{
  "aliases": [
    "GroupA21",
    "apt-04",
    "apt-c-24",
    "apt-q-39",
    "apt-q-42",
    "babyelephant",
    "ghostchat",
    "hardcore nationalist",
    "nh2",
    "rattlesnake",
    "sloppylemming",
    "ta399"
  ],
  "attack_id": "G0121",
  "attack_name": "Sidewinder",
  "attack_url": "https://attack.mitre.org/groups/G0121/",
  "counts": {
    "domain": 3640,
    "ipv4": 50,
    "url": 41,
    "url_path": 37
  },
  "first_seen": {
    "domain": {
      "0range.site": "2026-01-02",
      "0ultook.live": "2026-01-02",
      "1.modp-pk.org": "2024-04-04",
      "101c4a583c3acdd2a06ca2fb183cf995fgd55fghf67dhf7dhf7dhnfks7.pages.dev": "2026-01-02",
      "101c4a583c3acdd2afd06ca2fb183cf995sdfsdh54jkdfgh54893489h5.pages.dev": "2026-01-02",
      "101c4a583c3acdd2dfgn54990fgmkl5i90ghml569ig06ca2fb183cf995.pages.dev": "2026-01-02",
      "101c4a5fdjfjkf8fg90fksd9dfslsd0fk83c3acdd2a06ca2fb183cf995.pages.dev": "2026-01-02",
      "109.176.30.212.sslip.io": "2026-01-02",
      "126-com.live": "2024-02-27",
      "126mail-cn.com": "2026-01-02",
      "163inc.org": "2024-03-15",
      "168-gov.info": "2024-09-26",
      "16bz5.pmreco.xyz": "2026-01-02",
      "17067699af72f31706fgjkf5kg9j4990gk950.netlify.app": "2026-01-02",
      "172.86.92.150.sslip.io": "2026-01-02",
      "1846m.pmreco.xyz": "2026-01-02",
      "1c1157fa.caa.update.customs-lk.org": "2022-10-22",
      "1d06bfb2.check.update.fia-gov.org": "2022-10-22",
      "1d06bfb2.local.update.fia-gov.org": "2022-10-22",
      "1d06bfb2.scan.update.fia-gov.org": "2022-10-22",
      "203-124351878443.hopto.org": "2024-02-23",
      "234rewr44dfs34sdf43454353fd4ffg345rr4.netlify.app": "2026-02-16",
      "24170-40494.bacloud.info": "2026-01-02",
      "2672ewr5403894534fgdgfd5907e44fdfgdfg67088gdfgfd90e2cbd8b6.pages.dev": "2026-06-10",
      "2aeb306b-4c5f-4cc6-a7a2-6fcd96612b9d.us-east-1.cloud.genez.io": "2026-01-02",
      "2let.org": "2024-04-04",
      "2r.nrtcpk-net.com": "2026-05-14",
      "38273409.mail-defence-lk-loging-horde.pages.dev": "2024-12-27",
      "3nxyc.pmreco.xyz": "2026-01-02",
      "423743f1-53d2-41bf-9dba-e1e0b7c8f460.pmreco.xyz": "2026-01-02",
      "435fdgfd-fgh675gh56jh-65jhg65ghjytu65.netlify.app": "2026-02-16",
      "4yj7f.pmreco.xyz": "2026-01-02",
      "5673696e-bcf9-4a34-848d-2e6875b0561e.us-east-1.cloud.genez.io": "2026-01-02",
      "5vs9r.pmreco.xyz": "2026-01-02",
      "63inc.com": "2024-10-15",
      "64115cb6.check.update.fia-gov.org": "2022-10-22",
      "6441056b613c32a9.dwnlld.info": "2026-01-02",
      "6dbb77fd-6d9d-415e-b414-3d1051cd33f4.dytt888.net": "2026-01-02",
      "753fa5b2.check.update.fia-gov.org": "2022-10-22",
      "7b1271c3-0158-4f94-b54e-d51a4be1cfc4.us-east-1.cloud.genez.io": "2026-01-02",
      "7ef1996f-c463-4540-936a-70d0fd477f98.live-co.org": "2026-01-02",
      "81-cn.ddns.net": "2025-01-06",
      "81-cn.info": "2025-01-06",
      "85476ee3-a4b9-4815-bd1d-68653205e378.us-east-1.cloud.genez.io": "2026-01-02",
      "8ad94e36.cdn-caa-sco.pages.dev": "2026-01-02",
      "96c54.pmreco.xyz": "2026-01-02",
      "982m31.pmreco.xyz": "2026-01-02",
      "9af72fg4jg75hg8jg94kg94k9fk390gk4170674tr69bf1f766cdec1d11.pages.dev": "2026-02-16",
      "9af72fg4jg75hg8jg9dfghhfgdh5666k41706769d32bf1f766cdec1d1.pages.dev": "2026-06-10",
      "9af72fg4jg75hg8jg9dfghhfgdh5666k41706769d32bf1f766cdec1d11.pages.dev": "2026-06-10",
      "9t.fetchdrives.info": "2026-07-23",
      "a.bc.1d06bfb2.check.update.fia-gov.org": "2022-10-22",
      "a.bc.1d06bfb2.local.update.fia-gov.org": "2022-10-22",
      "a.bc.1d06bfb2.scan.update.fia-gov.org": "2022-10-22",
      "a.bc.64115cb6.check.update.fia-gov.org": "2022-10-22",
      "a.fetchdrive.info": "2026-01-02",
      "a5936441-e402-41e3-b02b-75af112074b5.org-co.net": "2026-01-02",
      "a6dff163-e0b9-49c9-87e4-357f761f3c3b.us-east-1.cloud.genez.io": "2026-01-02",
      "aa173.bank-ok.com": "2023-05-17",
      "aapletv.org": "2026-01-02",
      "abc.bol-north.com": "2022-12-01",
      "academy.lesporc.live": "2024-01-11",
      "acc.pk-govt.net": "2024-10-25",
      "acenent.site": "2026-01-02",
      "acfinang.shop": "2026-01-02",
      "acrobat.paknavy-pk.org": "2024-09-26",
      "active.roteh.site": "2023-05-17",
      "admin.grabfiles.org": "2026-01-02",
      "admin.onesom.biz": "2026-01-02",
      "adobe.pdf-downlod.com": "2026-01-02",
      "adobe.updatepdf.workers.dev": "2026-02-26",
      "adobeglobal.com": "2026-01-02",
      "advancedhealth.medicallab.site": "2026-01-02",
      "advisary.army-govbd.info": "2026-01-02",
      "advisories-sgcustoms.d0cumentview.info": "2024-11-18",
      "advisory-cabinetgpk.servehttp.com": "2024-02-10",
      "advisory.army-govbd.info": "2026-01-02",
      "advisory.info-bdgov.com": "2026-01-02",
      "advisory.ndma-govpk.co": "2026-01-02",
      "aeltron.xyz": "2022-02-04",
      "aeryple.xyz": "2023-05-17",
      "afcat.xyz": "2022-01-07",
      "afd-bdmil.cdn-pak.net": "2021-03-11",
      "afd.edu-cx.org": "2021-12-26",
      "afdinfo786.bdgov.info": "2026-01-02",
      "afdtrg.nrdi-gov.com": "2026-01-02",
      "afg-refugee.net": "2022-06-08",
      "afghannewsnetwork.com": "2021-06-21",
      "afmat.tech": "2024-04-03",
      "afohs.mod-pak.co": "2021-04-21",
      "afrepublic.xyz": "2021-12-03",
      "agarg.tech": "2023-05-17",
      "agency.lesporc.live": "2024-01-11",
      "agenda-talking-point-for-army.up.railway.app": "2026-01-02",
      "agent.onesom.biz": "2026-01-02",
      "ahsaanullaahkhan.workers.dev": "2026-01-19",
      "ai.mofagov.online": "2024-04-04",
      "ailyun.live": "2023-05-17",
      "aitkenspencelogistics.mofa.live": "2021-12-01",
      "akamai.servehttp.com": "2023-02-15",
      "aku-edu-pk.org": "2026-01-02",
      "alfalahtransct-bank.servehttp.com": "2024-01-15",
      "alhabib.live": "2026-01-02",
      "alibababackupcloud.com": "2023-05-02",
      "aliit.org": "2023-05-11",
      "alit.info": "2022-10-28",
      "alit.live": "2022-06-25",
      "aliyum.email": "2026-01-02",
      "aliyum.org": "2024-05-09",
      "aliyum.tech": "2024-10-15",
      "aliyumm.pro": "2026-01-02",
      "aliyumm.tech": "2024-04-03",
      "aljazeerak.online": "2024-09-26",
      "all-files.mail-sessionexpired.com": "2026-01-02",
      "allpakarmlicences.com": "2026-01-02",
      "allpakarmslicence.com": "2026-01-02",
      "allpakarmslisense.site": "2026-01-02",
      "almighty-allah.com": "2022-06-03",
      "almightyallah.live": "2024-04-03",
      "alphapolice.org": "2026-01-02",
      "alsalaf.info": "2021-02-22",
      "amarsonarbangla123.dgps-govpk.co": "2024-05-09",
      "amazingbonis.com": "2026-01-02",
      "amazonas-gov.co": "2024-05-23",
      "ambpoint.vip": "2026-03-18",
      "amended.army-govbd.info": "2026-01-02",
      "amigos.govt-pk.com": "2024-05-08",
      "amsss.in": "2021-12-03",
      "amuck.scoler.tech": "2023-05-17",
      "analytic.mfa-qov.com": "2026-01-02",
      "andc.govaf.org": "2026-01-02",
      "anefank.mom": "2026-01-02",
      "ankara-mofa-gov-bd.fia-g0v.net": "2026-03-11",
      "antarticarevolution.sbs": "2026-01-02",
      "aop.gov-af.org": "2024-01-16",
      "ap-ms.net": "2020-04-07",
      "ap1-acl.net": "2019-12-17",
      "ap12.ms-update-server.net": "2018-09-29",
      "apgml.pk-govt.net": "2024-10-25",
      "api.ahsaanullaahkhan.workers.dev": "2026-01-19",
      "api.almighty-allah.com": "2022-06-03",
      "api.argus.trondheim.bama.zoopit.no": "2024-01-11",
      "api.crypto-wise.co": "2024-05-09",
      "api.desco-gov-bd.workers.dev": "2026-01-19",
      "api.grabfiles.org": "2026-01-02",
      "api.nbppakistan.com": "2025-02-15",
      "api.nr3c-govpk.com": "2024-02-02",
      "api.onesom.biz": "2026-01-02",
      "api.pkgov.xyz": "2026-01-02",
      "api.supremeallah.world": "2022-06-03",
      "api.vpn-secure.co": "2022-06-02",
      "api.watch-earn.live": "2022-09-02",
      "apl-com.icu": "2024-09-26",
      "apl-org.online": "2024-09-26",
      "apostille-mofa-gov-pk-verify-attestation.cerapostille.com": "2026-04-20",
      "apostille-mofa-gov-pk-verify-attestation.encodertechs.com": "2026-04-20",
      "apostillemofag0v-pk.storeaone.com": "2026-04-20",
      "app-sec01.online": "2025-02-05",
      "app.dytt888.net": "2026-01-02",
      "app.grabfiles.org": "2026-01-02",
      "app.modcloudspace.com": "2026-01-02",
      "app.onesom.biz": "2026-01-02",
      "appclub.live": "2024-05-09",
      "appcrew.info": "2026-01-02",
      "appostile-mofa-pk.storeaone.com": "2026-04-20",
      "appostille-mofa-gov-pk-attestation.storeaone.com": "2026-04-20",
      "appostille-mofa-gov.storeaone.com": "2026-04-20",
      "apps-sco-gov-pk.workers.dev": "2026-08-05",
      "apps.fia-gov.net": "2023-12-29",
      "appsrv.live": "2022-12-05",
      "appsstore.in": "2021-12-03",
      "appt-sdf49fk0apt9dk9sdls9fl-dkgf9dld9.netlify.app": "2026-01-02",
      "arceno.xyz": "2026-01-02",
      "arcteno.live": "2026-01-02",
      "arf26th-hducim-kdu-ac-lk-index-html.pages.dev": "2026-01-02",
      "arg.gov-af.org": "2024-01-16",
      "armlicensepk.site": "2026-01-02",
      "armslicense.interiorgovt.com": "2026-01-02",
      "armslicensekpk.gov-pk.com": "2026-01-02",
      "army-bd.com": "2026-01-02",
      "army-bdgov.com": "2026-01-02",
      "army-govbd.info": "2026-01-02",
      "army-lk.com": "2026-01-02",
      "army-lk.info": "2026-01-02",
      "army-lk.org": "2026-01-02",
      "army.mil.bd.mofa-govlk.com": "2024-08-01",
      "army.mil.bd.pk-govt.com": "2024-08-01",
      "aromne.info": "2026-01-02",
      "article-viewer.com": "2023-05-17",
      "as.pakmarines.com": "2021-07-07",
      "asean-ajp.myftp.org": "2023-11-08",
      "asfinnagg.shop": "2026-01-02",
      "asfrimag.mom": "2026-01-02",
      "asfrimamg.mom": "2026-01-02",
      "asianetnews.xyz": "2022-02-10",
      "askari.bitlyy.me": "2022-06-02",
      "askaribank.bitlyy.me": "2022-06-02",
      "assbutt.xyz": "2023-05-17",
      "assets.fetchdrive.info": "2026-01-02",
      "assumptiontable.click": "2026-01-02",
      "asw-edu.net": "2020-08-24",
      "asw-sns.link": "2021-12-26",
      "asyn.info": "2024-10-15",
      "ateows.info": "2026-01-02",
      "attachments.gov-pk.info": "2021-02-22",
      "au-edu.km01s.net": "2020-05-14",
      "aurora.dawn-904.workers.dev": "2024-09-26",
      "ausib-edu.org": "2023-05-17",
      "ausibedu.org": "2024-04-03",
      "auth.desktopserver.top": "2024-10-16",
      "autoconfig.bdgov.info": "2026-01-02",
      "autoconfig.pk-mail.org": "2026-01-02",
      "autodiscover-paa-gov-pk-auth-logon-aspx.pages.dev": "2026-01-02",
      "autodiscover.mofagov-pk.online": "2021-04-28",
      "autodiscover.pk-mail.org": "2026-01-02",
      "autodiscover.seoshz.live": "2026-01-02",
      "avail.freay.tech": "2023-05-17",
      "awards-piacaero.servehalflife.com": "2024-02-10",
      "awards-piacaero.servehttp.com": "2024-02-10",
      "awards-piaccompk.serveftp.com": "2023-11-23",
      "awrah.live": "2023-04-07",
      "aws-check.net": "2020-01-06",
      "aws-pk.net": "2020-09-26",
      "awww.asianetnews.xyz": "2022-02-10",
      "awww.interior-pk.org": "2022-05-26",
      "awww.kpt-pk.net": "2022-03-17",
      "awww.paf-gov.org": "2022-07-22",
      "awww.paknavy.live": "2022-05-06",
      "awww.srvapp.co": "2022-06-03",
      "awww.tsinghua.institute": "2022-10-20",
      "axigen-web-expired-paknavy-files.netlify.app": "2026-01-02",
      "axis.heplor.biz": "2023-05-17",
      "az-updates.store": "2025-01-06",
      "b1x.mov": "2026-01-02",
      "b5hyr.pmreco.xyz": "2026-01-02",
      "baatube.com": "2026-01-02",
      "backup.download-services.online": "2024-01-30",
      "baerow.live": "2026-01-02",
      "baf.mil.bd.hilsa.online": "2025-02-14",
      "bahariafoundation.live": "2021-12-26",
      "bahariafoundation.org": "2021-05-24",
      "bahria-edu.workers.dev": "2026-03-13",
      "bahriafoundation.live": "2022-06-13",
      "balcon.live": "2022-07-31",
      "balochistanpolice.gov.pk-mail.org": "2026-01-02",
      "bangla.b-cdn.net": "2024-12-19",
      "bangladesh-islamic-baank.workers.dev": "2026-03-02",
      "bangladeshbaank-gov-bd.workers.dev": "2025-01-06",
      "bangladeshmarineacademylibrary.ppinewsagency.live": "2022-06-02",
      "bangladeshnavy.dgps-govpk.co": "2024-05-09",
      "bank-ok.com": "2023-05-17",
      "bankofceylon.sytes.net": "2023-02-15",
      "bard.gov.bd.pk-govt.net": "2024-10-25",
      "basic.gruh.site": "2023-05-17",
      "basis.agarg.tech": "2023-05-17",
      "bb.kdf-mail.com": "2022-06-02",
      "bbcnew.cn": "2022-06-02",
      "bbcworld-news.net": "2022-02-10",
      "bc.1d06bfb2.local.update.fia-gov.org": "2022-10-22",
      "bc.1d06bfb2.scan.update.fia-gov.org": "2022-10-22",
      "bc.753fa5b2.check.update.fia-gov.org": "2022-10-22",
      "bcc.gov.bd.pk-mail.org": "2026-01-02",
      "bcc.gov.bd.ramdaanvibe.info": "2026-01-02",
      "bcc.gov.bd.upworkoffice.online": "2026-01-02",
      "bccgov-bd-production.up.railway.app": "2026-01-02",
      "bd-gov.cdn-dl.cn": "2019-06-17",
      "bd-govt.com": "2026-01-02",
      "bd-govt.info": "2026-01-02",
      "bd.filenest.live": "2026-01-02",
      "bd.gov-co.org": "2024-04-04",
      "bd.govt-net.com": "2024-05-08",
      "bd.govt-org.net": "2024-04-04",
      "bd.govt-pk.com": "2024-05-08",
      "bd.hilsa.online": "2025-02-14",
      "bd.mail-pk.org": "2026-02-06",
      "bd.mofa-govbd.com": "2026-01-02",
      "bd.mofa-govtpk.net": "2026-01-02",
      "bd.officemuwork.online": "2026-01-02",
      "bd.pk-mail.org": "2026-01-02",
      "bd.ramdaanvibe.info": "2026-01-02",
      "bd.upworkoffice.online": "2026-01-02",
      "bdgov-mopa.cdn-dl.cn": "2019-06-17",
      "bdgov.info": "2026-01-02",
      "bdgovt.com": "2026-01-02",
      "bdmil.alit.live": "2022-06-25",
      "bdnavy.download-msoffice.com": "2026-07-11",
      "bdnews.info": "2026-01-02",
      "beaxor.xyz": "2026-01-02",
      "behr.ppinewsagency.live": "2021-12-26",
      "bentec.tech": "2022-10-20",
      "beoe.gov.pk-govt.com": "2024-08-01",
      "beoe.govtpk.co": "2026-01-02",
      "berec.live": "2026-01-02",
      "bgb.gov.bd.mofa-govtpk.net": "2026-01-02",
      "bgevin.live": "2022-07-14",
      "bgmea-com-bd.loadpath.net": "2026-02-08",
      "bgmea.com.bd.mail-pk.org": "2026-02-06",
      "biaa-org-bd.cdn-dl.cn": "2019-06-17",
      "biaa-org.cdn-dl.cn": "2019-06-17",
      "bismi.pro": "2026-01-02",
      "bitlyy.me": "2022-06-02",
      "bizor.live": "2026-01-02",
      "blabla.apl-com.icu": "2024-09-26",
      "blesico.site": "2023-04-07",
      "blesis.live": "2023-05-17",
      "bless.agarg.tech": "2023-05-17",
      "blog.fbmastery.com": "2026-04-04",
      "blog.grabfiles.org": "2026-01-02",
      "blty.at": "2026-01-02",
      "blue-term-c168.gov-pkgov.workers.dev": "2026-01-02",
      "blue.win-service-update.top": "2024-01-30",
      "bluedoor.click": "2023-05-17",
      "blueoceancode.com": "2026-03-18",
      "bluket.live": "2022-07-31",
      "bmac-g0v-cn-aman-exercise-1etter.netlify.app": "2024-11-12",
      "bmac-org-cn-exercise-observer-invites.netlify.app": "2024-11-12",
      "bmac-pla-exercise-aman-2024-letter.netlify.app": "2024-11-12",
      "bmac.iugur.live": "2021-04-21",
      "bnepon.xyz": "2026-01-02",
      "boc-cn.81-cn.info": "2025-01-06",
      "boc.cn.81-cn.info": "2025-01-06",
      "bodec.site": "2026-01-02",
      "bok.pkgov.org": "2022-03-12",
      "boket.tech": "2024-04-03",
      "bol-north.com": "2022-12-01",
      "bol-south.com": "2023-06-25",
      "bol-south.org": "2023-03-10",
      "bold-bonus-1d3b.malik-jaani786.workers.dev": "2026-03-19",
      "bookutrips.com": "2026-01-02",
      "bop.pkgov.org": "2022-03-12",
      "botcel.info": "2026-01-02",
      "botim.cc": "2026-01-02",
      "boundschain.workers.dev": "2026-01-02",
      "br.mofa-pk.org": "2022-07-08",
      "brac.tech": "2023-05-17",
      "brave.agarg.tech": "2023-05-17",
      "breat.info": "2023-05-17",
      "brebd-govt-bd.online": "2026-01-02",
      "brep.cdn-edu.net": "2022-01-10",
      "browser.apl-org.online": "2024-09-26",
      "brwse.co": "2022-06-08",
      "bscic-gov-bd.dwnlld.info": "2026-01-02",
      "btrc-gov-bd.mail-govt.com": "2024-12-19",
      "btud.live": "2024-04-03",
      "buildthenations.info": "2026-01-02",
      "buzsep.info": "2026-01-02",
      "c6udy.pmreco.xyz": "2026-01-02",
      "caa.update.customs-lk.org": "2022-10-22",
      "caab.gov.bd.pk-govt.net": "2024-10-25",
      "caapakistan.pk-mail.org": "2026-01-02",
      "cabinet-division-gov-pk.download-msoffice.com": "2026-07-11",
      "cabinet-division-pk.fia-gov.com": "2023-04-19",
      "cabinet-download-server.top": "2024-05-23",
      "cabinet-gov-bd.donwloaad-file.com": "2026-03-23",
      "cabinet-gov-bd.dwnlld.info": "2026-01-02",
      "cabinet-gov-bd.fia-g0v.net": "2026-03-11",
      "cabinet-gov-bd.nic-svc.net": "2026-01-02",
      "cabinet-gov-bd.org-liv.net": "2026-01-02",
      "cabinet-gov-pk.dytt888.net": "2026-01-02",
      "cabinet-gov-pk.fetchdrive.org": "2026-01-02",
      "cabinet-gov-pk.ministry-pk.net": "2022-01-13",
      "cabinet-gov-pk.mora-govpk.co": "2026-03-21",
      "cabinet-gov-pk.net-co.live": "2026-01-02",
      "cabinet.gov.bd.mofa-govtpk.net": "2026-01-02",
      "cabinet.gov.bd.pk-govt.com": "2024-08-01",
      "cabinet.gov.bd.pk-govt.net": "2024-10-25",
      "cabinet.gov.bd.pk-mailgov.com": "2026-04-21",
      "cabinet.gov.mail-pk.org": "2026-02-06",
      "cabinet.gov.pk-govt.com": "2024-08-01",
      "cabinet.gov.pk-mail.org": "2026-01-02",
      "cabinet.pk-govt.net": "2024-10-25",
      "cabint-division-pk.fia-gov.com": "2024-04-01",
      "cadetcollege.adobeglobal.com": "2026-01-02",
      "cag-org-bd.mail-govt.com": "2024-12-19",
      "caninetdivision.mail-pk.org": "2026-02-06",
      "cap-mofagovpk.servehttp.com": "2024-02-10",
      "cap-mofapk.servehttp.com": "2024-02-10",
      "careitservices.mofa.live": "2021-12-01",
      "careitservices.paknvay-pk.net": "2022-01-06",
      "cas.sysu.edu.cn.81-cn.info": "2025-01-06",
      "cater.sphery.live": "2023-05-17",
      "cb-govt.com": "2025-02-14",
      "cbsl-gov-lk.snagdrive.com": "2026-01-02",
      "cbsl.lk.mail-pk.org": "2026-02-06",
      "cbsl.lk.mofa-govtpk.net": "2026-01-02",
      "cbsl.lk.pk-mail.org": "2026-01-02",
      "cbsl.lk.pk-mailgov.com": "2026-04-21",
      "cc-cvbs-sco.workers.dev": "2026-03-13",
      "cc2mm.pmreco.xyz": "2026-01-02",
      "cdn-aws-s2.net": "2020-09-26",
      "cdn-aws.net": "2021-01-09",
      "cdn-caa-sco.pages.dev": "2026-01-02",
      "cdn-dl.cn": "2019-06-17",
      "cdn-do.net": "2019-07-15",
      "cdn-edge.net": "2019-07-15",
      "cdn-edu.net": "2020-11-17",
      "cdn-gov.net": "2021-05-28",
      "cdn-in.net": "2021-06-11",
      "cdn-list.net": "2019-07-15",
      "cdn-m1l.net": "2020-07-18",
      "cdn-noc.net": "2022-01-06",
      "cdn-pak.net": "2021-03-05",
      "cdn-pkcert-gov-pk.pages.dev": "2026-02-17",
      "cdn-ps.net": "2019-09-09",
      "cdn-re.net": "2020-12-25",
      "cdn-secure.net": "2021-02-20",
      "cdn-sop.net": "2020-10-15",
      "cdn-src.net": "2021-01-09",
      "cdn.awrah.live": "2024-01-11",
      "cdn.bgevin.live": "2022-07-14",
      "cdn.cpec.site": "2024-01-11",
      "cdn.dolper.top": "2024-01-11",
      "cdn.dr-doom.xyz": "2024-01-11",
      "cdn.fritor.xyz": "2022-08-15",
      "cdn.gearfill.biz": "2024-01-11",
      "cdn.geoloc.top": "2024-01-11",
      "cdn.ghaflah.top": "2022-07-29",
      "cdn.greploc.live": "2022-07-31",
      "cdn.hread.live": "2024-01-11",
      "cdn.nelpec.top": "2022-08-17",
      "cdn.plors.tech": "2024-01-11",
      "cdn.polvcrit.info": "2022-07-14",
      "cdn.preag.info": "2024-01-11",
      "cdn.preat.info": "2024-01-11",
      "cdn.prol.info": "2024-01-11",
      "cdn.torsey.xyz": "2023-05-17",
      "cdn.ubrig.live": "2022-08-05",
      "cdn.verocal.info": "2024-01-11",
      "cdsve.bol-north.com": "2022-12-01",
      "ceh.download-msoffice.com": "2026-07-11",
      "ceiling.kalpo.xyz": "2023-05-17",
      "centralized-email-system-np.com": "2026-01-02",
      "cert.pk-gov.org": "2021-08-03",
      "cert.repta.live": "2023-05-17",
      "cespkom.info": "2026-01-02",
      "cfau.edu.cn.81-cn.info": "2025-01-06",
      "cga.gov.bd.pk-govt.net": "2024-10-25",
      "cgate.ruve.live": "2023-06-11",
      "cgd64-gkgiot9lg0-ghbasbousa-01156egog.netlify.app": "2026-01-02",
      "cgwic-sessionexpired-challenge.pages.dev": "2026-01-02",
      "cgwic-sessionexpired-challenges.pages.dev": "2026-01-02",
      "changeworld.hopto.org": "2022-02-09",
      "check.update.fia-gov.org": "2022-10-22",
      "china-immigration-department-letter.netlify.app": "2024-11-12",
      "china.bbcnew.cn": "2022-06-02",
      "chinese-pla-a1rforce-0fficil-drive.netlify.app": "2024-11-12",
      "chrom3.net": "2020-06-03",
      "chughtai.medicallab.site": "2026-01-02",
      "ciamat.info": "2026-01-02",
      "circular-financegov.servehalflife.com": "2024-02-10",
      "circular.nrtcpk-net.com": "2026-05-14",
      "circulars.ntcpk.co": "2026-01-02",
      "cirt-gov-bd.org-liv.net": "2026-01-02",
      "cirt-gov-mm.fia-gov.net": "2023-12-25",
      "civil.leyra.tech": "2024-01-11",
      "civix.live": "2022-06-08",
      "civix.site": "2022-10-28",
      "claimmofnewbudgetsgp-ars.zeabur.app": "2026-01-02",
      "claimmofnewbudgetsgp-ck.zeabur.app": "2026-01-02",
      "claimmofnewbudgetsgp-fm.zeabur.app": "2026-01-02",
      "claimmofnewbudgetsgp-jz.zeabur.app": "2026-01-02",
      "claimmofnewbudgetsgp-pd.zeabur.app": "2026-01-02",
      "claimmofnewbudgetsgp-rk.zeabur.app": "2026-01-02",
      "claimmofnewbudgetsgp-vn.zeabur.app": "2026-01-02",
      "claimmofnewbuedgetsg-ars.zeabur.app": "2026-01-02",
      "claimmofnewbuedgetsg-ck.zeabur.app": "2026-01-02",
      "claimmofnewbuedgetsg-fm.zeabur.app": "2026-01-02",
      "claimmofnewbuedgetsg-jz.zeabur.app": "2026-01-02",
      "claimmofnewbuedgetsg-pd.zeabur.app": "2026-01-02",
      "claimmofnewbuedgetsg-rk.zeabur.app": "2026-01-02",
      "claimmofnewbuedgetsg-vn.zeabur.app": "2026-01-02",
      "claimmofnewbuedgetsgp-ars.zeabur.app": "2026-01-02",
      "claimmofnewbuedgetsgp-ck.zeabur.app": "2026-01-02",
      "claimmofnewbuedgetsgp-fm.zeabur.app": "2026-01-02",
      "claimmofnewbuedgetsgp-jz.zeabur.app": "2026-01-02",
      "claimmofnewbuedgetsgp-pd.zeabur.app": "2026-01-02",
      "claimmofnewbuedgetsgp-rk.zeabur.app": "2026-01-02",
      "claimmofnewbuedgetsgp-vn.zeabur.app": "2026-01-02",
      "claimmofnewbuedgetssg-ck.zeabur.app": "2026-01-02",
      "claimmofnewbuedgetssg-jz.zeabur.app": "2026-01-02",
      "claimmofnewbuedgetssg-pd.zeabur.app": "2026-01-02",
      "claimmofnewbuedgetssg-rk.zeabur.app": "2026-01-02",
      "claimmofnewbuedgetssg-vn.zeabur.app": "2026-01-02",
      "classifieds.workers.dev": "2024-09-26",
      "click-here-to-keep-same-password.netlify.app": "2026-01-02",
      "climb.kalpo.xyz": "2023-05-17",
      "clopem.info": "2026-01-02",
      "cloud-apt.net": "2022-06-02",
      "cloud-ntdc.servehttp.com": "2023-11-23",
      "cloud-ptclnetpk.servehttp.com": "2023-10-16",
      "cloud.coremailcloud.com": "2026-01-02",
      "cloud.dellicon.top": "2024-09-10",
      "cloud.desktopserver.top": "2024-10-16",
      "cloud.moe.gov.cn.81-cn.info": "2025-01-06",
      "cloud.nitc.gavnp.org": "2023-11-08",
      "cloudforme.top": "2026-05-14",
      "cloudmails.live": "2024-11-15",
      "cloudplatfromservice.one": "2023-08-24",
      "cloudpmo.top": "2024-12-26",
      "cluster.jotse.info": "2023-05-17",
      "cmclient-downloader.serveirc.com": "2025-01-06",
      "cmm.int-secure.org": "2025-01-05",
      "cms.bahria-edu.workers.dev": "2026-03-13",
      "cms.grabfiles.org": "2026-01-02",
      "cn.cvix.live": "2022-01-07",
      "cnmm.int-secure.org": "2025-01-05",
      "cnsa-gov.com": "2024-05-23",
      "cnsa-gov.org": "2024-10-15",
      "collector.nbppakistan.com": "2025-02-15",
      "colot.info": "2024-10-15",
      "com-e-visa.online": "2026-03-13",
      "com.bd.mail-pk.org": "2026-02-06",
      "com.gov-co.org": "2024-04-04",
      "com.govt-net.com": "2024-05-08",
      "com.mail-pk.org": "2026-02-06",
      "com.news-bd.com": "2026-01-02",
      "com.pakchinavest.info": "2024-04-12",
      "com.pk-mail.org": "2026-01-02",
      "combined-training-and-administrative.netlify.app": "2026-01-02",
      "command.ms-office.app": "2024-10-11",
      "commerce-gov-in.iima.remotexs.in": "2024-04-29",
      "commerce-gov-pk.directt888.com": "2024-04-03",
      "commerce-gov-pk.fetchdrive.org": "2026-01-02",
      "commerce.gov.pk.mail-pk.org": "2026-02-06",
      "commerce.gov.pk.pk-mailgov.com": "2026-04-21",
      "commerce.govpk.me": "2025-01-16",
      "communications.gov.mail-pk.org": "2026-02-06",
      "complaints-ntcgovpk.viewdns.net": "2023-10-16",
      "compnetworkservices.ddns.net": "2026-01-02",
      "compress.bahariafoundation.live": "2021-12-26",
      "comptes.tech": "2024-04-03",
      "comsates.org": "2021-05-25",
      "comsats-mail.pk": "2022-10-14",
      "comsats-net.com": "2022-09-30",
      "comsats.xyz": "2022-05-26",
      "condet.org": "2024-10-15",
      "confidential.ndma-govpk.co": "2026-01-02",
      "confidential.zapto.org": "2024-09-26",
      "confluence.assbutt.xyz": "2023-05-17",
      "conft.live": "2024-10-15",
      "connectiiest.com": "2023-03-10",
      "cons-mofa-gov-pk-hqr-1777839.online": "2026-01-02",
      "cons-mofa-gov-pk.rf.gd": "2026-01-02",
      "cons-mofa-govt.pk": "2026-01-02",
      "cons-mofagovpk.servehttp.com": "2024-02-25",
      "cons.gov-pk.pk": "2026-01-02",
      "cons.mofa-gov-pk.site": "2024-08-07",
      "cons.mofa.gov.pk-hq.qrrl.net": "2024-04-04",
      "cons.mofa.gov.pk.2let.org": "2024-04-04",
      "cons.mofa.gov.pk.cons1.mfa-ir.cn": "2026-01-02",
      "cons.mofagovpk.co": "2026-01-02",
      "consmofa-gov-pk.com": "2026-01-02",
      "consmofa.gov-pk.pk": "2026-01-02",
      "consmofagov.com": "2026-01-02",
      "consmofagovhqipk.com": "2026-01-02",
      "contact.gov-pak.org": "2021-02-22",
      "contract-agreement-with-staff.zeabur.app": "2026-04-06",
      "control.pk-mailgov.com": "2026-04-21",
      "coordination-cas-visit.netlify.app": "2026-01-02",
      "coremailcloud.com": "2026-01-02",
      "corporate-social-activity-updates.ciecc.com.cn.81-cn.info": "2025-01-06",
      "cosmic.cvix.live": "2022-01-07",
      "count.plokin.top": "2022-10-26",
      "countpro.info": "2023-05-17",
      "covid.bbcnew.cn": "2022-06-02",
      "covid.pakgov.net": "2022-06-02",
      "covid.pkrepublic.org": "2022-06-02",
      "covid19.mohp-gov.org": "2022-06-02",
      "cpanel-nha-gov-pk.pakistan-gov-pk.workers.dev": "2024-03-04",
      "cpanel.govpk.info": "2023-10-02",
      "cpanel.govpk.live": "2024-01-16",
      "cpanel.mofagov-pk.online": "2021-04-28",
      "cpanel.news-bd.com": "2026-01-02",
      "cpanel.pk-mail.org": "2026-01-02",
      "cpcalendars.bdgov.info": "2026-01-02",
      "cpcalendars.govpk.live": "2024-01-16",
      "cpcalendars.mofagov-pk.online": "2021-04-28",
      "cpcalendars.pk-mail.org": "2026-01-02",
      "cpcontacts.govpk.live": "2024-01-16",
      "cpcontacts.mofagov-pk.online": "2021-04-28",
      "cpcontacts.pk-mail.org": "2026-01-02",
      "cpec.site": "2023-05-17",
      "cpj.org.pk-mailgov.com": "2026-04-21",
      "cr20g.org": "2022-06-02",
      "crclab-bahria.org": "2022-02-22",
      "crec-bangladesh.ddns.net": "2025-01-06",
      "crec-bd.site": "2024-09-26",
      "crisismanagementunit.comsates.org": "2021-05-25",
      "critical-patch-update.com": "2026-01-02",
      "crontec.site": "2026-01-02",
      "crypto-wise.co": "2024-05-09",
      "crypton0019.workers.dev": "2024-02-23",
      "csd-govpk.servehttp.com": "2023-06-13",
      "csd-pk.co": "2022-06-02",
      "csd-pk.online": "2026-01-02",
      "csd.bitlyy.me": "2022-06-02",
      "csd.govpk-mail.net": "2022-05-23",
      "csd.paf-govt.net": "2022-12-21",
      "csd.pakgov.net": "2022-06-02",
      "csd.pkgov.org": "2022-03-12",
      "csdstore.app": "2023-05-17",
      "csla.blesis.live": "2024-01-11",
      "cssc-net.co": "2023-05-17",
      "cssc.info": "2022-05-19",
      "cssc.live": "2022-09-08",
      "cstc-spares-vip-163.dowmload.net": "2023-03-10",
      "ctd.govt-pk.com": "2024-05-23",
      "ctd2.police.fia-gov.com": "2024-04-01",
      "customs-gov-lk.net-co.info": "2026-01-02",
      "customs-lk.org": "2022-10-22",
      "customs.document-viewer.info": "2024-09-18",
      "cvix.cc": "2023-05-17",
      "cvix.live": "2022-01-07",
      "cxvdfg.aliit.org": "2023-05-11",
      "cyber.pmd-offc.info": "2024-08-15",
      "cybernet.pkgov.org": "2022-03-12",
      "cybersecurity.nepalarmy-milnp.info": "2026-01-02",
      "cylit.info": "2023-07-12",
      "d01fa.net": "2020-04-07",
      "d0cumentview.info": "2024-11-18",
      "d0ownload.com": "2026-01-02",
      "d0wnlaod.com": "2026-01-02",
      "d0wnlaod.org": "2026-01-02",
      "d101c4a583c3acdd2a06ca2fb183cf99d6fm7fjdf8djf9lfjf4mfi89.pages.dev": "2026-01-02",
      "d2klia4zfdp2mg.cloudfront.net": "2022-09-14",
      "d515dc5c-16cd-4443-8f83-0ab5cb549050.us-east-1.cloud.genez.io": "2026-01-02",
      "dacastexpo.com": "2026-01-02",
      "dad.fia-gov.com": "2023-04-19",
      "dafillio.com": "2026-01-02",
      "dafpak.org": "2024-04-03",
      "daraz-pk.com": "2023-05-13",
      "dasds.pak-gov.com": "2022-06-02",
      "dasdsadsa.pak-gov.com": "2022-06-02",
      "dashboard.onesom.biz": "2026-01-02",
      "data-protect.tech": "2023-06-11",
      "data-sob-gov-bd.live-co.org": "2025-02-17",
      "dawn.apl-org.online": "2024-09-26",
      "dawn.pakgov.org": "2022-06-02",
      "dawn.pkgov.org": "2022-03-12",
      "dawnnews.workers.dev": "2024-09-26",
      "dawnpk.org": "2022-06-02",
      "dbarny-fdtref.up.railway.app": "2026-01-02",
