipv4": 4 }, "first_seen": "2026-04-20", "indicators": { "domain": [ "02webzoom.us", "us-meet.com", "web02teams.com", "web04meet.top", "web04zoom.us", "web07zoom.us", "web12teams.com", "web21zoom.com", "web2meet.net", "web3meet.live", "web3meet.xyz", "web3zoom.xyz", "web71meet.shop", "web86meet.shop" ], "ipv4": [ "109.248.163.127:3000", "139.150.73.123:3000", "38.110.228.52:3000", "59.152.103.205:3000" ] }, "precision": "exact", "references": [ "https://www.validin.com/blog/i_cant_hear_you_unc1069/" ], "total": 18 }, { "counts": { "domain": 52 }, "first_seen": "2026-04-17", "indicators": { "domain": [ "g-call.net", "g-call.net.wildnextcard.com", "gmeet1.xyz", "googe-video-call.xyz", "google-meet-live.com", "google-meet.joins-video-call.com", "google-meet.video-call-now.live", "google-meets-view.7-vs.com", "google-meets.2mydns.net", "google.meet21web.com", "gooqle-meet-live.my.id", "gooqle-meet-lives.f-a1.com", "gooqle-meet-lives.my.id", "gooqle-meet-lives.s-41.com", "gooqle-meet-online.com", "gooqle-meet-online.com.wildnextcard.com", "gooqle-meet.my.id", "gooqle-view.com", "invite-meet-call.com", "invite-meet-call.com.wildnextcard.com", "joins-video-call.com", "live-call.net", "live-call.net.wildnextcard.com", "live-video-call.me", "live-video-call.me.panelize.cloud", "livemeetgooogle.com", "meet-call.com", "meet-call.com.wildnextcard.com", "meet-google.app", "meet-google.me.myprocloud.online", "meet-live.me", "meet-live.me.wildnextcard.com", "meet-video-chat.online", "meet-video-chat.online.wildnextcard.com", "meet.gmeet1.xyz", "meet.gooqle-view.com", "meet.video-livechat.com", "meet21web.com", "meetingnow-goo-gle.com", "minhhieu.xyz", "mymeetgoogle.com", "mymeetgooogle.com", "mymeetinglive.com", "mymeetingnow.com", "mymeetingtoday.com", "mymeetlive.com", "node.minhhieu.xyz", "tele-app.minhhieu.xyz", "usdxchange.org", "video-call-now.live", "video-call.0-1h.com", "video-livechat.com" ] }, "precision": "exact", "references": [ "https://x.com/Cyberteam008/status/2040979630480638398", "https://x.com/Merlax_/status/2044597897853825158" ], "total": 52 }, { "counts": { "domain": 1, "ipv4": 5 }, "first_seen": "2026-04-17", "indicators": { "domain": [ "check02id.com" ], "ipv4": [ "104.145.210.107:6783", "83.136.208.246:6783", "83.136.208.48:443", "83.136.209.22:8444", "83.136.210.180:5202" ] }, "precision": "exact", "references": [ "https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/" ], "total": 6 }, { "counts": { "domain": 83, "ipv4": 2 }, "first_seen": "2026-04-14", "indicators": { "domain": [ "02euweb.us", "02room.us", "02web-zoom.us", "05meet.us", "05uk.us", "05ukweb.uk", "05usweb.zoom.meet-05.sbs", "05web.us", "05webus.meet.05uk.us", "07-web.us", "07web.zoom.uk07.pro", "07webus.zoom.us07.sbs", "app.zm-web.uno", "cdsx.capital", "dengmt.us", "dentmt.us", "eu.web02meet.com", "godlike-visit.online", "gogoschip.online", "google.us-meet.com", "inteams.us", "meet-05.sbs", "meet-app.cc", "meet-web.us", "meet-web3.eu", "meet.05uk.us", "meet.app.zm-web.uno", "meet05.sbs", "meetingapp.us", "megabitcapital.com", "microsmeet.xyz", "premium-business.live", "teams.web-lives.com", "teamsupport.live", "uk07.pro", "uk07.us", "update-teams.live", "us.web02meet.com", "us02.us", "us02web.zoom.us02.us", "us03.meet-web.us", "us03.zoom.meet-web.us", "us05.sbs", "us05.us", "us05.web.meet05.sbs", "us05.zoom.web04.us", "us05web.zoom.us05.us", "us05zoom.meet-web3.eu", "us07.sbs", "us07zoom.meetingapp.us", "usweb.02room.us", "usweb.05meet.us", "usweb.07-web.us", "usweb.zoom.us05.sbs", "usweb05.us", "walleyeventure.xyz", "web-lives.com", "web.meet05.sbs", "web02meet.com", "web04.us", "web05meet.us", "web07.premium-business.live", "web07.zoom.meet-app.cc", "web07us.uk07.us", "weventure.capital", "zm-web.uno", "zoom-web07.meet-app.cc", "zoom.02euweb.us", "zoom.05ukweb.uk", "zoom.05web.us", "zoom.meet-05.sbs", "zoom.meet-app.cc", "zoom.meet-web.us", "zoom.uk07.pro", "zoom.us02.us", "zoom.us05.sbs", "zoom.us05.us", "zoom.us07.sbs", "zoom.usweb.05meet.us", "zoom.web02meet.com", "zoom.web04.us", "zoom.web05meet.us", "zoom.web07.premium-business.live" ], "ipv4": [ "45.61.129.29:3000", "45.61.157.248:3000" ] }, "precision": "exact", "references": [ "https://www.validin.com/blog/i_cant_hear_you_unc1069/" ], "total": 85 }, { "counts": { "domain": 147 }, "first_seen": "2026-04-08", "indicators": { "domain": [ "annaelsa.xyz", "callshere.com", "dencall.xyz", "inmsed.com", "join-uk.com", "lievec.com", "liivoe.com", "linelive.us", "liue.us", "liues.us", "liuesus.com", "liueus.com", "live-meet.online", "livehuddle01.us", "livescall.us", "livescall.xyz", "livesmeet.us", "livesmeets.us", "micrlive.online", "microb.click", "microc.click", "microca11.com", "microcal1.com", "microcall.us", "microcodf.com", "microcoll.com", "microe.click", "microg.click", "microh.click", "microi.click", "micromeet.us", "microp.click", "micror.click", "microsall.com", "microscalls.com", "microschats.com", "microsdb.com", "microselt.com", "microshen.com", "microshlop.com", "microsinfos.com", "microsmeet.com", "microsomeet.com", "microsout.com", "microsslcheck.com", "microszlt.com", "microt.click", "micstmeet.com", "ms-live.site", "ms-live.team", "ms-meet.xyz", "ms-meeting.us", "ms-meets.us.com", "ms-meets.xyz", "ms-teams.xyz", "mslivecall.com", "mslivecall.us", "mslivemeet.com", "msmeet.us", "msquickcall.com", "msteamcall.com", "nicrosofm.com", "nicrosolf.com", "nicrosolt.com", "nisrosodf.com", "olafsven.xyz", "oneasu.com", "onlivecall.com", "onmsed.com", "onreallive.com", "os-live.com", "os-live.online", "os-live.us", "os-live.xyz", "outms.com", "premuims.live", "reallivecall.us", "renaworkshard.xyz", "teams-us.live", "teamsiiwe.com", "teamslivc.com", "teamsliveo.com", "teamslivex.com", "teamslivos.com", "teamslivs.com", "teamsliwe.com", "teamsync.live", "teemsliivc.com", "teemslive.com", "teemslivo.com", "uae04webzoom.us", "uc01web.us", "uc02web.us", "uc02websoom.us", "uc03web.us", "uc04web.us", "uc05websoom.us", "uc06web.us", "uco4webzoom.us", "uco5webzoom.us", "uco6webzoom.us", "ucweb05.us", "ue01web.us", "ue02web.us", "ue03web.us", "ue04web.us", "ue06web.us", "ueo4webzoom.us", "un01web.us", "uo01web.us", "uo05web.us", "us02websoom.us", "us03live.com", "us03websoom.us", "us03webuoom.us", "us05web.site", "us05websoom.us", "us05webszoom.us", "us05webxoom.us", "us06websoom.us", "us07web.me", "us0lwebzoom.us", "usa04webzoom.us", "usa06webzoom.us", "use05webzoom.us", "uso04webzoom.us", "uso05webzoom.us", "uso06webzoom.us", "uso4web.us", "usobweb.us", "usweb0b.us", "usweb0l.us", "uswebob.com", "uswebob.us", "ux01web.us", "ux02web.us", "ux03web.us", "uz01web.us", "uz03web.us", "web-meet.live", "web-zoom.uk", "web05us.online", "web22n.us", "ww-live.us", "ww-live.xyz", "www-live.us", "www-live.xyz" ] }, "precision": "exact", "references": [ "https://radar.securityalliance.org/advisory-on-dprk-unc1069-fake-microsoft-teams-and-zoom-calls/" ], "total": 147 }, { "counts": { "domain": 17 }, "first_seen": "2026-04-08", "indicators": { "domain": [ "32.ww-live.online", "3f.teams-meet.xyz", "5q.ms-meets.online", "live-us.com", "micrusoft.us", "ms-meets.online", "ms-teams.live", "ms-teams.us.com", "rd.ww-live.uk", "teams-live.com.co", "teams-meet.online", "teams-meet.us.com", "teams-meet.xyz", "tu.live-us.com", "ww-live.com", "ww-live.online", "ww-live.uk" ] }, "precision": "exact", "references": [ "https://x.com/_SEAL_Org/status/2041673724764569896", "https://www.virustotal.com/gui/ip-address/83.136.210.87/relations" ], "total": 17 }, { "counts": { "domain": 2 }, "first_seen": "2026-04-08", "indicators": { "domain": [ "live05ms.us", "miscruft.us" ] }, "precision": "exact", "references": [ "https://x.com/_SEAL_Org/status/2041926956183076951" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2026-04-07", "indicators": { "domain": [ "uk05live.us" ] }, "precision": "exact", "references": [ "https://x.com/_SEAL_Org/status/2040974920973197511", "https://x.com/_SEAL_Org/status/2041289021503005128" ], "total": 1 }, { "counts": { "domain": 60 }, "first_seen": "2026-04-06", "indicators": { "domain": [ "06ukweb.uk", "06usweb.us", "07usweb.site", "account-googlemeet.com", "bycomsender.publicvm.com", "ccx.capital", "chaincapx.com", "chainverve.com", "coinairbit.com", "config-update.online", "config-update.site", "databox.linkpc.net", "databoxes.linkpc.net", "ddrive.publicvm.com", "drivebox.publicvm.com", "driveboxitem.publicvm.com", "gassist.publicvm.com", "gassists.run.place", "gdrive.sharemailcontents.com", "gdriveemail.publicvm.com", "gdriveshare.publicvm.com", "gmeet-private.com", "goog1e.us-meet.com", "googie.us-gmeet.com", "googie.us-meet.com", "google-meeting.com", "googlemeet-account.com", "googlemeett.com", "lodashmap.online", "managedoc.us", "meejgoogle.com", "meelgoogle.com", "meet-googie.com", "meet-google.me", "meet-google.me.proxnginx.com", "meet-google.ru", "meet-qoogle.com", "meet-video-call.com", "meet.coinairbit.com", "meet.play-goog1es.com", "meetgoogje.com", "meetgooglc.com", "meeting-chat.com", "meets-qoogle.com", "meettgoogle.com", "play-goog1es.com", "sendcontents.linkpc.net", "sharemailcontents.publicvm.com", "solidbitcapital.xyz", "video-chat-live.one", "video-chat-live.online", "video-chat-live.online.devto.cloud", "videocall.bloomup.app", "w3bitcapital.com", "walleyecapital.org", "walleyecapital.xyz", "walleyevc.capital", "zoom.06ukweb.uk", "zoom.06usweb.us", "zoom.07usweb.site" ] }, "precision": "exact", "references": [ "https://x.com/Cyberteam008/status/2040979630480638398", "https://x.com/Merlax_/status/2044597897853825158" ], "total": 60 }, { "counts": { "domain": 4 }, "first_seen": "2026-04-06", "indicators": { "domain": [ "microscell.com", "onlivemeet.com", "teams.microscell.com", "teams.onlivemeet.com" ] }, "precision": "exact", "references": [ "https://x.com/_SEAL_Org/status/2040974920973197511", "https://x.com/_SEAL_Org/status/2041289021503005128" ], "total": 