# APTtrail - G0096 APT41 domains
# 541 indicators | https://github.com/trilwu/apttrail
# Generated 2026-08-08T03:26:30+00:00
111111.note.down-flash.com
2f2640fb.dns.1433.eu.org
335b5282.dns.1433.eu.org
360photo.oss-cn-hongkong.aliyuncs.com
64-176-59-232.ipv4.staticdns3.io
64.176.35.214.sslip.io
64.176.65.49.sslip.io
6ed123bf7c014f8597b97c1e88c9d7e1.ddns.gcloud.gg
7f4d5b4d9b3b4474a46824c3ae43d06a.ddns.gcloud.gg
91newai.com
a.linuxupdate.info
accounts.longmusic.com
ad.scgawj.com
admin.netbill.pk
adobe-cdn.org
aejava.ddns.net
aejva.ddns.net
afdentry.workstation.eu.org
afsder.com
agegamepay.com
ageofwuxia.com
ageofwuxia.info
ageofwuxia.net
ageofwuxia.org
akacur.tk
akamaixed.net
alibaba.zzux.com
aliyun.com.co
alpha-els.com
alxc.tbtianyan.com
amazonlivenews.com
ampolice.org
andropwn.xyz
aone.ddns.net
ap.philancourts.com
api-v2.cloud
api.emazemedia.com
api.googleauthenticatoronline.com
api.sourcedata.kuwannba.com
app.kaspersky-scan.com
app.microsoftstaticapi.com
app30.hema129.com
app40.hema129.com
arestc.net
asdasw21.icu
ashcrack.freetcp.com
assistcustody.xyz
astudycarsceu.net
asushotfix.com
atomiclampco.com
auth.microsoftsservice.com
az.performed12.com
back.rooter.tk
backdoor.apt.photo
bganmcza.top
bigflx.net
bingsearches.com
bobs8.oss-cn-hongkong.aliyuncs.com
bold-hamilton.207-246-119-197.plesk.page
boopainc.com
box.xxe.pw
browser-events-data-microsoft.com
bssllxqxqzyo.giize.com
bugcheck.xigncodeservice.com
buildhosting.club
bulkyservice.info
byeserver.com
c.ymvh8w5.xyz
caba.superdasqe.me
cargobussi.org
carruthersfredericklawyers.com
carruthersfredericklegals.com
cashmicrosoft.com
cdn.google-au.ga
cdn.ns.time12.cf
cdn.withrental.com
cdn7854.workers.dev
chaindefend.bid
channels.openvista.ma
checkin.travelsanignacio.com
chrome.down-flash.com
chtq.net
closeby.coupons
cloud.kaspersky-scan.com
cloud.microsoftsservice.com
cloud.msapp.workers.dev
cloudat.ddns.net
cloudcat.ddns.net
cnt9.stayout.life
colunm.tk
commandidate.directory
cooltours.s3.sa-east-1.amazonaws.com
copilot-cloud.net
cs.colunm.tk
cs16.dns04.com
cyberkaspersky.com
czs.superdasqe.me
d5922235.dns.1433.eu.org
dasdasgoogle.com
dash.tcplog.com
db.microsoftsservice.com
dbhubspi.com
defendchain.xyz
delaylink.tk
dev.kinopoisksu.com
developers-cloudfare.us
dl-flash.tk
dns.dnserver.life
dns.win10micros0ft.com
dns.xxe.pw
dns224.com
dnserver.life
dnsgogle.com
dnssupportpc.com
doare-assets.s3.sa-east-1.amazonaws.com
down-flash.com
down.xxe.pw
down1.linuxupdate.info
down2.linuxupdate.info
drivefrontend.pa-clients.workers.dev
dscriy.chtq.net
dsqueryonline.com
dsqurey.com
dylerays.tk
east.winsproxy.com
easymicrosoft.com
ec2-16-163-161-107.ap-east-1.compute.amazonaws.com
ecgglass-arq.s3.sa-east-1.amazonaws.com
ellisonpeterslaws.com