      "dbms.crclab-bahria.org": "2022-02-22",
      "dc-4c46fcf37468.news-bd.com": "2026-01-02",
      "deb-cn.net": "2020-01-06",
      "debcon.live": "2026-01-02",
      "decoty.tech": "2024-10-15",
      "defence-bd.net": "2026-01-02",
      "defence-lk.military-bd.org": "2024-12-13",
      "defence-np.net": "2026-01-02",
      "defence.lk.gov-co.org": "2024-04-04",
      "defence.lk.gov-org.net": "2024-01-05",
      "defencearmy.pro": "2026-01-02",
      "defencelk.cvix.live": "2022-01-07",
      "defenec.net": "2024-04-03",
      "defense-housing-authority.vagued.live": "2026-08-07",
      "defpak.net": "2023-08-29",
      "defpak.org": "2023-03-21",
      "defrgthyj.ksewpk.com": "2022-04-25",
      "dekl-dgprocur2028200-ljakefli.leapcell.dev": "2026-03-14",
      "del-ivery.net": "2021-01-27",
      "dellicon.top": "2024-09-10",
      "demcon.live": "2026-01-02",
      "demo.fetchdrive.info": "2026-01-02",
      "demo.grabfiles.org": "2026-01-02",
      "demsflygerxamy.com": "2026-01-02",
      "density.meplor.xyz": "2024-01-11",
      "depo-gov-pk.loadpath.net": "2026-02-08",
      "depo-govpk.com": "2026-01-02",
      "depo.govpk.me": "2025-01-16",
      "deputy.meplor.xyz": "2024-01-11",
      "desco-gov-bd.workers.dev": "2026-01-19",
      "desk.fia-gov.com": "2023-04-19",
      "desktopserver.top": "2024-09-27",
      "detru.info": "2024-04-03",
      "dev.fetchdrive.info": "2026-01-02",
      "dev.govpk.info": "2023-10-02",
      "dev.grabfiles.org": "2026-01-02",
      "dev.onesom.biz": "2026-01-02",
      "df.donwloaad-file.com": "2026-03-23",
      "dfd-punjab.govt-pk.com": "2024-05-08",
      "dfd.punjab.govt-pk.com": "2024-05-08",
      "dfgrthy.moma-pk.org": "2022-01-07",
      "dfkl-mdalifhossen595864-bqa6juqe.leapcell.dev": "2026-01-16",
      "dgdfvdf.bol-north.com": "2022-12-01",
      "dgdp-account-file-data-doc-procuremen.netlify.app": "2026-01-02",
      "dgdp-drive-file-sharing-pdf-files-doc.netlify.app": "2026-01-02",
      "dgdp-gov-pk-technical-specification.pages.dev": "2026-01-02",
      "dgdp-gov-pk-technical-specification1.pages.dev": "2026-01-02",
      "dgdp-product-details-2025-turkey.netlify.app": "2026-01-02",
      "dgdp.cloud.secured.file.updatemind52.com": "2026-01-02",
      "dger.bol-north.com": "2022-12-01",
      "dgfi.gov.bd": "2026-01-02",
      "dgmi-share-folder-nepalarmy-mil-np-coas-sambodhan-pdf.netlify.app": "2021-04-28",
      "dgmp-paknavy.mod-pk.com": "2022-02-08",
      "dgms.paknavy-gov.com": "2023-05-13",
      "dgpr.paknvay-pk.net": "2022-01-06",
      "dgps-govpk.co": "2024-05-09",
      "dgps-govpk.com": "2024-05-09",
      "dgps-govpk.org": "2024-05-09",
      "dgps-govtpk.com": "2024-07-11",
      "dgtk.depo-govpk.com": "2026-01-02",
      "dha.pakgov.org": "2022-06-02",
      "diagov.ddns.net": "2024-02-02",
      "digitalworldonline.net": "2022-01-05",
      "dinfed.co": "2024-10-15",
      "dirbspta.govpk.live": "2024-01-16",
      "dirco.gov.za.mail-pk.org": "2026-02-06",
      "dirctt88.co": "2024-05-28",
      "dirctt88.info": "2025-02-10",
      "dirctt88.net": "2024-10-15",
      "dirctt88.org": "2023-05-17",
      "dirctt888.com": "2026-01-02",
      "dirctt888.info": "2024-10-11",
      "dirctt888.net": "2024-10-22",
      "direct88.co": "2024-10-15",
      "direct88.org": "2022-10-28",
      "direct880.net": "2026-04-28",
      "direct888.net": "2024-01-05",
      "direct888.org": "2024-01-11",
      "directt88.com": "2026-01-02",
      "directt88.org": "2023-05-17",
      "directt888.com": "2024-04-03",
      "dirsports.milqq.info": "2026-01-02",
      "discount.kpt-gov.org": "2022-07-20",
      "discount.srvapp.co": "2022-06-03",
      "discounts-ptclnetpk.servehttp.com": "2024-02-18",
      "dl.vlc-services.cfd": "2026-01-02",
      "dlimpunjabgov.com": "2026-01-02",
      "dlimsindhgov.com": "2026-01-02",
      "dlimsitp-gov.com": "2026-01-02",
      "dlimskpk-gov.com.pk": "2026-01-02",
      "dlimspunjab.gov-pk.com": "2026-01-02",
      "dlimspunjabgovpk.com": "2024-08-11",
      "dlimssindh.gov-pk.com": "2026-01-02",
      "dlimssindh.gov-pk.site": "2026-01-02",
      "dma.treasury.gov.lk.pk-mail.org": "2026-01-02",
      "dmerpccc.gov.pk.gmail.com.pk-mailgov.com": "2026-04-21",
      "dns-mofgovbt.ddns.net": "2023-11-02",
      "dns.andc.govaf.org": "2026-01-02",
      "dns.govnp.org": "2023-11-22",
      "dns.nepal.gavnp.org": "2023-11-08",
      "dns1.pk-gov.org": "2021-08-03",
      "dnsvay8faydj3f79dje9djr02j101c4a583c3acdd2a06ca2fb183cf995.pages.dev": "2026-01-02",
      "dnsvay8faydj3f79dje9djr02j101c4atg3c3acdd2a06ca2fb183cf995.pages.dev": "2026-06-10",
      "dntnavymil.mofw.pro": "2024-12-04",
      "doc-downlod.com": "2026-01-02",
      "doc-ye9wbezc.b4a.run": "2026-01-02",
      "docs.apl-com.icu": "2024-09-26",
      "docs.files-windows.top": "2026-05-14",
      "docs.mofa-services-server.top": "2024-04-30",
      "docum.store": "2025-02-05",
      "document-viewer.info": "2024-09-18",
      "document-viewer.live": "2024-09-03",
      "documents-server-pk.top": "2024-05-23",
      "documentviewer.info": "2026-01-02",
      "docuserve.ltd": "2022-06-02",
      "docusserve.cc": "2022-06-08",
      "docusserve.ltd": "2022-06-08",
      "docx2a2e3e78e76bcc759905da3f1532a4b8c2word.download-msoffice.com": "2026-07-11",
      "dof-govmm.sytes.net": "2023-11-03",
      "doken.xyz": "2022-06-08",
      "dolper.top": "2023-05-17",
      "donwloaad-file.com": "2026-03-23",
      "donwload-file.com": "2024-10-15",
      "donwloaded.com": "2026-01-02",
      "donwloaded.net": "2024-01-05",
      "dopm.gov.np.totheeverest.com": "2025-02-14",
      "dowmload.co": "2024-08-11",
      "dowmload.info": "2024-08-07",
      "dowmload.net": "2023-03-10",
      "dowmload.org": "2024-05-08",
      "dowmloade.org": "2026-01-02",
      "downl0ad.org": "2026-01-02",
      "downld.net": "2022-12-06",
      "downld.org": "2026-01-02",
      "download-doc.com": "2026-02-14",
      "download-doc.net": "2026-01-02",
      "download-file.net": "2024-04-03",
      "download-files-0pen-err0r-l0gin.netlify.app": "2025-01-05",
      "download-msoffice.com": "2026-07-11",
      "download-secure-app-from-icloud.malik-jaani786.workers.dev": "2026-03-01",
      "download-services.online": "2024-01-30",
      "download-store.tech": "2026-01-02",
      "downloadabledocx.com": "2024-10-15",
      "downloadfileddssdrrg.zeabur.app": "2026-01-02",
      "downloadfiles-mail.pages.dev": "2025-01-05",
      "downloads.masarh.live": "2026-01-02",
      "downnload.net": "2026-01-02",
      "downnload.org": "2025-01-06",
      "dp.islamic-finder.org": "2026-03-24",
      "dr-doom.xyz": "2023-05-17",
      "draft-paper-advertisementfdg.netlify.app": "2024-12-24",
      "drive-acct-offl-pdf.com": "2026-01-02",
      "drive-afd-gov-bd-account-file.netlify.app": "2026-01-02",
      "drive-armed-force-day-cas-msg.netlify.app": "2026-01-02",
      "drive-army-mil-bd-account-data-file.netlify.app": "2026-01-02",
      "drive-baf-mil-bd-share-file.netlify.app": "2026-01-02",
      "drive-bcc-registraion-cloud-storage.netlify.app": "2026-01-02",
      "drive-dgdp-gov-bd-confidential-files.netlify.app": "2026-01-02",
      "drive-dgdp-gov-bd-files.netlify.app": "2026-01-02",
      "drive-mha-gov-bd-files-acctn-doct.netlify.app": "2026-01-02",
      "drive-nepal-gov-np-files.netlify.app": "2026-01-02",
      "drive-nepal-gov.com": "2026-01-02",
      "drive-newmail-arm-mil-bd-account-data.netlify.app": "2026-01-02",
      "drive-rokectsaans-com-tr-account-file.netlify.app": "2026-01-02",
      "drive-roketsans-com-tr-account-files.netlify.app": "2026-01-02",
      "drive.desktopserver.top": "2024-09-27",
      "driveattachment-mofa.com": "2026-04-23",
      "drsasa.hopto.org": "2023-11-08",
      "drtgfhj.mofss.co": "2023-05-23",
      "dsadsa.pakmarines.com": "2021-07-07",
      "dsasa.cr20g.org": "2022-06-02",
      "dsf.army-lk.com": "2026-01-02",
      "dsfbgnh.office-drive.live": "2022-08-25",
      "dsfgb.pmdu-gov.org": "2023-02-03",
      "dsfvgbh.mofa.live": "2021-12-01",
      "dsmes.xyz": "2023-05-17",
      "dsocem.site": "2026-01-02",
      "dtecyber.nepalarmy-milnp.info": "2026-01-02",
      "dteofmediapsyops.army-lk.com": "2026-01-02",
      "ducane.info": "2026-01-02",
      "dumping-open-burning-of-hazardous-waste.zeabur.app": "2026-05-15",
      "dvdbhjk.pakgov.net": "2022-06-02",
      "dvdf.bol-north.com": "2022-12-01",
      "dwnlld.com": "2026-01-02",
      "dwnlld.info": "2026-01-02",
      "dwnlld.infomfa-gov-lk.dwnlld.info": "2026-01-02",
      "dxfgbdfh.paknavy.live": "2022-05-06",
      "dynamic.nactagovpk.org": "2024-10-15",
      "dynat.tech": "2024-04-03",
      "dytt88.co": "2024-10-25",
      "dytt88.org": "2023-05-11",
      "dytt888.net": "2026-01-02",
      "dytt888.org": "2025-01-28",
      "e-mopf.gov.mm.gov-co.org": "2024-04-04",
      "e-nothi.ddns.net": "2026-01-02",
      "e-servicesptclnetpk.servehttp.com": "2023-12-06",
      "e-supportntc.servehttp.com": "2023-11-23",
      "e-tohfa.net": "2023-05-17",
      "e1ix.mov": "2024-10-15",
      "e1x.tech": "2024-10-15",
      "ead.gov.pk-govt.com": "2024-08-01",
      "ead.govpk.me": "2025-01-16",
      "eairr.mom": "2026-01-02",
      "ebill-ptclnetpk.servehttp.com": "2023-06-02",
      "ecility.xyz": "2026-01-02",
      "ecloudsmails.com": "2024-11-15",
      "ecp.govpk.live": "2024-01-16",
      "ecp.govt-pk.com": "2024-05-23",
      "ecs.pk-govt.net": "2024-10-25",
      "edgeupdate.redirectme.net": "2026-01-02",
      "edms-vpn.ddns.net": "2023-12-30",
      "edu-cx.org": "2021-12-26",
      "edu-mil.cn": "2021-04-21",
      "ee-visa.com": "2026-05-02",
      "eede6f46.cdn-caa-sco.pages.dev": "2026-01-02",
      "efes-mindef-gov-pk.dowmload.org": "2024-05-08",
      "efes-mindef-qov-pk.dowmload.org": "2024-12-13",
      "efrgfh.pak-ntc.org": "2023-05-17",
      "elaopsu.live": "2026-01-02",
      "elccorp-net.ntc-telecomcorporation.workers.dev": "2024-02-18",
      "elchxdnj.pmdu-gov.org": "2023-02-03",
      "elestech.com.pk-mail.org": "2026-01-02",
      "elopter.top": "2023-05-17",
      "emaiil.co": "2024-04-04",
      "email-gov-in.digital": "2022-01-23",
      "email-nepalarmy-mil-np-owa.netlify.app": "2021-04-28",
      "email-sco-gov-pk.zeabur.app": "2026-01-02",
      "email.bcc.gov.bd.ramdaanvibe.info": "2026-01-02",
      "email.mofa.gov.pk.docum.store": "2025-02-05",
      "email.moitt.gov.pk.hilsa.online": "2025-02-14",
      "email.moitt.gov.pk.viewdoc.online": "2026-01-02",
      "email.navy.gov.bd.docum.store": "2025-02-05",
      "email.nespak.pkgov.org": "2022-03-12",
      "email.nitb.pkgov.org": "2022-03-12",
      "email.nlc.pkgov.org": "2022-03-12",
      "email.ntc.gov.pk.viewdoc.online": "2026-01-02",
      "email.nvy.milbd.onlinestatus.live": "2025-02-05",
      "email.paf.gov.pk.viewdoc.online": "2026-01-02",
      "email.pk-govt.net": "2024-10-25",
      "email.pof.gov.pk.viewdoc.online": "2026-01-02",
      "email.sco.gov.pk.viewdoc.online": "2026-01-02",
      "emails.mofa.gov.pk.docum.store": "2025-02-05",
      "emails.moitt.gov.pk.hilsa.online": "2025-02-14",
      "embajadadenepal.es.govt-pk.com": "2024-05-23",
      "embassy-of-italy-visit-to-cxb.netlify.app": "2026-01-02",
      "employ.fdrek.live": "2024-01-11",
      "emv1.army-govbd.info": "2026-01-02",
      "emv1.crypto-wise.co": "2024-05-09",
      "emv1.mofa-gov.org": "2023-09-26",
      "emv1.mofss.co": "2023-05-23",
      "emv1.ntc-net.co": "2023-05-18",
      "emv1.pak-ntc.org": "2023-05-17",
      "emv1.pkgov-mail.com": "2023-06-11",
      "encetion.live": "2026-01-02",
      "enclose.info": "2023-05-17",
      "encrypted-files-paknavy-0pen.netlify.app": "2026-01-02",
      "endofmission.govpk.info": "2023-10-02",
      "endure.sphery.live": "2023-05-17",
      "eneralbqark.shop": "2026-01-02",
      "energy.fdrek.live": "2024-01-11",
      "energy.pkgov.org": "2022-03-12",
      "ep-gov-pk.christmas": "2024-05-23",
      "ep-gov-pk.icu": "2024-05-23",
      "ep-mocha.vercel.app": "2026-07-05",
      "epaper.dawn-323.workers.dev": "2024-09-26",
      "epyi-zimbat-five.vercel.app": "2026-07-05",
      "erd.gov.lk.mofa-govbd.com": "2026-01-02",
      "erd.gov.lk.pk-mail.org": "2026-01-02",
      "ereribe.tech": "2026-01-02",
      "erty.nrtcpk-net.com": "2026-05-14",
      "eservice-ptclnetpk.servehttp.com": "2024-02-10",
      "estabiishment.gov.ministry-gov.org": "2026-04-02",
      "estabiishment.gov.pk-mailgov.com": "2026-04-21",
      "establishment.gov.pk-govt.net": "2024-10-25",
      "establishment.mails-pk.com": "2026-02-11",
      "estate.ovil.tech": "2023-05-17",
      "estsaln.site": "2026-01-02",
      "esxipubad-gov-lk.org-co.net": "2026-01-02",
      "eterplicity.live": "2022-07-14",
      "ethanhunthero125.workers.dev": "2024-02-23",
      "eurekawatersolution.com": "2021-12-03",
      "evisa-nadra-govpak.com": "2026-03-31",
      "ex1.mov": "2026-01-02",
      "exmail-qq-drive.com": "2026-01-02",
      "exosel.info": "2026-01-02",
      "expo.com.cn.mail-files-open-preview.com": "2026-01-02",
      "expo.infinityfreeapp.com": "2026-01-02",
      "expo.test-links.com": "2026-01-02",
      "expolanka.serveftp.com": "2023-02-15",
      "f.edu-cx.org": "2021-12-26",
      "fa-gov-lk.dwnlld.info": "2026-01-02",
      "fab-gov-pk-account.pages.dev": "2026-01-02",
      "fancy-voice-b182.goldibrowhoami.workers.dev": "2026-01-19",
      "fauji.pkgov.org": "2022-03-12",
      "faujifoundation.bitlyy.me": "2022-06-02",
      "fb-dn.net": "2019-07-15",
      "fbmastery.com": "2026-04-04",
      "fbr-g0v.pk": "2026-03-22",
      "fbr-gov-pk.donwloaad-file.com": "2026-03-23",
      "fbr-gov.net": "2024-10-25",
      "fbr-taxupdates.serveblog.net": "2023-11-23",
      "fbr.gov-pk.com": "2026-01-02",
      "fbr.gov.pk-mailgov.com": "2026-04-21",
      "fbr.mod-pak.co": "2021-04-21",
      "fbr.net-pk.org": "2022-11-15",
      "fbr.pak-web.com": "2021-07-29",
      "fbrgov-pk.ddns.net": "2024-02-02",
      "fbrgov.com": "2026-01-02",
      "fbrgov.ddns.net": "2024-02-02",
      "fcgzbgcvzsgrjbnndsfdsdfffcffgzsfwferfvd4hfgtyghjtghjrhgts.pages.dev": "2026-01-02",
      "fdb74.pmreco.xyz": "2026-01-02",
      "fdgnyt.tsinghua.institute": "2022-10-20",
      "fdn-en.net": "2020-04-07",
      "fdn-mac.net": "2022-06-08",
      "fdn-trace.net": "2022-06-02",
      "fdrek.live": "2023-05-17",
      "fdscv.tin-url.com": "2022-06-02",
      "febgif.pk-mail.org": "2026-01-02",
      "feedback.army-lk.info": "2026-01-02",
      "feedback.info-bdgov.com": "2026-01-02",
      "feew6.pmreco.xyz": "2026-01-02",
      "fenctor.top": "2022-10-28",
      "fetchdrive.info": "2026-01-02",
      "fetchdrive.org": "2026-01-02",
      "fetchdrives.info": "2026-07-23",
      "ffc.gov.pk-mail.org": "2026-01-02",
      "fia-g0v.net": "2026-03-11",
      "fia-gob.net": "2025-01-05",
      "fia-gov.com": "2023-04-19",
      "fia-gov.net": "2023-12-25",
      "fia-gov.org": "2022-10-22",
      "fia-govt-net.com.govt-net.com": "2024-05-08",
      "fia.gov.pk-govt.com": "2024-08-01",
      "fia.gov.pk.pk-govt.com": "2024-08-01",
      "fia.govpk.me": "2025-01-16",
      "fia.govt-net.com": "2024-05-08",
      "file-download.co": "2023-05-17",
      "file-downlod.org": "2026-01-02",
      "file-dwnld.net": "2026-01-02",
      "file-dwnld.org": "2026-01-02",
      "file-preview-session-expired.pages.dev": "2026-01-02",
      "file-server.co": "2022-10-28",
      "file.services-download.top": "2024-01-30",
      "filebox-1-y7125191.deta.app": "2024-09-26",
      "filedownload.work": "2022-06-08",
      "filenest.live": "2026-01-02",
      "filenesthub.org": "2026-02-11",
      "files-ci.com": "2025-02-05",
      "files-windows.top": "2026-05-14",
      "files.pdf-download.live": "2024-01-30",
      "fileserve.work": "2022-06-02",
      "fileserver.81-cn.info": "2025-01-06",
      "filesrvr.net": "2020-08-24",
      "finance-gov-pk.rf.gd": "2024-03-06",
      "finance-govnp.servehalflife.com": "2024-02-18",
      "finance-govpk.serveblog.net": "2024-02-10",
      "finance-govpk.serveftp.com": "2024-02-10",
      "finance-govpk.servehttp.com": "2023-06-13",
      "finance.gov-net.co": "2022-10-20",
      "finance.gov.bd.mail-pk.org": "2026-02-06",
      "finance.gov.mv.gov-co.org": "2024-04-04",
      "finance.gov.pk-govt.com": "2024-08-01",
      "finance.gov.pk-govt.net": "2024-10-25",
      "finance.gov.pk-mail.org": "2026-01-02",
      "finance.gov.pk.mail-pk.org": "2026-02-06",
      "finance.gov.pk.ntc-gov.com": "2022-10-14",
      "finance.govpk-mail.net": "2022-05-23",
      "finance.paf-gov.org": "2022-07-22",
      "finance.pakgov.net": "2022-06-02",
      "financegovpk.servehttp.com": "2024-02-10",
      "financeptcl-govpk.servehttp.com": "2023-11-23",
      "financial.pakgov.net": "2022-06-02",
      "fincruitconsulting.in": "2019-12-31",
      "fir.islamabadpolice.gov-pk.site": "2026-01-02",
      "firsatburdaavm.com": "2026-01-02",
      "fisheries.gov.bd.pk-govt.net": "2024-10-25",
      "flix.pakgov.net": "2022-06-02",
      "flomen.xyz": "2026-01-02",
      "flysmart-piac.servehttp.com": "2023-11-23",
      "flysmart-piaccompk.servehttp.com": "2023-06-02",
      "fmprc-gov-cn.dowmload.co": "2024-08-11",
      "fmprc.cdn-pak.net": "2021-03-11",
      "focus.mectel.tech": "2023-05-17",
      "focus.semain.tech": "2023-05-17",
      "fonts.apl-org.online": "2024-09-26",
      "foodies.alit.info": "2022-12-22",
      "foooders.fia-gov.com": "2023-04-19",
      "for.gov-co.org": "2024-04-04",
      "forecast.comsats-net.com": "2023-05-13",
      "foreign.gov.mv.gov-co.org": "2024-04-04",
      "found.neger.site": "2023-05-17",
      "found.troks.site": "2023-05-17",
      "fpsc.gov.pk-mailgov.com": "2026-04-21",
      "fqn-cloud.net": "2020-08-21",
      "fqn-mil.net": "2021-03-05",
      "freay.tech": "2023-05-17",
      "freedom.olerpic.info": "2023-05-17",
      "freshg-dgprocur2028200-ou4zqmub.leapcell.dev": "2026-03-15",
      "fritor.xyz": "2022-08-15",
      "front.bentec.tech": "2022-10-20",
      "frzpwdev.grabfiles.org": "2026-01-02",
      "fsfdsf.edu-cx.org": "2021-12-26",
      "fssp.tech": "2023-07-03",
      "ftp.desco-gov-bd.workers.dev": "2026-01-19",
      "ftp.mofa-govbd.com": "2026-01-02",
      "ftp.pk-mail.org": "2026-01-02",
      "ftp.true-islam.org": "2023-05-17",
      "fujit.info": "2023-05-17",
      "fwd-transaction-slip-52923640.gov1-lk.com": "2026-01-02",
      "fx1.live": "2026-01-02",
      "fyujv.bol-north.com": "2022-12-01",
      "g0v-pk.net": "2024-02-23",
      "g0vt.pk": "2026-01-02",
      "g20-org-za.loadpath.net": "2026-02-08",
      "gateway.ceair.com.81-cn.info": "2025-01-06",
      "gavaf.org": "2023-02-15",
      "gavnp.org": "2023-02-15",
      "gbpay.gov.pk": "2026-01-02",
      "gbpay.pmrugb.gov.pk": "2026-01-02",
      "gclouddrives.com": "2023-08-24",
      "gearfill.biz": "2023-05-17",
      "gebre.tech": "2024-04-03",
      "generic.update.fia-gov.org": "2022-10-22",
      "geneva-mofa-gov-bd.direct880.net": "2026-04-28",
      "geninstr.army-govbd.info": "2026-01-02",
      "geo.org.pk": "2024-08-01",
      "geoloc.top": "2023-05-17",
      "geopk.org": "2024-08-01",
      "georgion.info": "2023-05-17",
      "getnew.file.update.up2dts.online": "2025-02-14",
      "ghaflah.top": "2022-07-29",
      "ghckjxvo.fia-gov.com": "2023-04-19",
      "ghj.pmdu-gov.org": "2023-02-03",
      "girlfriendparty42.workers.dev": "2026-03-16",
      "github.nbppakistan.com": "2025-02-15",
      "gitlab.enclose.info": "2023-05-17",
      "gitlab.seoshz.live": "2026-01-02",
      "gleaming-praline-dcd579.netlify.app": "2026-01-02",
      "globaltimes-cn.org": "2025-01-06",
      "glorec.tech": "2023-05-17",
      "gmail-1-production-3004.up.railway.app": "2026-01-02",
      "gmail.com.mail-pk.org": "2026-02-06",
      "gmail.com.mofa-govlk.com": "2024-08-01",
      "gmail.com.pk-mail.org": "2026-01-02",
      "gmail.com.pk-mailgov.com": "2026-04-21",
      "gmails-downloadnew-production.up.railway.app": "2026-01-02",
      "gmals-downloadpdfs-gdrive.up.railway.app": "2026-01-02",
      "gmapp.info": "2026-01-02",
      "go.edu-cx.org": "2021-12-26",
      "go709p.dytt888.net": "2026-01-02",
      "goc-visit-program-details-pdf.netlify.app": "2026-01-02",
      "goinfinity.tech": "2023-03-10",
      "goldibrowhoami.workers.dev": "2026-01-19",
      "google.com.d-dns.co": "2019-07-15",
      "google.gov-pok.net": "2024-12-13",
      "google.play-store.co": "2022-11-14",
      "gooogle.files-cyber-net-pk.workers.dev": "2026-01-02",
      "gooogle.live": "2025-02-05",
      "goov.pk": "2026-01-02",
      "goslin.info": "2026-01-02",
      "gov-af.net": "2021-01-04",
      "gov-af.org": "2020-12-09",
      "gov-cn.cdn-dl.cn": "2019-06-17",
      "gov-cn.co": "2024-10-25",
      "gov-cn.net": "2021-01-06",
      "gov-cnn.net": "2021-01-06",
      "gov-co.org": "2024-04-04",
      "gov-crt.net": "2021-01-04",
      "gov-govpk.info": "2024-05-23",
      "gov-mail.net": "2021-01-03",
      "gov-mil.cn": "2020-07-10",
      "gov-nadra.net": "2021-01-04",
      "gov-net.co": "2022-10-20",
      "gov-netpk.net": "2022-10-28",
      "gov-np.org": "2020-12-09",
      "gov-office.org": "2026-01-02",
      "gov-org.com": "2024-10-25",
      "gov-org.net": "2024-01-05",
      "gov-pak.com": "2026-02-28",
      "gov-pak.org": "2021-02-22",
      "gov-pbs.net": "2021-01-04",
      "gov-pk.cdn-dl.cn": "2019-06-17",
      "gov-pk.com": "2026-01-02",
      "gov-pk.info": "2021-02-22",
      "gov-pk.net": "2022-06-08",
      "gov-pk.online": "2024-02-02",
      "gov-pk.org": "2020-01-07",
      "gov-pk.pk": "2026-01-02",
      "gov-pk.site": "2026-01-02",
      "gov-pk.workers.dev": "2026-08-05",
      "gov-pkgov.workers.dev": "2024-09-26",
      "gov-pknet.org": "2022-09-14",
      "gov-pmo.net": "2021-01-04",
      "gov-pok.net": "2020-11-05",
      "gov.bd.account.file.updatemind52.com": "2026-01-02",
      "gov.bd.account.login.sessions.webmailarmy.com": "2025-02-14",
      "gov.bd.gov-co.org": "2024-04-04",
      "gov.bd.govt-net.com": "2024-05-08",
      "gov.bd.govt-org.net": "2024-04-04",
      "gov.bd.mail-pk.org": "2026-02-06",
      "gov.bd.mofa-govbd.com": "2026-01-02",
      "gov.bd.mofa-govtpk.net": "2026-01-02",
      "gov.bd.pk-mail.org": "2026-01-02",
      "gov.bd.ramdaanvibe.info": "2026-01-02",
      "gov.bd.upworkoffice.online": "2026-01-02",
      "gov.lk.gov-org.net": "2024-01-05",
      "gov.lk.govt-net.com": "2024-05-08",
      "gov.lk.govt-org.com": "2024-04-04",
      "gov.lk.govt-org.net": "2024-04-04",
      "gov.lk.mail-pk.org": "2026-02-06",
      "gov.lk.mofa-govbd.com": "2026-01-02",
      "gov.lk.mofa-govlk.org": "2026-01-02",
      "gov.lk.mofa-govtpk.net": "2026-01-02",
      "gov.lk.pk-mail.org": "2026-01-02",
      "gov.mail-pk.org": "2026-02-06",
      "gov.ministry-gov.org": "2026-04-02",
      "gov.mm.gov-co.org": "2024-04-04",
      "gov.mm.gov-org.net": "2024-01-05",
      "gov.mv.gov-org.net": "2024-01-05",
      "gov.np.farwestkhabar.com": "2025-02-14",
      "gov.np.gov-co.org": "2024-04-04",
      "gov.np.gov-org.net": "2024-01-05",
      "gov.np.govt-net.com": "2024-05-08",
      "gov.np.mail-pk.org": "2026-02-06",
      "gov.np.namlo.com.np": "2025-02-14",
      "gov.np.officemuwork.online": "2026-01-02",
      "gov.np.pk-mail.org": "2026-01-02",
      "gov.np.totheeverest.com": "2025-02-14",
      "gov.np.unsilk.com": "2025-02-14",
      "gov.np.webproxy.to": "2025-02-14",
      "gov.pakmarines": "2022-06-02",
      "gov.pakmarines.com": "2021-07-07",
      "gov.pk-cam.online": "2026-03-30",
      "gov.pk-hhq.cc": "2026-01-02",
      "gov.pk-hq.cc": "2026-01-02",
      "gov.pk-hq.qrrl.net": "2024-04-04",
      "gov.pk-hq.us": "2026-01-02",
      "gov.pk-hqr-online.co": "2024-04-04",
      "gov.pk-hqr.co": "2026-01-02",
      "gov.pk-hqr.online": "2026-01-02",
      "gov.pk-ht.pk": "2026-01-02",
      "gov.pk-mail.co": "2026-01-02",
      "gov.pk-mail.org": "2026-01-02",
      "gov.pk-mailgov.com": "2026-04-21",
      "gov.pk.1.modp-pk.org": "2024-04-04",
      "gov.pk.2let.org": "2024-04-04",
      "gov.pk.emaiil.co": "2024-04-04",
      "gov.pk.govt-pk.com": "2024-05-08",
      "gov.pk.hilsa.online": "2025-02-14",
      "gov.pk.mail-pk.org": "2026-02-06",
      "gov.pk.modp-pk.org": "2024-04-04",
      "gov.pk.officemuwork.online": "2026-01-02",
      "gov.pk.onev.online": "2026-03-30",
      "gov.pk.pk-mail.org": "2026-01-02",
      "gov.pk.viewdoc.online": "2026-01-02",
      "gov.qrpk.info": "2026-03-30",
      "gov.za.mail-pk.org": "2026-02-06",
      "gov1-lk.com": "2026-01-02",
      "govaf.org": "2026-01-02",
      "govaruba.duckdns.org": "2024-02-02",
      "govbd-div.com": "2026-01-02",
      "gove.pw": "2026-02-28",
      "goverment-pk-update.top": "2024-05-23",
      "government-pak.workers.dev": "2024-02-21",
      "govmm.me": "2026-01-02",
      "govmm.org": "2026-01-02",
      "govnp.live": "2024-02-28",
      "govnp.org": "2023-11-22",
      "govpk-mail.net": "2022-05-23",
      "govpk.email": "2025-01-14",
      "govpk.info": "2023-10-02",
      "govpk.live": "2024-01-16",
      "govpk.me": "2025-01-16",
      "govpk.net": "2023-05-13",
      "govpk.org": "2023-05-16",
      "govpk.site": "2026-01-02",
      "govt-cn.co": "2024-10-25",
      "govt-cn.org": "2024-10-25",
      "govt-net.com": "2024-05-08",
      "govt-org.com": "2024-04-04",
      "govt-org.net": "2024-04-04",
      "govt-pk.com": "2024-05-08",
      "govt-pk.org": "2021-02-22",
      "govtpak.workers.dev": "2024-02-28",
      "govtpk.co": "2026-01-02",
      "govvv.pk": "2025-01-14",
      "gpk-production.up.railway.app": "2026-01-02",
      "grabfiles.net": "2026-02-06",
      "grabfiles.org": "2026-01-02",
      "graty.tech": "2022-11-29",
      "greatslols.com": "2026-01-02",
      "greenpaktourism.pk-mail.org": "2026-01-02",
      "greenstream.top": "2026-01-02",
      "greploc.live": "2022-07-31",
      "gretic.info": "2023-05-17",
      "groove.olipy.info": "2023-05-17",
      "grouit.tech": "2024-10-15",
      "gruve.site": "2023-05-17",
      "gso2.mail163.info": "2025-02-05",
      "gtrec.info": "2024-10-15",
      "guide.graty.tech": "2022-11-29",
      "gunaso.pk-mailgov.com": "2026-04-21",
      "guosapp.vip": "2026-03-18",
      "guotoujgvip.vip": "2026-03-18",
      "gvo-pk.cc": "2026-02-28",
      "gwadar-port.zapto.org": "2026-01-02",
      "gwadarport-gov-pk.gwadarportt.workers.dev": "2024-02-19",
      "gwadarport.ddns.net": "2024-04-12",
      "gwadarport.gov.jzbnco.com": "2024-04-29",
      "gwadarport.gov.packetfilters.org": "2024-04-29",
      "gwadarport.gov.pk.migkua.com": "2024-04-29",
      "gwadarport.gov.pk.rankglobe.com": "2024-04-29",
      "gwadarportt.workers.dev": "2024-02-19",
      "gygaxf.com": "2026-03-18",
      "gyre.site": "2023-08-31",
      "gysdj.mod-gov.org": "2023-02-17",
      "hajj.pakgov.net": "2022-06-02",
      "hajjplanner.bitlyy.me": "2022-06-02",
      "hajjplanner.tin-url.com": "2022-06-02",
      "hakimiya.live": "2023-05-17",
      "halcor.site": "2026-01-02",
      "halterarks.co.uk": "2023-04-20",
      "handle.proey.tech": "2023-05-17",
      "happyhours.sbs": "2026-01-02",
      "hare-ap.live": "2022-09-19",
      "hascolgov.info": "2024-09-26",
      "hbl.pakgov.org": "2022-06-02",
      "hblbank.co": "2022-10-28",
      "health.gov.lk.gov-co.org": "2024-04-04",
      "health.gov.mv.gov-co.org": "2024-04-04",
      "healththebest.com": "2024-10-15",
      "heartissuehigh.win": "2018-10-18",
      "heatwave.paknavy.store": "2024-07-19",
      "hec-gov.com": "2026-01-02",
      "helpdesk-gov.info": "2023-05-17",
      "helpdesk-lab.site": "2024-09-26",
      "helpful-national-poilcy-nepla-gov-np.netlify.app": "2026-01-02",
      "heplor.biz": "2023-05-17",
      "herald-b2a.workers.dev": "2024-09-26",
      "hertic.tech": "2023-05-17",
      "hesco.hascolgov.info": "2024-09-26",
      "hetlic.tech": "2026-01-02",
      "hillview.net.pk.hilsa.online": "2025-02-14",
      "hilsa.online": "2025-02-14",
      "hinoms.com": "2026-01-02",
      "hisidewindersidewinder.pimec-paknavy.updates-installer.store": "2026-01-02",
      "hit-deop-hasan7169004254-f24834bv.leapcell.dev": "2026-01-31",
      "hit-pk.org": "2024-09-26",
      "hit-view-message-preview.malik-jaani786.workers.dev": "2026-03-01",
      "hit.gov.pk.81-cn.info": "2025-01-06",
      "hitpak.org": "2026-01-02",
      "hkunionpoy.vip": "2026-03-18",
      "hldren.info": "2023-05-17",
      "hlones.xyz": "2026-01-02",
      "holemn.xyz": "2026-01-02",
      "holiday.ms-office.app": "2024-10-11",
      "hostmaster.cdn-dl.cn": "2019-06-17",
      "hostmaster.enclose.info": "2023-05-17",
      "hostmaster.news-bd.com": "2026-01-02",
      "hostmaster.play-store.co": "2022-11-14",
      "hotmail.pk-mailgov.com": "2026-04-21",
      "hpqumyre.grabfiles.org": "2026-01-02",
      "hpuniversity.in": "2023-03-01",
      "hpupdate.csd-pk.co": "2022-06-02",
      "hread.live": "2023-05-17",
      "hrka1.pmreco.xyz": "2026-01-02",
      "hrmis-financegovpk.serveftp.com": "2024-02-10",
      "huangjianglee.top": "2026-01-02",
      "humariweb.info": "2024-09-26",
      "huneme.live": "2026-01-02",
      "hurr.zapto.org": "2024-09-26",
      "hust.edu.cn.81-cn.info": "2025-01-06",
      "hyat.tech": "2023-05-17",
      "i737461746963o6578706fo646576z.oszar.com": "2026-01-02",
      "ib.govpk.me": "2025-01-16",
      "ib.govvv.pk": "2025-01-14",
      "ibas-finance-gov-bd.downnload.org": "2025-01-06",
      "ibn.cdn-pak.net": "2021-03-11",
      "icd.punjab.gov.pk-govt.net": "2024-10-25",
      "iclod.org": "2026-01-02",
      "ics.govt-pk.com": "2024-05-08",
      "ics1.govt-pk.com": "2024-05-08",
      "ideas2024-pakistan.myvnc.com": "2024-02-23",
      "ideaspakistan-govpk.myvnc.com": "2024-02-23",