4 }, { "counts": { "domain": 1 }, "first_seen": "2026-03-25", "indicators": { "domain": [ "calltan.com" ] }, "precision": "exact", "references": [ "https://x.com/L0Psec/status/2036815031283671284", "https://www.virustotal.com/gui/file/02fdd3fd9d8f70ab1c3796617296bec8e2b7e3796fd2e2c220ddaa8625081230/detection", "https://www.virustotal.com/gui/file/7d2c8ccbbb60dc340811b641abfe2cda4e7e9fc5a4eca1c703d07b86bc1263ba/detection" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2026-03-25", "indicators": { "domain": [ "bluyy.com" ] }, "precision": "exact", "references": [ "https://fieldeffect.com/blog/zoom-doom-bluenoroff-call-opens-the-door", "https://www.virustotal.com/gui/ip-address/191.96.235.88/relations" ], "total": 1 }, { "counts": { "url": 1 }, "first_seen": "2026-03-19", "indicators": { "url": [ "ecoferros.com/wp-content/plugins/elementor/core/page-assets/captcha/controller.php" ] }, "precision": "exact", "references": [ "https://x.com/L0Psec/status/2034379795635548484", "https://www.virustotal.com/gui/file/61b56c8c2df374861c8b23e6c555456f34e17e5638ea9965f721c3ffe77f57ca/detection", "https://www.virustotal.com/gui/file/9526d8b337a176a76d960867b281bba06310e3ef58056904591c510e51d90839/detection" ], "total": 1 }, { "counts": { "domain": 2 }, "first_seen": "2026-02-26", "indicators": { "domain": [ "us004zoom.us", "us005zoom.us" ] }, "precision": "exact", "references": [ "https://x.com/malwrhunterteam/status/1992990780521124298", "https://x.com/malwrhunterteam/status/1992991375604781075", "https://www.virustotal.com/gui/file/9135fb9e74bdb39828bfecf7919430062ce482a523999bd7ff1a368038f32371/detection", "https://www.virustotal.com/gui/file/ed705e5bab5da0f62ddfca9eb3e91ade284355ced3ed0efb366d7c3b892065c6/detection" ], "total": 2 }, { "counts": { "domain": 113 }, "first_seen": "2026-02-23", "indicators": { "domain": [ "ca05web.com", "us02webs.us", "us04webs.us", "us05webs.com", "us06webs.us", "us07webs.us", "us08webs.us", "us15web.com", "us15webs.us", "us25webs.us", "us55web.com", "us95webs.us", "zoom.ca05web.com", "zoom.ua03webzoom.us", "zoom.ua04webzoom.us", "zoom.ua06webzoom.us", "zoom.uc01webzoom.us", "zoom.uc03webzoom.us", "zoom.uc06webzoom.us", "zoom.ui01webzoom.us", "zoom.ui02webzoom.us", "zoom.ui03webzoom.us", "zoom.ui04webzoom.us", "zoom.ui05webzoom.us", "zoom.ui06webzoom.us", "zoom.ui07webzoom.us", "zoom.um03webzoom.us", "zoom.un01webzoom.us", "zoom.un03webzoom.us", "zoom.un05webzoom.us", "zoom.un06webzoom.us", "zoom.uo01webzoom.us", "zoom.uo02webzoom.us", "zoom.uo03webzoom.us", "zoom.uo04webzoom.us", "zoom.uo05webzoom.us", "zoom.uo06webzoom.us", "zoom.uq01webzoom.us", "zoom.uq02webzoom.us", "zoom.uq03webzoom.us", "zoom.uq05webzoom.us", "zoom.uq06webzoom.us", "zoom.uq08webzoom.us", "zoom.ur01webzoom.us", "zoom.ur02webzoom.us", "zoom.ur03webzoom.us", "zoom.ur04webzoom.us", "zoom.ur06webzoom.us", "zoom.us005webzoom.us", "zoom.us01webzoom.us", "zoom.us02webs.us", "zoom.us02webzoom.us", "zoom.us04webs.us", "zoom.us04webzoom.us", "zoom.us05webs.com", "zoom.us05webzoom.us", "zoom.us06webs.us", "zoom.us06webzoom.us", "zoom.us07webs.us", "zoom.us07webzoom.us", "zoom.us08webs.us", "zoom.us09webzoom.us", "zoom.us15web.com", "zoom.us15webs.us", "zoom.us16webzoom.us", "zoom.us22webzoom.us", "zoom.us25webs.us", "zoom.us29webzoom.us", "zoom.us30webzoom.us", "zoom.us31webzoom.us", "zoom.us41webzoom.us", "zoom.us52webzoom.us", "zoom.us54webzoom.us", "zoom.us55web.com", "zoom.us57webzoom.us", "zoom.us72webzoom.us", "zoom.us81webzoom.us", "zoom.us95webs.us", "zoom.usa01webzoom.us", "zoom.usa02webzoom.us", "zoom.usa05webzoom.us", "zoom.uso1webzoom.us", "zoom.uso3webzoom.us", "zoom.uso7webzoom.us", "zoom.ut01webzoom.us", "zoom.ut02webzoom.us", "zoom.ut03webzoom.us", "zoom.ut04webzoom.us", "zoom.ut05webzoom.us", "zoom.ut06webzoom.us", "zoom.uu01webzoom.us", "zoom.uu02webzoom.us", "zoom.uu03webzoom.us", "zoom.uv01webzoom.us", "zoom.uv02webzoom.us", "zoom.uv03webzoom.us", "zoom.uv04webzoom.us", "zoom.uv05webzoom.us", "zoom.uv06webzoom.us", "zoom.uv07webzoom.us", "zoom.uw01webzoom.us", "zoom.uw02webzoom.us", "zoom.uw03webzoom.us", "zoom.uw04webzoom.us", "zoom.uw05webzoom.us", "zoom.uw06webzoom.us", "zoom.ux01webzoom.us", "zoom.ux03webzoom.us", "zoom.ux06webzoom.us", "zoom.uy01webzoom.us", "zoom.uy02webzoom.us", "zoom.uy04webzoom.us", "zoom.uz03webzoom.us" ] }, "precision": "exact", "references": [ "https://x.com/TMJ0x/status/2014582284125421571", "https://www.virustotal.com/gui/ip-address/188.227.196.252/relations", "https://www.virustotal.com/gui/ip-address/188.227.197.32/relations" ], "total": 113 }, { "counts": { "domain": 2 }, "first_seen": "2026-02-11", "indicators": { "domain": [ "build-dream.com", "sendbrevo.com" ] }, "precision": "exact", "references": [ "https://x.com/JohnHultquist/status/2020952923082195374", "https://x.com/silentpush/status/2021453755808731140", "https://www.virustotal.com/gui/ip-address/134.45.83.95/relations", "https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering?e=48754805" ], "total": 2 }, { "counts": { "domain": 5 }, "first_seen": "2026-02-10", "indicators": { "domain": [ "breakdream.com", "cmailer.pro", "dreamdie.com", "supportzm.com", "zmsupport.com" ] }, "precision": "exact", "references": [ "https://x.com/JohnHultquist/status/2020952923082195374", "https://x.com/silentpush/status/2021453755808731140", "https://www.virustotal.com/gui/ip-address/134.45.83.95/relations", "https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering?e=48754805" ], "total": 5 }, { "counts": { "domain": 4 }, "first_seen": "2026-02-06", "indicators": { "domain": [ "prvservice.com", "sevrrhst.com", "stomcs.com", "tattomc.com" ] }, "precision": "exact", "references": [ "https://x.com/malwrhunterteam/status/2014611676042039493", "https://x.com/L0Psec/status/2014695975789691342", "https://x.com/L0Psec/status/2019773636647768330", "https://www.virustotal.com/gui/file/952d0a1bf4a8e474ad043258e238d47753a5bb8ca138ed79d11e4cbd555d5fec/detection", "https://www.virustotal.com/gui/file/3e4d35903c51db3da8d4bd77491b5c181b7361aaf152609d03a1e2bb86faee43/detection" ], "total": 4 }, { "counts": { "domain": 18 }, "first_seen": "2026-02-03", "indicators": { "domain": [ "ui07webzoom.us", "uq01webzoom.us", "uq02webzoom.us", "uq03webzoom.us", "uq05webzoom.us", "uq06webzoom.us", "uq08webzoom.us", "us31webzoom.us", "usa01webzoom.us", "usa02webzoom.us", "usa05webzoom.us", "uso1webzoom.us", "uso3webzoom.us", "uso7webzoom.us", "uv07webzoom.us", "uy01webzoom.us", "uy02webzoom.us", "uy04webzoom.us" ] }, "precision": "exact", "references": [ "https://x.com/TMJ0x/status/2014582284125421571", "https://www.virustotal.com/gui/ip-address/188.227.196.252/relations", "https://www.virustotal.com/gui/ip-address/188.227.197.32/relations" ], "total": 18 }, { "counts": { "domain": 2 }, "first_seen": "2026-02-02", "indicators": { "domain": [ "api.clearit.sbs", "api.flashstore.sbs" ] }, "precision": "exact", "references": [ "https://x.com/TLP_R3D/status/1935782157454078277", "https://x.com/TLP_R3D/status/1935782161757749475", "https://x.com/IstaPee/status/1935788234468213130" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2026-02-02", "indicators": { "domain": [ "support.ms-live.us" ] }, "precision": "exact", "references": [ "https://x.com/malwrhunterteam/status/1992990780521124298", "https://x.com/malwrhunterteam/status/1992991375604781075", "https://www.virustotal.com/gui/file/9135fb9e74bdb39828bfecf7919430062ce482a523999bd7ff1a368038f32371/detection", "https://www.virustotal.com/gui/file/ed705e5bab5da0f62ddfca9eb3e91ade284355ced3ed0efb366d7c3b892065c6/detection" ], "total": 1 }, { "counts": { "domain": 22 }, "first_seen": "2026-01-29", "indicators": { "domain": [ "ua04webzoom.us", "ui01webzoom.us", "ui02webzoom.us", "ui03webzoom.us", "ui04webzoom.us", "ui05webzoom.us", "ui06webzoom.us", "us01webzoom.us", "us02webzoom.us", "us04webzoom.us", "us05webzoom.us", "us06webzoom.us", "us07webzoom.us", "us09webzoom.us", "us30webzoom.us", "ut01webzoom.us", "ut02webzoom.us", "ut03webzoom.us", "ut04webzoom.us", "ut05webzoom.us", "ut06webzoom.us", "uu02webzoom.us" ] }, "precision": "exact", "references": [ "https://x.com/TMJ0x/status/2014582284125421571", "https://www.virustotal.com/gui/ip-address/188.227.196.252/relations", "https://www.virustotal.com/gui/ip-address/188.227.197.32/relations" ], "total": 22 }, { "counts": { "domain": 2 }, "first_seen": "2026-01-26", "indicators": { "domain": [ "us07-web.us", "zoom.us07-web.us" ] }, "precision": "exact", "references": [ "https://x.com/L0Psec/status/2014100649391137165", "https://x.com/moonlock_lab/status/2015857322963173657", "https://www.virustotal.com/gui/file/755cc133ae0519accbcfdd5f8f0d9fe1aa08cbcb306c3e5f29ebcb6ac12d9323/detection", "https://www.virustotal.com/gui/file/9a778d2b7919717e95072e4dec01c815a5fd81f574b538107652d73d8dc874b6/detection", "https://www.virustotal.com/gui/file/2fbd34eed9dbf57a44cf1540941fb43a793be27e13e937299167b2b67cb84d6b/detection" ], "total": 2 }, { "counts": { "domain": 49 }, "first_seen": "2026-01-24", "indicators": { "domain": [ "ua03webzoom.us", "ua06webzoom.us", "uc01webzoom.us", "uc03webzoom.us", "uc06webzoom.us", "um03webzoom.us", "un01webzoom.us", "un03webzoom.us", "un05webzoom.us", "un06webzoom.us", "uo01webzoom.us", "uo02webzoom.us", "uo03webzoom.us", "uo04webzoom.us", "uo05webzoom.us", "uo06webzoom.us", "ur01webzoom.us", "ur02webzoom.us", "ur03webzoom.us", "ur04webzoom.us", "ur06webzoom.us", "us005webzoom.us", "us16webzoom.us", "us22webzoom.us", "us29webzoom.us", "us41webzoom.us", "us52webzoom.us", "us54webzoom.us", "us57webzoom.us", "us72webzoom.us", "us81webzoom.us", "uu01webzoom.us", "uu03webzoom.us", "uv01webzoom.us", "uv02webzoom.us", "uv03webzoom.us", "uv04webzoom.us", "uv05webzoom.us", "uv06webzoom.us", "uw01webzoom.us", "uw02webzoom.us", "uw03webzoom.us", "uw04webzoom.us", "uw05webzoom.us", "uw06webzoom.us", "ux01webzoom.us", "ux03webzoom.us", "ux06webzoom.us", "uz03webzoom.us" ] }, "precision": "exact", "references": [ "https://x.com/TMJ0x/status/2014582284125421571", "https://www.virustotal.com/gui/ip-address/188.227.196.252/relations", "https://www.virustotal.com/gui/ip-address/188.227.197.32/relations" ], "total": 49 }, { "counts": { "domain": 2 }, "first_seen": "2026-01-22", "indicators": { "domain": [ "us05-web.us", "zoom.us05-web.us" ] }, "precision": "exact", "references": [ "https://x.com/L0Psec/status/2014100649391137165", "https://x.com/moonlock_lab/status/2015857322963173657", "https://www.virustotal.com/gui/file/755cc133ae0519accbcfdd5f8f0d9fe1aa08cbcb306c3e5f29ebcb6ac12d9323/detection", "https://www.virustotal.com/gui/file/9a778d2b7919717e95072e4dec01c815a5fd81f574b538107652d73d8dc874b6/detection", "https://www.virustotal.com/gui/file/2fbd34eed9dbf57a44cf1540941fb43a793be27e13e937299167b2b67cb84d6b/detection" ], "total": 2 }, { "counts": { "domain": 166 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "02usweb.us", "05usweb.us", "aleslosev.workers.dev", "app.republicrypto.vc", "bigbrain.group", "bizmeeting.online", "bizwebmeet.com", "bli.us06we.us", "businesstalks.site", "cn-zoom.us", "communicationhub.vip", "datatabletemplate.shop", "deliverypost.cloud", "dexalot.w03zoom.us", "doc-bridge.com", "drmariamaly.com", "em-oujuit78ytserve.com", "em-oujuit78ytserve.net", "ftp.uswe05.us", "google.xn--80aagm.beauty", "kanga.us05we.us", "laserdigital.xyz", "mail.w06zoom.us", "mediazoom.us", "meet-client.xyz", "meet.drmariamaly.com", "meeting-hub.team", "meeting-zone.team", "meetup-room.online", "meetuphub.online", "mughalfan.xyz", "mylingocoin.com", "newfromjune.shop", "newfromjune.site", "newwebapi.us", "nexologin.xyz", "online-conference.online", "online-conference.pro", "online-conference.site", "online-conference.store", "online-conference.xyz", "online-meets.cloud", "online-meets.store", "onlinemeet.video", "parafi.w03zoom.us", "parafi.wbzoom.us", "piprotocol.w03zoom.us", "republicrypto.vc", "room-meeting.online", "rwa.wbzoom.us", "rxamia.com", "sdk.w22zoom.us", "secure-meeting.cloud", "secure-meeting.xyz", "sendhosting.pro", "sg05web.us", "sidezoom.us", "singular.w03zoom.us", "singulardex.wbzoom.us", "support-gmeet.com", "support-google.co.im", "support-google.co.in", "support-google.us", "support-google.ws", "support-zoom.us", "team-meets.cloud", "team-meets.online", "team-meets.site", "team-meets.store", "team-meets.xyz", "techevent.us", "twosigmacap.com", "ukweb08.us", "us-playground.vc", "us001web.us", "us004web.us", "us02web-zoom.com", "us02www-zoom.us", "us03web-zoom.cc", "us03web-zoom.com", "us03www-zoom.us", "us04wezoom.us", "us05-zoom.com", "us05-zoom.uk", "us05biz-zoom.us", "us05we.us", "us05web-zoom.click", "us05web-zoom.cloud", "us05web-zoom.forum", "us05web-zoom.info", "us05web-zoom.ink", "us05web-zoom.pro", "us05web-zoom.site", "us05web-zoom.store", "us05web-zoom.uk", "us05web-zoom.xyz", "us05www-zoom.us", "us05zoom.com", "us05zoom.us.com", "us06we.us", "us06web-zoom.cc", "us06web-zoom.xyz", "us07web-zoom.cc", "us50webzoom.us", "uswe01.us", "uswe03.us", "uswe04.us", "uswe05.us", "uswe06.us", "uswe07.us", "uswe08.us", "uswe20.us", "usweb0.us", "usweb005.us", "usweb01.us", "usweb04.com", "usweb08.us", "usweb09.us", "venture-meeting.online", "video-conference.cloud", "video-conference.pro", "video-conference.site", "video-conference.store", "video-conference.xyz", "video-meeting.store", "videotalks.xyz", "vipocapital.com", "w03zoom.us", "w06zoom.us", "w07zoom.us", "w12zoom.us", "w21zoom.us", "w22zoom.us", "w41zoom.us", "wbzoom.us", "web01zoom.com", "web02zoom.us", "web031zoom.us", "web041zoom.us", "web06zoom.us", "web071zoom.us", "web082zoom.us", "web091zoom.us", "web21zoom.us", "web3fund.us", "webmeetapi.us", "webmeetoffice.us", "webus04.us", "webus05.us", "xn--80aagm.beauty", "zm-meeting.com", "zoom-support.com", "zoom-tech.us", "zoom.02usweb.us", "zoom.05usweb.us", "zoom.us05we.us", "zoom.uswe04.us", "zoom.uswe05.us", "zoom.uswe06.us", "zoom.uswe07.us", "zoom.uswe08.us", "zoom.uswe20.us", "zoom.usweb0.us", "zoom.usweb04.com", "zoom.webus04.us", "zoomweb.uswe05.us" ] }, "precision": "at-or-before", "references": [ "https://x.com/ValidinLLC/status/1943648048401244489", "https://www.validin.com/blog/zooming_through_bluenoroff_pivots/", "https://arcticwolf.com/resources/blog/bluenoroff-uses-clickfix-fileless-powershell-and-ai-generated-zoom-meetings-to-target-web3-sector/", "https://github.com/rtkwlf/wolf-tools/blob/main/threat-intelligence/bluenoroff-fake-zoom-clickfix/Bluenoroff_Appendix_items.md", "https://www.virustotal.com/gui/ip-address/147.79.103.251/relations" ], "total": 166 }, { "counts": { "domain": 56 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "us00web-zoom.us", "us01web-zoom.cloud", "us01web-zoom.com", "us01web-zoom.info", "us01web-zoom.org", "us01web-zoom.site", "us01web-zoom.store", "us01web-zoom.xyz", "us02biz-zoom.us", "us02cam-zoom.us", "us02web-zoom.info", "us02web-zoom.live", "us02web-zoom.org", "us02web-zoom.xyz", "us03biz-zoom.us", "us03web-zoom.biz", "us03web-zoom.info", "us03web-zoom.org", "us03web-zoom.site", "us03web-zoom.store", "us03web-zoom.top", "us03web-zoom.xyz", "us04web-zoom.info", "us04web-zoom.live", "us04web-zoom.org", "us04web-zoom.xyz", "us04www-zoom.us", "us05ad-zoom.us", "us05cc-zoom.us", "us05pro-zoom.us", "us05vip-zoom.us", "us05web-zoom.cc", "us05web-zoom.fun", "us05web-zoom.guru", "us05web-zoom.help", "us05web-zoom.live", "us05web-zoom.org", "us05web-zoom.top", "us05web-zoom.watch", "us05web-zoom.work", "us06web-zoom.info", "us06web-zoom.live", "us06web-zoom.org", "us06web-zoom.space", "us06www-zoom.us", "us07biz-zoom.us", "us07web-zoom.biz", "us07web-zoom.com", "us07web-zoom.live", "us08web-zoom.cc", "us08web-zoom.online", "us08www-zoom.us", "us09web-zoom.live", "us09www-zoom.us", "us12web-zoom.us", "us17web-zoom.us" ] }, "precision": "at-or-before", "references": [ "https://app.validin.com/lookalikes?lookback=90&depth=2&find=%2Fus%5B0-9%5D%7B2%7D%5Ba-z%5D%7B3%7D-zoom%5C.%5Ba-z%5D%7B2%2C5%7D%2F (# 2025-06-20)" ], "total": 56 }, { "counts": { "domain": 56 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "a.mylkc.cloudns.ch", "admin.unitpowergeneration.top", "algozzoom.us006web.us", "apizoom.myfanshu.com", "bigbrain.w04zoom.us", "bli.us02we.us", "blockstreet.w02zoom.us", "blockstreet.w04zoom.us", "blockstreet.w05zoom.us", "carriebrigham-c.com", "craftiq.cloud", "defactor.us002web.us", "dg01web.zoomconnector.com", "drainer.bot", "edgetunnel.leungkc.eu.org", "gosats.us02we.us", "goweb.zoomconnector.com", "httpscalm-morning-viber.comhmirihansa909workersdev.workers.dev", "johnmichaelsesay.com", "meet.w02zoom.us", "ortjc.com", "periqi.com", "reforge.w02zoom.us", "reforge.web099zoom.us", "solana.w05zoom.us", "solayer.us002web.us", "teams-live-meet.carriebrigham-c.com", "thanhthienai.com", "unitpowergeneration.top", "us002web.us", "us005office.us", "us006web.us", "us02we.us", "us02web.zoomconnector.com", "us04web.buszoom.us", "us05web.buszoom.us", "us05web.us", "us06web.zoomconnector.com", "us07web.zoomconnector.com", "vless.goowen-f5e.workers.dev", "vps-7880c010.vps.ovh.ca", "w02zoom.us", "w04zoom.us", "w05zoom.us", "web099zoom.us", "wesco-distributors.com", "zoom-meet-live.carriebrigham-c.com", "zoom-ru.github.io", "zoom.us002web.us", "zoom.us005office.us", "zoom.us006web.us", "zoom.us02we.us", "zoom.us05web.us", "zoommeetplace.com", "zoomus05web.com", "zoonn-platform.com" ] }, "precision": "at-or-before", "references": [ "https://app.validin.com/detail?find=One%20platform%20to%20connect%20%7C%20Zoom&type=raw&ref_id=da1dd79bcfb&os.sortcol=3&res.sortcol=4&res.headers_a=Key&res.headers_a=Type&res.headers_a=Value&res.headers_a=First+Seen&res.headers_a=Last+Seen&atr.sortcol=4&sub.sortcol=0&dns.sortcol=4&dns.headers_a=Key&dns.headers_a=Type&dns.headers_a=Value&dns.headers_a=First+Seen&dns.headers_a=Last+Seen&hp.pagesize=1000&hp.filters.Value.text_search.prefix_match=&hp.filters.Value.text_search.suffix_match=%21.zoom.us%2C%21.zoom.com&hp.filters.Value.text_search.contains=&hp.filters.Type.types.Type_a=TITLE-HOST&hr.sortcol=5&hr.headers_a=Host%2FIP&hr.headers_a=Port&hr.headers_a=Response%2FPath&hr.headers_a=Bytes+Received&hr.headers_a=Title&hr.headers_a=Response+Date&crts.sortcol=4&rdap.sortcol=2&rdap.headers_a=Domain&rdap.headers_a=Registrar&rdap.headers_a=Registered&rdap.headers_a=Expires&rdap.headers_a=Changed&rdap.headers_a=Updated&rdap.headers_a=Count#tab=host_pairs" ], "total": 56 }, { "counts": { "domain": 50 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "e.ms-live.xyz", "m.ms-live.xyz", "ms-live.us", "ms-live.xyz", "quick-meeting.online", "support.teams-live.org", "support.teams-live.us", "teams-live.biz", "teams-live.org", "teams-live.us", "uc04webzoom.us", "uc05webzoom.us", "uc07webzoom.us", "ue01webzoom.us", "ue03webzoom.us", "ue04webzoom.us", "ue05webzoom.us", "ue06webzoom.us", "ue07webzoom.us", "ue08webzoom.us", "ue09webzoom.us", "uk01webzoom.us", "uk02webzoom.us", "uk03webzoom.us", "uk04webzoom.us", "uk05webzoom.us", "uk06webzoom.us", "uk07webzoom.us", "um05webzoom.us", "um06webzoom.us", "ur05webzoom.us", "us10webzoom.us", "us11webzoom.us", "us12webzoom.us", "us13webzoom.us", "us14webzoom.us", "us15webzoom.us", "us17webzoom.us", "us19webzoom.us", "us21webzoom.us", "us24webzoom.us", "us25webzoom.us", "us26webzoom.us", "us60webzoom.us", "uz01webzoom.us", "uz02webzoom.us", "uz04webzoom.us", "uz05webzoom.us", "uz06webzoom.us", "uz07webzoom.us" ] }, "precision": "at-or-before", "references": [ "https://x.com/malwrhunterteam/status/1992990780521124298", "https://x.com/malwrhunterteam/status/1992991375604781075", "https://www.virustotal.com/gui/file/9135fb9e74bdb39828bfecf7919430062ce482a523999bd7ff1a368038f32371/detection", "https://www.virustotal.com/gui/file/ed705e5bab5da0f62ddfca9eb3e91ade284355ced3ed0efb366d7c3b892065c6/detection" ], "total": 50 }, { "counts": { "domain": 23 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "api.betterfun.space", "api.zerodev.pro", "autoupdate.online", "awaitingfor.online", "betterfun.space", "bots.autoupdate.online", "check-address.xyz", "clearit.sbs", "cron-stage.usecrowdpay.xyz", "ezqrn.top", "flashstore.sbs", "image-support.xyz", "neptune.tastebuds.buzz", "safeup.store", "secondshop.online", "signsafe.site", "signsafe.xyz", "tastebuds.buzz", "update-assist.org", "upload-test.xyz", "usecrowdpay.xyz", "web3-support.xyz", "zerodev.pro" ] }, "precision": "at-or-before", "references": [ "https://x.com/TLP_R3D/status/1935782157454078277", "https://x.com/TLP_R3D/status/1935782161757749475", "https://x.com/IstaPee/status/1935788234468213130" ], "total": 23 }, { "counts": { "domain": 21 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "awaitingfor.site", "check.datatabletemplate.shop", "chkactive.online", "chkstate.online", "cloud-server.store", "datatabletemplate.xyz", "download.datatabletemplate.xyz", "download.face-online.world", "face-online.world", "file-server.store", "filedrive.online", "flashserve.store", "real-update.xyz", "root.chkstate.online", "root.security-update.xyz", "second.awaitingfor.online", "second.systemupdate.cloud", "secondshop.store", "security-update.xyz", "systemupdate.cloud", "urgent-update.cloud" ] }, "precision": "at-or-before", "references": [ "https://securelist.com/bluenoroff-apt-campaigns-ghostcall-and-ghosthire/117842/" ], "total": 21 }, { "counts": { "domain": 17, "ipv4": 1 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "ua02webzoom.us", "ua05webzoom.us", "uc02webzoom.us", "ue02webzoom.us", "um02webzoom.us", "um04webzoom.us", "un02webzoom.us", "un04webzoom.us", "us27webzoom.us", "us28webzoom.us", "us45webzoom.us", "us51webzoom.us", "us53webzoom.us", "ux02webzoom.us", "ux04webzoom.us", "ux05webzoom.us", "webus06.us" ], "ipv4": [ "163.5.254.70:3000" ] }, "precision": "at-or-before", "references": [ "https://github.com/motuariki/IOCs/blob/main/DPRK%20Tracking/04-12-2025-DPRK-Fake-Meeting-Infrastructure" ], "total": 18 }, { "counts": { "domain": 14 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "join-meets.com", "refogevc.web08zoom.us", "reforgevc.web08zoom.us", "silver.web08zoom.us", "suweb05.us", "us007web.us", "us01web.com", "us07office.us", "web08zoom.us", "zoom.join-meets.com", "zoom.suweb05.us", "zoom.us007web.us", "zoom.us01web.com", "zoom.us07office.us" ] }, "precision": "at-or-before", "references": [ "https://x.com/ValidinLLC/status/1937089880439329047", "https://app.validin.com/detail?type=hash&find=23c501daff7991f82a93d94a4f14bd68fb5f61d9#tab=host_pairs (# 2025-06-23)" ], "total": 14 }, { "counts": { "domain": 14 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "app.thorwsap.finance", "remoteorder.shop", "thorwsap.finance", "us004zoom.com", "us005zoom.com", "us04web.com", "web3insider.forum", "web3journal.io", "web3journal.xyz", "web3signal.xyz", "webthreefinance.club", "whisperroom.forum", "ww1.us04web.com", "ww12.web3journal.io" ] }, "precision": "at-or-before", "references": [ "https://www.validin.com/blog/pivots_revisited/#bluenoroff" ], "total": 14 }, { "counts": { "domain": 10, "ipv4": 4 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "automatic-update.online", "autoupdate.store", "checkdata.wiki", "first.longlastfor.online", "firstfromsep.online", "instant-update.online", "longlastfor.online", "ovalln.top", "real.automatic-update.online", "safeup.online" ], "ipv4": [ "104.168.145.52:8080", "104.168.151.70:8080", "104.168.198.145:8080", "23.254.202.223:8080" ] }, "precision": "at-or-before", "references": [ "https://twitter.com/MichalKoczwara/status/1783136320166023648", "https://www.virustotal.com/gui/ip-address/104.168.198.145/relations", "https://app.validin.com/detail?type=raw&find=herblin1112%40gmail.com#tab=host_pairs (# 2025-05-20)", "https://app.validin.com/detail?find=1d398e3b572e906ecca28cc6fadc0fa6dcb0bd20&type=hash&ref_id=575dd0e9111#tab=host_pairs (# 2025-05-23)", "https://www.virustotal.com/gui/file/c24bb2b28d322faee5a0162675c0c579a5224149874742acdd0bdf0157359756/detection" ], "total": 14 }, { "counts": { "domain": 11 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "ajayplamingo.com", "app-wechat.xyz", "bluewhale7.xyz", "devlab.locker", "doc-secure.it.com", "doc-secure.me", "hanaconference.xyz", "honavolae.xyz", "pacificyouth.club", "rentyourmac.xyz", "securetech.fun" ] }, "precision": "at-or-before", "references": [ "https://fieldeffect.com/blog/zoom-doom-bluenoroff-call-opens-the-door", "https://www.virustotal.com/gui/ip-address/191.96.235.88/relations" ], "total": 11 }, { "counts": { "domain": 10 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "ms-live.com", "ms-meet.live", "onedrive.ms-live.com", "suport.ms-live.com", "support.ms-live.com", "support.ms-meet.live", "team-live.us.com", "teams-live.cn.com", "teams-live.us.com", "teams.ms-meet.live" ] }, "precision": "at-or-before", "references": [ "https://x.com/moonlock_lab/status/1996304740410347890", "https://x.com/moonlock_lab/status/1996305744598110500", "https://www.virustotal.com/gui/ip-address/192.64.119.54/relations", "https://www.virustotal.com/gui/ip-address/23.254.226.83/relations", "https://www.virustotal.com/gui/file/9135fb9e74bdb39828bfecf7919430062ce482a523999bd7ff1a368038f32371/detection", "https://www.virustotal.com/gui/file/14aba88b5f87ab9415bbca855d24abc3f151b819302930897e71e2626e823271/detection", "https://www.virustotal.com/gui/file/81c4ce82fe26e333a46e8a3d876e35b39725bda0a47f9c37ffc956d37da2d8fa/detection" ], "total": 10 }, { "counts": { "domain": 8 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "dataupload.store", "gumi-cryptos.us05web-zoom.pro", "support.us05web-zoom.cloud", "support.us05web-zoom.forum", "support.us05web-zoom.pro", "support.us06web-zoom.online", "us06web-zoom.online", "writeup.live" ] }, "precision": "at-or-before", "references": [ "https://huntability.tech/threat-note-2025-04-23-nk-zoom/", "https://www.sentinelone.com/labs/macos-nimdoor-dprk-threat-actors-target-web3-and-crypto-platforms-with-nim-based-malware/" ], "total": 8 }, { "counts": { "domain": 6 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "productnews.online", "readysafe.xyz", "safeupload.online", "support.us05web-zoom.biz", "us05web-zoom.biz", "us05web-zoom.space" ] }, "precision": "at-or-before", "references": [ "https://x.com/birchb0y/status/1935436678602055682", "https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis" ], "total": 6 }, { "counts": { "domain": 6 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "us05-zoom.forum", "us05-zoom.us", "us06-zoom.forum", "us06-zoom.uk", "us06-zoom.us", "us06www-zoom.com" ] }, "precision": "at-or-before", "references": [ "https://x.com/AlvieriD/status/1938253401868976404" ], "total": 6 }, { "counts": { "domain": 3 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "gost.run", "nicrft.site", "socialsuport.com" ] }, "precision": "at-or-before", "references": [ "https://darkatlas.io/blog/bluenoroff-apt38-live-infrastructure-hunting" ], "total": 3 }, { "counts": { "domain": 3 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "us4web.us", "usweb5.us", "zoom.us4web.us" ] }, "precision": "at-or-before", "references": [ "https://app.validin.com/detail?find=One%20platform%20to%20connect%20%7C%20Zoom&type=raw&ref_id=ea83c6e2c8d#tab=host_pairs" ], "total": 3 }, { "counts": { "domain": 2 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "cdnkit.io", "static.cdnkit.io" ] }, "precision": "at-or-before", "references": [ "https://github.com/hagezi/dns-blocklists/issues/6545" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "updatecheck.v6.rocks" ] }, "precision": "at-or-before", "references": [ "https://x.com/cyberoverdrive/status/1879616942040125648", "https://www.virustotal.com/gui/ip-address/5.230.44.79/relations" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "safefor.xyz" ] }, "precision": "at-or-before", "references": [ "https://x.com/birchb0y/status/1935436678602055682", "https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis", "https://x.com/TLP_R3D/status/1935782157454078277", "https://x.com/TLP_R3D/status/1935782161757749475", "https://x.com/IstaPee/status/1935788234468213130" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "teams-meet.us" ] }, "precision": "at-or-before", "references": [ "https://www.validin.com/blog/pivots_revisited/#bluenoroff", "https://x.com/malwrhunterteam/status/1992990780521124298", "https://x.com/malwrhunterteam/status/1992991375604781075", "https://www.virustotal.com/gui/file/9135fb9e74bdb39828bfecf7919430062ce482a523999bd7ff1a368038f32371/detection", "https://www.virustotal.com/gui/file/ed705e5bab5da0f62ddfca9eb3e91ade284355ced3ed0efb366d7c3b892065c6/detection" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "us05webzoom.link" ] }, "precision": "at-or-before", "references": [ "https://app.validin.com/detail?find=%3A%3A%22twitter%3Asite%22%3A%3A%22%40zoom%22&type=raw&ref_id=1a212fb7b37#tab=host_pairs (# 2025-07-07)" ], "total": 1 }, { "counts": { "domain": 19 }, "first_seen": "2025-01-15", "indicators": { "domain": [ "app.baiduweb.pro", "baiduweb.pro", "daiwa-v.com", "daiwa.in-zoom.us", "dunamu.in-zoom.us", "dunamuventures.com", "in-zoom.us", "meet.baiduweb.pro", "meet.daiwa-v.com", "meet.dunamuventures.com", "meet.mzweb3.fund", "meet.playgroundvc.capital", "meet.playgroundventures.capital", "meet.saisoncapital.net", "mzweb3.fund", "newtribe.in-zoom.us", "playgroundvc.capital", "playgroundventures.capital", "saisoncapital.net" ] }, "precision": "exact", "references": [ "https://x.com/cyberoverdrive/status/1879616942040125648", "https://www.virustotal.com/gui/ip-address/5.230.44.79/relations" ], "total": 19 }, { "counts": { "domain": 4 }, "first_seen": "2025-01-15", "indicators": { "domain": [ "api.zoom-sdk.com", "meet.twosigmavc.capital", "meet.twosigmaventures.us", "zoom-sdk.com" ] }, "precision": "exact", "references": [ "https://x.com/JRehbergCSK/status/1877800515871936822", "https://x.com/cosmonaut_joon/status/1879435681547858086", "https://x.com/tayvano_/status/1879611039953924592", "https://www.virustotal.com/gui/ip-address/216.107.136.11/relations" ], "total": 4 }, { "counts": { "domain": 4 }, "first_seen": "2025-01-13", "indicators": { "domain": [ "jobs.twosigmavc.capital", "jobs.twosigmaventures.us", "twosigmavc.capital", "twosigmaventures.us" ] }, "precision": "exact", "references": [ "https://x.com/JRehbergCSK/status/1877800515871936822", "https://x.com/cosmonaut_joon/status/1879435681547858086", "https://x.com/tayvano_/status/1879611039953924592", "https://www.virustotal.com/gui/ip-address/216.107.136.11/relations" ], "total": 4 }, { "counts": { "domain": 10 }, "first_seen": "2024-11-30", "indicators": { "domain": [ "info.anobaka.info", "jp-aprime.info", "word.anobaka.info", "ww25.amazon.co.jp-aprime.info", "ww25.co.jp-aprime.info", "ww25.jp-aprime.info", "ww25.login-service.amazon.co.jp-aprime.info", "ww25.mail.jp-aprime.info", "ww25.webmail.jp-aprime.info", "ww38.jp-aprime.info" ] }, "precision": "exact", "references": [ "https://securelist.com/bluenoroff-methods-bypass-motw/108383/", "https://otx.alienvault.com/pulse/63ac10d2a4d29d94a7766d7a" ], "total": 10 }, { "counts": { "domain": 1 }, "first_seen": "2024-11-13", "indicators": { "domain": [ "werfaultserver.com" ] }, "precision": "exact", "references": [ "https://x.com/TLP_R3D/status/1665014879151960065", "https://www.virustotal.com/gui/file/66916b0dfd9956b4b74640a4feb9459ea7986b056b2cecd361e4402d44a445a1/detection" ], "total": 1 }, { "counts": { "domain": 2 }, "first_seen": "2024-11-11", "indicators": { "domain": [ "hanagroup.video", "meet.hanagroup.video" ] }, "precision": "exact", "references": [ "https://www.virustotal.com/gui/ip-address/45.61.157.78/relations" ], "total": 2 }, { "counts": { "domain": 44 }, "first_seen": "2024-11-07", "indicators": { "domain": [ "analysis.arkinvst.com", "ankanimatoka.com", "appleaccess.pro", "arkinvst.com", "caladan.video", "calendly.caladan.video", "cardiagnostic.net", "community.edwardcaputo.shop", "community.kevinaraujo.shop", "community.selincapital.com", "customer-app.xyz", "delphidigital.org", "doc.solanalab.org", "drogueriasanjose.net", "edwardcaputo.shop", "email.sellinicapital.com", "frameworks.ventures", "hananetwork.video", "happyz.one", "huspot.blog", "hwsrv-1225327.hostwindsdns.com", "info.ankanimatoka.com", "info.customer-app.xyz", "kevinaraujo.shop", "maelstroms.fund", "matuaner.com", "meet.caladan.video", "meet.hananetwork.video", "meet.selinicapital.info", "meet.sellinicapital.com", "meeting.zoom-client.com", "mg21.1056.uk", "nodnote.com", "online.selinicapital.info", "online.zoom-client.com", "selincapital.com", "selinicapital.info", "selinicapital.network", "sendmailer.org", "shh5.baranftw.xyz", "solanalab.org", "verify.selinicapital.info", "xu10.1056.uk", "zoom-client.com" ] }, "precision": "exact", "references": [ "https://x.com/LabsSentinel/status/1854550940243702083", "https://www.sentinelone.com/labs/bluenoroff-hidden-risk-threat-actor-targets-macs-with-fake-crypto-news-and-novel-persistence/" ], "total": 44 }, { "counts": { "domain": 10 }, "first_seen": "2024-09-13", "indicators": { "domain": [ "imp-docs.digital", "microsoft-rage.world", "show-pdf-document.com", "uploadfiles.website", "uploadmefiles.site", "uploadmefiles.space", "uploadmefiles.tech", "uploadmefiles.xyz", "uploadmyfile.space", "uploadmyfile.tech" ] }, "precision": "exact", "references": [ "https://x.com/StrikeReadyLabs/status/1834588185835286571" ], "total": 10 }, { "counts": { "domain": 11 }, "first_seen": "2024-08-22", "indicators": { "domain": [ "cmt.ventures", "dourolab.xyz", "maelstromfund.org", "mc.tvdhoenn.net", "panda95sg.asia", "pixelmonmmo.net", "pixleon.net", "prismlab.xyz", "sendmailed.com", "tvdhoenn.net", "yoannturp.xyz" ] }, "precision": "exact", "references": [ "https://x.com/TLP_R3D/status/1826545317229015078", "https://www.virustotal.com/gui/ip-address/23.254.253.75/relations", "https://app.validin.com/detail?type=dom&find=panda95sg.asia#tab=host_pairs_v2" ], "total": 11 }, { "counts": { "domain": 1, "ipv4": 1 }, "first_seen": "2024-08-22", "indicators": { "domain": [ "versionupdate.dns.army" ], "ipv4": [ "45.61.140.26:3389" ] }, "precision": "exact", "references": [ "https://x.com/Cyberteam008/status/1826585708376850744", "https://app.validin.com/detail?type=ip&find=45.61.140.26#tab=resolutions" ], "total": 2 }, { "counts": { "domain": 1, "url_path": 6 }, "first_seen": "2024-08-17", "indicators": { "domain": [ "buy2x.com" ], "url_path": [ "/4SqSYtx%2B/", "/ABcTDInKWw/", "/EKfP7saoiP/", "/OcMySY5QNkY/", "/OcMySY5QNkY/ABcTDInKWw/4SqSYtx%2B/EKfP7saoiP/", "/OcMySY5QNkY/ABcTDInKWw/4SqSYtx%2B/EKfP7saoiP/BcA%3D%3D" ] }, "precision": "exact", "references": [ "https://www.kandji.io/blog/todoswift-disguises-malware-download-behind-bitcoin-pdf" ], "total": 7 }, { "counts": { "domain": 15 }, "first_seen": "2024-04-24", "indicators": { "domain": [ "adiclas-nft.quest", "appleupdate.datauploader.site", "datauploader.online", "datauploader.site", "dropepe.cfd", "first.system-update.xyz", "koreaair.tattoo", "metamask.awaitingfor.site", "root.system-update.cloud", "stabucksiren.fun", "star-bucks.life", "starbucksevent.pics", "system-update.cloud", "system-update.xyz", "thefirststore.bond" ] }, "precision": "exact", "references": [ "https://twitter.com/MichalKoczwara/status/1783136320166023648", "https://www.virustotal.com/gui/ip-address/104.168.198.145/relations", "https://app.validin.com/detail?type=raw&find=herblin1112%40gmail.com#tab=host_pairs (# 2025-05-20)", "https://app.validin.com/detail?find=1d398e3b572e906ecca28cc6fadc0fa6dcb0bd20&type=hash&ref_id=575dd0e9111#tab=host_pairs (# 2025-05-23)", "https://www.virustotal.com/gui/file/c24bb2b28d322faee5a0162675c0c579a5224149874742acdd0bdf0157359756/detection" ], "total": 15 }, { "counts": { "domain": 1 }, "first_seen": "2024-03-13", "indicators": { "domain": [ "atajerefoods.com" ] }, "precision": "exact", "references": [ "https://twitter.com/philofishal/status/1767951302607151351", "https://www.virustotal.com/gui/file/083f949e4708098b624dca017e2c0294a18e9a581f92baa8348836d7d9ba06c7/detection" ], "total": 1 }, { "counts": { "domain": 2 }, "first_seen": "2023-10-27", "indicators": { "domain": [ "internal-document-he-gr-me.run.place", "j-ic.co.internal-document-he-gr-me.run.place" ] }, "precision": "exact", "references": [ "https://twitter.com/greglesnewich/status/1717963704828915988" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2023-09-22", "indicators": { "domain": [ "techopscentral.com" ] }, "precision": "exact", "references": [ "https://twitter.com/TLP_R3D/status/1705211957941240212", "https://www.virustotal.com/gui/ip-address/172.86.121.198/relations" ], "total": 1 }, { "counts": { "domain": 3 }, "first_seen": "2023-09-20", "indicators": { "domain": [ "doc.apple.com.premienoe.aidl.eonw.line.pm", "pre.alwayswait.site", "tp-globa.xyz" ] }, "precision": "exact", "references": [ "https://community.emergingthreats.net/t/ruleset-update-summary-2023-09-20-v10421/970" ], "total": 3 }, { "counts": { "domain": 4 }, "first_seen": "2023-09-06", "indicators": { "domain": [ "cryptowave.capital", "datasend.fun", "internal-meeting.online", "video-meet.xyz" ] }, "precision": "exact", "references": [ "https://community.emergingthreats.net/t/ruleset-update-summary-2023-09-05-v10410/921" ], "total": 4 }, { "counts": { "domain": 1 }, "first_seen": "2023-08-10", "indicators": { "domain": [ "autodynamics.work.gd" ] }, "precision": "exact", "references": [ "https://www.sentinelone.com/blog/bluenoroff-how-dprks-macos-rustbucket-seeks-to-evade-analysis-and-detection/", "https://community.emergingthreats.net/t/ruleset-update-summary-2023-08-10-v10391/855" ], "total": 1 }, { "counts": { "domain": 11 }, "first_seen": "2023-08-03", "indicators": { "domain": [ "association.linkpc.net", "c-money.linkpc.net", "decentryk.online", "dma.linkpc.net", "docsend.com-proapple.cloud.line.pm", "longjourneycapital.publicvm.com", "longjourneyfund.publicvm.com", "longjourneyventure.publicvm.com", "protectsh.online", "raizerverify.online", "world.linkpc.net" ] }, "precision": "exact", "references": [ "https://twitter.com/KSeznec/status/1678319191110082560" ], "total": 11 }, { "counts": { "domain": 5 }, "first_seen": "2023-07-30", "indicators": { "domain": [ "docsend-cloud.espcap.fun", "docsend.com-pro.apple.cloud.line.pm", "espcap.fun", "group.pro-tokyo.top", "pro-tokyo.top" ] }, "precision": "exact", "references": [ "https://twitter.com/TLP_R3D/status/1685581711139102720", "https://www.virustotal.com/gui/ip-address/23.254.204.173/relations", "https://www.virustotal.com/gui/file/8949207761f3d09734aa716da1e6c182425bcde2a95dacb3320085f1fe66069c/detection" ], "total": 5 }, { "counts": { "domain": 3 }, "first_seen": "2023-07-09", "indicators": { "domain": [ "floriventurescapital.linkpc.net", "floriventuresfinance.linkpc.net", "floriventuresfund.linkpc.net" ] }, "precision": "exact", "references": [ "https://twitter.com/TLP_R3D/status/1677617586349981696", "https://www.virustotal.com/gui/ip-address/192.119.64.43/relations" ], "total": 3 }, { "counts": { "domain": 2 }, "first_seen": "2023-07-09", "indicators": { "domain": [ "obituary2.redirectme.net", "yorst.linkpc.net" ] }, "precision": "exact", "references": [ "https://www.virustotal.com/gui/file/0be79614938541a4cd85de1b6103f0fdeb3808aaba5856ba5bbd8ef6976cf8c3/detection" ], "total": 2 }, { "counts": { "domain": 3 }, "first_seen": "2023-06-16", "indicators": { "domain": [ "downloadfile.icu", "getfilefrom.site", "getfilefrom.store" ] }, "precision": "exact", "references": [ "https://twitter.com/C0ryInTheHous3/status/1669422415309418496" ], "total": 3 }, { "counts": { "domain": 5 }, "first_seen": "2023-06-03", "indicators": { "domain": [ "dontdie.cfd", "file.latest-report.online", "getwebconnection.cfd", "latest-report.online", "sts.interalliancemediagroups.cloud" ] }, "precision": "exact", "references": [ "https://twitter.com/C0ryInTheHous3/status/1661756717355483137", "https://www.virustotal.com/gui/ip-address/104.168.167.88/relations" ], "total": 5 }, { "counts": { "domain": 3 }, "first_seen": "2023-06-03", "indicators": { "domain": [ "app.developcore.org", "developcore.org", "gdrvcloud.com" ] }, "precision": "exact", "references": [ "https://twitter.com/TLP_R3D/status/1664980484219084801", "https://www.virustotal.com/gui/ip-address/172.93.193.219/relations" ], "total": 3 }, { "counts": { "domain": 10 }, "first_seen": "2023-05-23", "indicators": { "domain": [ "deck.latest-report.cloud", "docupload.lat", "docupload.store", "file.docupload.lat", "file.docupload.store", "getwebconnection.buzz", "last-report.online", "latest-report.cloud", "news.last-report.online", "ok.docupload.store" ] }, "precision": "exact", "references": [ "https://twitter.com/C0ryInTheHous3/status/1661076239614918660" ], "total": 10 }, { "counts": { "domain": 2 }, "first_seen": "2023-05-23", "indicators": { "domain": [ "docupload.bond", "els.docupload.bond" ] }, "precision": "exact", "references": [ "https://twitter.com/C0ryInTheHous3/status/1661075436783259649" ], "total": 2 }, { "counts": { "domain": 26 }, "first_seen": "2023-05-13", "indicators": { "domain": [ "arborventures.capital", "autoupdatecheck.work.gd", "companydeck.cloud", "companydeck.online", "contract-research.blog", "contractresearch.blog", "crypto.contract-research.blog", "crypto.contractresearch.blog", "deck.arbordeck.online", "docs-send.cloud", "docupload.site", "file.docupload.site", "file.myfirmdocument.cloud", "file.myfirmdocument.online", "gunosis.global", "mx.interalliancemediagroups.cloud", "myfirmdocument.cloud", "myfirmdocument.online", "safe.arborventures.capital", "safe.gunosis.global", "safe.job-description.online", "safe.nextera.capital", "safe.smart-contracts.blog", "securesmtp.interalliancemediagroups.cloud", "smtps.interalliancemediagroups.cloud", "webhostwatto.work.gd" ] }, "precision": "exact", "references": [ "https://twitter.com/C0ryInTheHous3/status/1646159776177324044", "https://twitter.com/C0ryInTheHous3/status/1646161233458999297", "https://www.virustotal.com/gui/ip-address/104.168.167.88/relations" ], "total": 26 }, { "counts": { "domain": 1 }, "first_seen": "2023-05-13", "indicators": { "domain": [ "interalliancemediagroups.cloud" ] }, "precision": "exact", "references": [ "https://twitter.com/C0ryInTheHous3/status/1646159776177324044", "https://twitter.com/C0ryInTheHous3/status/1646161233458999297", "https://www.virustotal.com/gui/ip-address/104.168.167.88/relations", "https://twitter.com/C0ryInTheHous3/status/1669422415309418496" ], "total": 1 }, { "counts": { "domain": 6 }, "first_seen": "2023-04-23", "indicators": { "domain": [ "cloud.hedgehogvc.us", "down.hedgehogvc.us", "hedgehogvc.us", "laos.hedgehogvc.us", "pet.hedgehogvc.us", "thai.hedgehogvc.us" ] }, "precision": "exact", "references": [ "https://twitter.com/k3yp0d/status/1650071119074844673", "https://www.virustotal.com/gui/file/ff8832355ae99ffd66d0fe9eda2d74efdf3ed87bb2a4c215b93ade93165f7c0b/detection", "https://www.virustotal.com/gui/file/3b6f30369a4ee8bf9409d141b6d1b3fb4286c34984b5de005ed7431df549b17e/detection" ], "total": 6 }, { "counts": { "domain": 2 }, "first_seen": "2023-04-23", "indicators": { "domain": [ "31ventures.info", "deck.31ventures.info" ] }, "precision": "exact", "references": [ "https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/" ], "total": 2 }, { "counts": { "domain": 18 }, "first_seen": "2023-04-20", "indicators": { "domain": [ "256ventures.us", "aidpartners.org", "altair-vc.co.uk", "altair-vc.com", "altair.linkpc.net", "deck.altair-vc.co.uk", "deck.altair-vc.com", "deck.toyota-ai.org", "deepcore.v.entures", "doc.256ventures.us", "docsend.me", "down.aidpartners.org", "down.protectedviewer.co", "inter.gpmtreit.co", "partner.deepcore.v.entures", "protectedviewer.co", "sarahbeery.docsend.me", "toyota-ai.org" ] }, "precision": "exact", "references": [ "https://twitter.com/TLP_R3D/status/1649147042680172571", "https://www.virustotal.com/gui/ip-address/104.255.172.52/relations" ], "total": 18 }, { "counts": { "domain": 11, "url": 1 }, "first_seen": "2023-04-20", "indicators": { "domain": [ "cloud.azurehosting.co", "doc.gdocshare.one", "down.espcapital.co", "nbright.best", "ns1.trytiponlineresult.com", "ns2.trytiponlineresult.com", "safe.doc-share.pro", "safe.doc-share.top", "site.siteshare.me", "siteshare.me", "trytiponlineresult.com" ], "url": [ "http://104.255.172.56" ] }, "precision": "exact", "references": [ "https://storage.pardot.com/838563/1676629189Mljyft19/CTI_Advisory_Undetected_North_Korean_Malware_A_Looming_Threat_to_Finan.pdf" ], "total": 12 }, { "counts": { "domain": 5 }, "first_seen": "2023-04-12", "indicators": { "domain": [ "arbordeck.co.in", "deck.arbordeck.co.in", "safe.shared-document.cloud", "shared-document.cloud", "spirtblockchain.com" ] }, "precision": "exact", "references": [ "https://twitter.com/C0ryInTheHous3/status/1646159776177324044", "https://twitter.com/C0ryInTheHous3/status/1646161233458999297", "https://www.virustotal.com/gui/ip-address/104.168.167.88/relations" ], "total": 5 }, { "counts": { "domain": 2 }, "first_seen": "2023-04-02", "indicators": { "domain": [ "jdshare.com.de", "mufg.us.com" ] }, "precision": "exact", "references": [ "https://twitter.com/StopMalvertisin/status/1642450636875898880", "https://twitter.com/StopMalvertisin/status/1642450639618973696", "https://www.virustotal.com/gui/file/4d5efd08e66c394b025a57995a7065fcda45a982a16ded4cdfc4ed42bd142ea5/detection" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2023-03-13", "indicators": { "domain": [ "share.dedesignanddev.com" ] }, "precision": "exact", "references": [ "https://twitter.com/souiten/status/1635210162805018624", "https://www.virustotal.com/gui/file/2c0a66c6370b4aa88ab3805d520e868cbc513b43119958257a72c9ff58ef241c/detection" ], "total": 1 }, { "counts": { "domain": 2 }, "first_seen": "2023-03-09", "indicators": { "domain": [ "cloud.daiwa.ventures", "daiwa.ventures" ] }, "precision": "exact", "references": [ "https://twitter.com/C0ryInTheHous3/status/1633897592806408192" ], "total": 2 }, { "counts": { "domain": 2 }, "first_seen": "2023-03-01", "indicators": { "domain": [ "azure.doc-view.cloud", "doc-view.cloud" ] }, "precision": "exact", "references": [ "https://twitter.com/C0ryInTheHous3/status/1630991590176030738" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2023-02-28", "indicators": { "domain": [ "mufg.yokohama" ] }, "precision": "exact", "references": [ "https://twitter.com/C0ryInTheHous3/status/1630551018084737027" ], "total": 1 }, { "counts": { "domain": 18 }, "first_seen": "2023-02-14", "indicators": { "domain": [ "cloud.anobaka.info", "cloud.dnx.capital", "cloud.gpmtreit.co", "cloud.j-ic.co", "cloud.j-ic.com", "cloud.mekongcapital.net", "down.gpmtreit.co", "down.gpmtreit.us", "down.j-ic.com", "down.tomming.us", "gpmtreit.co", "gpmtreit.us", "internal.j-ic.co", "j-ic.co", "j-ic.com", "mekongcapital.net", "tet.dnx.capital", "tomming.us" ] }, "precision": "exact", "references": [ "https://twitter.com/craiu/status/1625408594886762496", "https://twitter.com/craiu/status/1625408647508402176" ], "total": 18 }, { "counts": { "domain": 2 }, "first_seen": "2023-02-14", "indicators": { "domain": [ "cloud.espcapital.pro", "espcapital.pro" ] }, "precision": "exact", "references": [ "https://twitter.com/StopMalvertisin/status/1625402506737250304", "https://www.virustotal.com/gui/file/26e376fc80b090b2ee04e7d3104d308a150e58538580109a74f4ac49bf362423/detection" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2023-02-09", "indicators": { "domain": [ "autoprotect.com.se" ] }, "precision": "exact", "references": [ "https://community.emergingthreats.net/t/ruleset-update-summary-2023-02-09-v10240/306" ], "total": 1 }, { "counts": { "domain": 24 }, "first_seen": "2023-01-25", "indicators": { "domain": [ "autoprotect.gb.net", "azurehosting.co", "azureprotect.online", "azureprotection.cloud", "azuresecurity.online", "azuresecurity.site", "bankofamerica.offerings.cloud", "careers.bankofamerica.nyc", "careersbankofamerica.us", "cloud.globiscapital.co", "cloud.mufg.uk", "cloud.tptf.ltd", "cloud.wpic.ink", "docs.azurehosting.co", "globiscapital.co", "hoststudio.org", "ledgercloud.com", "mufg.ink", "mufg.uk", "mufg.us.org", "share.anobaka.info", "tptf.fund", "unchainedcapital.co", "updatezone.org" ] }, "precision": "exact", "references": [ "https://www.proofpoint.com/us/blog/threat-insight/ta444-apt-startup-aimed-at-your-funds" ], "total": 24 }, { "counts": { "domain": 1 }, "first_seen": "2023-01-25", "indicators": { "domain": [ "autoprotect.com.de" ] }, "precision": "exact", "references": [ "https://twitter.com/StopMalvertisin/status/1625710611425554434", "https://www.virustotal.com/gui/file/864f2a624a58cf460689d805e271fbffe24266933cc10166f4342e65143e019f/detection", "https://www.proofpoint.com/us/blog/threat-insight/ta444-apt-startup-aimed-at-your-funds" ], "total": 1 }, { "counts": { "domain": 25 }, "first_seen": "2022-12-30", "indicators": { "domain": [ "abf-cap.co", "abf-cap.com", "angelbridge.capital", "angelbridge.jp", "anobaka.info", "anobaka.jp", "avid.lno-prima.lol", "bankofamerica.nyc", "bankofamerica.tel", "bankofamerica.us.org", "beyondnextventures.co", "beyondnextventures.com", "careers.mizuhogroup.us", "cloud.beyondnextventures.co", "lno-prima.lol", "mizuhogroup.us", "offerings.cloud", "perseus.bond", "smbc-vc.com", "smbc.ltd", "smbcgroup.us", "tptf.co", "tptf.ltd", "tptf.us", "vote.anobaka.info" ] }, "precision": "exact", "references": [ "https://securelist.com/bluenoroff-methods-bypass-motw/108383/", "https://otx.alienvault.com/pulse/63ac10d2a4d29d94a7766d7a" ], "total": 