ellisonpeterslawyer.com
eloples.com
emazemedia.com
en.earthen.io
erp.kaspersky.icu
ertufg.com
escanavupdate.club
exchange.dumb1.com
exchange.longmusic.com
exchange.openmd5.com
exchange.portomnail.com
exchange4study.com
fadfar.com
farisrezky.com
feedfoodconcerning.info
feedfoodconcerning.org
fervent-curran.45-77-153-108.plesk.page
filename.onedumb.com
final.staticd.dynamic-dns.net
foligni.it
fonts.google-au.ga
freewula.strangled.net
ftp.gulliverwear.com
gallant-pike.45-77-153-108.plesk.page
gamewushu.com
getgooglecard.com
gfsg.chickenkiller.com
gjbopwmail.kozow.com
gknbm.ddns.net
glbaitech.com
gmail.verifypay.shop
gmailnews.net
gnel.feedfoodconcerning.org
goldenclear.top
goldmanrichardlegal.com
goldmanrichardlegals.com
gomyhalf.com
google-au.ga
google.org.im
google.pythonpplus.org
googleaccount.org
googleauthenticatoronline.com
googledrivecloud.com
googlelivenews.com
googleminigames.com
gov.jmjejij.otzo.com
greatsong.soundcast.me
greenhugeman.dns04.com
grxcmoyh.top
gssllxqxqzyo.giize.com
gulliverwear.com
gxh191.top
gxxservice.com
hb.kaspersky-scan.com
heatidc.com
help.down-flash.com
help.tcplog.com
helpwebmicrosoft.com
hinet.ink
hinet.lat
holdmem.dbhubspi.com
home.boopainc.com
homeabcd.com
homologacao-sisp.s3.sa-east-1.amazonaws.com
hopeful-jang.207-246-119-197.plesk.page
huaxin-bantian.duckdns.org
ibmupdate.com
icefirebest.com
icy-bar-c375.microsoft-updates.workers.dev
id2.microsoftsservice.com
img.shaduruanjian8.com
imiul.com
imjzo.com
indianrailway.hopto.org
indiasunsung.com
indrails.com
indrra.ddns.net
infallible-tereshkova.199-247-22-187.plesk.page
infestexe.com
info.kavlabonline.com
infrast.ygto.com
inraja.ddns.net
installation77.com
intanschools.py628fxjlk-gok67gvk2652.p.temp-site.link
invasion-prisoners-inns-aging.trycloudflare.com
ip-89-38-128-94-106854.vps.hosted-by-mvps.net
isbigfish.xyz
islot.ink
it.jmjejij.otzo.com
ixrails.com
jmjejij.otzo.com
jqvmwznu.top
js.down-flash.com
jsj1.linuxupdate.info
kasparsky.net
kaspersky-scan.com
kaspersky.icu
kasperskyguard.co
kasperskyguard.com
kasperskyprotect.com
kasperskysecure.com
kasperskyshield.co
kasperskyupdate.com
kazakhtelecom.zzux.com
kcalmoments.s3.me-south-1.amazonaws.com
kdalpqwx312dwjbb.leopard2.com
kinopoisksu.com
kkdiscover.com
krislab.site
kuwannba.com
kzb.performed12.com
laodocument.com
lemonupdate.ddns.net
libxqagv.ns.dns3.cf
linux-update.net
linux.down-flash.com
linuxupdate.ddns.net
linuxupdate.info
longlifetrump.com
ltupdate.ddns.net
m.necemarket.com
m.shadurauanjian8.com
macfee.ga
mail-pk.xyz
mail.netbill.pk
mail.xxe.pw
mails.foligni.it
maxdesigns.top
mb.glbaitech.com
mcafeeupdates.com
mesto-backtend-mp.nomoredomains.sbs
mesto-frontend-mp.nomoredomains.sbs
mexicobulk.info
mezigom.com
mgm4adminsi.com
mhgxpcgd.top