      "idef-2025-conf-data-file-tr-account-d.netlify.app": "2026-01-02",
      "idef2025-com-tr-files-drive-account.netlify.app": "2026-01-02",
      "ier-modile.shop": "2026-01-02",
      "igqlc.pmreco.xyz": "2026-01-02",
      "igyg8z.sepweo.info": "2026-01-02",
      "iididbiy.mod-gov.org": "2023-02-17",
      "ik-gost.ru": "2025-02-14",
      "images-11d.workers.dev": "2024-09-26",
      "imail.aop.gov-af.org": "2020-12-09",
      "imail.aop.gov.af.egateway.nsc-gov.com": "2021-04-28",
      "img-google.paf-gov.com": "2021-05-11",
      "immigration.gov.mv.gov-org.net": "2024-01-05",
      "immigration.gov.np.gov-co.org": "2024-04-04",
      "ims.sudurpashchim.gov.np.farwestkhabar.com": "2025-02-14",
      "inboxofficial-bd.com": "2026-01-02",
      "incometaxreturn.aeltron.xyz": "2022-02-04",
      "independenceday.pafwa.info": "2021-08-05",
      "indianarmy.mailnic.info": "2022-01-27",
      "info-account.cdn-dl.cn": "2019-06-17",
      "info-bdgov.com": "2026-01-02",
      "info-lanka.org": "2026-01-02",
      "info.bangladesh-islamic-baank.workers.dev": "2026-03-02",
      "info.pk-mailgov.com": "2026-04-21",
      "info2.pk-mailgov.com": "2026-04-21",
      "infomfa-gov-lk.dwnlld.info": "2026-01-02",
      "infomofa.workers.dev": "2026-08-07",
      "inkly.net": "2023-05-17",
      "inkora.org": "2026-01-02",
      "inporta.org": "2026-01-02",
      "input.info-bdgov.com": "2026-01-02",
      "insert.roteh.site": "2023-05-17",
      "install-e.store": "2026-01-02",
      "install-manager.com": "2026-01-02",
      "instructions.aeltron.xyz": "2022-02-04",
      "int-secure.org": "2025-01-05",
      "intdtebangladesh.govpk.info": "2023-10-02",
      "interior-gov-pk.com": "2026-01-02",
      "interior-gov-pk.direct880.net": "2026-05-17",
      "interior-gov-pk.file-dwnld.net": "2026-01-02",
      "interior-gov-pk.mail-govt.org": "2025-01-17",
      "interior-ministry.com": "2026-05-19",
      "interior-pk.org": "2022-05-26",
      "interior.gov.pk-mailgov.com": "2026-04-21",
      "interiorgovpk.life": "2026-05-19",
      "interiorgovpk.site": "2026-01-02",
      "interiorgovt.com": "2026-01-02",
      "interiorministrygov.site": "2026-01-02",
      "interiorministrypk.com": "2026-01-02",
      "interiorsgovpk.site": "2026-01-02",
      "internal-advisory-azerbaijan-russia-diplomatic-crisis.defence-np.net": "2026-01-02",
      "internal-portal.ceair.com.81-cn.info": "2025-01-06",
      "investgov.info": "2024-04-12",
      "investigation04.session-out.com": "2024-07-05",
      "investinnepal.gov.np.govt-pk.com": "2024-05-08",
      "invitation-letter.govpk.info": "2023-10-02",
      "invitation-mofa-nepli-gov-np-file.netlify.app": "2026-01-02",
      "invitation.army-lk.info": "2026-01-02",
      "invitation.bahariafoundation.live": "2021-12-26",
      "iportal-ntdcgovpk.myvnc.com": "2024-02-23",
      "ipv6.seoshz.live": "2026-01-02",
      "iran-war-or-deal.zeabur.app": "2026-05-15",
      "iseonea.live": "2026-01-02",
      "ishd.directt88.org": "2023-06-25",
      "islamabadclub.docuserve.ltd": "2022-06-02",
      "islamabadpk.site": "2026-01-02",
      "islamabadpolice.org": "2026-01-02",
      "islamic-finder.org": "2026-01-02",
      "islamic-path.com": "2023-05-17",
      "islamicfinder.bitlyy.me": "2022-06-02",
      "it-pakistan-gov-pk.workers.dev": "2026-01-02",
      "itsupport-gov.com": "2024-09-26",
      "itsupport.apps-sco-gov-pk.workers.dev": "2026-08-05",
      "iugur.live": "2021-04-21",
      "j2zfz.pmreco.xyz": "2026-01-02",
      "jestec.info": "2026-01-02",
      "jester.hyat.tech": "2023-05-17",
      "ji.pakgov.net": "2022-06-02",
      "jingjang-duduva.000webhostapp.com": "2026-01-02",
      "jmicc-gov-pk.pakmarines.com": "2021-07-07",
      "jmicc.xyz": "2022-06-14",
      "job.cssc.info": "2022-05-19",
      "job.kpt-pk.net": "2022-03-17",
      "jobfreeeco.it.com": "2026-03-18",
      "jomeno.site": "2026-01-02",
      "jomens.live": "2026-01-02",
      "jotse.info": "2023-05-17",
      "jp.pkrepublic.org": "2022-06-02",
      "jtops.milqq.info": "2026-01-02",
      "jupyt.tech": "2024-05-09",
      "justice-gov.info": "2024-05-23",
      "kafka.dirctt888.info": "2024-10-11",
      "kaleido.moe": "2026-01-02",
      "kalpo.xyz": "2023-05-17",
      "karachishipyard.krlwin.org": "2022-06-02",
      "kashmirawareness.loadpath.net": "2026-02-08",
      "kat0x.net": "2020-05-14",
      "kavach.mailnic.info": "2022-01-27",
      "kdf-mail.com": "2022-06-02",
      "kenaikan.portdedjibouti.live": "2024-12-13",
      "kenose.live": "2026-01-02",
      "kernet.info": "2024-10-15",
      "ketin.live": "2026-01-02",
      "ketle.site": "2026-01-02",
      "khaleejtimes.cc": "2026-01-02",
      "khanlab.medicallab.site": "2026-01-02",
      "kicov.site": "2026-01-02",
      "kintecc.com": "2026-01-02",
      "kito.countpro.info": "2023-05-17",
      "kmz.fetchdrive.info": "2026-01-02",
      "koepasc.live": "2026-01-02",
      "koitic.org": "2026-01-02",
      "kpkarmslicense.site": "2026-01-02",
      "kppolice.gov.pk-mail.org": "2026-01-02",
      "kpt-gov.org": "2022-07-20",
      "kpt-pk.net": "2022-03-17",
      "kptgov.org": "2026-01-02",
      "kptkp.online": "2026-01-02",
      "kr-i-sas-orv-e-l-a.workers.dev": "2024-02-20",
      "kra20.fun": "2025-02-05",
      "kretic.info": "2024-10-15",
      "krlwin.org": "2022-06-02",
      "krontab.info": "2026-01-02",
      "krontec.info": "2023-05-17",
      "krotab.info": "2026-01-02",
      "ksew.kpt-gov.org": "2022-07-20",
      "ksew.org": "2022-04-07",
      "ksewpk.com": "2022-04-25",
      "kuknalim.com.pk-mail.org": "2026-01-02",
      "l0gin-cetc1-files-0pen-expired.netlify.app": "2026-01-02",
      "l1kdine.com": "2026-01-02",
      "lalosop.biz": "2026-01-02",
      "lankabelltd.myftp.org": "2023-02-15",
      "laspzo.site": "2026-01-02",
      "latestupdate.adobeglobal.com": "2026-01-02",
      "lax036.relay.arandomserver.com": "2024-01-11",
      "lcbkp-gov-pk-sedang-berbunga.pages.dev": "2026-01-02",
      "leave.portdedjibouti.live": "2024-07-26",
      "leron.info": "2023-05-17",
      "lescrip.live": "2026-01-02",
      "lesporc.live": "2024-01-11",
      "letcrip.xyz": "2026-01-02",
      "leyra.tech": "2023-05-17",
      "lforvk.com": "2022-09-30",
      "lgcd.punjab.gov.pk.govt-pk.com": "2024-05-08",
      "libqstur.tech": "2024-05-09",
      "libreofficeupdates.com": "2023-07-19",
      "licenceinteriorministrypk.com": "2026-01-02",
      "license.interiorministrypk.com": "2026-01-02",
      "licenseinterior.gov-pk.com": "2026-01-02",
      "licenseinterior.gov-pk.site": "2026-01-02",
      "licenseinterior.govpk.site": "2026-01-02",
      "limkdin.com": "2026-01-02",
      "line-wqeyoiua.top": "2026-03-18",
      "lines.aeryple.xyz": "2023-05-17",
      "link-cdnl.net": "2020-04-21",
      "linkeden.net": "2026-01-02",
      "live-co.org": "2025-02-17",
      "livestreaming.adobeglobal.com": "2026-01-02",
      "livo.silvon.site": "2023-05-17",
      "lk.aliyumm.pro": "2026-01-02",
      "lk.gov-co.org": "2024-04-04",
      "lk.gov-org.net": "2024-01-05",
      "lk.govt-net.com": "2024-05-08",
      "lk.govt-org.com": "2024-04-04",
      "lk.govt-org.net": "2024-04-04",
      "lk.mail-pk.org": "2026-02-06",
      "lk.mofa-govbd.com": "2026-01-02",
      "lk.mofa-govlk.org": "2026-01-02",
      "lk.mofa-govtpk.net": "2026-01-02",
      "lk.pk-mail.org": "2026-01-02",
      "lms.update.fia-gov.org": "2022-10-22",
      "lnkly.net": "2024-01-11",
      "loadpath.info": "2026-01-02",
      "loadpath.net": "2026-02-08",
      "loasem.live": "2026-01-02",
      "loasen.xyz": "2026-01-02",
      "locaal.navybd-gov.info": "2024-09-26",
      "local.update.fia-gov.org": "2022-10-22",
      "localhost.apl-com.icu": "2024-09-26",
      "localhost.srvapp.co": "2022-06-03",
      "locall.hascolgov.info": "2024-09-26",
      "login.apl-org.online": "2024-09-26",
      "lolsidewindersidewinder.nic-svc.net": "2026-01-02",
      "lonime.xyz": "2026-01-02",
      "lotussrv01.fauji.pkgov.org": "2022-03-12",
      "ltd.cdn-pak.net": "2022-06-02",
      "lubeleaf.com": "2026-02-28",
      "lucas.hertic.tech": "2023-05-17",
      "luckjav.com": "2026-01-02",
      "luckydraw.csd-pk.co": "2022-06-02",
      "m.fia-gov.com": "2023-04-19",
      "m1n.mov": "2026-01-02",
      "maajankidevisevasansthan.org": "2021-12-03",
      "macop.site": "2026-01-02",
      "madhouse.cloud": "2026-01-02",
      "magento.seoshz.live": "2026-01-02",
      "mai1-sco-gov-pk-sdf.rf.gd": "2024-04-01",
      "maif-piac-aero.gov-pkgov.workers.dev": "2026-01-02",
      "mail-163cn.com": "2026-01-02",
      "mail-776f305796709f2d567e6868feaba274-gov-pk-investment.pages.dev": "2026-01-02",
      "mail-account-data.github.io": "2026-01-02",
      "mail-afd-gov-bd-account-error-issues.netlify.app": "2026-01-02",
      "mail-airforce-lk1b8470bce36a0e858a410b4169b23e1c.pages.dev": "2026-01-02",
      "mail-apfgavnp.hopto.org": "2020-12-09",
      "mail-apfgovnp.ddns.net": "2020-12-09",
      "mail-argaf.myftp.org": "2022-02-09",
      "mail-army-sl-dte-of-welfare-session-out.pages.dev": "2026-01-02",
      "mail-armybd.servehttp.com": "2024-02-25",
      "mail-armylk.myvnc.com": "2024-02-23",
      "mail-armylk.servehalflife.com": "2024-02-23",
      "mail-arny-nil-db.up.railway.app": "2026-01-02",
      "mail-aselsans-com-tr-account-files-da.netlify.app": "2026-01-02",
      "mail-asian-parliament-org.pakistan-gov-pk.workers.dev": "2024-03-04",
      "mail-aviation-gov-pk-pdf.pages.dev": "2026-01-02",
      "mail-baf-mil-bd-account-data-files-document.pages.dev": "2026-01-02",
      "mail-baf-mil-bd-fils-cas-visit-to-chi.netlify.app": "2026-01-02",
      "mail-bafmilbd.myvnc.com": "2024-02-23",
      "mail-bafmilbd.servequake.com": "2024-02-10",
      "mail-bcc-gov-bd-7j5la.bunny.run": "2026-01-02",
      "mail-bcc-gov-bd-condepakuregoda4533-fxr7ofbc.leapcell.dev": "2026-02-07",
      "mail-bcc-gov-bd.vercel.app": "2026-07-11",
      "mail-bccgov.gotdns.ch": "2026-01-02",
      "mail-bccnetdd.ddns.net": "2026-01-02",
      "mail-bfsa-gov-bd.netlify.app": "2026-06-21",
      "mail-bof-gov-bd-cas-visit.netlify.app": "2026-01-02",
      "mail-bof-gov-file-account-conf-files.netlify.app": "2026-01-02",
      "mail-corp.cybernet.pkgov.org": "2022-03-12",
      "mail-cscec.ddns.net": "2025-01-06",
      "mail-defence-lk-loging-horde.pages.dev": "2024-12-27",
      "mail-defence-lk-session-out.pages.dev": "2024-12-24",
      "mail-defence-lk-webmail-imp-view-php-actiob-ri5it-kgfi5kg9.pages.dev": "2026-06-10",
      "mail-depo-gov-pk.government-pak.workers.dev": "2024-03-04",
      "mail-depo-gov-pk.govtpak.workers.dev": "2024-02-28",
      "mail-depo-gov-pk.ntc-telecomcorporation.workers.dev": "2024-01-16",
      "mail-depogovpk.myvnc.com": "2024-02-23",
      "mail-depogovpk.servehttp.com": "2024-02-10",
      "mail-dgdp-gov-pk.ntc-telecomcorporation.workers.dev": "2024-01-16",
      "mail-dgdpgovpk.servehalflife.com": "2024-02-10",
      "mail-dgfi-gov-bd-accounts-file-data-d.netlify.app": "2026-01-02",
      "mail-dmp-navy-pk.dytt88.org": "2023-05-11",
      "mail-doc-download-pdf.up.railway.app": "2026-01-02",
      "mail-dor.hopto.org": "2023-12-30",
      "mail-download-army-mii-bd.up.railway.app": "2026-01-02",
      "mail-ead.gov-pk.online": "2024-02-02",
      "mail-ecp-gov-pk.ntc-telecomcorporation.workers.dev": "2024-02-18",
      "mail-files-open-preview.com": "2026-01-02",
      "mail-fisheries-gov-bd.netlify.app": "2026-07-24",
      "mail-gov.org": "2024-11-15",
      "mail-govpk.com": "2024-05-23",
      "mail-govt.com": "2024-12-19",
      "mail-govt.org": "2025-01-17",
      "mail-gwadarport-gov-pk.kr-i-sas-orv-e-l-a.workers.dev": "2024-02-20",
      "mail-gwadarport-gov-pk.ntc-telecomcorporation.workers.dev": "2024-02-18",
      "mail-hit-gov-pk.government-pak.workers.dev": "2024-03-04",
      "mail-hit-gov-pk.ntc-telecomcorporation.workers.dev": "2024-01-16",
      "mail-hit-gov.leapcell.app": "2026-03-14",
      "mail-hitgovpk.government-pak.workers.dev": "2024-03-04",
      "mail-hitgovpk.govtpak.workers.dev": "2024-02-28",
      "mail-hitgovpk.myvnc.com": "2024-02-23",
      "mail-hitgovpk.servegame.com": "2024-02-23",
      "mail-hitgovpk.servehttp.com": "2024-02-23",
      "mail-ideaspakistan-gov-pk.zeabur.app": "2026-05-15",
      "mail-invest-gov-pk.gwadarportt.workers.dev": "2024-02-19",
      "mail-islamabadpolice-gov-pk.ntc-telecommunication-safecity.workers.dev": "2024-09-26",
      "mail-kdu-lk-inbox-interanl-memo.pages.dev": "2026-01-02",
      "mail-kmgcom.ddns.net": "2020-12-09",
      "mail-kpt-gov-pk-2fa-registration.pages.dev": "2026-01-02",
      "mail-kpt-gov-pk-browserautheintacation.pages.dev": "2026-01-02",
      "mail-kpt-gov-pk-error.pages.dev": "2026-01-02",
      "mail-kpt-gov-pk-estblishment-it-park.pages.dev": "2026-01-02",
      "mail-kpt-gov-pk-joint-coordination-meeting.pages.dev": "2026-01-02",
      "mail-kpt-gov-pk-meeting-sub-committee.pages.dev": "2026-01-02",
      "mail-kpt-gov-pk-mod-revised-scheduled.pages.dev": "2026-01-02",
      "mail-kpt-gov-pk-provision-of-data-for-greater-karachi.pages.dev": "2026-01-02",
      "mail-kpt-gov-pk-provision-of-karachi-port-vision.pages.dev": "2026-01-02",
      "mail-kpt-gov-pk-securityupdates-jun2025olertnessegingvsdvs.pages.dev": "2026-01-02",
      "mail-kpt-gov-pk-training-course-public-finance.pages.dev": "2026-01-02",
      "mail-kpt-gov-pk-viruspurification-securitypachesjun-2025df.pages.dev": "2026-01-02",
      "mail-kpt-gov-pk-visit-to-malaysia-final.pages.dev": "2026-01-02",
      "mail-kpt-gov-pk.pak-gov-pk.workers.dev": "2024-03-04",
      "mail-meagovmv.hopto.org": "2022-02-09",
      "mail-mfagovcn.hopto.org": "2020-12-09",
      "mail-minfinance-gov-np.netlify.app": "2026-01-02",
      "mail-mod-gov-bd-account-conf-files.netlify.app": "2026-01-02",
      "mail-mod-gov-bd-account-data-file.netlify.app": "2025-02-14",
      "mail-mod-gov-np-account-file-data.netlify.app": "2026-01-02",
      "mail-mod-gov-np-download-pdf.netlify.app": "2026-01-02",
      "mail-mod-gov-pk.pakistan-gov-pk.workers.dev": "2024-02-21",
      "mail-modaf.hopto.org": "2022-02-09",
      "mail-modgav.hopto.org": "2022-02-09",
      "mail-modgovpk.servehttp.com": "2024-02-10",
      "mail-modp-gov-pk-view.netlify.app": "2026-01-02",
      "mail-modp-gov-pk.government-pak.workers.dev": "2024-02-21",
      "mail-modp-gov-pk.ntc-telecomcorporation.workers.dev": "2024-01-21",
      "mail-modp-gov-pk.pak-gov-pk.workers.dev": "2024-02-21",
      "mail-mofa-gov-pk-satellite-proposal-for-pakistan-files-ops.netlify.app": "2022-07-08",
      "mail-mofa-gov-pk.pakistan-gov-pk.workers.dev": "2024-03-04",
      "mail-mofa-gov.org-liv.net": "2026-01-02",
      "mail-mofa.ddns.net": "2025-01-06",
      "mail-mofa.hopto.org": "2022-02-09",
      "mail-mofa.myftp.org": "2024-01-16",
      "mail-mofagovnp.hopto.org": "2020-12-09",
      "mail-mofagovnp.zapto.org": "2020-12-09",
      "mail-mofagovpk.ddns.net": "2024-02-10",
      "mail-mofagovpk.gotdns.ch": "2024-02-10",
      "mail-mofagovpk.myddns.me": "2024-02-10",
      "mail-mofagovpk.myftp.org": "2022-02-09",
      "mail-mofagovpk.servehalflife.com": "2023-10-16",
      "mail-mofagovpk.servehttp.com": "2024-02-02",
      "mail-mofagovpk.serveirc.com": "2023-10-16",
      "mail-mofagovpk.viewdns.net": "2023-10-16",
      "mail-mofapk.servehttp.com": "2024-02-10",
      "mail-mofgovbt.hopto.org": "2023-11-02",
      "mail-mofgovnp.hopto.org": "2020-12-09",
      "mail-moha-gov-np-download.netlify.app": "2026-01-02",
      "mail-mohs.ddns.net": "2023-02-15",
      "mail-mohs.myftp.org": "2024-01-16",
      "mail-mohs.servehttp.com": "2023-11-08",
      "mail-moitt-gov-pk-meeting-sun-committee.pages.dev": "2026-01-02",
      "mail-mopitgovnp.hopto.org": "2022-02-09",
      "mail-mowr.gov-pk.online": "2024-02-02",
      "mail-na-gov-pk.na-gov-pk.workers.dev": "2024-09-26",
      "mail-navy-lk-4326er48fdu49fgu49fgj549fj349fdj3490fdjk390df.pages.dev": "2026-06-10",
      "mail-navy-lk-43897fyi78945tr78945uio89045iuort89045prt054k.pages.dev": "2026-02-19",
      "mail-navy-lk-login.pages.dev": "2026-06-10",
      "mail-navy-lk.up.railway.app": "2026-08-07",
      "mail-navy-mil-bd-modern-email-inbox-messages.webmailarmy.com": "2025-02-14",
      "mail-nba-gov-pk.pakistan-gov-pk.workers.dev": "2024-03-04",
      "mail-ncporgnp.hopto.org": "2020-12-09",
      "mail-nepalarmy-mil-np-fsdafjsd.herokuapp.com": "2021-04-28",
      "mail-nepalarmy-mil-np-login-download.netlify.app": "2021-04-28",
      "mail-nepalarmy-mil-np-view.netlify.app": "2021-04-28",
      "mail-nepalarmymilnp.duckdns.org": "2020-12-09",
      "mail-nepalgovnp.duckdns.org": "2020-12-09",
      "mail-nepalgovnp.zapto.org": "2024-01-16",
      "mail-nepalpolgavnp.hopto.org": "2022-02-09",
      "mail-nepalpolice-gov-np-loginn.herokuapp.com": "2021-04-28",
      "mail-nepalpolice.hopto.org": "2022-02-09",
      "mail-nepalpolicegov.hopto.org": "2020-12-09",
      "mail-nepalpolicegovnp.duckdns.org": "2020-12-09",
      "mail-nespak-com-pk.gwadarportt.workers.dev": "2024-02-19",
      "mail-np.net": "2024-03-29",
      "mail-nrborg.hopto.org": "2020-12-09",
      "mail-nscaf.hopto.org": "2021-04-28",
      "mail-nscaf.myftp.org": "2020-12-09",
      "mail-nscgovaf.hopto.org": "2024-01-16",
      "mail-nssc.sytes.net": "2025-01-06",
      "mail-ntc-net-pk-pdf.up.railway.app": "2026-01-02",
      "mail-ntc-net-pk-zimbra-dils-maint213-2q1ntcqz.leapcell.dev": "2026-02-12",
      "mail-ntc-net-pk.up.railway.app": "2026-01-02",
      "mail-ntc-net-pk.zeabur.app": "2026-01-02",
      "mail-ntc.gov-pk.online": "2024-02-02",
      "mail-ntcgovpk.servehttp.com": "2024-02-18",
      "mail-ntcnetnp.serveftp.com": "2020-12-09",
      "mail-ntmail-ntcnetnp.serveftp.comcnetnp.serveftp.com": "2021-04-28",
      "mail-nudt.sytes.net": "2025-01-06",
      "mail-opmcmgavnp.hopto.org": "2022-02-09",
      "mail-paa-gov-pk.pages.dev": "2026-01-02",
      "mail-paf-gov-pk.ntc-telecomcorporation.workers.dev": "2024-01-16",
      "mail-pc-gov-pk-login.ethanhunthero125.workers.dev": "2024-02-23",
      "mail-pc.gov-pk.online": "2024-02-02",
      "mail-pk.com": "2026-02-14",
      "mail-pk.org": "2026-02-06",
      "mail-pmo-gov-lk3u3i495ui3jkdf9d549fgkj45fg94jdfg904j439g.pages.dev": "2026-02-16",
      "mail-pmogovpk.servehttp.com": "2023-10-16",
      "mail-pof-gov-pk.government-pak.workers.dev": "2024-03-04",
      "mail-pofgovpk.3utilities.com": "2024-02-23",
      "mail-pofgovpk.sytes.net": "2024-02-23",
      "mail-ppra-org-pk.pakistan-gov-pk.workers.dev": "2024-03-04",
      "mail-preview-trainingcollabration-bangladesh-srilanka.pages.dev": "2026-01-02",
      "mail-prevlew-jointworkshop-training-srilanka-bangladesh.pages.dev": "2026-01-02",
      "mail-punjab-gov-pk.ntc-telecomcorporation.workers.dev": "2024-03-04",
      "mail-sco-gov-pk.crypton0019.workers.dev": "2024-02-23",
      "mail-sco-gov-pk.government-pak.workers.dev": "2024-03-04",
      "mail-sco-gov-pk.mil-bd.workers.dev": "2024-04-01",
      "mail-sco-gov-pk.netlify.app": "2026-01-02",
      "mail-sco-gov-pk.ntc-telecomcorporation.workers.dev": "2024-02-18",
      "mail-sco.gov-pk.online": "2024-02-02",
      "mail-scogovpk.servehalflife.com": "2024-02-10",
      "mail-scogovpk.servehttp.com": "2024-02-18",
      "mail-sessionexpired.com": "2026-01-02",
      "mail-suparco-gov-pk-owa-auth-logon-aspx.pages.dev": "2026-01-02",
      "mail-svr.co": "2026-04-16",
      "mail.a.globaltimes-cn.org": "2025-01-06",
      "mail.alit.info": "2022-12-22",
      "mail.allpakarmslicence.com": "2026-01-02",
      "mail.andc.govaf.org": "2026-01-02",
      "mail.apl-com.icu": "2024-09-26",
      "mail.arg.gov-af.org": "2020-12-09",
      "mail.army-govbd.info": "2026-01-02",
      "mail.baf.mil.bd.docum.store": "2025-02-05",
      "mail.baf.mil.bd.hilsa.online": "2025-02-14",
      "mail.baf.mil.bd.onlinestatus.live": "2025-02-05",
      "mail.baf.mil.bd.pdf.quickhelpsolve.com": "2026-01-02",
      "mail.bcc.gov.bd.onlinestatus.live": "2025-02-05",
      "mail.bcc.gov.bd.pdf.quickhelpsolve.com": "2026-01-02",
      "mail.bcc.gov.bd.upworkoffice.online": "2026-01-02",
      "mail.bdgov.info": "2026-01-02",
      "mail.bgb.gov.bd.account.modern.sessions.webmailarmy.com": "2025-02-14",
      "mail.bgb.gov.bd.up2dts.online": "2025-02-14",
      "mail.biitt.cn": "2026-01-02",
      "mail.bok.pkgov.org": "2022-03-12",
      "mail.bop.pkgov.org": "2022-03-12",
      "mail.cao.gov.bd.account.login.sessions.webmailarmy.com": "2025-02-14",
      "mail.cfau.edu.cn.81-cn.info": "2025-01-06",
      "mail.cmec.com.globaltimes-cn.org": "2025-01-06",
      "mail.csd.pkgov.org": "2022-03-12",
      "mail.dawn.pkgov.org": "2022-03-12",
      "mail.demsflygerxamy.com": "2026-01-02",
      "mail.dgdp.gov.pk.pujfjue003hmdhfh99ppjdflsdqwlkls.g0v-pk.net": "2024-02-23",
      "mail.dlimspunjabgovpk.com": "2026-01-02",
      "mail.drive.gov.bd.files.updatemind52.com": "2026-01-02",
      "mail.fwo.com.pk.onlinestatus.live": "2025-02-05",
      "mail.gavaf.org": "2023-02-15",
      "mail.gov-pk.com": "2026-01-02",
      "mail.gov-pk.pk": "2026-01-02",
      "mail.gov-pk.site": "2026-01-02",
      "mail.gov.bd.account.file.updatemind52.com": "2026-01-02",
      "mail.govpk.info": "2023-10-02",
      "mail.govpk.live": "2024-01-16",
      "mail.hillview.net.pk.hilsa.online": "2025-02-14",
      "mail.hilsa.online": "2025-02-14",
      "mail.hit.gov.pk.81-cn.info": "2025-01-06",
      "mail.hust.edu.cn.81-cn.info": "2025-01-06",
      "mail.investgov.info": "2024-04-12",
      "mail.licenceinteriorministrypk.com": "2026-01-02",
      "mail.mail.cmec.com.globaltimes-cn.org": "2025-01-06",
      "mail.mail.spacechina.com.81-cn.info": "2025-01-06",
      "mail.mfa.gov.cn.81-cn.info": "2025-01-06",
      "mail.mfaa.gov.cn.globaltimes-cn.org": "2025-01-06",
      "mail.mobta.govaf.org": "2026-01-02",
      "mail.mod.gov.bd.account.login.sessions.webmailarmy.com": "2025-02-14",
      "mail.modcloudspace.com": "2026-01-02",
      "mail.moe-gov-ae.info": "2024-04-01",
      "mail.mofa-gov-ae.info": "2024-04-01",
      "mail.mofa-gov-qa.gq": "2024-04-04",
      "mail.mofa-gov-qa.ml": "2024-04-04",
      "mail.mofa-govbd.com": "2026-01-02",
      "mail.mofa-govtpk.com": "2024-05-08",
      "mail.mofa.gov.pk.docum.store": "2025-02-05",
      "mail.mofa.gov.pk.globaltimes-cn.org": "2025-01-06",
      "mail.mofa.gov.pk.modp-pk.org": "2024-04-04",
      "mail.mofa.gov.pk.officemuwork.online": "2026-01-02",
      "mail.mofa.gov.pk.onlinestatus.live": "2025-02-05",
      "mail.mofa.gov.pk.up2dts.online": "2025-02-14",
      "mail.mofa.govnp.org": "2023-11-22",
      "mail.mofa.pkgov.org": "2022-03-12",
      "mail.mofagov-pk.online": "2021-04-28",
      "mail.mofagov-sa.info": "2024-04-01",
      "mail.mofas.gov.pk.updatemaster.info": "2025-02-14",
      "mail.moi.govaf.org": "2026-01-02",
      "mail.navy.lk.updatemaster.info": "2025-02-14",
      "mail.navy.mil.bd.docum.store": "2025-02-05",
      "mail.navy.mil.bd.officemuwork.online": "2026-01-02",
      "mail.navy.mil.bd.onlinestatus.live": "2025-02-05",
      "mail.navy.mil.bd.up2dts.online": "2025-02-14",
      "mail.nepal.gavnp.org": "2023-02-15",
      "mail.nepla.gov.np.onlinestatus.live": "2025-02-05",
      "mail.news-bd.com": "2026-01-02",
      "mail.nju.edu.cn.81-cn.info": "2025-01-06",
      "mail.npc.gov.np.officemuwork.online": "2026-01-02",
      "mail.npc.gov.np.up2dts.online": "2025-02-14",
      "mail.nrlpak.pkgov.org": "2022-03-12",
      "mail.ntc.gov.pk.hilsa.online": "2025-02-14",
      "mail.ntc.net.pk.bismi.pro": "2026-01-02",
      "mail.ntc.net.pk.onlinestatus.live": "2026-01-02",
      "mail.ntc.net.pk.vpdf.online": "2026-01-02",
      "mail.ntc.pkgov.org": "2022-03-12",
      "mail.ntdc.pkgov.org": "2022-03-12",
      "mail.nudt.edu.cn.81-cn.info": "2025-01-06",
      "mail.ogdcl.pkgov.org": "2022-03-12",
      "mail.oilplus1td.com": "2026-01-02",
      "mail.paf-gov.net": "2022-06-02",
      "mail.paf.gov.pk.hilsa.online": "2025-02-14",
      "mail.paf.gov.pk.onlinestatus.live": "2026-01-02",
      "mail.paf.gov.pk.pujfjue003hmdhfh99ppjdflsdqwlkls.g0v-pk.net": "2024-02-23",
      "mail.pak-gov.com": "2022-06-02",
      "mail.pakarmslicense.com.pk": "2026-01-02",
      "mail.pakistangov.com": "2024-09-26",
      "mail.pakoil.pkgov.org": "2022-03-12",
      "mail.pk-mail.org": "2026-01-02",
      "mail.pkgov.org": "2022-03-12",
      "mail.pmsa.pkgov.org": "2022-03-12",
      "mail.pof-gov-pk.workers.dev": "2026-01-02",
      "mail.pof.gov.pk.onlinestatus.live": "2025-02-05",
      "mail.power-govpk.org": "2026-01-02",
      "mail.ptv.pkgov.org": "2022-03-12",
      "mail.punjab.gov.pk.hilsa.online": "2025-02-14",
      "mail.punjabgov.org": "2024-03-29",
      "mail.radio.pkgov.org": "2022-03-12",
      "mail.sco.gov.pk.hilsa.online": "2025-02-14",
      "mail.sco.gov.pk.pujfjue003hmdhfh99ppjdflsdqwlkls.g0v-pk.net": "2024-02-23",
      "mail.sco.pkgov.org": "2022-03-12",
      "mail.smmu.edu.cn.81-cn.info": "2025-01-06",
      "mail.ssf.gov.bd.onlinestatus.live": "2025-02-05",
      "mail.tsinghua.edu.cn.81-cn.info": "2025-01-06",
      "mail.tsinghua.institute": "2022-10-20",
      "mail.voyage-prive.com.ru": "2026-01-02",
      "mail1.mofa.gov.pk.docum.store": "2025-02-05",
      "mail1.navy.mil.bd.docum.store": "2025-02-05",
      "mail126.live": "2026-01-02",
      "mail163.info": "2025-02-05",
      "mail163cn.info": "2026-01-02",
      "mailafdbd.mod-pkgov.org": "2023-07-18",
      "mailafdgovbd.163inc.org": "2024-03-15",
      "mailaplf.cvix.live": "2022-01-07",
      "mailarmy.cssc.live": "2022-09-08",
      "mailarmylk.126-com.live": "2024-02-27",
      "mailarmylk.mods.email": "2024-06-21",
      "mailbaf.mil-bd.workers.dev": "2024-04-01",
      "mailbox-inbox-bd.com": "2026-01-02",
      "mailbox3-inbox1-bd.com": "2026-01-02",
      "mailcantonfair.cssc.info": "2022-05-19",
      "mailcbmgovmm.pages.dev": "2026-01-02",
      "mailciieorg.mofa-gov.org": "2023-09-25",
      "mailcitifs.cssc.info": "2022-05-19",
      "mailcloucl.com": "2026-01-02",
      "mailcn.163inc.org": "2024-03-28",
      "maildefence.alit.info": "2022-12-22",
      "maildefence.myftp.org": "2026-01-02",
      "maile.mofa-gov.org": "2023-09-25",
      "mailgu.cssc.info": "2022-05-19",
      "mailh.alit.live": "2022-06-25",
      "mailhit-govpk.hopto.org": "2024-02-23",
      "mailhitgovpk.servehalflife.com": "2024-02-10",
      "maill-govtnepal-gov-np.netlify.app": "2026-01-02",
      "maill-nepalgv-gov-np.netlify.app": "2026-01-02",
      "mailmfa.mofa-gov.info": "2023-12-18",
      "mailmfagovnp.cvix.live": "2022-01-07",
      "mailmofa.alit.info": "2022-12-22",
      "mailmofa.alit.live": "2022-06-25",
      "mailmofa.cssc.info": "2022-05-19",
      "mailmofa.govnp.live": "2024-02-28",
      "mailmofa.mofa-gov.org": "2023-09-25",
      "mailmofa.newmofa.com": "2024-02-28",
      "mailmofagoug.cvix.live": "2022-01-07",
      "mailmofagovmm.mfa-gov.net": "2023-11-09",
      "mailmofagovmm.mofa.email": "2024-03-07",
      "mailmofagovpk.cdn-pak.net": "2021-03-05",
      "mailmofagovpk.cvix.live": "2022-01-07",
      "mailnavybd.govpk.net": "2023-05-13",
      "mailnavymilbd.govpk.net": "2023-05-13",
      "mailnepalarmy.mofagov.com": "2022-11-11",
      "mailnepalarmymil.mods.email": "2024-06-14",
      "mailnic.info": "2022-01-23",
      "mailotloc.aliyum.org": "2024-05-09",
      "mailotlook.aliyum.org": "2024-05-09",
      "mailoutlook.cssc.live": "2022-09-08",
      "mailoutlookcom.cvix.live": "2022-01-07",
      "mailpakbj.mofs-gov.org": "2022-11-28",
      "mailpsab-modgovpk.hopto.org": "2024-02-23",
      "mailrta.mfagov.org": "2024-04-03",
      "mails-pk.com": "2026-02-11",
      "mails-pk.net": "2026-02-14",
      "mails.baf.mil.bd.updatemaster.info": "2025-02-14",
      "mails.bcc.gov.bd.updatemaster.info": "2025-02-14",
      "mails.mofa.gov.np.updatemaster.info": "2025-02-14",
      "mails.mofa.gov.pk.updatemaster.info": "2025-02-14",
      "mails.navy.mil.bd.updatemaster.info": "2025-02-14",
      "mails.nepal.gov.np.updatemaster.info": "2025-02-14",
      "mails.ntc.net.pk.hilsa.online": "2025-02-14",
      "mails.paf.gov.pk.hilsa.online": "2025-02-14",
      "mails.pmo.gov.pk.hilsa.online": "2025-02-14",
      "mailsco-govpk.hopto.org": "2024-02-23",
      "mailsco-govpk.myvnc.com": "2024-02-23",
      "mailscodomain-hubenkks.b4a.run": "2026-01-02",
      "mailserver-lk.com": "2024-12-24",
      "mailserver.seoshz.live": "2026-01-02",
      "mailsiis.alit.info": "2023-07-05",
      "mailsserver-lk.com": "2026-01-02",
      "mailstinghua.sinacn.co": "2023-07-19",
      "mailtest-mofa.servehttp.com": "2024-02-25",
      "mailtsinghua.sinacn.co": "2023-07-19",
      "mailturkmenembassy.cssc.info": "2022-05-19",
      "mailv.mofs-gov.org": "2022-11-28",
      "mailx.nr3c-govpk.com": "2024-02-02",
      "mailyafd.mofa-gov.org": "2023-09-25",
      "mailyahoocom.cvix.live": "2022-01-07",
      "mainet.info": "2026-01-02",
      "malik-jaani786.workers.dev": "2026-03-19",
      "mall-ministryoffinance-np.netlify.app": "2026-01-02",
      "management.xuzeest.buzz": "2024-07-30",
      "marine-pak.org": "2026-01-02",
      "maritimepakistan.kpt-pk.net": "2022-03-17",
      "marksafe.org": "2022-10-28",
      "maroos.live": "2026-01-02",
      "masarh.live": "2026-01-02",
      "mat.trelin.tech": "2023-05-17",
      "mawazna.info": "2022-07-29",
      "me7q1.pmreco.xyz": "2026-01-02",
      "mectel.tech": "2023-05-17",
      "medeclinic.ae": "2021-04-28",
      "medicalbillers.govt-pk.com": "2024-05-08",
      "medicallab.site": "2026-01-02",
      "meet.kdf-mail.com": "2022-06-02",
      "meeting-rigistration-defence-attache.netlify.app": "2026-01-02",
      "meeting-rigistration-embassy.netlify.app": "2026-01-02",