25 }, { "counts": { "domain": 3 }, "first_seen": "2022-12-20", "indicators": { "domain": [ "cloud.prosec.ink", "cloudprotect.us.org", "prosec.ink" ] }, "precision": "exact", "references": [ "https://community.emergingthreats.net/t/ruleset-update-summary-2022-12-19-v10199/212" ], "total": 3 }, { "counts": { "domain": 3 }, "first_seen": "2022-12-14", "indicators": { "domain": [ "gdriveshare.com", "googledrive.services", "wirexapp.app" ] }, "precision": "exact", "references": [ "https://twitter.com/malwrhunterteam/status/1602997656468754432", "https://www.virustotal.com/gui/file/41c83c80fa348d56ccb10fa48114bac52691c9778812547290d13b3214d98e8c/detection" ], "total": 3 }, { "counts": { "domain": 1 }, "first_seen": "2022-08-20", "indicators": { "domain": [ "drive.sharegoogldrive.online" ] }, "precision": "exact", "references": [ "https://twitter.com/behindbreach/status/1287961015506927616", "https://www.clearskysec.com/wp-content/uploads/2020/06/CryptoCore_Group.pdf", "https://otx.alienvault.com/pulse/5ef36f8f63a7d8a11972ca54", "https://vblocalhost.com/conference/presentations/unveiling-the-cryptomimic/", "https://vblocalhost.com/uploads/VB2020-Takai-etal.pdf", "https://vblocalhost.com/uploads/VB2020-18.pdf", "https://otx.alienvault.com/pulse/5f74bcb0be4abfe12d93d2bf" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2022-04-16", "indicators": { "domain": [ "gdocsdown.com" ] }, "precision": "exact", "references": [ "https://twitter.com/e_kaspersky/status/1481665686351106053", "https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/" ], "total": 1 }, { "counts": { "domain": 100 }, "first_seen": "2022-01-17", "indicators": { "domain": [ "163qiye.top", "abiesvc.com", "abiesvc.info", "abiesvc.jp.net", "atom.publicvm.com", "att.gdrvupload.xyz", "azure-service.com", "azureprotect.xyz", "azureword.com", "backup.163qiye.top", "beenos.biz", "bhomes.cc", "bitcoinnews.mefound.com", "bitflyer.team", "bloomcloud.org", "buidihub.com", "circlecapital.us", "client.googleapis.online", "cloud.azure-service.com", "cloud.globalbrains.co", "cloud.jumpshare.vip", "coin-squad.co", "coinbig.dev", "deepmind.fund", "dekryptcap.digital", "doc.venturelabo.co", "doc.youbicapital.cc", "doconline.top", "docs.azureword.com", "docs.coinbigex.com", "docs.goglesheet.com", "docs.securedigitalmarkets.co", "docstream.online", "document.bhomes.cc", "document.fastercapital.cc", "document.kraken-dev.com", "document.lundbergs.cc", "document.skandiafastigheter.cc", "documents.antcapital.us", "docuserver.xyz", "domainhost.dynamic-dns.net", "download.azure-safe.com", "download.azure-service.com", "download.gdriveupload.site", "drives.googldrive.xyz", "drives.googlecloud.live", "driveshare.googldrive.xyz", "dronefund.icu", "drw.capital", "eii.world", "etherscan.mrslove.com", "faq78.faqserv.com", "fastdown.site", "fastercapital.cc", "file.venturelabo.co", "filestream.download", "foundico.mefound.com", "galaxydigital.cc", "galaxydigital.cloud", "globalbrains.co", "googleservice.icu", "gsheet.gdocsdown.com", "hiccup.shop", "isosecurity.xyz", "jack710.club", "jumpshare.vip", "kraken-dev.com", "lemniscap.cc", "lundbergs.cc", "mail.gdriveupload.info", "mail.gmaildrive.site", "mail.googleupload.info", "microstratgey.com", "miss.outletalertsdaily.com", "msoffice.qooqle.download", "note.onedocshare.com", "onlinedocpage.org", "outletalertsdaily.com", "page.googledocpage.com", "protect.venturelabo.co", "pvset.itsaol.com", "qoqle.online", "regcnlab.com", "reit.live", "securedigitalmarkets.ca", "securedigitalmarkets.co", "share.bloomcloud.org", "share.docuserver.xyz", "sharedocs.xyz", "sinovationventures.co", "skandiafastigheter.cc", "slot0.regcnlab.com", "svr04.faqserv.com", "tokenhub.mefound.com", "tokentrack.mrbasic.com", "updatepool.online", "upload.gdrives.best", "verify.googleauth.pro", "word.azureword.com", "youbicapital.cc" ] }, "precision": "exact", "references": [ "https://twitter.com/e_kaspersky/status/1481665686351106053", "https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/" ], "total": 100 }, { "counts": { "domain": 13, "ipv4": 5, "url": 2 }, "first_seen": "2022-01-14", "indicators": { "domain": [ "devstar.dnsrd.com", "dllhost.xyz", "fxbet.linkpc.net", "lservs.linkpc.net", "mmsreceive.linkpc.net", "msservices.hxxps443.org", "onlineshoping.publicvm.com", "palconshop.linkpc.net", "pokersonic.publicvm.com", "press.linkpc.net", "rubbishshop.linkpc.net", "rubbishshop.publicvm.com", "socins.publicvm.com" ], "ipv4": [ "118.70.116.154:8080", "163.25.24.44:443", "186.183.185.94:8080", "45.238.25.2:443", "66.181.166.15:8080" ], "url": [ "http://163.25.24.44", "http://45.238.25.2" ] }, "precision": "exact", "references": [ "https://twitter.com/e_kaspersky/status/1481665686351106053", "https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/" ], "total": 20 }, { "counts": { "domain": 2 }, "first_seen": "2022-01-07", "indicators": { "domain": [ "share.stablemarket.org", "stablemarket.org" ] }, "precision": "exact", "references": [ "https://twitter.com/e_kaspersky/status/1481665686351106053", "https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/" ], "total": 2 }, { "counts": { "domain": 3 }, "first_seen": "2022-01-01", "indicators": { "domain": [ "googlesheetpage.org", "onlinedoc.dev", "product.onlinedoc.dev" ] }, "precision": "exact", "references": [ "https://twitter.com/e_kaspersky/status/1481665686351106053", "https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/" ], "total": 3 }, { "counts": { "domain": 4 }, "first_seen": "2021-07-10", "indicators": { "domain": [ "devprocloud.com", "share.devprocloud.com", "sharebusiness.xyz", "signverydn.sharebusiness.xyz" ] }, "precision": "exact", "references": [ "https://twitter.com/e_kaspersky/status/1481665686351106053", "https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/" ], "total": 4 }, { "counts": { "domain": 1 }, "first_seen": "2021-06-19", "indicators": { "domain": [ "authenticate.azure-drive.com" ] }, "precision": "exact", "references": [ "https://twitter.com/e_kaspersky/status/1481665686351106053", "https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/" ], "total": 1 }, { "counts": { "domain": 2 }, "first_seen": "2021-06-09", "indicators": { "domain": [ "azure-drive.com", "protect.azure-drive.com" ] }, "precision": "exact", "references": [ "https://twitter.com/e_kaspersky/status/1481665686351106053", "https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2021-05-11", "indicators": { "domain": [ "googledocpage.com" ] }, "precision": "exact", "references": [ "https://twitter.com/e_kaspersky/status/1481665686351106053", "https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/" ], "total": 1 }, { "counts": { "domain": 2 }, "first_seen": "2021-05-06", "indicators": { "domain": [ "cloud.venturelabo.co", "venturelabo.co" ] }, "precision": "exact", "references": [ "https://twitter.com/e_kaspersky/status/1481665686351106053", "https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2021-04-11", "indicators": { "domain": [ "protectoffice.club" ] }, "precision": "exact", "references": [ "https://twitter.com/e_kaspersky/status/1481665686351106053", "https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/" ], "total": 1 }, { "counts": { "domain": 5 }, "first_seen": "2021-03-26", "indicators": { "domain": [ "chemistryworld.us", "coinbigex.com", "innoenergy.info", "mclland.com", "qooqle.download" ] }, "precision": "exact", "references": [ "https://twitter.com/e_kaspersky/status/1481665686351106053", "https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/" ], "total": 5 }, { "counts": { "domain": 3 }, "first_seen": "2021-03-23", "indicators": { "domain": [ "antcapital.us", "document.antcapital.us", "protect.antcapital.us" ] }, "precision": "exact", "references": [ "https://twitter.com/e_kaspersky/status/1481665686351106053", "https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/" ], "total": 3 }, { "counts": { "domain": 1 }, "first_seen": "2021-03-22", "indicators": { "domain": [ "cloudshare.jumpshare.vip" ] }, "precision": "exact", "references": [ "https://twitter.com/e_kaspersky/status/1481665686351106053", "https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/" ], "total": 1 }, { "counts": { "domain": 2 }, "first_seen": "2021-03-21", "indicators": { "domain": [ "documentprotect.live", "documentprotect.pro" ] }, "precision": "exact", "references": [ "https://twitter.com/e_kaspersky/status/1481665686351106053", "https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/" ], "total": 2 }, { "counts": { "domain": 2 }, "first_seen": "2021-03-12", "indicators": { "domain": [ "docs.gdriveshare.top", "up.digifincx.com" ] }, "precision": "exact", "references": [ "https://twitter.com/e_kaspersky/status/1481665686351106053", "https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2020-09-10", "indicators": { "domain": [ "googleservice.xyz" ] }, "precision": "exact", "references": [ "https://twitter.com/e_kaspersky/status/1481665686351106053", "https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/" ], "total": 1 }, { "counts": { "domain": 27, "ipv4": 2 }, "first_seen": "2020-08-25", "indicators": { "domain": [ "armzon.onmypc.org", "blackwell.tekstar.us", "btcprime.itsaol.com", "chromeupdate.publicvm.com", "coindeck.onmypc.org", "coinnews.onmypc.org", "coinomic.itsaol.com", "connsec.publicvm.com", "ddsvr.itsaol.com", "drivegoogle.publicvm.com", "drivegooogle.publicvm.com", "esosv.itemdb.com", "europegdprsec.onmypc.org", "eusharesrv.onmypc.org", "excinfo.itemdb.com", "gdrive.onmypc.org", "googleupdate.publicvm.com", "matrixpartners.theworkpc.com", "mpksl.publicvm.com", "mskpupdate.publicvm.com", "msupdate.publicvm.com", "onedriveupdate.publicvm.com", "sevicebill.itemdb.com", "termsofservice.onmypc.org", "tokenomic.itsaol.com", "vpset.onmypc.org", "windrvupdate.kozow.com" ], "ipv4": [ "140.136.134.201:8080", "41.85.145.164:8080" ] }, "precision": "exact", "references": [ "https://twitter.com/behindbreach/status/1287961015506927616", "https://www.clearskysec.com/wp-content/uploads/2020/06/CryptoCore_Group.pdf", "https://otx.alienvault.com/pulse/5ef36f8f63a7d8a11972ca54", "https://vblocalhost.com/conference/presentations/unveiling-the-cryptomimic/", "https://vblocalhost.com/uploads/VB2020-Takai-etal.pdf", "https://vblocalhost.com/uploads/VB2020-18.pdf", "https://otx.alienvault.com/pulse/5f74bcb0be4abfe12d93d2bf" ], "total": 29 }, { "counts": { "domain": 4 }, "first_seen": "2020-08-25", "indicators": { "domain": [ "googledrive.publicvm.com", "ledgerservice.itsaol.com", "twosigma.publicvm.com", "vpsfree.linkpc.net" ] }, "precision": "exact", "references": [ "https://twitter.com/e_kaspersky/status/1481665686351106053", "https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/", "https://twitter.com/behindbreach/status/1287961015506927616", "https://www.clearskysec.com/wp-content/uploads/2020/06/CryptoCore_Group.pdf", "https://otx.alienvault.com/pulse/5ef36f8f63a7d8a11972ca54", "https://vblocalhost.com/conference/presentations/unveiling-the-cryptomimic/", "https://vblocalhost.com/uploads/VB2020-Takai-etal.pdf", "https://vblocalhost.com/uploads/VB2020-18.pdf", "https://otx.alienvault.com/pulse/5f74bcb0be4abfe12d93d2bf" ], "total": 4 }, { "counts": { "domain": 1 }, "first_seen": "2020-08-25", "indicators": { "domain": [ "blog.cloudsecure.space" ] }, "precision": "exact", "references": [ "https://twitter.com/e_kaspersky/status/1481665686351106053", "https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/", "https://twitter.com/_re_fox/status/1232320036834025472", "https://app.any.run/tasks/8d5e66c9-3942-4e00-bfdf-8f2c24054a92/" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2020-08-25", "indicators": { "domain": [ "drivegoogles.com" ] }, "precision": "exact", "references": [ "https://twitter.com/_re_fox/status/1298281770597654529" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2020-08-25", "indicators": { "domain": [ "twosigmateam.info" ] }, "precision": "exact", "references": [ "https://twitter.com/_re_fox/status/1280138335214804995" ], "total": 1 }, { "counts": { "ipv4": 1 }, "first_seen": "2020-08-25", "indicators": { "ipv4": [ "140.117.91.22:8080" ] }, "precision": "exact", "references": [ "https://twitter.com/_re_fox/status/1232320036834025472", "https://app.any.run/tasks/8d5e66c9-3942-4e00-bfdf-8f2c24054a92/" ], "total": 1 }, { "counts": { "domain": 57 }, "first_seen": "2020-06-24", "indicators": { "domain": [ "1driv.org", "1drv.email", "1drvmail.work", "amzonnews.club", "blockchaintransparency.institute", "bugscrowd.com", "cloudocs.space", "decurret.site", "digifincx.com", "drivegmail.top", "drivegoogle.org", "drivegooglshare.xyz", "euprotect.net", "fcloudshare.xyz", "filecloud.website", "financialmarketing.live", "gdriverfileshare.com", "gdrives.best", "gdrives.top", "gdriveshareslink.xyz", "gdriveupload.site", "gdrvauth.cloud", "gdrvcheck.co", "gdrvshare.site", "gmaildrive.info", "gmaildriver.info", "gogleshare.xyz", "googldocs.org", "googleclouddrive.com", "googlecstorage.com", "googledrive.network", "googledriver.net", "googledriver.xyz", "googledriveshare.com", "googledrv.com", "googlefiledrive.com", "googlefileshare.com", "googleshare.org", "krypitalvc.com", "microsoftapp.life", "msupdatepms.xyz", "navicheck.xyz", "onedrivecloud.store", "onedriveglobal.com", "onedrivems.online", "onedrivrshares.xyz", "onedrvdn.co", "onedrvfile.site", "privacyshield.services", "provemail.net", "sendspace.buzz", "sharedrivegght.xyz", "sharegoogldrive.online", "sharesdown.xyz", "showprice.xyz", "uploadsfiles.xyz", "wechart.org" ] }, "precision": "exact", "references": [ "https://twitter.com/behindbreach/status/1287961015506927616", "https://www.clearskysec.com/wp-content/uploads/2020/06/CryptoCore_Group.pdf", "https://otx.alienvault.com/pulse/5ef36f8f63a7d8a11972ca54", "https://vblocalhost.com/conference/presentations/unveiling-the-cryptomimic/", "https://vblocalhost.com/uploads/VB2020-Takai-etal.pdf", "https://vblocalhost.com/uploads/VB2020-18.pdf", "https://otx.alienvault.com/pulse/5f74bcb0be4abfe12d93d2bf" ], "total": 57 }, { "counts": { "domain": 11 }, "first_seen": "2020-06-24", "indicators": { "domain": [ "cloudsecure.space", "gdriveshare.top", "gdrvupload.xyz", "goglesheet.com", "googldrive.xyz", "googleapis.online", "googlecloud.live", "googledrive.download", "googledrive.email", "googledrive.online", "googleexplore.net" ] }, "precision": "exact", "references": [ "https://twitter.com/e_kaspersky/status/1481665686351106053", "https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/", "https://twitter.com/behindbreach/status/1287961015506927616", "https://www.clearskysec.com/wp-content/uploads/2020/06/CryptoCore_Group.pdf", "https://otx.alienvault.com/pulse/5ef36f8f63a7d8a11972ca54", "https://vblocalhost.com/conference/presentations/unveiling-the-cryptomimic/", "https://vblocalhost.com/uploads/VB2020-Takai-etal.pdf", "https://vblocalhost.com/uploads/VB2020-18.pdf", "https://otx.alienvault.com/pulse/5f74bcb0be4abfe12d93d2bf" ], "total": 11 }, { "counts": { "domain": 1 }, "first_seen": "2020-05-14", "indicators": { "domain": [ "ownemail.me" ] }, "precision": "exact", "references": [ "https://twitter.com/behindbreach/status/1287961015506927616", "https://www.clearskysec.com/wp-content/uploads/2020/06/CryptoCore_Group.pdf", "https://otx.alienvault.com/pulse/5ef36f8f63a7d8a11972ca54", "https://vblocalhost.com/conference/presentations/unveiling-the-cryptomimic/", "https://vblocalhost.com/uploads/VB2020-Takai-etal.pdf", "https://vblocalhost.com/uploads/VB2020-18.pdf", "https://otx.alienvault.com/pulse/5f74bcb0be4abfe12d93d2bf" ], "total": 1 }, { "counts": { "domain": 2 }, "first_seen": "2020-04-18", "indicators": { "domain": [ "googledrive.dynu.net", "googledrive.linkpc.net" ] }, "precision": "exact", "references": [ "https://twitter.com/behindbreach/status/1287961015506927616", "https://www.clearskysec.com/wp-content/uploads/2020/06/CryptoCore_Group.pdf", "https://otx.alienvault.com/pulse/5ef36f8f63a7d8a11972ca54", "https://vblocalhost.com/conference/presentations/unveiling-the-cryptomimic/", "https://vblocalhost.com/uploads/VB2020-Takai-etal.pdf", "https://vblocalhost.com/uploads/VB2020-18.pdf", "https://otx.alienvault.com/pulse/5f74bcb0be4abfe12d93d2bf" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2020-03-31", "indicators": { "domain": [ "cloudfiles.club" ] }, "precision": "exact", "references": [ "https://twitter.com/behindbreach/status/1287961015506927616", "https://www.clearskysec.com/wp-content/uploads/2020/06/CryptoCore_Group.pdf", "https://otx.alienvault.com/pulse/5ef36f8f63a7d8a11972ca54", "https://vblocalhost.com/conference/presentations/unveiling-the-cryptomimic/", "https://vblocalhost.com/uploads/VB2020-Takai-etal.pdf", "https://vblocalhost.com/uploads/VB2020-18.pdf", "https://otx.alienvault.com/pulse/5f74bcb0be4abfe12d93d2bf" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2020-02-21", "indicators": { "domain": [ "gdriveupload.info" ] }, "precision": "exact", "references": [ "https://twitter.com/e_kaspersky/status/1481665686351106053", "https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/", "https://twitter.com/behindbreach/status/1287961015506927616", "https://www.clearskysec.com/wp-content/uploads/2020/06/CryptoCore_Group.pdf", "https://otx.alienvault.com/pulse/5ef36f8f63a7d8a11972ca54", "https://vblocalhost.com/conference/presentations/unveiling-the-cryptomimic/", "https://vblocalhost.com/uploads/VB2020-Takai-etal.pdf", "https://vblocalhost.com/uploads/VB2020-18.pdf", "https://otx.alienvault.com/pulse/5f74bcb0be4abfe12d93d2bf" ], "total": 1 }, { "counts": { "domain": 5 }, "first_seen": "2020-02-07", "indicators": { "domain": [ "amazonaws1.info", "gdrvup.xyz", "googledriver.info", "liveonedrvshare.xyz", "secureshares.online" ] }, "precision": "exact", "references": [ "https://twitter.com/behindbreach/status/1287961015506927616", "https://www.clearskysec.com/wp-content/uploads/2020/06/CryptoCore_Group.pdf", "https://otx.alienvault.com/pulse/5ef36f8f63a7d8a11972ca54", "https://vblocalhost.com/conference/presentations/unveiling-the-cryptomimic/", "https://vblocalhost.com/uploads/VB2020-Takai-etal.pdf", "https://vblocalhost.com/uploads/VB2020-18.pdf", "https://otx.alienvault.com/pulse/5f74bcb0be4abfe12d93d2bf" ], "total": 5 }, { "counts": { "domain": 3 }, "first_seen": "2020-02-07", "indicators": { "domain": [ "gmaildrive.site", "googleauth.pro", "googleupload.info" ] }, "precision": "exact", "references": [ "https://twitter.com/e_kaspersky/status/1481665686351106053", "https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/", "https://twitter.com/behindbreach/status/1287961015506927616", "https://www.clearskysec.com/wp-content/uploads/2020/06/CryptoCore_Group.pdf", "https://otx.alienvault.com/pulse/5ef36f8f63a7d8a11972ca54", "https://vblocalhost.com/conference/presentations/unveiling-the-cryptomimic/", "https://vblocalhost.com/uploads/VB2020-Takai-etal.pdf", "https://vblocalhost.com/uploads/VB2020-18.pdf", "https://otx.alienvault.com/pulse/5f74bcb0be4abfe12d93d2bf" ], "total": 3 }, { "counts": { "domain": 10 }, "first_seen": "2019-12-09", "indicators": { "domain": [ "a.updatesinfos.com", "b.updatesinfos.com", "gphi-adhaswe.xyz", "gphi-gsaeyheq.top", "gphi.site", "ip1.gphi-adhaswe.xyz", "ip1.gphi-gsaeyheq.top", "ip1.s.gphi.site", "ip2.s.gphi.site", "updatesinfos.com" ] }, "precision": "exact", "references": [ "https://twitter.com/ccxsaber/status/1204007469053165570" ], "total": 10 }, { "counts": { "domain": 1 }, "first_seen": "2018-10-23", "indicators": { "domain": [ "bitdefs.ignorelist.com" ] }, "precision": "exact", "references": [ "https://content.fireeye.com/apt/rpt-apt38", "https://otx.alienvault.com/pulse/5bb4bdccd63eeb0a87994870" ], "total": 1 } ] }