micheeasodh.top
micro.gay
micro.supermirco.us
microfastforbenden.com
microport.com.cn
micros0ff.com
micros0tf.com
microsoft-updates.workers.dev
microsoft.kiwi.nz
microsoft.performed12.com
microsoftasps.com
microsoftbackups.com
microsoftbooks.dns-dns.com
microsoftbooks.dynamic-dns.net
microsoftcode.com
microsoftcontents.com
microsoftdaily.com
microsoftdesktop.com
microsoftdnshelp.com
microsoftdocs.dns05.com
microsoftfile.com
microsofthelp.dns1.us
microsoftonedrive.help
microsoftonlineupdate.dynamic-dns.net
microsoftremotehelps.com
microsoftsservice.com
microsoftstaticapi.com
micsoftonedrive.com
midtntoday.com
milli-seconds.com
mindssurpass.com
mirco.supermirco.us
mircoo.supermirco.us
mircosoftdoc.com
mircoupdate.https443.net
mirros.microsoftcontents.com
mirros3.linuxupdate.info
mm.portomnail.com
modibest.sytes.net
money.moneyhome.biz
mongolv.com
ms1.hinet.lat
msa.hinet.ink
msn-microsoft.org
mssetting.com
mta0.bulkyservice.info
mta0.mexicobulk.info
n2.xxe.pw
ncdle.net
necemarket.com
netbill.pk
network.oossafe.com
networkpach.com
new-openai.com
newimages.socialpt2021.tk
news.revecontopsy.com
ngo.91newai.com
node5.cnaidun.net
note.down-flash.com
notes.oossafe.com
notify.serveuser.com
notped.com
ns.cloud01.tk
ns.cloud20.tk
ns.glbaitech.com
ns.microsoftdocs.dns05.com
ns.mircosoftdoc.com
ns.supermirco.us
ns1.akacur.tk
ns1.bulkyservice.info
ns1.colunm.tk
ns1.dnssupportpc.com
ns1.entrydns.eu.org
ns1.extrsports.ru
ns1.microsoftdnshelp.com
ns1.xxe.pw
ns2.akacur.tk
ns2.bulkyservice.info
ns2.colunm.tk
ns2.dnssupportpc.com
ns2.mexicobulk.info
ns2.microsoftdnshelp.com
ns2.xxe.pw
ntpc-co.com
oca.pics
officecdn-microsoft-com.akamaixed.net
oldfriendsnetwork.com
onedriveconsole.com
oossafe.com
operatingbox.com
opwmail.kozow.com
orange-breeze-66bb.tezsfsoikdvd.workers.dev
paloaltonetworkhelp.com
pandorarve.com
paniesx.com
pants-graphs-optics-worse.trycloudflare.com
patch.updatesapi.com
performed12.com
pic.farisrezky.com
pishgaman.pw
pk-information.com
platform.freetcp.com
pneword.net
portomnail.com
power.installation77.com
prod.microsoftdirect.com
proradead.s3.sa-east-1.amazonaws.com
protacik.com
proxy-test.dynv6.net
proxy.xxe.pw
ptciocl.com
pubs.infinityfreeapp.com
pythonpplus.org
q.xxe.pw
q2.xxe.pw
q4.xxe.pw
qq.xxe.pw
queryip.cf
quickmicrosoft.com
qw05.liaoqazqq.com
railway.sytes.net
railways.hopto.org
rallyracingglobal.com
rambiler.com
random.netbill.pk
randzalo.com
realgodad.workers.dev
recall-addressed-who-collector.trycloudflare.com
recordar-simmco.s3.sa-east-1.amazonaws.com
reply.ygto.com
resource.infinityfreeapp.com
revitpourtous.com
riwmztda.top
rocean.oca.pics
rtku.lat
rtxwen.com
s.pishgaman.pw
s3-azure.com
s3-contemp.s3.sa-east-1.amazonaws.com
s3-microsoft.com
s3-r-w.me-south-1.amazonaws.com