      "meplor.xyz": "2024-01-11",
      "meter-ntdccompk.myvnc.com": "2024-02-23",
      "meter-ntdccompk.servehttp.com": "2024-02-23",
      "mevron.tech": "2026-01-02",
      "mfa-go-ke.dytt88.co": "2024-10-25",
      "mfa-gov-al.com": "2026-01-02",
      "mfa-gov-cy.info": "2026-01-02",
      "mfa-gov-cy.online": "2026-01-02",
      "mfa-gov-lk.dirctt88.co": "2024-05-28",
      "mfa-gov-lk.dwnlld.info": "2026-01-02",
      "mfa-gov.cc": "2024-04-03",
      "mfa-gov.net": "2023-11-09",
      "mfa-govt.net": "2024-04-03",
      "mfa-govtt-az.com": "2026-01-02",
      "mfa-govtt-mm.com": "2026-01-02",
      "mfa-ir.cn": "2026-01-02",
      "mfa-qov.com": "2026-01-02",
      "mfa.gov.cn.81-cn.info": "2025-01-06",
      "mfa.gov.lk.gov-co.org": "2024-04-04",
      "mfa.gov.lk.gov-org.net": "2024-01-05",
      "mfa.gov.lk.govt-net.com": "2024-05-08",
      "mfa.gov.lk.govt-org.com": "2024-04-04",
      "mfa.gov.lk.mofa-govlk.org": "2026-01-02",
      "mfaa.gov.cn.globaltimes-cn.org": "2025-01-06",
      "mfacom.org": "2024-04-03",
      "mfagov.info": "2026-01-02",
      "mfagov.net": "2026-01-02",
      "mfagov.org": "2023-05-17",
      "mfas.pro": "2024-10-15",
      "mha.gov.bd.mail-pk.org": "2026-02-06",
      "mha.gov.bd.pk-mail.org": "2026-01-02",
      "mha.gov.bd.pk-mailgov.com": "2026-04-21",
      "mhapsd.gov.bd.mofa-govbd.com": "2026-01-02",
      "mhealth.dopm.gov.np.totheeverest.com": "2025-02-14",
      "micret.live": "2025-02-10",
      "microsoft-365.directt88.org": "2023-06-25",
      "microsoft-winupdate.servehttp.com": "2022-02-09",
      "microsoft.update.fia-gov.org": "2022-10-22",
      "microsoftfp.hopto.org": "2024-01-16",
      "microsoftupdte.redirectme.net": "2023-11-02",
      "mil-bd.workers.dev": "2024-04-01",
      "mil-pk.net": "2020-08-25",
      "mil.bd.hilsa.online": "2025-02-14",
      "mil.bd.officemuwork.online": "2026-01-02",
      "mil.np.gov-co.org": "2024-04-04",
      "milbdarmy.live": "2026-01-02",
      "military-bd.org": "2024-12-13",
      "milqq.info": "2026-01-02",
      "min-pk.com": "2026-06-15",
      "min.tin-url.com": "2022-06-02",
      "mindef.gov.pk-mail.org": "2026-01-02",
      "mindef.gov.pk.govt-pk.com": "2024-05-08",
      "mindef.govvv.pk": "2025-01-14",
      "ministry-gov.cdn-dl.cn": "2019-06-17",
      "ministry-gov.org": "2026-04-02",
      "ministry-interior-gov-pk.cdn-dl.cn": "2019-06-17",
      "ministry-pk.net": "2022-01-13",
      "ministryofdefencechinadrive.pages.dev": "2024-11-12",
      "ministryofficedownloadcloudserver.screenpont.xyz": "2024-08-08",
      "ministryofforeignaffairs-mofa-gov-pk.dytt88.org": "2023-05-11",
      "ministryofinterior.fileserve.work": "2022-06-02",
      "ministryofinterior.shop": "2026-01-02",
      "ministryofinteriorlicense.gov-pk.com": "2026-01-02",
      "ministryofinteriorlicense.gov-pk.site": "2026-01-02",
      "ministryofinteriorlicense.govpk.site": "2026-01-02",
      "ministryofinteriorpermit.gov-pk.com": "2026-01-02",
      "ministryofinteriorpermit.gov-pk.site": "2026-01-02",
      "minland.pk-govt.net": "2024-10-25",
      "minutes-interministryproduction.up.railway.app": "2026-01-02",
      "minutes-of-meeting.zeabur.app": "2026-05-15",
      "mishal.com.pk-mailgov.com": "2026-04-21",
      "misty-pond-6b85.infomofa.workers.dev": "2026-08-07",
      "mitgiied.vip": "2026-03-18",
      "mitlec.site": "2024-10-15",
      "mm.download-msoffice.com": "2026-07-11",
      "mm.gov-org.net": "2024-01-05",
      "mmcert-org-mm.donwloaded.com": "2024-10-15",
      "mms.phone-update.click": "2026-01-02",
      "mo.treasury.gov.lk.mail-pk.org": "2026-02-06",
      "mo.treasury.gov.lk.pk-mail.org": "2026-01-02",
      "mo.treasury.gov.lk.pk-mailgov.com": "2026-04-21",
      "mobta.govaf.org": "2026-01-02",
      "mocat-gov-bd.filenest.live": "2026-01-02",
      "mocat.gov.bd.pk-mail.org": "2026-01-02",
      "mochta.pk-govt.net": "2024-10-25",
      "mod-cn.trans-del.net": "2021-04-28",
      "mod-gov-bd.direct888.net": "2024-10-15",
      "mod-gov-bd.dowmload.co": "2024-08-11",
      "mod-gov-bd.downld.org": "2026-01-02",
      "mod-gov-bd.dwnlld.com": "2026-01-02",
      "mod-gov-bd.dwnlld.info": "2026-01-02",
      "mod-gov-bd.filenest.live": "2026-01-02",
      "mod-gov-bd.info": "2026-01-02",
      "mod-gov-bd.live-co.org": "2025-02-17",
      "mod-gov-bd.net-src.org": "2026-01-02",
      "mod-gov-bd.org-liv.net": "2026-01-02",
      "mod-gov-bd.snagdrive.com": "2026-01-02",
      "mod-gov-pk.live": "2024-05-23",
      "mod-gov.cdn-dl.cn": "2019-06-17",
      "mod-gov.com": "2023-04-10",
      "mod-gov.org": "2023-02-17",
      "mod-govbd.com": "2024-10-25",
      "mod-kh.info": "2026-01-02",
      "mod-pak.co": "2021-04-21",
      "mod-pk.com": "2022-02-08",
      "mod-pkgov.org": "2023-07-18",
      "mod-portal-gov-bd.mail-govt.com": "2024-12-19",
      "mod.gov.ba.pk-govt.com": "2024-08-01",
      "mod.gov.bd.govt-org.net": "2024-04-04",
      "mod.gov.bd.govt-pk.com": "2024-05-08",
      "mod.gov.bd.mail-pk.org": "2026-02-06",
      "mod.gov.bd.mofa-govlk.com": "2024-08-01",
      "mod.gov.bd.mofa-govtpk.net": "2026-01-02",
      "mod.gov.bd.pk-govt.com": "2024-08-01",
      "mod.gov.bd.pk-govt.net": "2024-10-25",
      "mod.gov.bd.pk-mail.org": "2026-01-02",
      "mod.gov.bd.pk-mailgov.com": "2026-04-21",
      "mod.gov.np.gov-co.org": "2024-04-04",
      "mod.gov.np.gov-org.net": "2024-01-05",
      "mod.gov.np.govt-pk.com": "2024-05-08",
      "mod.gov.np.pk-mail.org": "2026-01-02",
      "mod.gov.pk-govt.net": "2024-10-25",
      "mod.gov.pk.emaiil.co": "2024-04-04",
      "mod.mailnic.info": "2022-01-27",
      "mod.mofa-govbd.com": "2026-01-02",
      "mod.mofa-govlk.org": "2026-01-02",
      "modcloudspace.com": "2026-01-02",
      "moddirectoratecloud.com": "2026-01-02",
      "modeso.info": "2026-01-02",
      "modltr.info-lanka.org": "2026-01-02",
      "modp-gov-pk.d0wnlaod.org": "2026-01-02",
      "modp-pk.org": "2024-04-04",
      "modp-view-full-message.malik-jaani786.workers.dev": "2026-03-01",
      "modp.gov.pk-govt.net": "2024-10-25",
      "modp.gov.pk-mail.org": "2026-01-02",
      "modpak-info.services": "2026-01-02",
      "modpak.info": "2026-01-02",
      "modpak.live": "2025-01-10",
      "mods.email": "2024-06-14",
      "moe-gov-ae.info": "2024-04-01",
      "moe-gov.cdn-dl.cn": "2019-06-17",
      "moe.gov.cn.81-cn.info": "2025-01-06",
      "moef.gov.bd.pk-mail.org": "2026-01-02",
      "moemaldives.pmd-office.com": "2024-03-08",
      "mof-gov-bd.loadpath.net": "2026-02-08",
      "mof-gov-bd.nic-svc.net": "2026-01-02",
      "mof-gov-np.dwnlld.info": "2026-01-02",
      "mof-govn.online": "2024-02-26",
      "mof-govnp.servehttp.com": "2024-02-18",
      "mof-newbudget25-ck.zeabur.app": "2026-01-02",
      "mof-newbudget25-fm.zeabur.app": "2026-01-02",
      "mof-newbudget25-jz.zeabur.app": "2026-01-02",
      "mof-newbudget25-pdx.zeabur.app": "2026-01-02",
      "mof-newbudget25-rk.zeabur.app": "2026-01-02",
      "mof-newbudget25-vn.zeabur.app": "2026-01-02",
      "mof-newbuedget2025-jz.zeabur.app": "2026-01-02",
      "mof-newbuedget25-ars.zeabur.app": "2026-01-02",
      "mof-newbuedget25-jz.zeabur.app": "2026-01-02",
      "mof-newbuedget25-rk.zeabur.app": "2026-01-02",
      "mof-portal-gov-bd.downnload.org": "2025-01-06",
      "mof-portal-gov-bd.loadpath.net": "2026-02-08",
      "mof.gov.np.mail-pk.org": "2026-02-06",
      "mof.gov.np.pk-mail.org": "2026-01-02",
      "mof.gov.np.pk-mailgov.com": "2026-04-21",
      "mof.pk-govt.net": "2024-10-25",
      "mofa-filetransfer.servehttp.com": "2024-07-16",
      "mofa-g0v-pk.workers.dev": "2024-08-07",
      "mofa-go-np.direct880.net": "2026-04-28",
      "mofa-gov-ae.info": "2024-04-01",
      "mofa-gov-bd-mailll.rf.gd": "2024-04-04",
      "mofa-gov-bd.com": "2026-01-02",
      "mofa-gov-bd.dowmload.co": "2024-08-11",
      "mofa-gov-bd.downld.org": "2026-01-02",
      "mofa-gov-bd.downnload.org": "2025-01-06",
      "mofa-gov-bd.dwnlld.info": "2026-01-02",
      "mofa-gov-bd.fetchdrive.org": "2026-01-02",
      "mofa-gov-bd.fetchdrives.info": "2026-07-23",
      "mofa-gov-bd.fia-gov.net": "2023-12-25",
      "mofa-gov-bd.file-dwnld.net": "2026-01-02",
      "mofa-gov-bd.filenest.live": "2026-01-02",
      "mofa-gov-bd.grabfiles.net": "2026-02-06",
      "mofa-gov-bd.interior-ministry.com": "2026-05-19",
      "mofa-gov-bd.live-co.org": "2025-02-17",
      "mofa-gov-bd.mail-svr.co": "2026-04-16",
      "mofa-gov-bd.snagdrive.com": "2026-01-02",
      "mofa-gov-mail-view-pk.rf.gd": "2024-04-04",
      "mofa-gov-msg-view.rf.gd": "2024-04-04",
      "mofa-gov-np.dirctt88.co": "2024-12-13",
      "mofa-gov-np.dirctt888.info": "2024-10-16",
      "mofa-gov-np.direct880.net": "2026-04-28",
      "mofa-gov-np.direct888.net": "2024-01-05",
      "mofa-gov-np.downld.org": "2026-01-02",
      "mofa-gov-np.downnload.org": "2025-01-06",
      "mofa-gov-np.dwnlld.com": "2026-01-02",
      "mofa-gov-np.dytt888.net": "2026-01-02",
      "mofa-gov-np.fia-g0v.net": "2026-03-11",
      "mofa-gov-np.fia-gob.net": "2025-01-05",
      "mofa-gov-np.fia-gov.net": "2024-01-30",
      "mofa-gov-np.live-co.org": "2026-01-02",
      "mofa-gov-np.min-pk.com": "2026-06-15",
      "mofa-gov-np.net-src.info": "2026-01-02",
      "mofa-gov-np.org-liv.net": "2026-01-02",
      "mofa-gov-pk-692e658f-19ac-8320-a0ee-b52b2198b13c-visit.pages.dev": "2026-01-02",
      "mofa-gov-pk-692e658f-19ac-8320-a0ee-b52b2198b13c.pages.dev": "2026-01-02",
      "mofa-gov-pk-download.rf.gd": "2024-04-04",
      "mofa-gov-pk-foreignministry-documents.timeoflahore.com": "2024-04-04",
      "mofa-gov-pk-press-release-training-course-public-finance.pages.dev": "2026-01-02",
      "mofa-gov-pk-wireless.comsates.org": "2021-05-25",
      "mofa-gov-pk.asianetnews.xyz": "2022-02-10",
      "mofa-gov-pk.co": "2024-04-04",
      "mofa-gov-pk.directt888.com": "2024-04-03",
      "mofa-gov-pk.donwloaded.com": "2023-11-24",
      "mofa-gov-pk.dowmload.co": "2024-08-11",
      "mofa-gov-pk.dowmload.info": "2024-08-07",
      "mofa-gov-pk.download.info": "2024-12-13",
      "mofa-gov-pk.dwnlld.com": "2026-01-02",
      "mofa-gov-pk.fdn-trace.net": "2022-06-02",
      "mofa-gov-pk.fia-g0v.net": "2026-03-11",
      "mofa-gov-pk.pages.dev": "2024-04-04",
      "mofa-gov-pk.rf.gd": "2024-04-04",
      "mofa-gov-pk.site": "2024-08-07",
      "mofa-gov-pk.xyz": "2024-06-07",
      "mofa-gov-qa.gq": "2024-04-04",
      "mofa-gov-qa.ml": "2024-04-04",
      "mofa-gov-qa.srvssl.cf": "2024-04-12",
      "mofa-gov-sa.direct888.net": "2024-01-05",
      "mofa-gov.info": "2023-07-10",
      "mofa-gov.interior-pk.org": "2022-05-26",
      "mofa-gov.org": "2023-09-25",
      "mofa-govbd.com": "2026-01-02",
      "mofa-govbd.org": "2026-01-02",
      "mofa-govlk.com": "2024-08-01",
      "mofa-govlk.net": "2024-10-25",
      "mofa-govlk.org": "2026-01-02",
      "mofa-govpk.co": "2026-01-02",
      "mofa-govtpk.com": "2024-05-08",
      "mofa-govtpk.net": "2026-01-02",
      "mofa-lk.org": "2026-01-02",
      "mofa-pk.co": "2022-06-08",
      "mofa-pk.org": "2022-07-08",
      "mofa-portal-gov-bd.mail-govt.com": "2024-12-19",
      "mofa-qov.com": "2026-01-02",
      "mofa-services-server.top": "2024-04-30",
      "mofa.bd.gov-co.org": "2024-04-04",
      "mofa.cdn-pak.net": "2021-03-11",
      "mofa.cssc.info": "2022-05-19",
      "mofa.email": "2024-03-07",
      "mofa.g0v.cq.cn": "2022-07-08",
      "mofa.gov-pk.online": "2024-02-02",
      "mofa.gov.bd.gov-co.org": "2024-04-04",
      "mofa.gov.bd.govt-net.com": "2024-05-08",
      "mofa.gov.bd.govt-pk.com": "2024-05-08",
      "mofa.gov.bd.mail-pk.org": "2026-02-06",
      "mofa.gov.bd.mofa-govbd.com": "2026-01-02",
      "mofa.gov.bd.mofa-govlk.com": "2024-08-01",
      "mofa.gov.bd.mofa-govtpk.net": "2026-01-02",
      "mofa.gov.bd.pk-govt.com": "2024-08-01",
      "mofa.gov.bd.pk-govt.net": "2024-10-25",
      "mofa.gov.bd.pk-mail.org": "2026-01-02",
      "mofa.gov.bd.pk-mailgov.com": "2026-04-21",
      "mofa.gov.lk.govt-net.com": "2024-05-08",
      "mofa.gov.lk.govt-org.net": "2024-04-04",
      "mofa.gov.mail-pk.org": "2026-02-06",
      "mofa.gov.np.gov-co.org": "2024-04-04",
      "mofa.gov.np.gov-org.net": "2024-01-05",
      "mofa.gov.np.govt-net.com": "2024-05-08",
      "mofa.gov.np.govt-pk.com": "2024-05-08",
      "mofa.gov.np.mail-pk.org": "2026-02-06",
      "mofa.gov.np.pk-govt.com": "2024-08-01",
      "mofa.gov.np.pk-govt.net": "2024-10-25",
      "mofa.gov.np.updatemaster.info": "2025-02-14",
      "mofa.gov.pk-govt.com": "2024-08-01",
      "mofa.gov.pk-govt.net": "2024-10-25",
      "mofa.gov.pk-hq.qrrl.net": "2024-04-04",
      "mofa.gov.pk-hqr-online.co": "2024-04-04",
      "mofa.gov.pk-mail.org": "2026-01-02",
      "mofa.gov.pk.1.modp-pk.org": "2024-04-04",
      "mofa.gov.pk.2let.org": "2024-04-04",
      "mofa.gov.pk.globaltimes-cn.org": "2025-01-06",
      "mofa.gov.pk.modp-pk.org": "2024-04-04",
      "mofa.gov.pk.officemuwork.online": "2026-01-02",
      "mofa.gov.pk.pk-govt.com": "2024-08-01",
      "mofa.govnp.live": "2024-02-28",
      "mofa.govnp.org": "2023-11-22",
      "mofa.govpk.email": "2025-01-14",
      "mofa.govpk.info": "2023-10-02",
      "mofa.govpk.me": "2025-01-16",
      "mofa.govvv.pk": "2025-01-14",
      "mofa.iugur.live": "2021-04-21",
      "mofa.live": "2021-12-01",
      "mofa.mail-pk.org": "2026-02-06",
      "mofa.moma-pk.org": "2022-01-07",
      "mofa.paknvay-pk.net": "2022-01-06",
      "mofa.pk-govt.net": "2024-10-25",
      "mofa.pkgov.org": "2022-03-12",
      "mofabn.ksewpk.com": "2022-04-25",
      "mofadividion.ptcl-gov.com": "2022-09-15",
      "mofaga.gov.np.pk-mail.org": "2026-01-02",
      "mofagov-pk.naatlibrary.com": "2021-04-28",
      "mofagov-pk.online": "2021-04-28",
      "mofagov-sa.info": "2024-04-01",
      "mofagov.com": "2022-11-11",
      "mofagov.info": "2023-07-17",
      "mofagov.live": "2023-07-05",
      "mofagov.online": "2024-04-04",
      "mofagovbd.com": "2026-01-02",
      "mofagovpk-hq.co": "2026-01-02",
      "mofagovpk.cheematrd.com": "2024-02-02",
      "mofagovpk.co": "2026-01-02",
      "mofagovpk.com": "2024-04-04",
      "mofagovpk.edu-cx.org": "2021-12-26",
      "mofagovpk.info": "2024-03-29",
      "mofagovs.org": "2024-10-15",
      "mofapak.info": "2024-09-26",
      "mofbudget-ars.zeabur.app": "2026-01-02",
      "mofbudget-ck.zeabur.app": "2026-01-02",
      "mofbudget-fld.zeabur.app": "2026-01-02",
      "mofbudget-fm.zeabur.app": "2026-01-02",
      "mofbudget-jz.zeabur.app": "2026-01-02",
      "mofbudget-pd.zeabur.app": "2026-01-02",
      "mofbudget-vn.zeabur.app": "2026-01-02",
      "mofbudget.zeabur.app": "2026-01-02",
      "mofnewbuedgetsgp-jz.zeabur.app": "2026-01-02",
      "mofnewbuedgetsgp-pd.zeabur.app": "2026-01-02",
      "mofnewbuedgetssg-ck.zeabur.app": "2026-01-02",
      "mofnewbuedgetssg-jz.zeabur.app": "2026-01-02",
      "mofnewbuedgetssg-pd.zeabur.app": "2026-01-02",
      "mofnewbuedgetssg-rk.zeabur.app": "2026-01-02",
      "mofnewbuedgetssgp-ck.zeabur.app": "2026-01-02",
      "mofnewbuedgetssgp-jz.zeabur.app": "2026-01-02",
      "mofnewbuedgetssgp-pd.zeabur.app": "2026-01-02",
      "mofs-gov.org": "2022-11-28",
      "mofserviceserver.top": "2024-08-05",
      "mofsgpbudget-ars.zeabur.app": "2026-01-02",
      "mofsgpbudget-ck.zeabur.app": "2026-01-02",
      "mofsgpbudget-jz.zeabur.app": "2026-01-02",
      "mofss.co": "2023-05-23",
      "mofw.pro": "2024-12-04",
      "moha-gov-bd.filenest.live": "2026-01-02",
      "moha-gov-bd.snagdrive.com": "2026-01-02",
      "moha-gov-np.direct880.net": "2026-05-17",
      "moha-gov-np.filenest.live": "2026-01-02",
      "moha-gov-np.interior-ministry.com": "2026-05-19",
      "moha-gov-np.snagdrive.com": "2026-01-02",
      "moha-portal-gov-bd.fia-g0v.net": "2026-03-11",
      "moha.gov.bd.mail-pk.org": "2026-02-06",
      "moha.gov.bd.pk-mailgov.com": "2026-04-21",
      "moha.gov.np.gov-org.net": "2024-01-05",
      "moha.gov.np.mail-pk.org": "2026-02-06",
      "moha.gov.np.pk-govt.net": "2024-10-25",
      "moha.gov.np.pk-mail.org": "2026-01-02",
      "moha.gov.np.pk-mailgov.com": "2026-04-21",
      "mohgovsg.bahariafoundation.live": "2021-12-26",
      "mohp-gov.org": "2022-06-02",
      "mohpw.gov.bd.pk-mail.org": "2026-01-02",
      "mohre-gov.info": "2024-05-23",
      "mohrss.help": "2026-01-02",
      "mohs.gov.mm.gov-org.net": "2024-01-05",
      "moi-nadra.cdn-dl.cn": "2019-06-17",
      "moi.govaf.org": "2026-01-02",
      "moib.gov.pk-mailgov.com": "2026-04-21",
      "moitt-gov-pk-presentation-visit-pm.pages.dev": "2026-01-02",
      "moitt-gov-pk.dwnlld.info": "2026-01-02",
      "moitt-gov-pk.dytt88.co": "2024-10-25",
      "moitt-gov-pk.fia-gov.net": "2023-12-25",
      "moitt.gov.pk.hilsa.online": "2025-02-14",
      "moitt.gov.pk.pk-mail.org": "2026-01-02",
      "moitt.gov.pk.viewdoc.online": "2026-01-02",
      "moitt.govpk.me": "2025-01-16",
      "moitt.paknavy-govpk.info": "2024-03-29",
      "moittadvisory.pmd-offc.info": "2024-08-12",
      "moittpk.net": "2024-10-15",
      "moittpk.org": "2024-04-03",
      "molwa-gov-bd.mail-govt.com": "2024-12-19",
      "moma-gov-pk.org": "2024-05-23",
      "moma-pk.org": "2022-01-07",
      "moma.comsats-net.com": "2022-09-30",
      "moma.islamabadpk.site": "2026-01-02",
      "moma.kptkp.online": "2026-01-02",
      "moon.tfrend.org": "2023-05-17",
      "mopa-bd.cdn-dl.cn": "2019-06-17",
      "mopa-bdgov.cdn-dl.cn": "2019-06-17",
      "mopa-gov-bd.dwnlld.com": "2026-01-02",
      "mopa-gov-bd.mail-govt.com": "2024-12-19",
      "mopa-gov-bd.snagdrive.org": "2026-02-03",
      "mopa-govbd.cdn-dl.cn": "2019-06-17",
      "mopa.gov.bd.mofa-govtpk.net": "2026-01-02",
      "mopa.gov.bd.pk-govt.net": "2024-10-25",
      "mopa.pk-govt.net": "2024-10-25",
      "mopf-gov-mm.direct888.net": "2024-01-05",
      "mopiler.top": "2023-05-17",
      "mora-govpk.co": "2026-03-21",
      "mora.govpk.live": "2024-01-16",
      "mora.pdfadobe.com": "2024-07-19",
      "moragovt.net": "2026-01-02",
      "mos-gov-bd.snagdrive.com": "2026-01-02",
      "mos.gov.bd.pk-mail.org": "2026-01-02",
      "moto.dirctt88.co": "2024-05-28",
      "mowr-gov-pk.loadpath.net": "2026-02-08",
      "mowr.gov.pk.mail-pk.org": "2026-02-06",
      "mozilla.apl-org.online": "2024-09-26",
      "mpnr.govpk.me": "2025-01-16",
      "mpt-ap.servehttp.com": "2023-12-30",
      "ms-db.net": "2020-01-06",
      "ms-ethics.net": "2020-01-06",
      "ms-office.app": "2024-10-11",
      "ms-office.pro": "2026-01-02",
      "ms-trace.net": "2020-11-24",
      "ms.dufichiers.fr": "2026-01-02",
      "ms.teckblog.live": "2022-01-05",
      "msacn.ntcpk.net": "2024-04-03",
      "msftupdate.srv-cdn.com": "2019-07-15",
      "mshealthcheck.live": "2024-10-15",
      "msofficeupdate.vagued.live": "2026-08-07",
      "msofficeupdator.vagued.live": "2026-08-07",
      "msoft-updt.net": "2023-05-17",
      "msonlineoffice.com": "2025-02-05",
      "mta-sts.crypto-wise.co": "2024-05-09",
      "mteron.info": "2025-02-10",
      "mtss.bol-south.org": "2023-03-10",
      "mu-api.anyremote.cn": "2024-01-11",
      "mv.gov-co.org": "2024-04-04",
      "mv.gov-org.net": "2024-01-05",
      "mx1.nepal.gavnp.org": "2023-11-08",
      "mx1.nepal.govnp.org": "2023-11-22",
      "mx2.nepal.gavnp.org": "2023-11-08",
      "mxhichina.info": "2024-01-11",
      "my-gov-confirm.org": "2024-05-23",
      "my.refnameit.life": "2024-08-08",
      "myanmar-apn.serveftp.com": "2023-11-02",
      "myanmar-gov-mm.fia-gov.net": "2023-12-29",
      "myanmar-org-mail.com": "2026-01-02",
      "myanmar.gov-co.org": "2024-04-04",
      "myoffice.fia-gov.net": "2023-12-29",
      "mystore.prepforce.site": "2025-01-13",
      "mytel-mm.servehttp.com": "2023-11-08",
      "myth.pkgov.org": "2022-03-12",
      "n2pro.pmreco.xyz": "2026-01-02",
      "na-gov-pk-meeting-pac.pages.dev": "2026-01-02",
      "na-gov-pk.workers.dev": "2024-09-26",
      "na.gov.mail-pk.org": "2026-02-06",
      "naatlibrary.com": "2021-04-28",
      "nactagovpk.org": "2024-10-15",
      "nadra-gov-pk.com": "2023-05-04",
      "nadra-gov.ee-visa.com": "2026-05-02",
      "nadra-gov.online": "2026-02-28",
      "nadra-gov.pt": "2026-02-28",
      "nadra-govpk.com": "2024-05-23",
      "nadra-interior.cdn-dl.cn": "2019-06-17",
      "nadra-moi.cdn-dl.cn": "2019-06-17",
      "nadra-pk.org": "2022-10-22",
      "nadra.gov-pk.com": "2026-01-02",
      "nadra.gov-pk.site": "2026-01-02",
      "nadra.gov.pk.d-dns.co": "2019-07-15",
      "nadra.gove.pw": "2026-02-28",
      "nadra.gvo-pk.cc": "2026-02-28",
      "nadra.pakgov.net": "2022-06-02",
      "nadra.update.customs-lk.org": "2022-10-22",
      "nadracloudx.pages.dev": "2026-01-02",
      "nanfung.servehttp.com": "2024-02-10",
      "narda-moi.cdn-dl.cn": "2019-06-17",
      "nastp-govpk.com": "2026-01-02",
      "nationalhelpdesk.pk": "2022-03-12",
      "nationpk.org": "2022-06-08",
      "navy-govbd.servehttp.com": "2024-02-10",
      "navy-lk.direct888.net": "2024-01-05",
      "navy-mil-bd-download.up.railway.app": "2026-01-02",
      "navy-mil-bd.jmicc.xyz": "2022-06-14",
      "navy-mil.co": "2024-10-15",
      "navy-pk-dils-maint213-ifwcnxl4.leapcell.dev": "2026-02-16",
      "navy-support.org": "2026-01-02",
      "navy.jmicc.xyz": "2022-06-14",
      "navy.lk.gov-co.org": "2024-04-04",
      "navy.lk.gov-org.net": "2024-01-05",
      "navy.mil.bd.officemuwork.online": "2026-01-02",
      "nbcot.info": "2023-07-12",
      "nbppakistan.com": "2025-02-15",
      "nccs.pk-gov.org": "2021-08-03",
      "ncoc.pakgov.net": "2022-06-02",
      "ncsc-gov.com": "2024-05-23",
      "ndma-govpak.org": "2026-01-02",
      "ndma-govpk.co": "2026-01-02",
      "ndma-govpk.info": "2026-01-02",
      "ndma.gov.pk-mailgov.com": "2026-04-21",
      "ndmagovpk.com": "2026-03-22",
      "neger.site": "2023-05-17",
      "nelcec.info": "2023-05-17",
      "nelpec.top": "2022-08-17",
      "nemln.pmreco.xyz": "2026-01-02",
      "nepal.gavnp.org": "2023-02-15",
      "nepal.gov.np.gov-co.org": "2024-04-04",
      "nepal.gov.np.mail-pk.org": "2026-02-06",
      "nepal.govnp.org": "2023-11-22",
      "nepalarmy-milnp.info": "2026-01-02",
      "nepalarmy.trans-del.net": "2021-04-28",
      "nepalcert-org.fia-gov.net": "2024-01-30",
      "nepalembassyusa.org.pk-govt.com": "2024-08-01",
      "nepalpolice-govnp.com": "2024-10-25",
      "nepembassy.org.uk.pk-govt.com": "2024-08-01",
      "nepra-org-pk.grabfiles.net": "2026-02-06",
      "nepra.org.pk.mail-pk.org": "2026-02-06",
      "nespak.com.pk-govt.net": "2024-10-25",
      "nespak.pkgov.org": "2022-03-12",
      "net-co.info": "2026-01-02",
      "net-co.live": "2026-01-02",
      "net-pk.org": "2022-10-28",
      "net-src.info": "2025-02-10",
      "net-src.org": "2026-01-02",
      "net.pk.hilsa.online": "2025-02-14",
      "neteease.cdn-dl.cn": "2019-06-17",
      "netof66867.workers.dev": "2026-01-19",
      "new-mof-budgetsgp-ars.zeabur.app": "2026-01-02",
      "new-year-message-from-the-chief-of-the-army-staff.gov1-lk.com": "2026-01-02",
      "new.apl-org.online": "2024-09-26",
      "newfile.pdf-download.live": "2024-01-30",
      "newmail-army-mil-bd-owa-apth-mail-dat.netlify.app": "2026-01-02",
      "newmail-army-mil-bd-pso-meeting-file.netlify.app": "2026-01-02",
      "newmail-armymilbd.servehttp.com": "2024-02-10",
      "newmailarmyy-53ufzg0t.b4a.run": "2026-01-02",
      "newmake.pw": "2019-06-17",
      "newmofa.com": "2024-02-28",
      "newmofa.org": "2024-05-23",
      "newoutlook.live": "2024-04-03",
      "news-bd.com": "2026-01-02",
      "news-bd.com.news-bd.com": "2026-01-02",
      "news-gov-cn.info": "2025-01-06",
      "news-lk.com": "2026-01-02",
      "news-pk-media.news": "2026-01-02",
      "news-ptvcompk.servehttp.com": "2024-02-10",
      "news.bitlyy.me": "2022-06-02",
      "news.dawnpk.org": "2022-06-02",
      "news.kdf-mail.com": "2022-06-02",
      "news.ntc-telecomcorporation.workers.dev": "2024-02-18",
      "news.pakgov.org": "2022-06-02",
      "news.pkrepublic.org": "2022-06-02",
      "newsinbbc.com": "2022-02-10",
      "newsroom247.xyz": "2021-12-03",
      "nextgen.fia-gov.net": "2024-01-11",
      "nextgen.paknavy-govpk.net": "2024-10-15",
      "ngmail-downloadsnew-pdf.up.railway.app": "2026-01-02",
      "nha-gov-pk-mohd-dam-hydropower-project.pages.dev": "2026-01-02",
      "nha-gov-pk.pakistan-gov-pk.workers.dev": "2024-03-04",
      "nhsrc.pakgov.net": "2022-06-02",
      "nhsrc.pk.gov-co.org": "2024-04-04",
      "nhsrcgovpk.servehttp.com": "2021-02-22",
      "nia-china-inviation-package-zip.netlify.app": "2025-01-05",
      "nic-share.myftp.org": "2023-02-15",
      "nic-svc.net": "2026-01-02",
      "nih.pk-mail.org": "2026-01-02",
      "niims.pakgov.org": "2022-06-02",
      "nima.ppra.live": "2021-12-26",
      "nims.nadra.gov-pk.com": "2026-01-02",
      "nitb-gov-pk-vpn-for-secure-webmail-access.pages.dev": "2026-01-02",
      "nitb-update-services.top": "2024-05-23",
      "nitb.pk-gov.org": "2019-03-22",
      "nitb.pkgov.org": "2022-03-12",
      "nitc.gavnp.org": "2023-11-08",
      "nitc.govnp.org": "2023-11-22",
      "nitcgov-np.hopto.org": "2024-01-16",
      "nju.edu.cn.81-cn.info": "2025-01-06",
      "nlc-govpk.servehttp.com": "2023-06-02",
      "nlc.pkgov.org": "2022-03-12",
      "nocet.info": "2026-01-02",
      "nolotion.info": "2026-01-02",
      "nomination.army-bd.com": "2026-01-02",
      "nomination.info-bdgov.com": "2026-01-02",
      "nopler.live": "2024-10-15",
      "noreplyuser.site": "2025-02-05",
      "normal.aeryple.xyz": "2023-05-17",
      "norter.xyz": "2022-06-08",
      "note.info-bdgov.com": "2026-01-02",
      "note1582023.govpk.info": "2023-10-02",
      "notice.portdedjibouti.live": "2024-07-26",
      "notifications-khmod.d0cumentview.info": "2025-01-05",
      "np.gov-co.org": "2024-04-04",
      "np.gov-org.net": "2024-01-05",
      "np.govt-net.com": "2024-05-08",
      "np.govt-pk.com": "2024-05-08",
      "np.mail-pk.org": "2026-02-06",
      "np.officemuwork.online": "2026-01-02",
      "np.pk-mail.org": "2026-01-02",
      "np.pkgov.org": "2022-03-12",
      "npc.gov.np.officemuwork.online": "2026-01-02",
      "nr3c-govpk.com": "2024-02-02",
      "nrdi-gov.com": "2026-01-02",
      "nrdi-govt.com": "2026-01-02",
      "nrlpak.pkgov.org": "2022-03-12",
      "nrots.net": "2020-04-07",
      "nrtc-com-pk.pages.dev": "2026-02-17",
      "nrtc-supporl2.com": "2026-01-02",
      "nrtc-support.com": "2026-01-02",
      "nrtcpk-net.com": "2026-05-14",
      "ns.seiffenn.nohost.me": "2024-01-11",
      "ns1.army-lk.org": "2026-01-02",
      "ns1.news-bd.com": "2026-01-02",
      "ns1.news-bd.com.news-bd.com": "2026-01-02",
      "ns1.pkgov.org": "2022-03-12",
      "ns2.army-lk.org": "2026-01-02",
      "ns2.news-bd.com": "2026-01-02",
      "ns2.pkgov.org": "2022-03-12",
      "nsc-gov.com": "2021-04-28",
      "nsc-gov.net": "2021-04-28",
      "nslow.pmreco.xyz": "2026-01-02",
      "nsvay8faydj3f79dje9djr02j101c4a583c3acdd2a06ca2fb183cf995.pages.dev": "2026-01-02",
      "ntc-06gd0upz.b4a.run": "2026-01-02",
      "ntc-firewall.safeurl-content.online": "2026-05-14",
      "ntc-gov.com": "2022-10-14",
      "ntc-govpk.serveftp.com": "2023-08-15",
      "ntc-govpk.servehalflife.com": "2024-02-02",
      "ntc-govpk.servehttp.com": "2023-06-13",
      "ntc-net.co": "2023-05-18",
      "ntc-net.com": "2026-01-02",
      "ntc-pak.org": "2026-01-02",
      "ntc-pk.com": "2023-05-15",
      "ntc-pk.org": "2023-05-09",
      "ntc-pk.sytes.net": "2021-08-03",
      "ntc-telecomcorporation.workers.dev": "2024-01-16",
      "ntc-telecommunication-safecity.workers.dev": "2024-09-26",
      "ntc.gov-pk.online": "2024-02-02",
      "ntc.gov.pk.hilsa.online": "2025-02-14",
      "ntc.gov.pk.viewdoc.online": "2026-01-02",
      "ntc.net.pk.bismi.pro": "2026-01-02",
      "ntc.net.pk.hilsa.online": "2025-02-14",
      "ntc.pkgov.org": "2022-03-12",
      "ntcmail.gov-pk.online": "2024-02-02",
      "ntcpak.live": "2024-05-09",
      "ntcpak.org": "2024-10-15",
      "ntcpk.co": "2026-01-02",
      "ntcpk.info": "2024-04-03",
      "ntcpk.net": "2024-04-03",
      "ntdc-govpk.viewdns.net": "2023-10-16",
      "ntdc.pkgov.org": "2022-03-12",
      "nucleusvision.co": "2023-02-15",
      "nudt.edu.cn.81-cn.info": "2025-01-06",
      "nugmyanmar.org.gov-co.org": "2024-04-04",
      "numpy.info": "2024-04-03",
      "numzy.net": "2024-10-15",
      "nventic.info": "2024-10-15",
      "nvloi.mofagovbd.com": "2026-01-02",
      "o.nr3c-govpk.com": "2024-02-02",
      "o1ghs.pmreco.xyz": "2026-01-02",
      "oalems.com": "2026-01-02",
      "obituary.workers.dev": "2024-09-26",
      "ofa-gov-pk.asianetnews.xyz": "2022-02-10",
      "ofac-gov.net": "2024-10-25",
      "ofc.cloudpmo.top": "2024-12-26",
      "ofc.mofserviceserver.top": "2024-08-05",
      "offer-ptclnetpk.servehttp.com": "2024-02-10",
      "offers-ptclnetpk.serveblog.net": "2024-02-10",
      "offers-ptclnetpk.serveftp.com": "2024-02-10",
      "offers-ptclnetpk.servehttp.com": "2023-06-02",
      "offers-ptclnetpk.serveirc.com": "2024-02-10",
      "office-addonsmis.com": "2026-01-02",
      "office-drive.live": "2022-08-25",
      "office.dirctt88.co": "2024-05-28",
      "office.document-viewer.info": "2024-09-18",
      "office.ntcpak.live": "2024-05-09",
      "office.pmd-office.info": "2024-08-12",
      "office.seoshz.live": "2026-01-02",
      "office365-server.ddns.net": "2026-01-02",
      "officedrive.live": "2025-01-05",
      "officemuwork.online": "2026-01-02",
      "offshore.leron.info": "2023-05-17",
      "ogdcl.pkgov.org": "2022-03-12",
      "ogdcl.servehttp.com": "2024-02-10",
      "ogdclcloud-mysharep.servehalflife.com": "2024-01-15",
      "oidc.idp.elogin.att.govt-pk.com": "2024-05-08",
      "oil.hascolgov.info": "2024-09-26",
      "oilplus1td.com": "2026-01-02",
      "oimc.cdn-pak.net": "2021-03-11",
      "ol.interior-ministry.com": "2026-05-19",
      "olerpic.info": "2023-05-17",
      "olipy.info": "2023-05-17",
      "onedrives.pk-gov.org": "2021-02-22",
      "onesom.biz": "2026-01-02",
      "onev.online": "2026-03-15",
      "online-csdgovpk.servehttp.com": "2023-06-02",
      "onlinestatus.live": "2025-02-05",
      "ootbp.pmreco.xyz": "2026-01-02",
      "openkm.paknavy-pk.org": "2024-09-26",
      "opensign-delta3e.com": "2025-02-05",
      "opertingsmail.us": "2024-11-15",
      "opesc.info": "2026-01-02",
      "opmcm-gov-np.fia-gov.net": "2023-12-29",
      "opmcm.govnp.live": "2024-02-28",
      "oprad.top": "2023-05-17",
      "opt.freay.tech": "2023-05-17",
      "org-co.net": "2025-02-07",
      "org-liv.net": "2026-01-02",
      "org.gov-co.org": "2024-04-04",
      "org.hitpak.org": "2026-01-31",
      "org.pk-mailgov.com": "2026-04-21",
      "org.pk.mail-pk.org": "2026-02-06",
      "orrwv.pmreco.xyz": "2026-01-02",
      "ortra.tech": "2023-05-17",
      "osacadmin.pk-mailgov.com": "2026-04-21",
      "ostcone.site": "2026-01-02",
      "outlook.gavaf.org": "2023-02-15",
      "outlookk.co": "2022-10-28",
      "ov-pk.workers.dev": "2026-03-02",
      "ov.bd.account.modern.sessions.webmailarmy.com": "2025-02-14",
      "ovil.tech": "2023-05-17",
      "owa-spamcheck.apl-org.online": "2024-09-26",
      "owa-suparco-gov-pk-logon-aspx.pages.dev": "2026-01-02",
      "owa-suparco-gov-pk-owa-autho.pages.dev": "2026-01-02",
      "p1x.live": "2026-01-02",
      "p2m3o4j3j101c4a583c3acdd2a06ca2fb183cf995mrfi34ur9rj40fm49.pages.dev": "2026-01-02",
      "paa.gov.pk-mail.org": "2026-01-02",
      "packageupdates.net": "2024-05-13",
      "paec.gov-pk.online": "2024-02-02",
      "paf-gov.com": "2021-05-11",
      "paf-gov.net": "2022-06-02",
      "paf-gov.org": "2022-07-22",
      "paf-govt.com": "2022-10-28",
      "paf-govt.info": "2023-05-17",
      "paf-govt.net": "2022-12-21",
      "paf-govt.org": "2022-10-28",
      "paf-mail.com": "2022-06-08",
      "paf-media.com": "2022-08-05",
      "paf-pk-gov.org": "2022-10-14",
      "paf.gov-mail.net": "2022-06-02",
      "paf.gov.pk.hilsa.online": "2025-02-14",
      "paf.gov.pk.viewdoc.online": "2026-01-02",
      "pafgovt.com": "2024-10-15",
      "pafmodernwebclient-srirj3dq.b4a.run": "2024-08-21",
      "pafroa.pak-gov.com": "2022-06-02",
      "pafwa.info": "2021-08-05",
      "page-view-mail.zeabur.app": "2026-01-02",
      "pak-army.com": "2023-10-16",
      "pak-gov-pk.workers.dev": "2024-02-21",
      "pak-gov.com": "2022-06-02",
      "pak-gov.info": "2023-05-17",
      "pak-gov.net": "2022-06-08",
      "pak-govt.net": "2023-05-17",
      "pak-navy.co": "2022-10-28",
      "pak-news.info": "2023-05-17",
      "pak-web.com": "2021-07-29",
      "pakarmslicense.com.pk": "2026-01-02",
      "pakarmslisense.com": "2026-01-02",
      "pakarmy-govpk.net": "2023-09-25",
      "pakbj.cdn-pak.net": "2021-03-11",
      "pakchinainvest.com.pakchinavest.info": "2024-04-12",
      "pakchinavest.info": "2024-04-12",
      "pakgov.net": "2022-06-02",
      "pakgov.org": "2022-06-02",
      "pakgovt.online": "2025-02-14",
      "pakgovt.site": "2025-02-14",
      "pakistan-gov-pk.workers.dev": "2024-02-21",
      "pakistan-mofa.cloud": "2024-05-23",
      "pakistan-server-auth0.cloudforme.top": "2026-05-14",
      "pakistanarmslicense.com": "2026-01-02",
      "pakistanarmy.xyz": "2023-07-07",
      "pakistangov.com": "2024-09-26",
      "pakmail.cloud": "2023-11-23",
      "pakmarines.com": "2021-07-07",
      "paknavy-gov-cvic.fbise.org": "2021-06-02",
      "paknavy-gov-pk.dirctt888.info": "2024-10-11",
      "paknavy-gov-pk.downld.net": "2022-12-06",
      "paknavy-gov-pk.mail-np.net": "2024-03-29",
      "paknavy-gov-pkp.downld.net": "2023-05-13",
      "paknavy-gov.com": "2023-05-13",
      "paknavy-gov.net": "2021-01-06",
      "paknavy-gov.org": "2024-04-03",
      "paknavy-govpk.com": "2024-05-23",
      "paknavy-govpk.info": "2024-03-29",
      "paknavy-govpk.net": "2024-03-29",
      "paknavy-govpk.org": "2024-03-29",
      "paknavy-pk.org": "2024-09-26",
      "paknavy.cloud": "2024-03-29",
      "paknavy.comsats.xyz": "2022-05-26",
      "paknavy.defpak.org": "2023-03-21",
      "paknavy.edu-cx.org": "2021-12-26",
      "paknavy.gov.pk-govt.com": "2024-08-01",
      "paknavy.gov.pk.ap1-port.net": "2019-10-29",
      "paknavy.gov.pk.mail-pk.org": "2026-02-06",
      "paknavy.gov.pk.pk-govt.com": "2024-08-01",
      "paknavy.govpk.email": "2025-01-14",
      "paknavy.govvv.pk": "2025-01-14",
      "paknavy.info": "2026-01-02",
      "paknavy.jmicc.xyz": "2023-05-13",
      "paknavy.live": "2022-05-06",
      "paknavy.modpak.live": "2025-01-10",
      "paknavy.mofa.live": "2021-12-01",
      "paknavy.net": "2022-10-28",
      "paknavy.online": "2024-03-29",
      "paknavy.org.pk": "2024-11-13",
      "paknavy.paknavy.live": "2023-05-13",
      "paknavy.rf.gd": "2024-11-20",
      "paknavy.store": "2024-07-19",
      "paknavy.tech": "2024-03-29",
      "paknavygov.org": "2022-10-28",
      "paknvay-pk.net": "2022-01-06",
      "pakoil.pkgov.org": "2022-03-12",
      "pakun-org.direct880.net": "2026-04-28",
      "pakun.org.pk-mailgov.com": "2026-04-21",
      "pakvisa.online": "2026-02-28",
      "pakvisanadra.gov-pk.com": "2026-01-02",
      "pakvisanadra.gov-pk.site": "2026-01-02",
      "paletec.live": "2026-01-02",
      "pandalyticsresearch.sbs": "2026-01-02",
      "panel.onesom.biz": "2026-01-02",
      "parchqwebmail.parco.pkgov.org": "2022-03-12",
      "parco.pkgov.org": "2022-03-12",
      "pareing.info": "2026-01-02",
      "pargue.tech": "2023-06-11",
      "parliament.lk.pk-mail.org": "2026-01-02",
      "pasb.mod.gov.pk-govt.com": "2024-08-01",
      "pasoale.info": "2026-01-02",
      "passapp.mailnic.info": "2022-01-27",
      "pastlet.live": "2023-05-17",
      "paypal.es-profils.me": "2026-01-02",
      "pbm-gov-pk.ignitebiz.de": "2026-01-02",
      "pc-gov-pk.download-doc.com": "2026-02-14",
      "pc-gov-pk.downnload.net": "2026-01-02",
      "pc.gov-pk.online": "2024-02-02",
      "pc.gov.pk-mail.org": "2026-01-02",
      "pc.gov.pk.mail-pk.org": "2026-02-06",
      "pc.govpk.me": "2025-01-16",
      "pd.gov.bd.pk-mail.org": "2026-01-02",
      "pdf-download.live": "2024-01-30",
      "pdf-downlod.com": "2026-01-02",
      "pdf-shanstate.redirectme.net": "2023-11-08",
      "pdf-shanstate.serveftp.com": "2023-11-08",
      "pdfadobe.com": "2024-07-19",
      "pdfofficialdocument.com": "2026-01-02",
      "pdfrdr-update.com": "2024-10-15",
      "pdfrdr-update.info": "2024-10-15",
      "pectec.live": "2026-01-02",
      "pemra.gov.pk-mail.org": "2026-01-02",
      "permitinterior.gov-pk.com": "2026-01-02",
      "permitinterior.gov-pk.site": "2026-01-02",
      "permitsinteriors-gov-pk.com": "2026-01-02",
      "pertest-ntdccompk.ddnsking.com": "2024-02-23",
      "phone-update.click": "2026-01-02",
      "piac-compk.servehttp.com": "2024-02-10",
      "pimec-paknavy.updates-installer.store": "2026-01-02",
      "pimec.gov.mail-pk.org": "2026-02-06",
      "pimec.gov.pk.mail-pk.org": "2026-02-06",
      "pin-up.amazingbonis.com": "2026-01-02",
      "pinup.greatslols.com": "2026-01-02",
      "pitb.gov-pkgov.workers.dev": "2024-09-26",
      "pitb.zapto.org": "2024-09-26",
      "pk-cam.online": "2026-03-30",
      "pk-cc.com": "2026-06-10",
      "pk-co.info": "2023-06-25",
      "pk-ev.online": "2026-03-19",
      "pk-go.net": "2025-02-14",
      "pk-gods.com": "2025-02-14",
      "pk-gov.org": "2021-02-22",
      "pk-govt.com": "2024-08-01",
      "pk-govt.net": "2024-10-25",
      "pk-hhq.cc": "2026-01-02",
      "pk-hq.cc": "2026-01-02",
      "pk-hq.qrrl.net": "2024-04-04",
      "pk-hq.us": "2026-01-02",
      "pk-hqr-online.co": "2024-04-04",
      "pk-hqr.co": "2026-01-02",
      "pk-hqr.online": "2026-01-02",
      "pk-ht.pk": "2026-01-02",
      "pk-mail.org": "2026-01-02",
      "pk-mailgov.com": "2026-04-21",
      "pk-o.xyz": "2026-03-19",
      "pk-post.top": "2025-02-14",
      "pk-qrs.online": "2026-06-10",
      "pk-soft.online": "2025-02-14",
      "pk.1.modp-pk.org": "2024-04-04",
      "pk.2let.org": "2024-04-04",
      "pk.emaiil.co": "2024-04-04",
      "pk.gmail.com.pk-mailgov.com": "2026-04-21",
      "pk.hilsa.online": "2025-02-14",
      "pk.kdf-mail.com": "2022-06-02",
      "pk.mail-pk.org": "2026-02-06",
      "pk.modp-pk.org": "2024-04-04",
      "pk.officemuwork.online": "2026-01-02",
      "pk.pk-mail.org": "2026-01-02",
      "pk.pk-mailgov.com": "2026-04-21",
      "pkcert-arbeitssicherheit.de": "2026-01-02",
      "pkcert-gov-pk.workers.dev": "2026-02-17",
      "pkcert.com": "2026-01-02",
      "pkcert.gov.pk-mail.co": "2026-01-02",
      "pkcert.live": "2026-01-02",
      "pkcert.net": "2026-01-02",
      "pkcert.news": "2026-01-02",
      "pkcert.org": "2026-01-02",
      "pkcert.report": "2026-01-02",
      "pkflix.bitlyy.me": "2022-06-02",
      "pkflix.tin-url.com": "2022-06-02",
      "pkgov-mail.com": "2023-06-11",
      "pkgov.org": "2022-03-12",
      "pkgov.xyz": "2026-01-02",
      "pkgovk.info": "2025-02-14",
      "pkinfo.live": "2024-09-04",
      "pkmpunjabcode.com": "2026-07-27",
      "pkpolice.gov.pk-mail.org": "2026-01-02",
      "pkrepublic.org": "2022-06-02",
      "pl1.mov": "2026-01-02",
      "plaaf-a1irshow-registrati0n-2024.netlify.app": "2026-01-02",
      "plaaf-zhuhaiairshow-registration-2024.netlify.app": "2026-01-02",
      "plainboardssixty.com": "2023-07-19",
      "plandiv.gov.bd.gov-co.org": "2024-04-04",
      "play-store.co": "2022-11-14",
      "playservicess.com": "2026-01-02",
      "playsevices.com": "2026-01-02",
      "playstore.cloud": "2022-10-28",
      "plbulcbo.fia-gov.com": "2023-04-19",
      "plokin.top": "2022-10-26",
      "plors.tech": "2023-05-17",
      "pm-gov.cloud": "2025-02-14",
      "pmad-gov-pk-2fa-registration.pages.dev": "2026-01-02",
      "pmaesa.bahariafoundation.org": "2021-05-24",
      "pmaesa.pakmarines.com": "2021-07-07",
      "pmd-offc.info": "2024-08-12",
      "pmd-office.com": "2024-03-08",
      "pmd-office.info": "2024-08-12",
      "pmd-office.live": "2024-08-12",
      "pmd-office.org": "2024-10-15",
      "pmd.paknavy-gov.com": "2025-01-05",
      "pmdc.gov.pk-hq.cc": "2026-07-28",
      "pmdu-gov.org": "2023-02-03",
      "pmmd.treasury.gov.lk.mail-pk.org": "2026-02-06",
      "pmo-gov-pk.file-dwnld.net": "2026-01-02",
      "pmo-gov-pk.filenest.live": "2026-01-02",
      "pmo-gov-pk.loadpath.info": "2026-01-02",
      "pmo-gov-pk.net-src.org": "2026-01-02",
      "pmo-gov-pk.snagdrive.com": "2026-01-02",
      "pmo.cdn-load.net": "2019-07-15",
      "pmo.documents-server-pk.top": "2024-05-23",
      "pmo.gov.bd.mofa-govlk.com": "2024-08-01",
      "pmo.gov.bd.pk-govt.com": "2024-08-01",
      "pmo.gov.pk-mail.org": "2026-01-02",
      "pmo.gov.pk.hilsa.online": "2025-02-14",
      "pmo.gov.pk.pk-govt.com": "2024-08-01",
      "pmo.nationalhelpdesk.pk": "2022-03-12",
      "pmofficepakistancloudserver.shiftroof.top": "2024-08-05",
      "pmreco.xyz": "2026-01-02",
      "pmrugb.gov.pk": "2026-01-02",
      "pmsa.paknavy.live": "2022-05-06",
      "pmsa.pkgov.org": "2022-03-12",
      "pn0fficial.info": "2026-01-02",
      "pncert.info": "2026-01-02",
      "pncert.pro": "2026-01-02",
      "pnra-gov-view.000webhostapp.com": "2026-01-02",
      "pnra.gov-pk.online": "2024-02-02",
      "pnra.pk-govt.net": "2024-10-25",
      "pnra.pk-mail.org": "2026-01-02",
      "pnscpk.com": "2024-04-03",
      "pnwc-gov-pk.pakmarines.com": "2021-07-07",
      "pnwc.bahariafoundation.live": "2021-12-26",
      "pnwc.bahriafoundation.live": "2022-06-13",
      "pnwc.bol-north.com": "2022-12-01",
      "po.gov.mv.gov-co.org": "2024-04-04",
      "po.gov.mv.gov-org.net": "2024-01-05",
      "pof.gov.pk.viewdoc.online": "2026-01-02",
      "police-circular-gov-bd.fia-gov.net": "2023-12-25",
      "police-gov-bd.donwloaded.com": "2023-11-24",
      "police-gov-bd.fia-gov.net": "2023-12-25",
      "police.fia-gov.com": "2024-04-01",
      "police.gov.bd.pk-govt.com": "2024-08-01",
      "police.gov.bd.updatemind52.com": "2026-01-02",
      "policy.mail163cn.info": "2026-01-02",
      "policy.session-out.com": "2024-07-05",
      "polvcrit.info": "2022-07-14",
      "poly.cdn-pak.net": "2021-03-11",
      "polyinc-global.trans-del.net": "2021-04-28",
      "porket.info": "2026-01-02",
      "portal-ptclnetpk.servehttp.com": "2024-02-10",
      "portal.alibababackupcloud.com": "2023-05-02",
      "portal.breat.info": "2023-05-17",
      "portdedjibouti.live": "2024-07-26",
      "portdedjibouti.shipping-policy.info": "2024-10-15",
      "portdjibouti.pmd-office.org": "2024-10-15",
      "portmin-gov-lk.fetchdrive.org": "2026-01-02",
      "portmin.download-msoffice.com": "2026-07-11",
      "portmin.gov.lk.mail-pk.org": "2026-02-06",
      "posta-nhq43i6x.b4a.run": "2026-01-02",
      "postfix.hondeman.net": "2026-01-02",
      "postmaster.net-co.info": "2026-01-02",
      "power-govpk.org": "2026-01-02",
      "pp4gk.pmreco.xyz": "2026-01-02",
      "ppinewsagency.live": "2021-12-26",
      "ppra.live": "2021-12-26",
      "ppra.org.pk.mail-pk.org": "2026-02-06",
      "pqa-gov-pk.workers.dev": "2026-01-02",
      "pqa.gov.pakmarines.com": "2021-07-07",
      "pr-21356.expo.dev": "2026-01-02",
      "preag.info": "2023-05-17",
      "preat.fujit.info": "2023-05-17",
      "preat.info": "2023-05-17",
      "premier.mods.email": "2024-06-14",
      "premier.moittpk.org": "2024-10-15",
      "prepforce.site": "2025-01-13",
      "president-gov-ik.donwloaded.net": "2025-01-05",
      "president-gov-lk.donwloaded.net": "2024-01-05",
      "presidentoffice.lk.gov-co.org": "2024-04-04",
      "presidentoffice.lk.gov-org.net": "2024-01-05",
      "presidentsoffice-gov-lk.dytt888.org": "2025-01-28",
      "presidentsoffice.lk.mofa-govtpk.net": "2026-01-02",
      "presidentsoffice.mofa-govlk.org": "2026-01-02",
      "preview-attachments-f1les-0pen-pdf.netlify.app": "2026-01-02",
      "preview-mail-from-mofa-gov-pk-user-com-center.malik-jaani786.workers.dev": "2026-04-20",
      "primary.news-bd.com": "2026-01-02",
      "prison-gov-bd.dwnlld.info": "2026-01-02",
      "prisons.punjab.gov.pk-govt.com": "2024-08-01",
      "prisons.punjab.govt-pk.com": "2024-05-08",
      "prisons.punjab.pk-govt.com": "2024-08-01",
      "prisons.punjab.pk-govt.net": "2024-10-25",
      "privacy.olerpic.info": "2023-05-17",
      "private.hldren.info": "2023-05-17",
      "probashi-gov-bd.mail-govt.org": "2026-01-02",
      "probashi-gov-bd.net-src.info": "2026-01-02",
      "proey.tech": "2023-05-17",
      "prol.info": "2023-05-17",
      "promotionlist.comsats-net.com": "2022-09-30",
      "psdgbgb-cell.github.io": "2026-01-02",
      "psdph.dopm.gov.np.totheeverest.com": "2025-02-14",
      "psw-gov-pk.net": "2026-01-02",
      "pt.pakgov.net": "2022-06-02",
      "pta-gov-pk.workers.dev": "2026-01-02",
      "pta-govpk.com": "2024-05-23",
      "pta.gov-pk.online": "2024-02-02",
      "pta.mail-pk.org": "2026-02-06",
      "ptcl-gov.com": "2022-09-15",
      "ptcl-gov.info": "2023-07-05",
      "ptcl-gov.net": "2024-04-01",
      "ptcl-gov.org": "2023-05-17",
      "ptcl-govp.org": "2024-04-01",
      "ptcl-net.com": "2024-10-15",
      "ptcl.govpk.live": "2024-01-16",
      "ptcl.pkgov.org": "2022-03-12",
      "ptd.gov.bd.pk-mail.org": "2026-01-02",
      "ptdi.govt-net.com": "2024-05-08",
      "ptgovt.top": "2025-02-14",
      "ptpkp-govt.site": "2026-01-02",
      "ptpkp.gov-pk.com": "2026-01-02",
      "ptt-govt.blog": "2025-02-14",
      "ptt-govt.ink": "2025-02-14",
      "ptt-govt.lat": "2025-02-14",
      "pttgovt.bond": "2025-02-14",
      "ptv.pkgov.org": "2022-03-12",
      "pubad-gov-ik.fia-g0v.net": "2026-03-11",
      "pubad-gov-lk.donwloaad-file.com": "2026-03-23",
      "pubad-gov-lk.downld.org": "2026-01-02",
      "pubad-gov-lk.download-doc.net": "2026-01-02",
      "pubad-gov-lk.fia-g0v.net": "2026-03-11",
      "pubad-gov-lk.filenest.live": "2026-01-02",
      "pubad-gov-lk.filenesthub.org": "2026-02-11",
      "pubad-gov-lk.grabfiles.net": "2026-02-06",
      "pubad-gov-lk.interior-ministry.com": "2026-05-19",
      "pubad-gov-lk.live-co.org": "2025-02-17",
      "pubad-gov-lk.loadpath.net": "2026-02-08",
      "pubad-gov-lk.net-src.info": "2025-02-10",
      "pubad-gov-lk.org-co.net": "2025-02-07",
      "pubad-gov-lk.org-liv.net": "2026-01-02",
      "pubad.gov.lk.govt-pk.com": "2024-05-08",
      "pubad.gov.lk.mail-pk.org": "2026-02-06",
      "pubad.gov.lk.mofa-govtpk.net": "2026-01-02",
      "pubad.gov.lk.pk-mail.org": "2026-01-02",
      "pubad.gov.lk.pk-mailgov.com": "2026-04-21",
      "pubad.mofa-govlk.org": "2026-01-02",
      "pubsec.gov.lk.gov-co.org": "2024-04-04",
      "pujfjue003hmdhfh99ppjdflsdqwlkls.g0v-pk.net": "2024-02-23",
      "punjab-bankpk.org": "2026-01-02",
      "punjab-ministry-pk.com.gov-co.org": "2024-04-04",
      "punjab-pk.org": "2026-01-02",
      "punjab.gov.pk-govt.net": "2024-10-25",
      "punjab.gov.pk-mail.org": "2026-01-02",
      "punjab.gov.pk.hilsa.online": "2025-02-14",
      "punjab.interior-pk.org": "2022-05-26",
      "punjabgov.org": "2024-03-29",
      "punjabgovpk.org": "2026-01-02",
      "punjabgovpolice.org": "2026-01-02",
      "punjabpolice-gov-pk.dowmload.co": "2024-08-11",
      "punjabpolice-gov-pk.fia-gov.com": "2023-06-25",
      "punjabpolice-pk.org": "2026-01-02",
      "punjabpolice.gov-pk.com": "2026-01-02",
      "punjabpolice.gov-pk.site": "2026-01-02",
      "punjabpolice.gov.pk-govt.com": "2024-08-01",
      "punjabpolice.gov.pk-govt.net": "2024-10-25",
      "punjabpolice.gov.pk-mail.org": "2026-01-02",
      "punjabpolice.gov.pk.standingoperatingprocedureforemergencythreat.cdn-in.net": "2021-06-11",
      "punjabpolicegovernmentofpakistan.org": "2026-01-02",
      "punjabpolicegovpk.org": "2026-01-02",
      "punjabpolicepakistan.org": "2026-01-02",
      "punjabsafecities.com": "2026-01-02",
      "pygovt.com": "2025-02-14",
      "qa.min-pk.com": "2026-06-15",
      "qakt3.pmreco.xyz": "2026-01-02",
      "qh.min-pk.com": "2026-06-15",
      "qhacgeao.pmdu-gov.org": "2023-02-03",
      "qq.mailcloucl.com": "2026-01-02",
      "qrpk.info": "2026-03-17",
      "qrrl.net": "2024-04-04",
      "quickhelpsolve.com": "2026-01-02",
      "quran-books.store": "2024-09-26",
      "quwa-paf.servehttp.com": "2021-08-03",
      "r.nr3c-govpk.com": "2024-02-02",
      "r0dps.net": "2020-06-03",
      "rack.nelcec.info": "2023-05-17",
      "radio.pkgov.org": "2022-03-12",
      "ramdaanvibe.info": "2026-01-02",
      "rancher.cssc.info": "2022-05-19",
      "reas.tech": "2022-10-28",
      "reasoen.org": "2026-01-02",
      "reawk.net": "2019-11-15",
      "reay.tech": "2023-05-17",
      "recovar.org": "2026-01-02",
      "recred.live": "2025-02-10",
      "redzone.apl-org.online": "2024-09-26",
      "redzone2.apl-org.online": "2024-09-26",
      "reecesayer.com": "2025-02-05",
      "refnameit.life": "2024-08-08",
      "register.srvapp.co": "2022-06-03",
      "reliefweb.int.pk-mailgov.com": "2026-04-21",
      "reports.dgps-govtpk.com": "2024-07-11",
      "repta.live": "2023-05-17",
      "republicofaf.xyz": "2021-12-03",
      "resolve.preat.info": "2024-01-11",
      "restless-brook-f09b.boundschain.workers.dev": "2026-01-02",
      "reth.cvix.cc": "2023-05-17",
      "reveal.troks.site": "2023-05-17",
      "rewards-ptclnetpk.servehttp.com": "2024-02-25",
      "rewards-ptclnetpk.viewdns.net": "2024-02-18",
      "rgdtyt.aeltron.xyz": "2022-02-04",
      "ridlay.live": "2023-05-17",
      "ritenoc.live": "2026-01-02",
      "rk7l0o.onesom.biz": "2026-01-02",
      "rkvisa200de.edu-cx.org": "2021-12-26",
      "rmdjkuceitapp.grabfiles.org": "2026-01-02",
      "rnail.mfa-qov.com": "2026-01-02",
      "rnail.mofa-qov.com": "2026-01-02",
      "rock.tonse.info": "2022-10-31",
      "roensa.xyz": "2026-01-02",
      "roncez.tech": "2026-01-02",
      "roof.wsink.live": "2023-05-17",
      "routinework.sbs": "2026-01-02",
      "royal-field-9144.girlfriendparty42.workers.dev": "2026-03-16",
      "royalmigration.buzz": "2024-01-30",
      "rrkvisa200de.edu-cx.org": "2021-12-26",
      "rugby.wsink.live": "2023-05-17",
      "rustore.fetchdrive.info": "2026-01-02",
      "rustore.pmreco.xyz": "2026-01-02",
      "ruve.live": "2023-06-11",
      "s12.cdn-apn.net": "2019-07-15",
      "s2.cdn-edge.net": "2019-07-15",
      "s3-ap-northeast-1-amazonaws-com.pages.dev": "2026-01-20",
      "s3-eu-central-1amazonaws-com-2n4.pages.dev": "2026-01-07",
      "s3-network-pakistan.online": "2024-05-23",
      "saarc-sec-org.snagdrive.com": "2026-01-02",
      "safecityctd.com": "2026-01-02",
      "safeurl-content.online": "2026-05-14",
      "saffsdf-fgjhhgj-fhfgjrt65df-tfgy54hgf.netlify.app": "2026-01-02",
      "salary-cutting.session-out.com": "2024-07-05",
      "salary-cuxxing.session-out.com": "2024-12-13",
      "samaa-tv.com": "2026-01-02",
      "sarabanmithnavvtni-mil.com": "2025-01-05",
      "sarabanmithnavy.tni-mil.com": "2024-04-03",
      "sbd1u.pmreco.xyz": "2026-01-02",
      "sbp-pk.org": "2023-05-17",
      "sbp.pakgov.org": "2022-06-02",
      "scan.update.fia-gov.org": "2022-10-22",
      "scandalsofallovertheworld.gov-pk.com": "2026-01-02",
      "school.gov-pk.pk": "2026-01-02",
      "sco.gov-pk.online": "2024-02-02",
      "sco.gov.pk.hilsa.online": "2025-02-14",
      "sco.gov.pk.viewdoc.online": "2026-01-02",
      "sco.mail163cn.info": "2026-01-02",
      "sco.pkgov.org": "2022-03-12",
      "sco.pkgov.xyz": "2026-01-02",
      "sco.zapto.org": "2024-09-26",
      "scout.fontsplugins.com": "2021-12-03",
      "scouttable.xyz": "2021-12-03",
      "scrabt.tech": "2024-10-15",
      "screenpont.xyz": "2024-08-08",
      "sd1-bin.net": "2019-11-15",
      "sdf-sdgyhsdfg-sdfglksdjh-sdglkjsdglhks-gsdflsdfhhsdfgjklls.pages.dev": "2026-06-10",
      "sdfgsdfsdhfgdfgdsgfsdjfdjsghfsdgfjkdsfdsbfbsdfjksdkjfdsfks.pages.dev": "2026-01-02",
      "sdfsdf-tfghfghf546rty6ytuuyjgutyjghj-rtfytr54fghf-fghfg-fg.pages.dev": "2026-06-10",
      "sdfsdg.enclose.info": "2023-05-17",
      "sdfsdgfsd-sdfjdgsjff-sdfg44gdfgjf-dfghkjfdhkj-dfgklhfghklf.pages.dev": "2026-01-02",
      "sdgf9af72f31706769d32bf1ff66cdec1d1gkj5jg95jg5k0hkg95kg0tk.pages.dev": "2026-06-10",
      "sdgsfg.cssc.info": "2022-05-19",
      "sdkfjsh23-sdfgdklhg4-efglhdfg4-dfgjkl.netlify.app": "2026-01-02",
      "sdmx-financegovpk.servehttp.com": "2024-02-10",
      "sec-vpn.bitlyy.me": "2022-06-02",
      "secp.pakgov.org": "2022-06-02",
      "secure-ntc.net": "2026-01-02",
      "secure.alibababackupcloud.com": "2023-05-02",
      "secure.tin-url.com": "2022-06-02",
      "securecheker.in": "2021-12-03",
      "securedesk.one": "2021-11-17",
      "security-it1.com": "2025-02-05",
      "securitycouncilreport.org.pk-mailgov.com": "2026-04-21",
      "see.gov.np.unsilk.com": "2025-02-14",
      "seiffenn.nohost.me": "2024-01-11",
      "sellersprofile.sbs": "2026-01-02",
      "semain.tech": "2023-05-17",
      "senate-pak.site": "2023-11-23",
      "senine.info": "2026-01-02",
      "seoshz.live": "2026-01-02",
      "sepweo.info": "2026-01-02",
      "sercha.info": "2026-01-02",
      "sercoten.info": "2026-01-02",
      "serve-dropbx-ap-east1.cdn-dl.cn": "2019-06-17",
      "server.mofagov.online": "2024-04-04",
      "server.oilplus1td.com": "2026-01-02",
      "service.mod-gov.org": "2023-02-17",
      "service.mofss.co": "2023-05-23",
      "service.ntc-net.co": "2023-05-18",
      "service.pak-ntc.org": "2023-05-17",
      "service.pkgov-mail.com": "2023-06-11",
      "service.true-islam.org": "2023-05-17",
      "services-download.top": "2024-01-30",
      "services-pk-users.top": "2024-05-23",
      "services-ptclnetpk.servehttp.com": "2023-11-23",
      "session-expired-file-download-cetcimail.pages.dev": "2026-01-02",
      "session-out.com": "2024-07-05",
      "sezti.org": "2024-04-03",
      "sg21-production.up.railway.app": "2026-01-02",
      "sgad-punjab-gov-pk.dirctt888.info": "2024-10-22",
      "sgad.punjab.gov.pk-govt.net": "2024-10-25",
      "shafaftech.com": "2026-02-28",
      "shaheenfoundation.mod-pak.co": "2021-04-21",
      "sharepakistan-mofa.viewdns.net": "2024-02-10",
      "sharepakistan.mofa-g0v-pk.workers.dev": "2024-08-07",
      "sharepakistanmofa.servehttp.com": "2023-10-16",
      "sharepoint-punjab.sharepoint-e13.workers.dev": "2024-09-26",
      "shiftroof.top": "2024-08-05",
      "shipping-policy.info": "2024-10-15",
      "shoemo.xyz": "2026-01-02",
      "shoprex.bitlyy.me": "2022-06-02",
      "shortney.org": "2023-05-17",
      "shrtny.co": "2023-05-17",
      "shrtny.live": "2023-05-17",
      "silk.freat.site": "2023-05-17",
      "silvon.site": "2023-05-17",
      "sinacn.co": "2023-02-23",
      "sinantion.com": "2026-01-02",
      "sindh.police.fia-gov.com": "2024-04-01",
      "sindhpolice-govpk.org": "2023-05-17",
      "sindhpolice.gov.pk-mail.org": "2026-01-02",
      "site4-map-com.zeabur.app": "2026-01-06",
      "sjfu-edu.co": "2024-10-15",
      "sk.krontec.info": "2023-05-17",
      "sl-navy.office-drive.live": "2022-08-25",
      "sl-navy.officedrive.live": "2025-01-05",
      "slap-games.club": "2022-06-08",
      "slic.live": "2023-09-05",
      "slpa-lk.nrdi-gov.com": "2026-01-02",
      "slpa.mod-gov.org": "2023-02-17",
      "slpa.news": "2026-01-02",
      "slservices-lk.com": "2026-02-16",
      "sltelecom.servehttp.com": "2023-02-15",
      "sltmobitel.hopto.org": "2023-02-15",
      "sltnet.lk.mail-pk.org": "2026-02-06",
      "sltnet.lk.pk-mailgov.com": "2026-04-21",
      "smmu.edu.cn.81-cn.info": "2025-01-06",
      "smstest.kdf-mail.com": "2022-06-02",
      "smtp.dytt888.net": "2026-01-02",
      "snagdrive.com": "2026-01-02",
      "snagdrive.org": "2026-01-02",
      "sngpl.com.pk-mail.org": "2026-01-02",
      "sngpl.org.pk": "2022-03-12",
      "snnp.gov.np.namlo.com.np": "2025-02-14",
      "sob.mofa-govlk.org": "2026-01-02",
      "social-welfare.ddns.net": "2026-01-02",
      "songlong88.net": "2026-01-02",
      "sopeor.com": "2026-01-02",
      "sp-nepalembassy-gov-np.dirctt88.co": "2024-05-28",
      "spacechina.com.81-cn.info": "2025-01-06",
      "spark.126-com.live": "2024-02-27",
      "sparrso-gov-bd.dirctt88.co": "2024-05-28",
      "sparrso.gov.bd.govt-pk.com": "2024-05-08",
      "sparrso.gov.bd.mofa-govlk.com": "2024-08-01",
      "sparrso.gov.bd.pk-govt.com": "2024-08-01",
      "spec.trelin.tech": "2023-05-17",
      "spfc-punjab-gov-pk.com": "2026-01-02",
      "spfc-punjab-gov-pk.online": "2026-07-27",
      "spfc-punjab-govpk.xyz": "2026-07-27",
      "spfc-punjab-pk.cc": "2026-07-27",
      "spfc-punjabgov-pk.co": "2026-07-27",
      "spfc-punjabgov-pk.com": "2026-07-27",
      "spfc.pk": "2026-07-27",
      "spfcpkm.online": "2026-07-27",
      "spfcpungov.site": "2026-07-27",
      "spfcpunjab-gov-pk.com": "2026-07-27",
      "spfcpunjabgov.com": "2026-07-27",
      "spfcpunjabsgovs.pk": "2026-07-27",
      "sphery.live": "2023-05-17",
      "split.tyoin.biz": "2023-05-17",
      "sppc.moma-pk.org": "2022-01-07",
      "sqrt.ovh": "2025-02-05",
      "square.oprad.top": "2023-05-17",
      "sri-lanka-it.com": "2026-01-02",
      "sri-lanka.it.com": "2026-01-02",
      "srilanka-navy.lforvk.com": "2022-09-30",
      "srilankanairlines.redirectme.net": "2023-02-15",
      "srilankanavy.ksew.org": "2022-04-07",
      "srv-app.co": "2023-05-17",
      "srvapp.co": "2022-06-03",
      "srvssl.cf": "2024-04-12",
      "ssgc.pkgov.org": "2022-03-12",
      "stae-org-mz.document-viewer.live": "2024-09-03",
      "stage.onesom.biz": "2026-01-02",
      "staging.grabfiles.org": "2026-01-02",
      "staging.onesom.biz": "2026-01-02",
      "state.gov.pk-mailgov.com": "2026-04-21",
      "storage-e13.sharepoint-e13.workers.dev": "2024-09-26",
      "storeapp.site": "2023-05-17",
      "straight.hldren.info": "2023-05-17",
      "submitsurvey.info": "2024-03-29",
      "sudden.nepalarmy-milnp.info": "2026-01-02",
      "suezcanal.portdedjibouti.live": "2024-12-13",
      "sui.nationalhelpdesk.pk": "2022-03-12",
      "summer.paf-gov.org": "2022-07-22",
      "suodeshui.cdn-dl.cn": "2019-06-17",
      "suparco-gov-pk-6866387a-44d0-8009-a76e-6948da2c3278.pages.dev": "2026-01-02",
      "suparco.gov-pk.online": "2024-02-02",
      "superback.space": "2026-01-02",
      "superset.mfa-qov.com": "2026-01-02",
      "support-gov.myftp.org": "2021-02-22",
      "support-ntc.servehttp.com": "2024-02-10",
      "support-twitter.com": "2023-05-17",
      "support-update.info": "2024-10-15",
      "support.cc-cvbs-sco.workers.dev": "2026-03-13",
      "support.gov-pak.org": "2021-02-22",
      "support.govt-pk.org": "2021-02-22",
      "support.it-pakistan-gov-pk.workers.dev": "2026-01-02",
      "supportgovpk.co": "2022-10-28",
      "supremeallah.world": "2022-06-03",
      "surveydocs.online": "2025-02-05",
      "surveyofpakistan.org": "2024-03-29",
      "swo-gov-pk.grabfiles.net": "2026-02-06",
      "swo.gov.pk.mail-pk.org": "2026-02-06",
      "syncscheduler.com": "2024-03-15",
      "synoslabs-test.com": "2025-02-05",
      "system-services-manual.life": "2026-01-02",
      "systemhealthservices.top": "2026-01-02",
      "systemupdateanalysis.blog": "2026-01-02",
      "systemupgradationservices.net": "2026-01-02",
      "t.bitlyy.me": "2022-06-02",
      "tab.gruve.site": "2023-05-17",
      "tactin.info": "2026-01-02",
      "tamhuudung.com": "2026-01-02",
      "tar-gz.net": "2020-07-18",
      "taxsys-fbrgovpk.servehttp.com": "2024-02-02",
      "tazze.co": "2024-10-15",
      "tchgin.site": "2026-01-02",