s3bucket-azure.online
s3cloud-azure.com
sapress.help
schememicrosoft.com
sdbnasbnf.top
sdfsj3h1s54-yh.foy9dong.com
securityhealthservice.com
server.mexicobulk.info
server04.dns04.com
serverbye.com
service.dns22.ml
service04.dns04.com
sexyjapan.ddns.info
shaduranjian8.com
shadurauanjian8.com
shaduruanjian8.com
shipcardonlinehelp.com
shrill-tooth-b557.vgfjuic.workers.dev
silly-swirles.207-246-119-197.plesk.page
simplexoj.com
smartdevoe.com
smiss.imwork.net
smivsugd.top
smsvc.mooo.com
socialentertainments.store
socialpt2021.club
solarwindsaf.com
sourcedata.kuwannba.com
souzacambos.s3.sa-east-1.amazonaws.com
splunkds.com
st.kinopoisksu.com
static.adobe-cdn.org
static.developers-cloudfare.us
static.krislab.site
static.tcplog.com
static.trendmicrotech.com
stationarycell.xyz
status.s3cloud-azure.com
stdhgd.com
subnet.milli-seconds.com
superdasqe.me
supermarket.ownip.net
supermirco.us
supership.dynv6.net
sv3.xxyybb.xyz
symanteclabs.com
symence.org
szuunet.strangled.net
tastygoodness.net
tc.microsoftsservice.com
tcplog.com
techniciantext.com
techsupport-microsoft.co.in
term-restore-satisfied-hence.trycloudflare.com
test.dagnelie.fr
test.securityhealthservice.com
time.afsder.com
time.kkdiscover.com
time12.cf
top.microsoftsservice.com
topmicrosoft.com
topmicrosoftmarketing.com
track.cdn78544.ru
transcom.ddns.net
trendmicrotech.com
trendupdate.dns05.com
tripmerry.com
ttareyice.jkub.com
turkeylahainasunset.com
tw.new-openai.com
twitterproxy.com
twnoc.ddns.net
ubuntumax.com
ufsllcdxb-ae.com
umbet.art
unaecry.zzux.com
updata.dsqueryonline.com
updata.dsqurey.com
updata.installation77.com
update-chrome.realgodad.workers.dev
update.alpha-els.com
update.imiul.com
update.imjzo.com
update.kkdiscover.com
update.micro.gay
update.networkpach.com
update.performed12.com
update.updatemic.com
updatemic.com
updatenew.servehttp.com
us2.s3bucket-azure.online
ussainc.org
vbnmob.ddns.net
verifypay.shop
vgfjuic.workers.dev
viewdns.ml
vip.googleminigames.com
visualstudio-microsoft.com
vmess.xhhzs.cn
voda.dns04.com
voiptelsolutions.splynx.app
volleyball.ddns.net
vpnmobupdate.ddns.net
wait.imiul.com
ways-sms-pmc-shareholders.trycloudflare.com
weblink.microsoftsservice.com
websencl.com
wikipedla.blog
win10micros0ft.com
win7update.net
windowsupdate.cyou
winsproxy.com
word.msapp.workers.dev
wordpresss-data.s3.me-south-1.amazonaws.com
work.queryip.cf
work.viewdns.ml
workers.viewdns.ml
x.xxe.pw
xeaefryx.top
xiang1234.oss-cn-hongkong.aliyuncs.com
xiiltrionsoledadprod.s3.sa-east-1.amazonaws.com
xtools.lol
xvaxzoac.top
xxe.linuxupdate.info
xxe.pw
xxyybb.xyz
yandex2unitedstated.dns04.com
ymvh8w5.xyz
youtubedownloading.com
yunchat.ddns.net
yxwasec.com
zalofilescdn.com
zhydromet.com
zitanlodge.com
zngb.kozow.com