      "tcp.gov.pk-govt.net": "2024-10-25",
      "tdap.gov-pk.online": "2024-02-02",
      "teamchat.hopto.org": "2022-02-09",
      "techfriend.hopto.org": "2024-01-16",
      "technicaladivsory.click": "2026-01-02",
      "technicaladvisory.sbs": "2026-01-02",
      "technologysupport.help": "2026-01-02",
      "teckblog.live": "2022-01-05",
      "telcec.site": "2026-01-02",
      "telemart-pk.com": "2023-05-17",
      "telemart.bitlyy.me": "2022-06-02",
      "telenor-mm.redirectme.net": "2023-12-30",
      "tercom.site": "2024-01-11",
      "test.api.68wx.com": "2024-01-11",
      "test.api.g.luohu8.com": "2024-01-11",
      "test.api.hzy.68wx.com": "2024-01-11",
      "test.es.68wx.com": "2024-01-11",
      "test.fetchdrive.info": "2026-01-02",
      "test.fia-gov.com": "2023-04-19",
      "test.gbpay.gov.pk": "2026-01-02",
      "test.netof66867.workers.dev": "2026-01-19",
      "test.onesom.biz": "2026-01-02",
      "tex-ideas.info": "2024-10-15",
      "tfrend.org": "2023-05-17",
      "themegaprovider.ddns.net": "2026-01-02",
      "tiexue.cdn-dl.cn": "2019-06-17",
      "tight-lake-webuploader.malik-jaani786.workers.dev": "2026-07-03",
      "tiinly.co": "2023-05-17",
      "timeoflahore.com": "2024-04-04",
      "timoney.getexpo.com": "2026-01-02",
      "tin-url.com": "2022-06-02",
      "tinlly.co": "2022-10-28",
      "tinly.org": "2022-10-28",
      "tinurl.click": "2023-05-17",
      "tmlbxveb.fia-gov.com": "2023-04-19",
      "tni-mil.com": "2024-04-03",
      "tni-mil.org": "2024-04-03",
      "tnial-mil.net": "2024-04-03",
      "tod.treasury.gov.lk.mofa-govbd.com": "2026-01-02",
      "toepsai.tech": "2026-02-03",
      "tolera.live": "2026-01-02",
      "tonse.info": "2022-10-31",
      "torsey.xyz": "2023-05-17",
      "toss.tercom.site": "2024-01-11",
      "training-course-on-improving-safety.up.railway.app": "2026-01-16",
      "training.detru.info": "2024-04-03",
      "training.docx2a2e3e78e76bcc759905da3f1532a4b8c2word.download-msoffice.com": "2026-07-11",
      "trans-aws.net": "2021-01-27",
      "trans-can.net": "2019-08-12",
      "trans-del.net": "2021-04-28",
      "trans-pre.net": "2019-07-15",
      "tray.balcon.live": "2022-07-31",
      "treasury.gov.lk.mail-pk.org": "2026-02-06",
      "treasury.gov.lk.mofa-govbd.com": "2026-01-02",
      "treasury.gov.lk.pk-mail.org": "2026-01-02",
      "treasury.gov.lk.pk-mailgov.com": "2026-04-21",
      "treat.fraty.info": "2023-05-17",
      "treaty.balcon.live": "2022-07-31",
      "tref.tech": "2023-07-17",
      "trelin.tech": "2023-05-17",
      "trgdte.cdn-pak.net": "2021-03-11",
      "trik.live": "2022-06-08",
      "troks.site": "2023-05-17",
      "true-islam.org": "2023-05-17",
      "trust-crypto.net": "2024-01-11",
      "tsinghua-edu.tech": "2024-05-09",
      "tsinghua.edu.cn.81-cn.info": "2025-01-06",
      "tsinghua.institute": "2022-10-20",
      "tumet.info": "2024-10-15",
      "turkavic.org": "2026-01-02",
      "twilight-violet-55a5.malik-jaani786.workers.dev": "2026-04-20",
      "tyoin.biz": "2023-05-17",
      "u1x.co": "2024-10-15",
      "uat-updates.gateway.ceair.com.81-cn.info": "2025-01-06",
      "ubl.pakgov.org": "2022-06-02",
      "ubrig.live": "2022-08-05",
      "ujsen.net": "2024-10-15",
      "uk-gov.cyou": "2025-02-14",
      "uk-gov.icu": "2025-02-14",
      "uk-gov.qpon": "2025-02-14",
      "uk-gova.today": "2025-02-14",
      "uk.royalmigration.buzz": "2024-01-30",
      "un.org.pk-mailgov.com": "2026-04-21",
      "up2dts.online": "2025-02-14",
      "update-govpk.co": "2024-05-23",
      "update.apl-org.online": "2024-09-26",
      "update.customs-lk.org": "2022-10-22",
      "update.fia-gov.org": "2022-10-22",
      "update.ms-office.app": "2024-10-11",
      "update1.store": "2026-01-02",
      "updatemanager.ddns.net": "2023-11-02",
      "updatemaster.info": "2025-02-14",
      "updatemind52.com": "2026-01-02",
      "updatepdf.workers.dev": "2026-02-26",
      "updates-installer.store": "2026-01-02",
      "updates.moe.gov.cn.81-cn.info": "2025-01-06",
      "updotes.co": "2026-01-02",
      "updpcn.online": "2024-09-26",
      "updtesession.online": "2024-10-15",
      "uploads.ptcl-gov-pk.workers.dev": "2026-01-02",
      "upones.site": "2026-01-02",
      "uptownhigh.live": "2026-07-05",
      "upworkoffice.online": "2026-01-02",
      "user.onesom.biz": "2026-01-02",
      "usermail-output-panel.000webhostapp.com": "2026-01-02",
      "utilize.elopter.top": "2023-05-17",
      "uw9i.pmreco.xyz": "2026-01-02",
      "uy.vagued.live": "2026-08-07",
      "v1d.mov": "2026-01-02",
      "vaccine.moha.gov.np.webproxy.to": "2025-02-14",
      "vaccine.mohp.gov.np.webproxy.to": "2025-02-14",
      "vagued.live": "2026-08-07",
      "valac.biz": "2026-01-02",
      "vateno.info": "2026-01-02",
      "vehicleverificationsystem.com": "2026-01-02",
      "velopen.info": "2026-01-02",
      "veorey.live": "2026-01-02",
      "verification.ptcl.govpk.live": "2024-01-16",
      "verify.mod-defence-lk.workers.dev": "2026-01-02",
      "verocal.info": "2023-05-17",
      "vibe-ptclnetpk.servehalflife.com": "2023-10-16",
      "vibe-ptclnetpk.servehttp.com": "2024-02-10",
      "vibe-ptclnetpk.viewdns.net": "2024-02-11",
      "view.full.pdf.file.up2dts.online": "2025-02-14",
      "view.proey.tech": "2023-05-17",
      "viewdoc.online": "2026-01-02",
      "viewpdfonline-1wgtaeus.b4a.run": "2026-01-02",
      "vim.kdf-mail.com": "2022-06-02",
      "vinver.live": "2026-01-02",
      "visa-nadra-gov-pk.desynt.com": "2026-02-28",
      "visa-nadra-gov-pk.info": "2026-07-18",
      "visa-nadra-gov-pk.lubeleaf.com": "2026-02-28",
      "visa-nadra-gov-pk.pages.dev": "2026-02-28",
      "visa-nadra-gov-pk.pk": "2026-01-02",
      "visa-nadra-gov-pk.shafaftech.com": "2026-02-28",
      "visa-nadra-gov-pk.xo.je": "2026-02-28",
      "visa.nadra-gov.click": "2026-03-09",
      "visa.nadra-gov.online": "2026-02-28",
      "visa.nadra-gov.pt": "2026-02-28",
      "visa.nadra.gov-pak.com": "2026-02-28",
      "visa.nadra.gov-pk.info": "2026-03-17",
      "visa.nadra.gov.pk-cam.online": "2026-03-30",
      "visa.nadra.gov.pk-cc.com": "2026-06-10",
      "visa.nadra.gov.pk-ev.online": "2026-03-09",
      "visa.nadra.gov.pk-o.xyz": "2026-03-19",
      "visa.nadra.gov.pk.com-e-visa.online": "2026-03-13",
      "visa.nadra.gov.pk.pakvisa.online": "2026-02-28",
      "visa.nadra.gov.pk.rdpip.com": "2026-02-28",
      "visa.nadra.gov.qrpk.info": "2026-03-17",
      "visa.nadra.gove.pw": "2026-02-28",
      "visa.nadra.gvo-pk.cc": "2026-02-28",
      "vistavue.shop": "2026-01-02",
      "vlc-services.cfd": "2026-01-02",
      "vmi1789770.contaboserver.net": "2026-01-02",
      "vmi2186317.contaboserver.net": "2026-01-02",
      "volt.ruve.live": "2023-06-11",
      "vopler.tech": "2022-10-28",
      "voyage-prive.com.ru": "2026-01-02",
      "vpdf.online": "2026-01-02",
      "vpn-ptclnetpk.servehalflife.com": "2024-02-02",
      "vpn-ptclnetpk.servehttp.com": "2023-08-15",
      "vpn-ptclnetpk.viewdns.net": "2024-02-02",
      "vpn-secure.co": "2022-06-02",
      "vpn.alibababackupcloud.com": "2023-05-02",
      "vpn.fia-gov.com": "2024-04-01",
      "vpn.pakgov.net": "2022-06-02",
      "vpn.tin-url.com": "2022-06-02",
      "vpsaren.site": "2026-02-03",
      "vrms.bangladeshbaank-gov-bd.workers.dev": "2025-01-06",
      "vtray.tech": "2023-05-17",
      "wandering-pond-e7f4.foxiproxi.workers.dev": "2025-01-06",
      "wapda.gov.mail-pk.org": "2026-02-06",
      "wapda.pkgov.org": "2022-03-12",
      "wapda.pkgov.xyz": "2026-01-02",
      "warecon.xyz": "2025-02-10",
      "watch-earn.live": "2022-06-08",
      "we-are-under-gain.000webhostapp.com": "2026-01-02",
      "web.sngpl.org.pk": "2022-03-12",
      "webapp-getdocumentodwnload-pacapp.malik-jaani786.workers.dev": "2026-04-25",
      "webarchive-datacenter.herokuapp.com": "2021-12-03",
      "webdisk.bdgov.info": "2026-01-02",
      "webdisk.govpk.info": "2023-10-02",
      "webdisk.govpk.live": "2024-01-16",
      "webdisk.mofagov-pk.online": "2021-04-28",
      "webdisk.news-bd.com": "2026-01-02",
      "webdisk.pk-mail.org": "2026-01-02",
      "webdisk.pk-mailgov.com": "2026-04-21",
      "webmaii-bcc-gov-bd-newfiles.up.railway.app": "2026-01-02",
      "webmail-accbt.hopto.org": "2022-02-09",
      "webmail-gda-gov-pk.gwadarportt.workers.dev": "2024-02-19",
      "webmail-gov-pk-action-plan-cpec-inbox-download.pages.dev": "2026-01-02",
      "webmail-hubpower-com-error.pages.dev": "2026-01-02",
      "webmail-mofa-gov-pk.zeabur.app": "2026-01-02",
      "webmail-morrgovaf.hopto.org": "2022-02-09",
      "webmail-pacorgpk.myvnc.com": "2024-02-29",
      "webmail-pnra.gov-pk.workers.dev": "2026-08-05",
      "webmail-wapda-gov-pk.pakistan-gov-pk.workers.dev": "2024-03-04",
      "webmail.bdgov.info": "2026-01-02",
      "webmail.cybar-net-pk.workers.dev": "2026-01-02",
      "webmail.cybernet.pkgov.org": "2022-03-12",
      "webmail.fwo.com.pk.docum.store": "2025-02-05",
      "webmail.gavaf.org": "2023-02-15",
      "webmail.govpk.info": "2023-10-02",
      "webmail.govpk.live": "2024-01-16",
      "webmail.mfa-gov.net": "2023-11-09",
      "webmail.mofa-gov-qa.gq": "2024-04-04",
      "webmail.mofagov-pk.online": "2021-04-28",
      "webmail.news-bd.com": "2026-01-02",
      "webmail.pakchinainvest.com.pakchinavest.info": "2024-04-12",
      "webmail.pk-mail.org": "2026-01-02",
      "webmail.pk-mailgov.com": "2026-04-21",
      "webmail.police.gov.bd.updatemind52.com": "2026-01-02",
      "webmail.ssgc.pkgov.org": "2022-03-12",
      "webmail.wapda.pkgov.org": "2022-03-12",
      "webmailarmy.com": "2025-02-14",
      "webserv-redir.net": "2018-10-18",
      "webservermail-g2689far.b4a.run": "2026-01-02",
      "wetransfer.servehttp.com": "2023-11-23",
      "wg.direct880.net": "2026-04-28",
      "whale.pkgov.org": "2022-03-12",
      "whm.pk-mail.org": "2026-01-02",
      "whm.pk-mailgov.com": "2026-04-21",
      "wide.storeapp.site": "2024-01-11",
      "widge.info": "2024-10-15",
      "win-service-update.top": "2024-01-30",
      "wind.ridlay.live": "2024-01-11",
      "windows-update.hopto.org": "2023-11-03",
      "windowupdate.myftp.org": "2023-02-15",
      "winger.live": "2026-01-02",
      "winhost.redirectme.net": "2026-01-02",
      "winupdate.redirectme.net": "2026-01-02",
      "wl8aq8.nocet.info": "2026-01-02",
      "wmail-zim-gov-rj-se-sp-br-63330a.netlify.app": "2026-07-04",
      "wndro.fia-gov.com": "2023-04-19",
      "wnic-svc.net": "2026-01-02",
      "word.download-msoffice.com": "2026-07-11",
      "worker-crimson-bread-052d.crypton0019.workers.dev": "2024-02-23",
      "worker-orange-unit-abfb.gwadarportt.workers.dev": "2024-02-19",
      "worker-plain-wind-01a9.pakistan-gov-pk.workers.dev": "2024-03-04",
      "workermdxxx.naychilin-pk.workers.dev": "2026-01-02",
      "wpda-mom-meeting-invitation-letter.netlify.app": "2026-01-02",
      "wps-hakjgyu.top": "2026-03-18",
      "wps-yoiuzuiof.top": "2026-03-18",
      "wqkwqcwvcn.filenest.live": "2026-01-02",
      "wqqwysd-qwbeaxsb.zeabur.app": "2026-01-02",
      "wsde.pakgov.net": "2022-06-02",
      "wsed.pkrepublic.org": "2022-06-02",
      "wsink.live": "2023-05-17",
      "ww1.govpk.info": "2023-10-02",
      "ww2.pakgov.net": "2022-06-02",
      "ww25.govpk.info": "2023-10-02",
      "ww25.mail-dmp-navy-pk.dytt88.org": "2024-12-13",
      "ww25.ministryofforeignaffairs-mofa-gov-pk.dytt88.org": "2024-12-13",
      "ww38.govpk.info": "2023-10-02",
      "www-airforcelk-preview-com.netlify.app": "2026-01-02",
      "www-airport-lk.mail-gov.org": "2024-11-20",
      "www-army-mil-bd.dirctt88.co": "2024-05-28",
      "www-army-mil-bd.dowmload.co": "2024-08-11",
      "www-cabinetoffice-gov-lk.mail-govt.org": "2025-01-17",
      "www-cbsl-gov-lk.download-doc.com": "2026-02-14",
      "www-cbsl-gov-lk.download-doc.net": "2026-01-02",
      "www-cbsl-gov-lk.dwnlld.com": "2026-01-02",
      "www-cbsl-gov-lk.dwnlld.info": "2026-01-02",
      "www-cbsl-gov-lk.dwnlld.infomfa-gov-lk.dwnlld.info": "2026-01-02",
      "www-cbsl-gov-lk.fia-g0v.net": "2026-03-11",
      "www-cbsl-gov-lk.filenest.live": "2026-01-02",
      "www-cbsl-gov-lk.grabfiles.net": "2026-02-06",
      "www-cbsl-gov-lk.loadpath.info": "2026-01-02",
      "www-cbsl-gov-lk.snagdrive.com": "2026-01-02",
      "www-ccdi-gov-cn.hkbmwzone.com": "2026-02-11",
      "www-cdn.net": "2021-04-08",
      "www-chinaneast-gov-cn.videoem.com": "2026-02-11",
      "www-commerce-gov-pk.fia-g0v.net": "2026-03-11",
      "www-communications-gov-pk.fetchdrive.org": "2026-01-02",
      "www-creditjx-gov-cn.aaaqb.com": "2026-02-11",
      "www-customs-gov-lk.net-co.info": "2026-01-02",
      "www-enfotss-gov-ao.pages.dev": "2026-02-11",
      "www-erd-gov-lk.downld.org": "2026-01-02",
      "www-erd-gov-lk.dwnlld.info": "2026-01-02",
      "www-erd-gov-lk.nic-svc.net": "2026-01-02",
      "www-establishment-gov-pk.fia-g0v.net": "2026-03-11",
      "www-fbr-gov-pk.direct880.net": "2026-04-28",
      "www-fbr-gov-pk.donwloaad-file.com": "2026-03-23",
      "www-finance-gov-pk.fetchdrive.org": "2026-02-08",
      "www-finance-gov-pk.filenesthub.org": "2026-02-11",
      "www-finance-gov-pk.grabfiles.net": "2026-02-06",
      "www-finance-gov-pk.loadpath.net": "2026-02-08",
      "www-foreignaffairs-nepal-com.netlify.app": "2026-01-02",
      "www-hernandarias-gov-py.pages.dev": "2026-02-11",
      "www-kashmirawareness-org.loadpath.net": "2026-02-08",
      "www-mof-gov-np.mail-govt.com": "2024-12-19",
      "www-moha-gov-lk.direct888.net": "2024-01-05",
      "www-mopa-gov-bd.dytt888.org": "2025-01-28",
      "www-navl-com-lk.pages.dev": "2026-01-02",
      "www-ndma-gov-pk.interior-ministry.com": "2026-05-19",
      "www-nea-gov-cn.fetchdrives.info": "2026-08-01",
      "www-nepalgovernment-genz-agendapdf.netlify.app": "2026-01-02",
      "www-officialregistration-accounts.netlify.app": "2026-01-02",
      "www-opmcm-gov-np.direct888.net": "2024-12-13",
      "www-parliament-lk.snagdrive.com": "2026-01-02",
      "www-pmo-gov-pk.dytt888.net": "2026-01-02",
      "www-police-gov-bd.direct888.net": "2024-01-05",
      "www-prc-mhapsd-gov-bd.mail-govt.com": "2024-12-19",
      "www-presidentsoffice-gov-lk.dwnlld.com": "2026-01-02",
      "www-presidentsoffice-gov-lk.dytt888.org": "2025-01-28",
      "www-punjabpolice-gov-pk-sopforsecurityofforeignersandchinese.trans-aws.net": "2021-04-28",
      "www-sbp-org-pk.interior-ministry.com": "2026-05-19",
      "www-securitycouncilreport-org.direct880.net": "2026-04-28",
      "www-shshjs-gov-cn.videoem.com": "2026-02-11",
      "www-srilankanavy-cabinet-decision.netlify.app": "2026-01-02",
      "www-tic-gov-tl.outlookowa.com": "2026-02-11",
      "www-tic-gov-tl.selectpaw.com": "2026-02-11",
      "www-tjlsj-gov-cn.syyjc.net": "2026-02-11",
      "www-toki-gov-tr.sa.com": "2026-02-11",
      "www-treasury-gov-lk.downld.org": "2026-01-02",
      "www-treasury-gov-lk.filenest.live": "2026-01-02",
      "www-treasury-gov-lk.nic-svc.net": "2026-01-02",
      "www-treasury-gov-lk.org-liv.net": "2026-01-02",
      "www-treasury-gov-lk.snagdrive.com": "2026-01-02",
      "www-unocha-org.mail-svr.co": "2026-04-16",
      "www-ymbq-gov-cn.drron.net": "2026-02-11",
      "wwww.direct888.net": "2024-01-05",
      "wwww.govpk.info": "2023-10-02",
      "wwww.invitation-letter.govpk.info": "2023-10-02",
      "wwww.mofa-gov-sa.direct888.net": "2024-01-05",
      "wwww.notice.portdedjibouti.live": "2024-07-26",
      "wwww.portdedjibouti.live": "2024-07-26",
      "xcfhg.dwnlld.info": "2026-01-02",
      "xdappxz.vip": "2026-03-18",
      "xdlxweb.vip": "2026-03-18",
      "xmpp-upload.seiffenn.nohost.me": "2024-01-11",
      "xn--micosoftonline-iwc.com": "2025-02-05",
      "xuzeest.buzz": "2024-07-30",
      "xyz.kdf-mail.com": "2022-06-02",
      "y1x.org": "2026-01-02",
      "y9zz2.pmreco.xyz": "2026-01-02",
      "yahoo.com.mofa-govbd.com": "2026-01-02",
      "yahoo.edu-cx.org": "2021-12-26",
      "yayoi.it.com": "2026-03-18",
      "yerac.live": "2026-01-02",
      "yes2khalistan.online": "2023-11-23",
      "yfghvjb.paknavy.live": "2022-05-06",
      "yhue2.pmreco.xyz": "2026-01-02",
      "yrak.info": "2023-05-17",
      "za.mail-pk.org": "2026-02-06",
      "zamannindaindirimlerimm.com": "2026-01-02",
      "zeanos.live": "2026-01-02",
      "zed.shrtny.live": "2023-05-17",
      "zeltech.live": "2026-01-02",
      "zero-berlin-covenant.apl-org.online": "2024-09-26",
      "zhenpinxuanji.vip": "2026-03-18",
      "zhuhai-a1rsh0w-reg1strat1i0n-2o24.netlify.app": "2026-01-02",
      "zimbra-com.up.railway.app": "2026-01-04",
      "zimbra-nyatel-production.up.railway.app": "2026-04-26",
      "zimbra10-internationalrelation40-beep5751-brqupv53.leapcell.dev": "2026-01-31",
      "zimbra10-nml3wp-max8143-3ipio7e5.leapcell.dev": "2026-01-16",
      "zimbra10-nml3wp-max8143-fn1rsf7l.leapcell.dev": "2026-01-23",
      "zimbramail-nayatel-com.zeabur.app": "2026-04-03",
      "zimbramail-nayatel.leapcell.app": "2026-03-12",
      "zimbramail-nyatel-com.up.railway.app": "2026-05-15",
      "zimramail-nayatel.girlfriendparty42.workers.dev": "2026-04-20",
      "ziptec.info": "2026-01-02",
      "zlaeso.xyz": "2026-01-02",
      "zmail.ptcl.pkgov.org": "2022-03-12",
      "zolosy.top": "2023-05-17",
      "zone.vtray.tech": "2023-05-17",
      "zoom.osutuga7.workers.dev": "2024-09-26",
      "zretw.xyz": "2023-05-17",
      "zruod.pmreco.xyz": "2026-01-02",
      "zyu43.pmreco.xyz": "2026-01-02"
    },
    "ipv4": {
      "110.10.176.193:4443": "2020-01-16",
      "141.136.0.91:443": "2021-08-03",
      "144.91.72.17:8080": "2023-03-09",
      "149.102.131.122:41521": "2026-01-02",
      "151.236.11.147:57670": "2021-02-22",
      "164.68.108.153:4142": "2022-01-05",
      "164.68.108.153:5000": "2022-01-05",
      "164.68.108.153:8062": "2022-01-05",
      "167.86.94.42:18745": "2026-01-02",
      "173.212.242.43:57149": "2021-12-06",
      "185.159.128.117:443": "2026-01-02",
      "185.225.17.239:443": "2019-12-09",
      "185.225.19.46:4589": "2020-12-09",
      "185.225.19.46:4875": "2020-12-09",
      "193.200.16.230:443": "2024-05-09",
      "202.58.104.100:81": "2020-08-11",
      "213.227.154.175:443": "2021-08-03",
      "31.15.17.230:443": "2026-01-02",
      "31.58.137.246:443": "2026-01-02",
      "38.60.235.109:9876": "2026-04-23",
      "46.8.226.5:443": "2026-01-02",
      "47.236.177.123:9090": "2026-01-02",
      "47.76.135.130:443": "2024-12-19",
      "47.84.196.148:443": "2024-12-19",
      "5.230.40.141:443": "2024-05-09",
      "5.230.42.202:443": "2024-05-09",
      "5.230.43.203:443": "2024-05-09",
      "5.230.52.133:443": "2024-05-09",
      "5.230.54.162:443": "2024-05-09",
      "5.230.54.63:443": "2024-05-09",
      "5.230.55.29:443": "2024-05-09",
      "5.230.70.181:443": "2024-05-09",
      "5.230.71.148:443": "2024-05-09",
      "5.230.74.96:443": "2024-05-09",
      "5.230.77.142:443": "2024-05-09",
      "5.252.178.27:443": "2026-05-21",
      "5.252.178.27:9889": "2026-05-21",
      "62.171.172.199:443": "2021-12-10",
      "62.171.172.199:81": "2021-12-10",
      "62.171.172.199:88": "2022-01-07",
      "62.171.187.53:43": "2021-12-16",
      "62.171.187.53:44": "2021-12-16",
      "62.171.187.53:45": "2021-12-16",
      "64.46.102.122:8443": "2024-04-01",
      "64.46.102.26:443": "2024-04-01",
      "64.46.102.63:8443": "2024-04-01",
      "74.125.196.113:53": "2022-10-22",
      "8.222.250.160:443": "2023-11-23",
      "89.46.65.19:443": "2026-01-02",
      "91.193.18.248:443": "2021-08-03"
    },
    "url": {
      "cornerstonebeverly.org/js/files/DRDO-K4-Missile-Clean-room": "2023-03-09",
      "cornerstonebeverly.org/js/files/docufentososo/doecumentosoneso/pantomime.hta": "2023-03-10",
      "cornerstonebeverly.org/js/files/ntfonts/": "2023-03-13",
      "cornerstonebeverly.org/js/files/ntfonts/avena": "2023-03-13",
      "http://111.229.73.84": "2020-08-11",
      "http://112.13.121.89": "2026-01-02",
      "http://146.190.235.137": "2022-10-22",
      "http://149.129.237.253": "2023-06-02",
      "http://160.20.147.84": "2023-02-15",
      "http://167.86.116.39": "2019-07-07",
      "http://185.159.128.117": "2026-01-02",
      "http://185.163.47.226": "2023-02-15",
      "http://185.243.112.186": "2023-02-15",
      "http://185.248.101.231": "2023-02-15",
      "http://185.248.102.15": "2023-02-15",
      "http://194.32.76.244": "2023-02-15",
      "http://213.109.192.93": "2023-12-30",
      "http://213.183.55.52": "2024-12-13",
      "http://213.227.154.175": "2021-08-03",
      "http://31.15.17.230": "2026-01-02",
      "http://31.58.137.246": "2026-01-02",
      "http://45.153.240.66": "2023-02-15",
      "http://45.92.156.114": "2023-02-15",
      "http://46.30.188.222": "2023-02-15",
      "http://46.8.226.5": "2026-01-02",
      "http://47.76.135.130": "2024-12-19",
      "http://47.84.196.148": "2024-12-19",
      "http://5.2.79.135": "2023-02-15",
      "http://62.171.172.199": "2021-12-10",
      "http://78.142.29.118": "2021-08-03",
      "http://8.222.250.160": "2023-11-23",
      "http://83.171.236.49": "2023-02-15",
      "http://89.46.65.19": "2026-01-02",
      "kcps.edu.in/css/fonts/files/docs/graentsodocumentso/ganeshostwoso/": "2023-02-24",
      "kcps.edu.in/css/fonts/files/jquery/": "2023-02-24",
      "kcps.edu.in/css/fonts/files/ntsfonts/": "2023-02-24",
      "nepra.org.pk/css/32-Advisory-No-32.iso": "2022-10-22",
      "paryavaranindia.com/css/files/docs/Updated-Leave-Rules-Fourth-Edition/css": "2021-12-06",
      "paryavaranindia.com/css/files/hulfz/": "2021-12-06",
      "vidyasagaracademybrg.in/scripts/am/": "2019-07-08",
      "vidyasagaracademybrg.in/scripts/lnk/": "2019-07-08"
    },
    "url_path": {
      "/?ausbduabxyasgdbaskbbx=": "2026-02-07",
      "/?dhsfiourewjdfjgkfdgkldfjiorejfdjgfdgjkdfjgreioo=": "2026-01-02",
      "/?evfdbskjfbksjlfkjsengknsjbgwg34vf": "2026-01-02",
      "/?hebjwhihsdbwbsdbwudiok": "2026-01-02",
      "/?ioewroiewrioweroiriwwoei=": "2026-01-02",
      "/?jcvjeijnasdncadasdbfdfurhtnbfgbsydbx=": "2026-01-02",
      "/?lfdkjgiroetuiroyhgfhnbjkfsdfiowerierehjre": "2026-01-02",
      "/@/@/h31l0": "2023-02-15",
      "/AFA/RWlVOGJCSUxEaVljT0dKaQ==.aspx": "2023-11-22",
      "/F453457Pl_TMP347923592380/": "2021-08-03",
      "/R0FNd0lCb0RGbU1VTUdwcQ==.php": "2023-11-02",
      "/R1JNU1p4a1RGbU1VTUdwcQ==.php": "2023-11-02",
      "/RWlVOGJCSUxEaVljT0dKaQ==.aspx": "2023-11-22",
      "/W6taHcwqKwhgzWGWr7ElpRAfWA7JcsXC0A2a4eFv/": "2022-07-14",
      "/api/root_3977413298779/hello": "2026-01-02",
      "/api/root_3977413298779/upload": "2026-01-02",
      "/cetcc/crud.php": "2026-01-02",
      "/cvbnhmj7.php": "2026-01-02",
      "/fbd901_harassment/": "2024-07-05",
      "/ganeshostwoso/": "2023-02-24",
      "/graentsodocumentso/": "2023-02-24",
      "/graentsodocumentso/ganeshostwoso/": "2023-02-24",
      "/krypt0kickoswk1wokic.html": "2026-01-20",
      "/load/?lfdkjgiroetuiroyhgfhnbjkfsdfiowerierehjre": "2026-01-02",
      "/login/?dhsfiourewjdfjgkfdgkldfjiorejfdjgfdgjkdfjgreioo=": "2026-01-02",
      "/login/?jcvjeijnasdncadasdbfdfurhtnbfgbsydbx=": "2026-01-02",
      "/mail/AFA/RWlVOGJCSUxEaVljT0dKaQ==.aspx": "2023-11-22",
      "/opx/mailflair/r/EZ6n6FMhSh": "2026-05-14",
      "/pl200_TMP2831474WDF.php": "2021-08-03",
      "/r3diRecT/redirector/": "2024-03-15",
      "/r3diRecT/redirector/proxy.php": "2024-03-15",
      "/swpGMooD": "2026-01-02",
      "/uPSnswhC": "2023-11-23",
      "/update/R0FNd0lCb0RGbU1VTUdwcQ==.php": "2023-11-02",
      "/update/R1JNU1p4a1RGbU1VTUdwcQ==.php": "2023-11-02",
      "/wh/glass.php": "2022-10-22",
      "/x9238vnhajerh.html": "2026-01-07"
    }
  },
  "first_seen_precision": {
    "domain": {
      "0range.site": "at-or-before",
      "0ultook.live": "at-or-before",
      "101c4a583c3acdd2a06ca2fb183cf995fgd55fghf67dhf7dhf7dhnfks7.pages.dev": "at-or-before",
      "101c4a583c3acdd2afd06ca2fb183cf995sdfsdh54jkdfgh54893489h5.pages.dev": "at-or-before",
      "101c4a583c3acdd2dfgn54990fgmkl5i90ghml569ig06ca2fb183cf995.pages.dev": "at-or-before",
      "101c4a5fdjfjkf8fg90fksd9dfslsd0fk83c3acdd2a06ca2fb183cf995.pages.dev": "at-or-before",
      "109.176.30.212.sslip.io": "at-or-before",
      "126mail-cn.com": "at-or-before",
      "16bz5.pmreco.xyz": "at-or-before",
      "17067699af72f31706fgjkf5kg9j4990gk950.netlify.app": "at-or-before",
      "172.86.92.150.sslip.io": "at-or-before",
      "1846m.pmreco.xyz": "at-or-before",
      "24170-40494.bacloud.info": "at-or-before",
      "2aeb306b-4c5f-4cc6-a7a2-6fcd96612b9d.us-east-1.cloud.genez.io": "at-or-before",
      "3nxyc.pmreco.xyz": "at-or-before",
      "423743f1-53d2-41bf-9dba-e1e0b7c8f460.pmreco.xyz": "at-or-before",
      "4yj7f.pmreco.xyz": "at-or-before",
      "5673696e-bcf9-4a34-848d-2e6875b0561e.us-east-1.cloud.genez.io": "at-or-before",
      "5vs9r.pmreco.xyz": "at-or-before",
      "6441056b613c32a9.dwnlld.info": "at-or-before",
      "6dbb77fd-6d9d-415e-b414-3d1051cd33f4.dytt888.net": "at-or-before",
      "7b1271c3-0158-4f94-b54e-d51a4be1cfc4.us-east-1.cloud.genez.io": "at-or-before",
      "7ef1996f-c463-4540-936a-70d0fd477f98.live-co.org": "at-or-before",
      "85476ee3-a4b9-4815-bd1d-68653205e378.us-east-1.cloud.genez.io": "at-or-before",
      "8ad94e36.cdn-caa-sco.pages.dev": "at-or-before",
      "96c54.pmreco.xyz": "at-or-before",
      "982m31.pmreco.xyz": "at-or-before",
      "a.fetchdrive.info": "at-or-before",
      "a5936441-e402-41e3-b02b-75af112074b5.org-co.net": "at-or-before",
      "a6dff163-e0b9-49c9-87e4-357f761f3c3b.us-east-1.cloud.genez.io": "at-or-before",
      "aapletv.org": "at-or-before",
      "acenent.site": "at-or-before",
      "acfinang.shop": "at-or-before",
      "admin.grabfiles.org": "at-or-before",
      "admin.onesom.biz": "at-or-before",
      "adobe.pdf-downlod.com": "at-or-before",
      "adobeglobal.com": "at-or-before",
      "advancedhealth.medicallab.site": "at-or-before",
      "advisary.army-govbd.info": "at-or-before",
      "advisory.army-govbd.info": "at-or-before",
      "advisory.info-bdgov.com": "at-or-before",
      "advisory.ndma-govpk.co": "at-or-before",
      "afdinfo786.bdgov.info": "at-or-before",
      "afdtrg.nrdi-gov.com": "at-or-before",
      "agenda-talking-point-for-army.up.railway.app": "at-or-before",
      "agent.onesom.biz": "at-or-before",
      "aku-edu-pk.org": "at-or-before",
      "alhabib.live": "at-or-before",
      "aliyum.email": "at-or-before",
      "aliyumm.pro": "at-or-before",
      "all-files.mail-sessionexpired.com": "at-or-before",
      "allpakarmlicences.com": "at-or-before",
      "allpakarmslicence.com": "at-or-before",
      "allpakarmslisense.site": "at-or-before",
      "alphapolice.org": "at-or-before",
      "amazingbonis.com": "at-or-before",
      "amended.army-govbd.info": "at-or-before",
      "analytic.mfa-qov.com": "at-or-before",
      "andc.govaf.org": "at-or-before",
      "anefank.mom": "at-or-before",
      "antarticarevolution.sbs": "at-or-before",
      "api.grabfiles.org": "at-or-before",
      "api.onesom.biz": "at-or-before",
      "api.pkgov.xyz": "at-or-before",
      "app.dytt888.net": "at-or-before",
      "app.grabfiles.org": "at-or-before",
      "app.modcloudspace.com": "at-or-before",
      "app.onesom.biz": "at-or-before",
      "appcrew.info": "at-or-before",
      "appt-sdf49fk0apt9dk9sdls9fl-dkgf9dld9.netlify.app": "at-or-before",
      "arceno.xyz": "at-or-before",
      "arcteno.live": "at-or-before",
      "arf26th-hducim-kdu-ac-lk-index-html.pages.dev": "at-or-before",
      "armlicensepk.site": "at-or-before",
      "armslicense.interiorgovt.com": "at-or-before",
      "armslicensekpk.gov-pk.com": "at-or-before",
      "army-bd.com": "at-or-before",
      "army-bdgov.com": "at-or-before",
      "army-govbd.info": "at-or-before",
      "army-lk.com": "at-or-before",
      "army-lk.info": "at-or-before",
      "army-lk.org": "at-or-before",
      "aromne.info": "at-or-before",
      "asfinnagg.shop": "at-or-before",
      "asfrimag.mom": "at-or-before",
      "asfrimamg.mom": "at-or-before",
      "assets.fetchdrive.info": "at-or-before",
      "assumptiontable.click": "at-or-before",
      "ateows.info": "at-or-before",
      "autoconfig.bdgov.info": "at-or-before",
      "autoconfig.pk-mail.org": "at-or-before",
      "autodiscover-paa-gov-pk-auth-logon-aspx.pages.dev": "at-or-before",
      "autodiscover.pk-mail.org": "at-or-before",
      "autodiscover.seoshz.live": "at-or-before",
      "axigen-web-expired-paknavy-files.netlify.app": "at-or-before",
      "b1x.mov": "at-or-before",
      "b5hyr.pmreco.xyz": "at-or-before",
      "baatube.com": "at-or-before",
      "baerow.live": "at-or-before",
      "balochistanpolice.gov.pk-mail.org": "at-or-before",
      "bcc.gov.bd.pk-mail.org": "at-or-before",
      "bcc.gov.bd.ramdaanvibe.info": "at-or-before",
      "bcc.gov.bd.upworkoffice.online": "at-or-before",
      "bccgov-bd-production.up.railway.app": "at-or-before",
      "bd-govt.com": "at-or-before",
      "bd-govt.info": "at-or-before",
      "bd.filenest.live": "at-or-before",
      "bd.mofa-govbd.com": "at-or-before",
      "bd.mofa-govtpk.net": "at-or-before",
      "bd.officemuwork.online": "at-or-before",
      "bd.pk-mail.org": "at-or-before",
      "bd.ramdaanvibe.info": "at-or-before",
      "bd.upworkoffice.online": "at-or-before",
      "bdgov.info": "at-or-before",
      "bdgovt.com": "at-or-before",
      "bdnews.info": "at-or-before",
      "beaxor.xyz": "at-or-before",
      "beoe.govtpk.co": "at-or-before",
      "berec.live": "at-or-before",
      "bgb.gov.bd.mofa-govtpk.net": "at-or-before",
      "bismi.pro": "at-or-before",
      "bizor.live": "at-or-before",
      "blog.grabfiles.org": "at-or-before",
      "blty.at": "at-or-before",
      "blue-term-c168.gov-pkgov.workers.dev": "at-or-before",
      "bnepon.xyz": "at-or-before",
      "bodec.site": "at-or-before",
      "bookutrips.com": "at-or-before",
      "botcel.info": "at-or-before",
      "botim.cc": "at-or-before",
      "boundschain.workers.dev": "at-or-before",
      "brebd-govt-bd.online": "at-or-before",
      "bscic-gov-bd.dwnlld.info": "at-or-before",
      "buildthenations.info": "at-or-before",
      "buzsep.info": "at-or-before",
      "c6udy.pmreco.xyz": "at-or-before",
      "caapakistan.pk-mail.org": "at-or-before",
      "cabinet-gov-bd.dwnlld.info": "at-or-before",
      "cabinet-gov-bd.nic-svc.net": "at-or-before",
      "cabinet-gov-bd.org-liv.net": "at-or-before",
      "cabinet-gov-pk.dytt888.net": "at-or-before",
      "cabinet-gov-pk.fetchdrive.org": "at-or-before",
      "cabinet-gov-pk.net-co.live": "at-or-before",
      "cabinet.gov.bd.mofa-govtpk.net": "at-or-before",
      "cabinet.gov.pk-mail.org": "at-or-before",
      "cadetcollege.adobeglobal.com": "at-or-before",
      "cbsl-gov-lk.snagdrive.com": "at-or-before",
      "cbsl.lk.mofa-govtpk.net": "at-or-before",
      "cbsl.lk.pk-mail.org": "at-or-before",
      "cc2mm.pmreco.xyz": "at-or-before",
      "cdn-caa-sco.pages.dev": "at-or-before",
      "centralized-email-system-np.com": "at-or-before",
      "cespkom.info": "at-or-before",
      "cgd64-gkgiot9lg0-ghbasbousa-01156egog.netlify.app": "at-or-before",
      "cgwic-sessionexpired-challenge.pages.dev": "at-or-before",
      "cgwic-sessionexpired-challenges.pages.dev": "at-or-before",
      "chughtai.medicallab.site": "at-or-before",
      "ciamat.info": "at-or-before",
      "circulars.ntcpk.co": "at-or-before",
      "cirt-gov-bd.org-liv.net": "at-or-before",
      "claimmofnewbudgetsgp-ars.zeabur.app": "at-or-before",
      "claimmofnewbudgetsgp-ck.zeabur.app": "at-or-before",
      "claimmofnewbudgetsgp-fm.zeabur.app": "at-or-before",
      "claimmofnewbudgetsgp-jz.zeabur.app": "at-or-before",
      "claimmofnewbudgetsgp-pd.zeabur.app": "at-or-before",
      "claimmofnewbudgetsgp-rk.zeabur.app": "at-or-before",
      "claimmofnewbudgetsgp-vn.zeabur.app": "at-or-before",
      "claimmofnewbuedgetsg-ars.zeabur.app": "at-or-before",
      "claimmofnewbuedgetsg-ck.zeabur.app": "at-or-before",
      "claimmofnewbuedgetsg-fm.zeabur.app": "at-or-before",
      "claimmofnewbuedgetsg-jz.zeabur.app": "at-or-before",
      "claimmofnewbuedgetsg-pd.zeabur.app": "at-or-before",
      "claimmofnewbuedgetsg-rk.zeabur.app": "at-or-before",
      "claimmofnewbuedgetsg-vn.zeabur.app": "at-or-before",
      "claimmofnewbuedgetsgp-ars.zeabur.app": "at-or-before",
      "claimmofnewbuedgetsgp-ck.zeabur.app": "at-or-before",
      "claimmofnewbuedgetsgp-fm.zeabur.app": "at-or-before",
      "claimmofnewbuedgetsgp-jz.zeabur.app": "at-or-before",
      "claimmofnewbuedgetsgp-pd.zeabur.app": "at-or-before",
      "claimmofnewbuedgetsgp-rk.zeabur.app": "at-or-before",
      "claimmofnewbuedgetsgp-vn.zeabur.app": "at-or-before",
      "claimmofnewbuedgetssg-ck.zeabur.app": "at-or-before",
      "claimmofnewbuedgetssg-jz.zeabur.app": "at-or-before",
      "claimmofnewbuedgetssg-pd.zeabur.app": "at-or-before",
      "claimmofnewbuedgetssg-rk.zeabur.app": "at-or-before",
      "claimmofnewbuedgetssg-vn.zeabur.app": "at-or-before",
      "click-here-to-keep-same-password.netlify.app": "at-or-before",
      "clopem.info": "at-or-before",
      "cloud.coremailcloud.com": "at-or-before",
      "cms.grabfiles.org": "at-or-before",
      "com.news-bd.com": "at-or-before",
      "com.pk-mail.org": "at-or-before",
      "combined-training-and-administrative.netlify.app": "at-or-before",
      "commerce-gov-pk.fetchdrive.org": "at-or-before",
      "compnetworkservices.ddns.net": "at-or-before",
      "confidential.ndma-govpk.co": "at-or-before",
      "cons-mofa-gov-pk-hqr-1777839.online": "at-or-before",
      "cons-mofa-gov-pk.rf.gd": "at-or-before",
      "cons-mofa-govt.pk": "at-or-before",
      "cons.gov-pk.pk": "at-or-before",
      "cons.mofa.gov.pk.cons1.mfa-ir.cn": "at-or-before",
      "cons.mofagovpk.co": "at-or-before",
      "consmofa-gov-pk.com": "at-or-before",
      "consmofa.gov-pk.pk": "at-or-before",
      "consmofagov.com": "at-or-before",
      "consmofagovhqipk.com": "at-or-before",
      "coordination-cas-visit.netlify.app": "at-or-before",
      "coremailcloud.com": "at-or-before",
      "cpanel.news-bd.com": "at-or-before",
      "cpanel.pk-mail.org": "at-or-before",
      "cpcalendars.bdgov.info": "at-or-before",
      "cpcalendars.pk-mail.org": "at-or-before",
      "cpcontacts.pk-mail.org": "at-or-before",
      "critical-patch-update.com": "at-or-before",
      "crontec.site": "at-or-before",
      "csd-pk.online": "at-or-before",
      "customs-gov-lk.net-co.info": "at-or-before",
      "cybersecurity.nepalarmy-milnp.info": "at-or-before",
      "d0ownload.com": "at-or-before",
      "d0wnlaod.com": "at-or-before",
      "d0wnlaod.org": "at-or-before",
      "d101c4a583c3acdd2a06ca2fb183cf99d6fm7fjdf8djf9lfjf4mfi89.pages.dev": "at-or-before",
      "d515dc5c-16cd-4443-8f83-0ab5cb549050.us-east-1.cloud.genez.io": "at-or-before",
      "dacastexpo.com": "at-or-before",
      "dafillio.com": "at-or-before",
      "dashboard.onesom.biz": "at-or-before",
      "dbarny-fdtref.up.railway.app": "at-or-before",
      "dc-4c46fcf37468.news-bd.com": "at-or-before",
      "debcon.live": "at-or-before",
      "defence-bd.net": "at-or-before",
      "defence-np.net": "at-or-before",
      "defencearmy.pro": "at-or-before",
      "demcon.live": "at-or-before",
      "demo.fetchdrive.info": "at-or-before",
      "demo.grabfiles.org": "at-or-before",
      "demsflygerxamy.com": "at-or-before",
      "depo-govpk.com": "at-or-before",
      "dev.fetchdrive.info": "at-or-before",
      "dev.grabfiles.org": "at-or-before",
      "dev.onesom.biz": "at-or-before",
      "dgdp-account-file-data-doc-procuremen.netlify.app": "at-or-before",
      "dgdp-drive-file-sharing-pdf-files-doc.netlify.app": "at-or-before",
      "dgdp-gov-pk-technical-specification.pages.dev": "at-or-before",
      "dgdp-gov-pk-technical-specification1.pages.dev": "at-or-before",
      "dgdp-product-details-2025-turkey.netlify.app": "at-or-before",
      "dgdp.cloud.secured.file.updatemind52.com": "at-or-before",
      "dgfi.gov.bd": "at-or-before",
      "dgtk.depo-govpk.com": "at-or-before",
      "dirctt888.com": "at-or-before",
      "directt88.com": "at-or-before",
      "dirsports.milqq.info": "at-or-before",
      "dl.vlc-services.cfd": "at-or-before",
      "dlimpunjabgov.com": "at-or-before",
      "dlimsindhgov.com": "at-or-before",
      "dlimsitp-gov.com": "at-or-before",
      "dlimskpk-gov.com.pk": "at-or-before",
      "dlimspunjab.gov-pk.com": "at-or-before",
      "dlimssindh.gov-pk.com": "at-or-before",
      "dlimssindh.gov-pk.site": "at-or-before",
      "dma.treasury.gov.lk.pk-mail.org": "at-or-before",
      "dns.andc.govaf.org": "at-or-before",
      "dnsvay8faydj3f79dje9djr02j101c4a583c3acdd2a06ca2fb183cf995.pages.dev": "at-or-before",
      "doc-downlod.com": "at-or-before",
      "doc-ye9wbezc.b4a.run": "at-or-before",
      "documentviewer.info": "at-or-before",
      "donwloaded.com": "at-or-before",
      "dowmloade.org": "at-or-before",
      "downl0ad.org": "at-or-before",
      "downld.org": "at-or-before",
      "download-doc.net": "at-or-before",
      "download-store.tech": "at-or-before",
      "downloadfileddssdrrg.zeabur.app": "at-or-before",
      "downloads.masarh.live": "at-or-before",
      "downnload.net": "at-or-before",
      "drive-acct-offl-pdf.com": "at-or-before",
      "drive-afd-gov-bd-account-file.netlify.app": "at-or-before",
      "drive-armed-force-day-cas-msg.netlify.app": "at-or-before",
      "drive-army-mil-bd-account-data-file.netlify.app": "at-or-before",
      "drive-baf-mil-bd-share-file.netlify.app": "at-or-before",
      "drive-bcc-registraion-cloud-storage.netlify.app": "at-or-before",
      "drive-dgdp-gov-bd-confidential-files.netlify.app": "at-or-before",
      "drive-dgdp-gov-bd-files.netlify.app": "at-or-before",
      "drive-mha-gov-bd-files-acctn-doct.netlify.app": "at-or-before",
      "drive-nepal-gov-np-files.netlify.app": "at-or-before",
      "drive-nepal-gov.com": "at-or-before",
      "drive-newmail-arm-mil-bd-account-data.netlify.app": "at-or-before",
      "drive-rokectsaans-com-tr-account-file.netlify.app": "at-or-before",
      "drive-roketsans-com-tr-account-files.netlify.app": "at-or-before",
      "dsf.army-lk.com": "at-or-before",
      "dsocem.site": "at-or-before",
      "dtecyber.nepalarmy-milnp.info": "at-or-before",
      "dteofmediapsyops.army-lk.com": "at-or-before",
      "ducane.info": "at-or-before",
      "dwnlld.com": "at-or-before",
      "dwnlld.info": "at-or-before",
      "dwnlld.infomfa-gov-lk.dwnlld.info": "at-or-before",
      "dytt888.net": "at-or-before",
      "e-nothi.ddns.net": "at-or-before",
      "eairr.mom": "at-or-before",
      "ecility.xyz": "at-or-before",
      "edgeupdate.redirectme.net": "at-or-before",
      "eede6f46.cdn-caa-sco.pages.dev": "at-or-before",
      "elaopsu.live": "at-or-before",
      "elestech.com.pk-mail.org": "at-or-before",
      "email-sco-gov-pk.zeabur.app": "at-or-before",
      "email.bcc.gov.bd.ramdaanvibe.info": "at-or-before",
      "email.moitt.gov.pk.viewdoc.online": "at-or-before",
      "email.ntc.gov.pk.viewdoc.online": "at-or-before",
      "email.paf.gov.pk.viewdoc.online": "at-or-before",
      "email.pof.gov.pk.viewdoc.online": "at-or-before",
      "email.sco.gov.pk.viewdoc.online": "at-or-before",
      "embassy-of-italy-visit-to-cxb.netlify.app": "at-or-before",
      "emv1.army-govbd.info": "at-or-before",
      "encetion.live": "at-or-before",
      "encrypted-files-paknavy-0pen.netlify.app": "at-or-before",
      "eneralbqark.shop": "at-or-before",
      "erd.gov.lk.mofa-govbd.com": "at-or-before",
      "erd.gov.lk.pk-mail.org": "at-or-before",
      "ereribe.tech": "at-or-before",
      "estsaln.site": "at-or-before",
      "esxipubad-gov-lk.org-co.net": "at-or-before",
      "ex1.mov": "at-or-before",
      "exmail-qq-drive.com": "at-or-before",
      "exosel.info": "at-or-before",
      "expo.com.cn.mail-files-open-preview.com": "at-or-before",
      "expo.infinityfreeapp.com": "at-or-before",
      "expo.test-links.com": "at-or-before",
      "fa-gov-lk.dwnlld.info": "at-or-before",
      "fab-gov-pk-account.pages.dev": "at-or-before",
      "fbr.gov-pk.com": "at-or-before",
      "fbrgov.com": "at-or-before",
      "fcgzbgcvzsgrjbnndsfdsdfffcffgzsfwferfvd4hfgtyghjtghjrhgts.pages.dev": "at-or-before",
      "fdb74.pmreco.xyz": "at-or-before",
      "febgif.pk-mail.org": "at-or-before",
      "feedback.army-lk.info": "at-or-before",
      "feedback.info-bdgov.com": "at-or-before",
      "feew6.pmreco.xyz": "at-or-before",
      "fetchdrive.info": "at-or-before",
      "fetchdrive.org": "at-or-before",
      "ffc.gov.pk-mail.org": "at-or-before",
      "file-downlod.org": "at-or-before",
      "file-dwnld.net": "at-or-before",
      "file-dwnld.org": "at-or-before",
      "file-preview-session-expired.pages.dev": "at-or-before",
      "filenest.live": "at-or-before",
      "finance.gov.pk-mail.org": "at-or-before",
      "fir.islamabadpolice.gov-pk.site": "at-or-before",
      "firsatburdaavm.com": "at-or-before",
      "flomen.xyz": "at-or-before",
      "frzpwdev.grabfiles.org": "at-or-before",
      "ftp.mofa-govbd.com": "at-or-before",
      "ftp.pk-mail.org": "at-or-before",
      "fwd-transaction-slip-52923640.gov1-lk.com": "at-or-before",
      "fx1.live": "at-or-before",
      "g0vt.pk": "at-or-before",
      "gbpay.gov.pk": "at-or-before",
      "gbpay.pmrugb.gov.pk": "at-or-before",
      "geninstr.army-govbd.info": "at-or-before",
      "gitlab.seoshz.live": "at-or-before",
      "gleaming-praline-dcd579.netlify.app": "at-or-before",
      "gmail-1-production-3004.up.railway.app": "at-or-before",
      "gmail.com.pk-mail.org": "at-or-before",
      "gmails-downloadnew-production.up.railway.app": "at-or-before",
      "gmals-downloadpdfs-gdrive.up.railway.app": "at-or-before",
      "gmapp.info": "at-or-before",
      "go709p.dytt888.net": "at-or-before",
      "goc-visit-program-details-pdf.netlify.app": "at-or-before",
      "gooogle.files-cyber-net-pk.workers.dev": "at-or-before",
      "goov.pk": "at-or-before",
      "goslin.info": "at-or-before",
      "gov-office.org": "at-or-before",
      "gov-pk.com": "at-or-before",
      "gov-pk.pk": "at-or-before",
      "gov-pk.site": "at-or-before",
      "gov.bd.account.file.updatemind52.com": "at-or-before",
      "gov.bd.mofa-govbd.com": "at-or-before",
      "gov.bd.mofa-govtpk.net": "at-or-before",
      "gov.bd.pk-mail.org": "at-or-before",
      "gov.bd.ramdaanvibe.info": "at-or-before",
      "gov.bd.upworkoffice.online": "at-or-before",
      "gov.lk.mofa-govbd.com": "at-or-before",
      "gov.lk.mofa-govlk.org": "at-or-before",
      "gov.lk.mofa-govtpk.net": "at-or-before",
      "gov.lk.pk-mail.org": "at-or-before",
      "gov.np.officemuwork.online": "at-or-before",
      "gov.np.pk-mail.org": "at-or-before",
      "gov.pk-hhq.cc": "at-or-before",
      "gov.pk-hq.cc": "at-or-before",
      "gov.pk-hq.us": "at-or-before",
      "gov.pk-hqr.co": "at-or-before",
      "gov.pk-hqr.online": "at-or-before",
      "gov.pk-ht.pk": "at-or-before",
      "gov.pk-mail.co": "at-or-before",
      "gov.pk-mail.org": "at-or-before",
      "gov.pk.officemuwork.online": "at-or-before",
      "gov.pk.pk-mail.org": "at-or-before",
      "gov.pk.viewdoc.online": "at-or-before",
      "gov1-lk.com": "at-or-before",
      "govaf.org": "at-or-before",
      "govbd-div.com": "at-or-before",
      "govmm.me": "at-or-before",
      "govmm.org": "at-or-before",
      "govpk.site": "at-or-before",
      "govtpk.co": "at-or-before",
      "gpk-production.up.railway.app": "at-or-before",
      "grabfiles.org": "at-or-before",
      "greatslols.com": "at-or-before",
      "greenpaktourism.pk-mail.org": "at-or-before",
      "greenstream.top": "at-or-before",
      "gwadar-port.zapto.org": "at-or-before",
      "halcor.site": "at-or-before",
      "happyhours.sbs": "at-or-before",
      "hec-gov.com": "at-or-before",
      "helpful-national-poilcy-nepla-gov-np.netlify.app": "at-or-before",
      "hetlic.tech": "at-or-before",
      "hinoms.com": "at-or-before",
      "hisidewindersidewinder.pimec-paknavy.updates-installer.store": "at-or-before",
      "hitpak.org": "at-or-before",
      "hlones.xyz": "at-or-before",
      "holemn.xyz": "at-or-before",
      "hostmaster.news-bd.com": "at-or-before",
      "hpqumyre.grabfiles.org": "at-or-before",
      "hrka1.pmreco.xyz": "at-or-before",
      "huangjianglee.top": "at-or-before",
      "huneme.live": "at-or-before",
      "i737461746963o6578706fo646576z.oszar.com": "at-or-before",
      "iclod.org": "at-or-before",
      "idef-2025-conf-data-file-tr-account-d.netlify.app": "at-or-before",
      "idef2025-com-tr-files-drive-account.netlify.app": "at-or-before",
      "ier-modile.shop": "at-or-before",
      "igqlc.pmreco.xyz": "at-or-before",
      "igyg8z.sepweo.info": "at-or-before",
      "inboxofficial-bd.com": "at-or-before",
      "info-bdgov.com": "at-or-before",
      "info-lanka.org": "at-or-before",
      "infomfa-gov-lk.dwnlld.info": "at-or-before",
      "inkora.org": "at-or-before",
      "inporta.org": "at-or-before",
      "input.info-bdgov.com": "at-or-before",
      "install-e.store": "at-or-before",
      "install-manager.com": "at-or-before",
      "interior-gov-pk.com": "at-or-before",
      "interior-gov-pk.file-dwnld.net": "at-or-before",
      "interiorgovpk.site": "at-or-before",
      "interiorgovt.com": "at-or-before",
      "interiorministrygov.site": "at-or-before",
      "interiorministrypk.com": "at-or-before",
      "interiorsgovpk.site": "at-or-before",
      "internal-advisory-azerbaijan-russia-diplomatic-crisis.defence-np.net": "at-or-before",
      "invitation-mofa-nepli-gov-np-file.netlify.app": "at-or-before",
      "invitation.army-lk.info": "at-or-before",
      "ipv6.seoshz.live": "at-or-before",
      "iseonea.live": "at-or-before",
      "islamabadpk.site": "at-or-before",
      "islamabadpolice.org": "at-or-before",
      "islamic-finder.org": "at-or-before",
      "it-pakistan-gov-pk.workers.dev": "at-or-before",
      "j2zfz.pmreco.xyz": "at-or-before",
      "jestec.info": "at-or-before",
      "jingjang-duduva.000webhostapp.com": "at-or-before",
      "jomeno.site": "at-or-before",
      "jomens.live": "at-or-before",
      "jtops.milqq.info": "at-or-before",
      "kaleido.moe": "at-or-before",
      "kenose.live": "at-or-before",
      "ketin.live": "at-or-before",
      "ketle.site": "at-or-before",
      "khaleejtimes.cc": "at-or-before",
      "khanlab.medicallab.site": "at-or-before",
      "kicov.site": "at-or-before",
      "kintecc.com": "at-or-before",
      "kmz.fetchdrive.info": "at-or-before",
      "koepasc.live": "at-or-before",
      "koitic.org": "at-or-before",
      "kpkarmslicense.site": "at-or-before",
      "kppolice.gov.pk-mail.org": "at-or-before",
      "kptgov.org": "at-or-before",
      "kptkp.online": "at-or-before",
      "krontab.info": "at-or-before",
      "krotab.info": "at-or-before",
      "kuknalim.com.pk-mail.org": "at-or-before",
      "l0gin-cetc1-files-0pen-expired.netlify.app": "at-or-before",
      "l1kdine.com": "at-or-before",
      "lalosop.biz": "at-or-before",
      "laspzo.site": "at-or-before",
      "latestupdate.adobeglobal.com": "at-or-before",
      "lcbkp-gov-pk-sedang-berbunga.pages.dev": "at-or-before",
      "lescrip.live": "at-or-before",
      "letcrip.xyz": "at-or-before",
      "licenceinteriorministrypk.com": "at-or-before",
      "license.interiorministrypk.com": "at-or-before",
      "licenseinterior.gov-pk.com": "at-or-before",
      "licenseinterior.gov-pk.site": "at-or-before",
      "licenseinterior.govpk.site": "at-or-before",
      "limkdin.com": "at-or-before",
      "linkeden.net": "at-or-before",
      "livestreaming.adobeglobal.com": "at-or-before",
      "lk.aliyumm.pro": "at-or-before",
      "lk.mofa-govbd.com": "at-or-before",
      "lk.mofa-govlk.org": "at-or-before",
      "lk.mofa-govtpk.net": "at-or-before",
      "lk.pk-mail.org": "at-or-before",
      "loadpath.info": "at-or-before",
      "loasem.live": "at-or-before",
      "loasen.xyz": "at-or-before",
      "lolsidewindersidewinder.nic-svc.net": "at-or-before",
      "lonime.xyz": "at-or-before",
      "luckjav.com": "at-or-before",
      "m1n.mov": "at-or-before",
      "macop.site": "at-or-before",
      "madhouse.cloud": "at-or-before",
      "magento.seoshz.live": "at-or-before",
      "maif-piac-aero.gov-pkgov.workers.dev": "at-or-before",
      "mail-163cn.com": "at-or-before",
      "mail-776f305796709f2d567e6868feaba274-gov-pk-investment.pages.dev": "at-or-before",
      "mail-account-data.github.io": "at-or-before",
      "mail-afd-gov-bd-account-error-issues.netlify.app": "at-or-before",
      "mail-airforce-lk1b8470bce36a0e858a410b4169b23e1c.pages.dev": "at-or-before",
      "mail-army-sl-dte-of-welfare-session-out.pages.dev": "at-or-before",
      "mail-arny-nil-db.up.railway.app": "at-or-before",
      "mail-aselsans-com-tr-account-files-da.netlify.app": "at-or-before",
      "mail-aviation-gov-pk-pdf.pages.dev": "at-or-before",
      "mail-baf-mil-bd-account-data-files-document.pages.dev": "at-or-before",
      "mail-baf-mil-bd-fils-cas-visit-to-chi.netlify.app": "at-or-before",
      "mail-bcc-gov-bd-7j5la.bunny.run": "at-or-before",
      "mail-bccgov.gotdns.ch": "at-or-before",
      "mail-bccnetdd.ddns.net": "at-or-before",
      "mail-bof-gov-bd-cas-visit.netlify.app": "at-or-before",
      "mail-bof-gov-file-account-conf-files.netlify.app": "at-or-before",
      "mail-dgfi-gov-bd-accounts-file-data-d.netlify.app": "at-or-before",
      "mail-doc-download-pdf.up.railway.app": "at-or-before",
      "mail-download-army-mii-bd.up.railway.app": "at-or-before",
      "mail-files-open-preview.com": "at-or-before",
      "mail-kdu-lk-inbox-interanl-memo.pages.dev": "at-or-before",
      "mail-kpt-gov-pk-2fa-registration.pages.dev": "at-or-before",
      "mail-kpt-gov-pk-browserautheintacation.pages.dev": "at-or-before",
      "mail-kpt-gov-pk-error.pages.dev": "at-or-before",
      "mail-kpt-gov-pk-estblishment-it-park.pages.dev": "at-or-before",
      "mail-kpt-gov-pk-joint-coordination-meeting.pages.dev": "at-or-before",
      "mail-kpt-gov-pk-meeting-sub-committee.pages.dev": "at-or-before",
      "mail-kpt-gov-pk-mod-revised-scheduled.pages.dev": "at-or-before",
      "mail-kpt-gov-pk-provision-of-data-for-greater-karachi.pages.dev": "at-or-before",
      "mail-kpt-gov-pk-provision-of-karachi-port-vision.pages.dev": "at-or-before",
      "mail-kpt-gov-pk-securityupdates-jun2025olertnessegingvsdvs.pages.dev": "at-or-before",
      "mail-kpt-gov-pk-training-course-public-finance.pages.dev": "at-or-before",
      "mail-kpt-gov-pk-viruspurification-securitypachesjun-2025df.pages.dev": "at-or-before",
      "mail-kpt-gov-pk-visit-to-malaysia-final.pages.dev": "at-or-before",
      "mail-minfinance-gov-np.netlify.app": "at-or-before",
      "mail-mod-gov-bd-account-conf-files.netlify.app": "at-or-before",
      "mail-mod-gov-np-account-file-data.netlify.app": "at-or-before",
      "mail-mod-gov-np-download-pdf.netlify.app": "at-or-before",
      "mail-modp-gov-pk-view.netlify.app": "at-or-before",
      "mail-mofa-gov.org-liv.net": "at-or-before",
      "mail-moha-gov-np-download.netlify.app": "at-or-before",
      "mail-moitt-gov-pk-meeting-sun-committee.pages.dev": "at-or-before",
      "mail-ntc-net-pk-pdf.up.railway.app": "at-or-before",
      "mail-ntc-net-pk.up.railway.app": "at-or-before",
      "mail-ntc-net-pk.zeabur.app": "at-or-before",
      "mail-paa-gov-pk.pages.dev": "at-or-before",
      "mail-preview-trainingcollabration-bangladesh-srilanka.pages.dev": "at-or-before",
      "mail-prevlew-jointworkshop-training-srilanka-bangladesh.pages.dev": "at-or-before",
      "mail-sco-gov-pk.netlify.app": "at-or-before",
      "mail-sessionexpired.com": "at-or-before",
      "mail-suparco-gov-pk-owa-auth-logon-aspx.pages.dev": "at-or-before",
      "mail.allpakarmslicence.com": "at-or-before",
      "mail.andc.govaf.org": "at-or-before",
      "mail.army-govbd.info": "at-or-before",
      "mail.baf.mil.bd.pdf.quickhelpsolve.com": "at-or-before",
      "mail.bcc.gov.bd.pdf.quickhelpsolve.com": "at-or-before",
      "mail.bcc.gov.bd.upworkoffice.online": "at-or-before",
      "mail.bdgov.info": "at-or-before",
      "mail.biitt.cn": "at-or-before",
      "mail.demsflygerxamy.com": "at-or-before",
      "mail.dlimspunjabgovpk.com": "at-or-before",
      "mail.drive.gov.bd.files.updatemind52.com": "at-or-before",
      "mail.gov-pk.com": "at-or-before",
      "mail.gov-pk.pk": "at-or-before",
      "mail.gov-pk.site": "at-or-before",
      "mail.gov.bd.account.file.updatemind52.com": "at-or-before",
      "mail.licenceinteriorministrypk.com": "at-or-before",
      "mail.mobta.govaf.org": "at-or-before",
      "mail.modcloudspace.com": "at-or-before",
      "mail.mofa-govbd.com": "at-or-before",
      "mail.mofa.gov.pk.officemuwork.online": "at-or-before",
      "mail.moi.govaf.org": "at-or-before",
      "mail.navy.mil.bd.officemuwork.online": "at-or-before",
      "mail.news-bd.com": "at-or-before",
      "mail.npc.gov.np.officemuwork.online": "at-or-before",
      "mail.ntc.net.pk.bismi.pro": "at-or-before",
      "mail.ntc.net.pk.onlinestatus.live": "at-or-before",
      "mail.ntc.net.pk.vpdf.online": "at-or-before",
      "mail.oilplus1td.com": "at-or-before",
      "mail.paf.gov.pk.onlinestatus.live": "at-or-before",
      "mail.pakarmslicense.com.pk": "at-or-before",
      "mail.pk-mail.org": "at-or-before",
      "mail.pof-gov-pk.workers.dev": "at-or-before",
      "mail.power-govpk.org": "at-or-before",
      "mail.voyage-prive.com.ru": "at-or-before",
      "mail126.live": "at-or-before",
      "mail163cn.info": "at-or-before",
      "mailbox-inbox-bd.com": "at-or-before",
      "mailbox3-inbox1-bd.com": "at-or-before",
      "mailcbmgovmm.pages.dev": "at-or-before",
      "mailcloucl.com": "at-or-before",
      "maildefence.myftp.org": "at-or-before",
      "maill-govtnepal-gov-np.netlify.app": "at-or-before",
      "maill-nepalgv-gov-np.netlify.app": "at-or-before",
      "mailscodomain-hubenkks.b4a.run": "at-or-before",
      "mailserver.seoshz.live": "at-or-before",
      "mailsserver-lk.com": "at-or-before",
      "mainet.info": "at-or-before",
      "mall-ministryoffinance-np.netlify.app": "at-or-before",
      "marine-pak.org": "at-or-before",
      "maroos.live": "at-or-before",
      "masarh.live": "at-or-before",
      "me7q1.pmreco.xyz": "at-or-before",
      "medicallab.site": "at-or-before",
      "meeting-rigistration-defence-attache.netlify.app": "at-or-before",
      "meeting-rigistration-embassy.netlify.app": "at-or-before",
      "mevron.tech": "at-or-before",
      "mfa-gov-al.com": "at-or-before",
      "mfa-gov-cy.info": "at-or-before",
      "mfa-gov-cy.online": "at-or-before",
      "mfa-gov-lk.dwnlld.info": "at-or-before",
      "mfa-govtt-az.com": "at-or-before",
      "mfa-govtt-mm.com": "at-or-before",
      "mfa-ir.cn": "at-or-before",
      "mfa-qov.com": "at-or-before",
      "mfa.gov.lk.mofa-govlk.org": "at-or-before",
      "mfagov.info": "at-or-before",
      "mfagov.net": "at-or-before",
      "mha.gov.bd.pk-mail.org": "at-or-before",
      "mhapsd.gov.bd.mofa-govbd.com": "at-or-before",
      "mil.bd.officemuwork.online": "at-or-before",
      "milbdarmy.live": "at-or-before",
      "milqq.info": "at-or-before",
      "mindef.gov.pk-mail.org": "at-or-before",
      "ministryofinterior.shop": "at-or-before",
      "ministryofinteriorlicense.gov-pk.com": "at-or-before",
      "ministryofinteriorlicense.gov-pk.site": "at-or-before",
      "ministryofinteriorlicense.govpk.site": "at-or-before",
      "ministryofinteriorpermit.gov-pk.com": "at-or-before",
      "ministryofinteriorpermit.gov-pk.site": "at-or-before",
      "minutes-interministryproduction.up.railway.app": "at-or-before",
      "mms.phone-update.click": "at-or-before",
      "mo.treasury.gov.lk.pk-mail.org": "at-or-before",
      "mobta.govaf.org": "at-or-before",
      "mocat-gov-bd.filenest.live": "at-or-before",
      "mocat.gov.bd.pk-mail.org": "at-or-before",
      "mod-gov-bd.downld.org": "at-or-before",
      "mod-gov-bd.dwnlld.com": "at-or-before",
      "mod-gov-bd.dwnlld.info": "at-or-before",
      "mod-gov-bd.filenest.live": "at-or-before",
      "mod-gov-bd.info": "at-or-before",
      "mod-gov-bd.net-src.org": "at-or-before",
      "mod-gov-bd.org-liv.net": "at-or-before",
      "mod-gov-bd.snagdrive.com": "at-or-before",
      "mod-kh.info": "at-or-before",
      "mod.gov.bd.mofa-govtpk.net": "at-or-before",
      "mod.gov.bd.pk-mail.org": "at-or-before",
      "mod.gov.np.pk-mail.org": "at-or-before",
      "mod.mofa-govbd.com": "at-or-before",
      "mod.mofa-govlk.org": "at-or-before",
      "modcloudspace.com": "at-or-before",
      "moddirectoratecloud.com": "at-or-before",
      "modeso.info": "at-or-before",
      "modltr.info-lanka.org": "at-or-before",
      "modp-gov-pk.d0wnlaod.org": "at-or-before",
      "modp.gov.pk-mail.org": "at-or-before",
      "modpak-info.services": "at-or-before",
      "modpak.info": "at-or-before",
      "moef.gov.bd.pk-mail.org": "at-or-before",
      "mof-gov-bd.nic-svc.net": "at-or-before",
      "mof-gov-np.dwnlld.info": "at-or-before",
      "mof-newbudget25-ck.zeabur.app": "at-or-before",
      "mof-newbudget25-fm.zeabur.app": "at-or-before",
      "mof-newbudget25-jz.zeabur.app": "at-or-before",
      "mof-newbudget25-pdx.zeabur.app": "at-or-before",
      "mof-newbudget25-rk.zeabur.app": "at-or-before",
      "mof-newbudget25-vn.zeabur.app": "at-or-before",
      "mof-newbuedget2025-jz.zeabur.app": "at-or-before",
      "mof-newbuedget25-ars.zeabur.app": "at-or-before",
      "mof-newbuedget25-jz.zeabur.app": "at-or-before",
      "mof-newbuedget25-rk.zeabur.app": "at-or-before",
      "mof.gov.np.pk-mail.org": "at-or-before",
      "mofa-gov-bd.com": "at-or-before",
      "mofa-gov-bd.downld.org": "at-or-before",
      "mofa-gov-bd.dwnlld.info": "at-or-before",
      "mofa-gov-bd.fetchdrive.org": "at-or-before",
      "mofa-gov-bd.file-dwnld.net": "at-or-before",
      "mofa-gov-bd.filenest.live": "at-or-before",
      "mofa-gov-bd.snagdrive.com": "at-or-before",
      "mofa-gov-np.downld.org": "at-or-before",
      "mofa-gov-np.dwnlld.com": "at-or-before",
      "mofa-gov-np.dytt888.net": "at-or-before",
      "mofa-gov-np.live-co.org": "at-or-before",
      "mofa-gov-np.net-src.info": "at-or-before",
      "mofa-gov-np.org-liv.net": "at-or-before",
      "mofa-gov-pk-692e658f-19ac-8320-a0ee-b52b2198b13c-visit.pages.dev": "at-or-before",
      "mofa-gov-pk-692e658f-19ac-8320-a0ee-b52b2198b13c.pages.dev": "at-or-before",
      "mofa-gov-pk-press-release-training-course-public-finance.pages.dev": "at-or-before",
      "mofa-gov-pk.dwnlld.com": "at-or-before",
      "mofa-govbd.com": "at-or-before",
      "mofa-govbd.org": "at-or-before",
      "mofa-govlk.org": "at-or-before",
      "mofa-govpk.co": "at-or-before",
      "mofa-govtpk.net": "at-or-before",
      "mofa-lk.org": "at-or-before",
      "mofa-qov.com": "at-or-before",
      "mofa.gov.bd.mofa-govbd.com": "at-or-before",
      "mofa.gov.bd.mofa-govtpk.net": "at-or-before",
      "mofa.gov.bd.pk-mail.org": "at-or-before",
      "mofa.gov.pk-mail.org": "at-or-before",
      "mofa.gov.pk.officemuwork.online": "at-or-before",
      "mofaga.gov.np.pk-mail.org": "at-or-before",
      "mofagovbd.com": "at-or-before",
      "mofagovpk-hq.co": "at-or-before",
      "mofagovpk.co": "at-or-before",
      "mofbudget-ars.zeabur.app": "at-or-before",
      "mofbudget-ck.zeabur.app": "at-or-before",
      "mofbudget-fld.zeabur.app": "at-or-before",
      "mofbudget-fm.zeabur.app": "at-or-before",
      "mofbudget-jz.zeabur.app": "at-or-before",
      "mofbudget-pd.zeabur.app": "at-or-before",
      "mofbudget-vn.zeabur.app": "at-or-before",
      "mofbudget.zeabur.app": "at-or-before",
      "mofnewbuedgetsgp-jz.zeabur.app": "at-or-before",
      "mofnewbuedgetsgp-pd.zeabur.app": "at-or-before",
      "mofnewbuedgetssg-ck.zeabur.app": "at-or-before",
      "mofnewbuedgetssg-jz.zeabur.app": "at-or-before",
      "mofnewbuedgetssg-pd.zeabur.app": "at-or-before",
      "mofnewbuedgetssg-rk.zeabur.app": "at-or-before",
      "mofnewbuedgetssgp-ck.zeabur.app": "at-or-before",
      "mofnewbuedgetssgp-jz.zeabur.app": "at-or-before",
      "mofnewbuedgetssgp-pd.zeabur.app": "at-or-before",
      "mofsgpbudget-ars.zeabur.app": "at-or-before",
      "mofsgpbudget-ck.zeabur.app": "at-or-before",
      "mofsgpbudget-jz.zeabur.app": "at-or-before",
      "moha-gov-bd.filenest.live": "at-or-before",
      "moha-gov-bd.snagdrive.com": "at-or-before",
      "moha-gov-np.filenest.live": "at-or-before",
      "moha-gov-np.snagdrive.com": "at-or-before",
      "moha.gov.np.pk-mail.org": "at-or-before",
      "mohpw.gov.bd.pk-mail.org": "at-or-before",
      "mohrss.help": "at-or-before",
      "moi.govaf.org": "at-or-before",
      "moitt-gov-pk-presentation-visit-pm.pages.dev": "at-or-before",
      "moitt-gov-pk.dwnlld.info": "at-or-before",
      "moitt.gov.pk.pk-mail.org": "at-or-before",
      "moitt.gov.pk.viewdoc.online": "at-or-before",
      "moma.islamabadpk.site": "at-or-before",
      "moma.kptkp.online": "at-or-before",
      "mopa-gov-bd.dwnlld.com": "at-or-before",
      "mopa.gov.bd.mofa-govtpk.net": "at-or-before",
      "moragovt.net": "at-or-before",
      "mos-gov-bd.snagdrive.com": "at-or-before",
      "mos.gov.bd.pk-mail.org": "at-or-before",
      "ms-office.pro": "at-or-before",
      "ms.dufichiers.fr": "at-or-before",
      "myanmar-org-mail.com": "at-or-before",
      "n2pro.pmreco.xyz": "at-or-before",
      "na-gov-pk-meeting-pac.pages.dev": "at-or-before",
      "nadra.gov-pk.com": "at-or-before",
      "nadra.gov-pk.site": "at-or-before",
      "nadracloudx.pages.dev": "at-or-before",
      "nastp-govpk.com": "at-or-before",
      "navy-mil-bd-download.up.railway.app": "at-or-before",
      "navy-support.org": "at-or-before",
      "navy.mil.bd.officemuwork.online": "at-or-before",
      "ndma-govpak.org": "at-or-before",
      "ndma-govpk.co": "at-or-before",
      "ndma-govpk.info": "at-or-before",
      "nemln.pmreco.xyz": "at-or-before",
      "nepalarmy-milnp.info": "at-or-before",
      "net-co.info": "at-or-before",
      "net-co.live": "at-or-before",
      "net-src.org": "at-or-before",
      "new-mof-budgetsgp-ars.zeabur.app": "at-or-before",
      "new-year-message-from-the-chief-of-the-army-staff.gov1-lk.com": "at-or-before",
      "newmail-army-mil-bd-owa-apth-mail-dat.netlify.app": "at-or-before",
      "newmail-army-mil-bd-pso-meeting-file.netlify.app": "at-or-before",
      "newmailarmyy-53ufzg0t.b4a.run": "at-or-before",
      "news-bd.com": "at-or-before",
      "news-bd.com.news-bd.com": "at-or-before",
      "news-lk.com": "at-or-before",
      "news-pk-media.news": "at-or-before",
      "ngmail-downloadsnew-pdf.up.railway.app": "at-or-before",
      "nha-gov-pk-mohd-dam-hydropower-project.pages.dev": "at-or-before",
      "nic-svc.net": "at-or-before",
      "nih.pk-mail.org": "at-or-before",
      "nims.nadra.gov-pk.com": "at-or-before",
      "nitb-gov-pk-vpn-for-secure-webmail-access.pages.dev": "at-or-before",
      "nocet.info": "at-or-before",
      "nolotion.info": "at-or-before",
      "nomination.army-bd.com": "at-or-before",
      "nomination.info-bdgov.com": "at-or-before",
      "note.info-bdgov.com": "at-or-before",
      "np.officemuwork.online": "at-or-before",
      "np.pk-mail.org": "at-or-before",
      "npc.gov.np.officemuwork.online": "at-or-before",
      "nrdi-gov.com": "at-or-before",
      "nrdi-govt.com": "at-or-before",
      "nrtc-supporl2.com": "at-or-before",
      "nrtc-support.com": "at-or-before",
      "ns1.army-lk.org": "at-or-before",
      "ns1.news-bd.com": "at-or-before",
      "ns1.news-bd.com.news-bd.com": "at-or-before",
      "ns2.army-lk.org": "at-or-before",
      "ns2.news-bd.com": "at-or-before",
      "nslow.pmreco.xyz": "at-or-before",
      "nsvay8faydj3f79dje9djr02j101c4a583c3acdd2a06ca2fb183cf995.pages.dev": "at-or-before",
      "ntc-06gd0upz.b4a.run": "at-or-before",
      "ntc-net.com": "at-or-before",
      "ntc-pak.org": "at-or-before",
      "ntc.gov.pk.viewdoc.online": "at-or-before",
      "ntc.net.pk.bismi.pro": "at-or-before",
      "ntcpk.co": "at-or-before",
      "nvloi.mofagovbd.com": "at-or-before",
      "o1ghs.pmreco.xyz": "at-or-before",
      "oalems.com": "at-or-before",
      "office-addonsmis.com": "at-or-before",
      "office.seoshz.live": "at-or-before",
      "office365-server.ddns.net": "at-or-before",
      "officemuwork.online": "at-or-before",
      "oilplus1td.com": "at-or-before",
      "onesom.biz": "at-or-before",
      "ootbp.pmreco.xyz": "at-or-before",
      "opesc.info": "at-or-before",
      "org-liv.net": "at-or-before",
      "orrwv.pmreco.xyz": "at-or-before",
      "ostcone.site": "at-or-before",
      "owa-suparco-gov-pk-logon-aspx.pages.dev": "at-or-before",
      "owa-suparco-gov-pk-owa-autho.pages.dev": "at-or-before",
      "p1x.live": "at-or-before",
      "p2m3o4j3j101c4a583c3acdd2a06ca2fb183cf995mrfi34ur9rj40fm49.pages.dev": "at-or-before",
      "paa.gov.pk-mail.org": "at-or-before",
      "paf.gov.pk.viewdoc.online": "at-or-before",
      "page-view-mail.zeabur.app": "at-or-before",
      "pakarmslicense.com.pk": "at-or-before",
      "pakarmslisense.com": "at-or-before",
      "pakistanarmslicense.com": "at-or-before",
      "paknavy.info": "at-or-before",
      "pakvisanadra.gov-pk.com": "at-or-before",
      "pakvisanadra.gov-pk.site": "at-or-before",
      "paletec.live": "at-or-before",
      "pandalyticsresearch.sbs": "at-or-before",
      "panel.onesom.biz": "at-or-before",
      "pareing.info": "at-or-before",
      "parliament.lk.pk-mail.org": "at-or-before",
      "pasoale.info": "at-or-before",
      "paypal.es-profils.me": "at-or-before",
      "pbm-gov-pk.ignitebiz.de": "at-or-before",
      "pc-gov-pk.downnload.net": "at-or-before",
      "pc.gov.pk-mail.org": "at-or-before",
      "pd.gov.bd.pk-mail.org": "at-or-before",
      "pdf-downlod.com": "at-or-before",
      "pdfofficialdocument.com": "at-or-before",
      "pectec.live": "at-or-before",
      "pemra.gov.pk-mail.org": "at-or-before",
      "permitinterior.gov-pk.com": "at-or-before",
      "permitinterior.gov-pk.site": "at-or-before",
      "permitsinteriors-gov-pk.com": "at-or-before",
      "phone-update.click": "at-or-before",
      "pimec-paknavy.updates-installer.store": "at-or-before",
      "pin-up.amazingbonis.com": "at-or-before",
      "pinup.greatslols.com": "at-or-before",
      "pk-hhq.cc": "at-or-before",
      "pk-hq.cc": "at-or-before",
      "pk-hq.us": "at-or-before",
      "pk-hqr.co": "at-or-before",
      "pk-hqr.online": "at-or-before",
      "pk-ht.pk": "at-or-before",
      "pk-mail.org": "at-or-before",
      "pk.officemuwork.online": "at-or-before",
      "pk.pk-mail.org": "at-or-before",
      "pkcert-arbeitssicherheit.de": "at-or-before",
      "pkcert.com": "at-or-before",
      "pkcert.gov.pk-mail.co": "at-or-before",
      "pkcert.live": "at-or-before",
      "pkcert.net": "at-or-before",
      "pkcert.news": "at-or-before",
      "pkcert.org": "at-or-before",
      "pkcert.report": "at-or-before",
      "pkgov.xyz": "at-or-before",
      "pkpolice.gov.pk-mail.org": "at-or-before",
      "pl1.mov": "at-or-before",
      "plaaf-a1irshow-registrati0n-2024.netlify.app": "at-or-before",
      "plaaf-zhuhaiairshow-registration-2024.netlify.app": "at-or-before",
      "playservicess.com": "at-or-before",
      "playsevices.com": "at-or-before",
      "pmad-gov-pk-2fa-registration.pages.dev": "at-or-before",
      "pmo-gov-pk.file-dwnld.net": "at-or-before",
      "pmo-gov-pk.filenest.live": "at-or-before",
      "pmo-gov-pk.loadpath.info": "at-or-before",
      "pmo-gov-pk.net-src.org": "at-or-before",
      "pmo-gov-pk.snagdrive.com": "at-or-before",
      "pmo.gov.pk-mail.org": "at-or-before",
      "pmreco.xyz": "at-or-before",
      "pmrugb.gov.pk": "at-or-before",
      "pn0fficial.info": "at-or-before",
      "pncert.info": "at-or-before",
      "pncert.pro": "at-or-before",
      "pnra-gov-view.000webhostapp.com": "at-or-before",
      "pnra.pk-mail.org": "at-or-before",
      "pof.gov.pk.viewdoc.online": "at-or-before",
      "police.gov.bd.updatemind52.com": "at-or-before",
      "policy.mail163cn.info": "at-or-before",
      "porket.info": "at-or-before",
      "portmin-gov-lk.fetchdrive.org": "at-or-before",
      "posta-nhq43i6x.b4a.run": "at-or-before",
      "postfix.hondeman.net": "at-or-before",
      "postmaster.net-co.info": "at-or-before",
      "power-govpk.org": "at-or-before",
      "pp4gk.pmreco.xyz": "at-or-before",
      "pqa-gov-pk.workers.dev": "at-or-before",
      "pr-21356.expo.dev": "at-or-before",
      "presidentsoffice.lk.mofa-govtpk.net": "at-or-before",
      "presidentsoffice.mofa-govlk.org": "at-or-before",
      "preview-attachments-f1les-0pen-pdf.netlify.app": "at-or-before",
      "primary.news-bd.com": "at-or-before",
      "prison-gov-bd.dwnlld.info": "at-or-before",
      "probashi-gov-bd.mail-govt.org": "at-or-before",
      "probashi-gov-bd.net-src.info": "at-or-before",
      "psdgbgb-cell.github.io": "at-or-before",
      "psw-gov-pk.net": "at-or-before",
      "pta-gov-pk.workers.dev": "at-or-before",
      "ptd.gov.bd.pk-mail.org": "at-or-before",
      "ptpkp-govt.site": "at-or-before",
      "ptpkp.gov-pk.com": "at-or-before",
      "pubad-gov-lk.downld.org": "at-or-before",
      "pubad-gov-lk.download-doc.net": "at-or-before",
      "pubad-gov-lk.filenest.live": "at-or-before",
      "pubad-gov-lk.org-liv.net": "at-or-before",
      "pubad.gov.lk.mofa-govtpk.net": "at-or-before",
      "pubad.gov.lk.pk-mail.org": "at-or-before",
      "pubad.mofa-govlk.org": "at-or-before",
      "punjab-bankpk.org": "at-or-before",
      "punjab-pk.org": "at-or-before",
      "punjab.gov.pk-mail.org": "at-or-before",
      "punjabgovpk.org": "at-or-before",
      "punjabgovpolice.org": "at-or-before",
      "punjabpolice-pk.org": "at-or-before",
      "punjabpolice.gov-pk.com": "at-or-before",
      "punjabpolice.gov-pk.site": "at-or-before",
      "punjabpolice.gov.pk-mail.org": "at-or-before",
      "punjabpolicegovernmentofpakistan.org": "at-or-before",
      "punjabpolicegovpk.org": "at-or-before",
      "punjabpolicepakistan.org": "at-or-before",
      "punjabsafecities.com": "at-or-before",
      "qakt3.pmreco.xyz": "at-or-before",
      "qq.mailcloucl.com": "at-or-before",
      "quickhelpsolve.com": "at-or-before",
      "ramdaanvibe.info": "at-or-before",
      "reasoen.org": "at-or-before",
      "recovar.org": "at-or-before",
      "restless-brook-f09b.boundschain.workers.dev": "at-or-before",
      "ritenoc.live": "at-or-before",
      "rk7l0o.onesom.biz": "at-or-before",
      "rmdjkuceitapp.grabfiles.org": "at-or-before",
      "rnail.mfa-qov.com": "at-or-before",
      "rnail.mofa-qov.com": "at-or-before",
      "roensa.xyz": "at-or-before",
      "roncez.tech": "at-or-before",
      "routinework.sbs": "at-or-before",
      "rustore.fetchdrive.info": "at-or-before",
      "rustore.pmreco.xyz": "at-or-before",
      "saarc-sec-org.snagdrive.com": "at-or-before",
      "safecityctd.com": "at-or-before",
      "saffsdf-fgjhhgj-fhfgjrt65df-tfgy54hgf.netlify.app": "at-or-before",
      "samaa-tv.com": "at-or-before",
      "sbd1u.pmreco.xyz": "at-or-before",
      "scandalsofallovertheworld.gov-pk.com": "at-or-before",
      "school.gov-pk.pk": "at-or-before",
      "sco.gov.pk.viewdoc.online": "at-or-before",
      "sco.mail163cn.info": "at-or-before",
      "sco.pkgov.xyz": "at-or-before",
      "sdfgsdfsdhfgdfgdsgfsdjfdjsghfsdgfjkdsfdsbfbsdfjksdkjfdsfks.pages.dev": "at-or-before",
      "sdfsdgfsd-sdfjdgsjff-sdfg44gdfgjf-dfghkjfdhkj-dfgklhfghklf.pages.dev": "at-or-before",
      "sdkfjsh23-sdfgdklhg4-efglhdfg4-dfgjkl.netlify.app": "at-or-before",
      "secure-ntc.net": "at-or-before",
      "sellersprofile.sbs": "at-or-before",
      "senine.info": "at-or-before",
      "seoshz.live": "at-or-before",
      "sepweo.info": "at-or-before",
      "sercha.info": "at-or-before",
      "sercoten.info": "at-or-before",
      "server.oilplus1td.com": "at-or-before",
      "session-expired-file-download-cetcimail.pages.dev": "at-or-before",
      "sg21-production.up.railway.app": "at-or-before",
      "shoemo.xyz": "at-or-before",
      "sinantion.com": "at-or-before",
      "sindhpolice.gov.pk-mail.org": "at-or-before",
      "slpa-lk.nrdi-gov.com": "at-or-before",
      "slpa.news": "at-or-before",
      "smtp.dytt888.net": "at-or-before",
      "snagdrive.com": "at-or-before",
      "snagdrive.org": "at-or-before",
      "sngpl.com.pk-mail.org": "at-or-before",
      "sob.mofa-govlk.org": "at-or-before",
      "social-welfare.ddns.net": "at-or-before",
      "songlong88.net": "at-or-before",
      "sopeor.com": "at-or-before",
      "spfc-punjab-gov-pk.com": "at-or-before",
      "sri-lanka-it.com": "at-or-before",
      "sri-lanka.it.com": "at-or-before",
      "stage.onesom.biz": "at-or-before",
      "staging.grabfiles.org": "at-or-before",
      "staging.onesom.biz": "at-or-before",
      "sudden.nepalarmy-milnp.info": "at-or-before",
      "suparco-gov-pk-6866387a-44d0-8009-a76e-6948da2c3278.pages.dev": "at-or-before",
      "superback.space": "at-or-before",
      "superset.mfa-qov.com": "at-or-before",
      "support.it-pakistan-gov-pk.workers.dev": "at-or-before",
      "system-services-manual.life": "at-or-before",
      "systemhealthservices.top": "at-or-before",
      "systemupdateanalysis.blog": "at-or-before",
      "systemupgradationservices.net": "at-or-before",
      "tactin.info": "at-or-before",
      "tamhuudung.com": "at-or-before",
      "tchgin.site": "at-or-before",
      "technicaladivsory.click": "at-or-before",
      "technicaladvisory.sbs": "at-or-before",
      "technologysupport.help": "at-or-before",
      "telcec.site": "at-or-before",
      "test.fetchdrive.info": "at-or-before",
      "test.gbpay.gov.pk": "at-or-before",
      "test.onesom.biz": "at-or-before",
      "themegaprovider.ddns.net": "at-or-before",
      "timoney.getexpo.com": "at-or-before",
      "tod.treasury.gov.lk.mofa-govbd.com": "at-or-before",
      "tolera.live": "at-or-before",
      "treasury.gov.lk.mofa-govbd.com": "at-or-before",
      "treasury.gov.lk.pk-mail.org": "at-or-before",
      "turkavic.org": "at-or-before",
      "update1.store": "at-or-before",
      "updatemind52.com": "at-or-before",
      "updates-installer.store": "at-or-before",
      "updotes.co": "at-or-before",
      "uploads.ptcl-gov-pk.workers.dev": "at-or-before",
      "upones.site": "at-or-before",
      "upworkoffice.online": "at-or-before",
      "user.onesom.biz": "at-or-before",
      "usermail-output-panel.000webhostapp.com": "at-or-before",
      "uw9i.pmreco.xyz": "at-or-before",
      "v1d.mov": "at-or-before",
      "valac.biz": "at-or-before",
      "vateno.info": "at-or-before",
      "vehicleverificationsystem.com": "at-or-before",
      "velopen.info": "at-or-before",
      "veorey.live": "at-or-before",
      "verify.mod-defence-lk.workers.dev": "at-or-before",
      "viewdoc.online": "at-or-before",
      "viewpdfonline-1wgtaeus.b4a.run": "at-or-before",
      "vinver.live": "at-or-before",
      "visa-nadra-gov-pk.pk": "at-or-before",
      "vistavue.shop": "at-or-before",
      "vlc-services.cfd": "at-or-before",
      "vmi1789770.contaboserver.net": "at-or-before",
      "vmi2186317.contaboserver.net": "at-or-before",
      "voyage-prive.com.ru": "at-or-before",
      "vpdf.online": "at-or-before",
      "wapda.pkgov.xyz": "at-or-before",
      "we-are-under-gain.000webhostapp.com": "at-or-before",
      "webdisk.bdgov.info": "at-or-before",
      "webdisk.news-bd.com": "at-or-before",
      "webdisk.pk-mail.org": "at-or-before",
      "webmaii-bcc-gov-bd-newfiles.up.railway.app": "at-or-before",
      "webmail-gov-pk-action-plan-cpec-inbox-download.pages.dev": "at-or-before",
      "webmail-hubpower-com-error.pages.dev": "at-or-before",
      "webmail-mofa-gov-pk.zeabur.app": "at-or-before",
      "webmail.bdgov.info": "at-or-before",
      "webmail.cybar-net-pk.workers.dev": "at-or-before",
      "webmail.news-bd.com": "at-or-before",
      "webmail.pk-mail.org": "at-or-before",
      "webmail.police.gov.bd.updatemind52.com": "at-or-before",
      "webservermail-g2689far.b4a.run": "at-or-before",
      "whm.pk-mail.org": "at-or-before",
      "winger.live": "at-or-before",
      "winhost.redirectme.net": "at-or-before",
      "winupdate.redirectme.net": "at-or-before",
      "wl8aq8.nocet.info": "at-or-before",
      "wnic-svc.net": "at-or-before",
      "workermdxxx.naychilin-pk.workers.dev": "at-or-before",
      "wpda-mom-meeting-invitation-letter.netlify.app": "at-or-before",
      "wqkwqcwvcn.filenest.live": "at-or-before",
      "wqqwysd-qwbeaxsb.zeabur.app": "at-or-before",
      "www-airforcelk-preview-com.netlify.app": "at-or-before",
      "www-cbsl-gov-lk.download-doc.net": "at-or-before",
      "www-cbsl-gov-lk.dwnlld.com": "at-or-before",
      "www-cbsl-gov-lk.dwnlld.info": "at-or-before",
      "www-cbsl-gov-lk.dwnlld.infomfa-gov-lk.dwnlld.info": "at-or-before",
      "www-cbsl-gov-lk.filenest.live": "at-or-before",
      "www-cbsl-gov-lk.loadpath.info": "at-or-before",
      "www-cbsl-gov-lk.snagdrive.com": "at-or-before",
      "www-communications-gov-pk.fetchdrive.org": "at-or-before",
      "www-customs-gov-lk.net-co.info": "at-or-before",
      "www-erd-gov-lk.downld.org": "at-or-before",
      "www-erd-gov-lk.dwnlld.info": "at-or-before",
      "www-erd-gov-lk.nic-svc.net": "at-or-before",
      "www-foreignaffairs-nepal-com.netlify.app": "at-or-before",
      "www-navl-com-lk.pages.dev": "at-or-before",
      "www-nepalgovernment-genz-agendapdf.netlify.app": "at-or-before",
      "www-officialregistration-accounts.netlify.app": "at-or-before",
      "www-parliament-lk.snagdrive.com": "at-or-before",
      "www-pmo-gov-pk.dytt888.net": "at-or-before",
      "www-presidentsoffice-gov-lk.dwnlld.com": "at-or-before",
      "www-srilankanavy-cabinet-decision.netlify.app": "at-or-before",
      "www-treasury-gov-lk.downld.org": "at-or-before",
      "www-treasury-gov-lk.filenest.live": "at-or-before",
      "www-treasury-gov-lk.nic-svc.net": "at-or-before",
      "www-treasury-gov-lk.org-liv.net": "at-or-before",
      "www-treasury-gov-lk.snagdrive.com": "at-or-before",
      "xcfhg.dwnlld.info": "at-or-before",
      "y1x.org": "at-or-before",
      "y9zz2.pmreco.xyz": "at-or-before",
      "yahoo.com.mofa-govbd.com": "at-or-before",
      "yerac.live": "at-or-before",
      "yhue2.pmreco.xyz": "at-or-before",
      "zamannindaindirimlerimm.com": "at-or-before",
      "zeanos.live": "at-or-before",
      "zeltech.live": "at-or-before",
      "zhuhai-a1rsh0w-reg1strat1i0n-2o24.netlify.app": "at-or-before",
      "ziptec.info": "at-or-before",
      "zlaeso.xyz": "at-or-before",
      "zruod.pmreco.xyz": "at-or-before",
      "zyu43.pmreco.xyz": "at-or-before"
    },
    "ipv4": {
      "149.102.131.122:41521": "at-or-before",
      "167.86.94.42:18745": "at-or-before",
      "185.159.128.117:443": "at-or-before",
      "31.15.17.230:443": "at-or-before",
      "31.58.137.246:443": "at-or-before",
      "46.8.226.5:443": "at-or-before",
      "47.236.177.123:9090": "at-or-before",
      "89.46.65.19:443": "at-or-before"
    },
    "url": {
      "http://112.13.121.89": "at-or-before",
      "http://185.159.128.117": "at-or-before",
      "http://31.15.17.230": "at-or-before",
      "http://31.58.137.246": "at-or-before",
      "http://46.8.226.5": "at-or-before",
      "http://89.46.65.19": "at-or-before"
    },
    "url_path": {
      "/?dhsfiourewjdfjgkfdgkldfjiorejfdjgfdgjkdfjgreioo=": "at-or-before",
      "/?evfdbskjfbksjlfkjsengknsjbgwg34vf": "at-or-before",
      "/?hebjwhihsdbwbsdbwudiok": "at-or-before",
      "/?ioewroiewrioweroiriwwoei=": "at-or-before",
      "/?jcvjeijnasdncadasdbfdfurhtnbfgbsydbx=": "at-or-before",
      "/?lfdkjgiroetuiroyhgfhnbjkfsdfiowerierehjre": "at-or-before",
      "/api/root_3977413298779/hello": "at-or-before",
      "/api/root_3977413298779/upload": "at-or-before",
      "/cetcc/crud.php": "at-or-before",
      "/cvbnhmj7.php": "at-or-before",
      "/load/?lfdkjgiroetuiroyhgfhnbjkfsdfiowerierehjre": "at-or-before",
      "/login/?dhsfiourewjdfjgkfdgkldfjiorejfdjgfdgjkdfjgreioo=": "at-or-before",
      "/login/?jcvjeijnasdncadasdbfdfurhtnbfgbsydbx=": "at-or-before",
      "/swpGMooD": "at-or-before"
    }
  },
  "first_seen_range": {
    "earliest": "2018-09-29",
    "latest": "2026-08-07"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "0range.site",
      "0ultook.live",
      "1.modp-pk.org",
      "101c4a583c3acdd2a06ca2fb183cf995fgd55fghf67dhf7dhf7dhnfks7.pages.dev",
      "101c4a583c3acdd2afd06ca2fb183cf995sdfsdh54jkdfgh54893489h5.pages.dev",
      "101c4a583c3acdd2dfgn54990fgmkl5i90ghml569ig06ca2fb183cf995.pages.dev",
      "101c4a5fdjfjkf8fg90fksd9dfslsd0fk83c3acdd2a06ca2fb183cf995.pages.dev",
      "109.176.30.212.sslip.io",
      "126-com.live",
      "126mail-cn.com",
      "163inc.org",
      "168-gov.info",
      "16bz5.pmreco.xyz",
      "17067699af72f31706fgjkf5kg9j4990gk950.netlify.app",
      "172.86.92.150.sslip.io",
      "1846m.pmreco.xyz",
      "1c1157fa.caa.update.customs-lk.org",
      "1d06bfb2.check.update.fia-gov.org",
      "1d06bfb2.local.update.fia-gov.org",
      "1d06bfb2.scan.update.fia-gov.org",
      "203-124351878443.hopto.org",
      "234rewr44dfs34sdf43454353fd4ffg345rr4.netlify.app",
      "24170-40494.bacloud.info",
      "2672ewr5403894534fgdgfd5907e44fdfgdfg67088gdfgfd90e2cbd8b6.pages.dev",
      "2aeb306b-4c5f-4cc6-a7a2-6fcd96612b9d.us-east-1.cloud.genez.io",
      "2let.org",
      "2r.nrtcpk-net.com",
      "38273409.mail-defence-lk-loging-horde.pages.dev",
      "3nxyc.pmreco.xyz",
      "423743f1-53d2-41bf-9dba-e1e0b7c8f460.pmreco.xyz",
      "435fdgfd-fgh675gh56jh-65jhg65ghjytu65.netlify.app",
      "4yj7f.pmreco.xyz",
      "5673696e-bcf9-4a34-848d-2e6875b0561e.us-east-1.cloud.genez.io",
      "5vs9r.pmreco.xyz",
      "63inc.com",
      "64115cb6.check.update.fia-gov.org",
      "6441056b613c32a9.dwnlld.info",
      "6dbb77fd-6d9d-415e-b414-3d1051cd33f4.dytt888.net",
      "753fa5b2.check.update.fia-gov.org",
      "7b1271c3-0158-4f94-b54e-d51a4be1cfc4.us-east-1.cloud.genez.io",
      "7ef1996f-c463-4540-936a-70d0fd477f98.live-co.org",
      "81-cn.ddns.net",
      "81-cn.info",
      "85476ee3-a4b9-4815-bd1d-68653205e378.us-east-1.cloud.genez.io",
      "8ad94e36.cdn-caa-sco.pages.dev",
      "96c54.pmreco.xyz",
      "982m31.pmreco.xyz",
      "9af72fg4jg75hg8jg94kg94k9fk390gk4170674tr69bf1f766cdec1d11.pages.dev",
      "9af72fg4jg75hg8jg9dfghhfgdh5666k41706769d32bf1f766cdec1d1.pages.dev",
      "9af72fg4jg75hg8jg9dfghhfgdh5666k41706769d32bf1f766cdec1d11.pages.dev",
      "9t.fetchdrives.info",
      "a.bc.1d06bfb2.check.update.fia-gov.org",
      "a.bc.1d06bfb2.local.update.fia-gov.org",
      "a.bc.1d06bfb2.scan.update.fia-gov.org",
      "a.bc.64115cb6.check.update.fia-gov.org",
      "a.fetchdrive.info",
      "a5936441-e402-41e3-b02b-75af112074b5.org-co.net",
      "a6dff163-e0b9-49c9-87e4-357f761f3c3b.us-east-1.cloud.genez.io",
      "aa173.bank-ok.com",
      "aapletv.org",
      "abc.bol-north.com",
      "academy.lesporc.live",
      "acc.pk-govt.net",
      "acenent.site",
      "acfinang.shop",
      "acrobat.paknavy-pk.org",
      "active.roteh.site",
      "admin.grabfiles.org",
      "admin.onesom.biz",
      "adobe.pdf-downlod.com",
      "adobe.updatepdf.workers.dev",
      "adobeglobal.com",
      "advancedhealth.medicallab.site",
      "advisary.army-govbd.info",
      "advisories-sgcustoms.d0cumentview.info",
      "advisory-cabinetgpk.servehttp.com",
      "advisory.army-govbd.info",
      "advisory.info-bdgov.com",
      "advisory.ndma-govpk.co",
      "aeltron.xyz",
      "aeryple.xyz",
      "afcat.xyz",
      "afd-bdmil.cdn-pak.net",
      "afd.edu-cx.org",
      "afdinfo786.bdgov.info",
      "afdtrg.nrdi-gov.com",
      "afg-refugee.net",
      "afghannewsnetwork.com",
      "afmat.tech",
      "afohs.mod-pak.co",
      "afrepublic.xyz",
      "agarg.tech",
      "agency.lesporc.live",
      "agenda-talking-point-for-army.up.railway.app",
      "agent.onesom.biz",
      "ahsaanullaahkhan.workers.dev",
      "ai.mofagov.online",
      "ailyun.live",
      "aitkenspencelogistics.mofa.live",
      "akamai.servehttp.com",
      "aku-edu-pk.org",
      "alfalahtransct-bank.servehttp.com",
      "alhabib.live",
      "alibababackupcloud.com",
      "aliit.org",
      "alit.info",
      "alit.live",
      "aliyum.email",
      "aliyum.org",
      "aliyum.tech",
      "aliyumm.pro",
      "aliyumm.tech",
      "aljazeerak.online",
      "all-files.mail-sessionexpired.com",
      "allpakarmlicences.com",
      "allpakarmslicence.com",
      "allpakarmslisense.site",
      "almighty-allah.com",
      "almightyallah.live",
      "alphapolice.org",
      "alsalaf.info",
      "amarsonarbangla123.dgps-govpk.co",
      "amazingbonis.com",
      "amazonas-gov.co",
      "ambpoint.vip",
      "amended.army-govbd.info",
      "amigos.govt-pk.com",
      "amsss.in",
      "amuck.scoler.tech",
      "analytic.mfa-qov.com",
      "andc.govaf.org",
      "anefank.mom",
      "ankara-mofa-gov-bd.fia-g0v.net",
      "antarticarevolution.sbs",
      "aop.gov-af.org",
      "ap-ms.net",
      "ap1-acl.net",
      "ap12.ms-update-server.net",
      "apgml.pk-govt.net",
      "api.ahsaanullaahkhan.workers.dev",
      "api.almighty-allah.com",
      "api.argus.trondheim.bama.zoopit.no",
      "api.crypto-wise.co",
      "api.desco-gov-bd.workers.dev",
      "api.grabfiles.org",
      "api.nbppakistan.com",
      "api.nr3c-govpk.com",
      "api.onesom.biz",
      "api.pkgov.xyz",
      "api.supremeallah.world",
      "api.vpn-secure.co",
      "api.watch-earn.live",
      "apl-com.icu",
      "apl-org.online",
      "apostille-mofa-gov-pk-verify-attestation.cerapostille.com",
      "apostille-mofa-gov-pk-verify-attestation.encodertechs.com",
      "apostillemofag0v-pk.storeaone.com",
      "app-sec01.online",
      "app.dytt888.net",
      "app.grabfiles.org",
      "app.modcloudspace.com",
      "app.onesom.biz",
      "appclub.live",
      "appcrew.info",
      "appostile-mofa-pk.storeaone.com",
      "appostille-mofa-gov-pk-attestation.storeaone.com",
      "appostille-mofa-gov.storeaone.com",
      "apps-sco-gov-pk.workers.dev",
      "apps.fia-gov.net",
      "appsrv.live",
      "appsstore.in",
      "appt-sdf49fk0apt9dk9sdls9fl-dkgf9dld9.netlify.app",
      "arceno.xyz",
      "arcteno.live",
      "arf26th-hducim-kdu-ac-lk-index-html.pages.dev",
      "arg.gov-af.org",
      "armlicensepk.site",
      "armslicense.interiorgovt.com",
      "armslicensekpk.gov-pk.com",
      "army-bd.com",
      "army-bdgov.com",
      "army-govbd.info",
      "army-lk.com",
      "army-lk.info",
      "army-lk.org",
      "army.mil.bd.mofa-govlk.com",
      "army.mil.bd.pk-govt.com",
      "aromne.info",
      "article-viewer.com",
      "as.pakmarines.com",
      "asean-ajp.myftp.org",
      "asfinnagg.shop",
      "asfrimag.mom",
      "asfrimamg.mom",
      "asianetnews.xyz",
      "askari.bitlyy.me",
      "askaribank.bitlyy.me",
      "assbutt.xyz",
      "assets.fetchdrive.info",
      "assumptiontable.click",
      "asw-edu.net",
      "asw-sns.link",
      "asyn.info",
      "ateows.info",
      "attachments.gov-pk.info",
      "au-edu.km01s.net",
      "aurora.dawn-904.workers.dev",
      "ausib-edu.org",
      "ausibedu.org",
      "auth.desktopserver.top",
      "autoconfig.bdgov.info",
      "autoconfig.pk-mail.org",
      "autodiscover-paa-gov-pk-auth-logon-aspx.pages.dev",
      "autodiscover.mofagov-pk.online",
      "autodiscover.pk-mail.org",
      "autodiscover.seoshz.live",
      "avail.freay.tech",
      "awards-piacaero.servehalflife.com",
      "awards-piacaero.servehttp.com",
      "awards-piaccompk.serveftp.com",
      "awrah.live",
      "aws-check.net",
      "aws-pk.net",
      "awww.asianetnews.xyz",
      "awww.interior-pk.org",
      "awww.kpt-pk.net",
      "awww.paf-gov.org",
      "awww.paknavy.live",
      "awww.srvapp.co",
      "awww.tsinghua.institute",
      "axigen-web-expired-paknavy-files.netlify.app",
      "axis.heplor.biz",
      "az-updates.store",
      "b1x.mov",
      "b5hyr.pmreco.xyz",
      "baatube.com",
      "backup.download-services.online",
      "baerow.live",
      "baf.mil.bd.hilsa.online",
      "bahariafoundation.live",
      "bahariafoundation.org",
      "bahria-edu.workers.dev",
      "bahriafoundation.live",
      "balcon.live",
      "balochistanpolice.gov.pk-mail.org",
      "bangla.b-cdn.net",
      "bangladesh-islamic-baank.workers.dev",
      "bangladeshbaank-gov-bd.workers.dev",
      "bangladeshmarineacademylibrary.ppinewsagency.live",
      "bangladeshnavy.dgps-govpk.co",
      "bank-ok.com",
      "bankofceylon.sytes.net",
      "bard.gov.bd.pk-govt.net",
      "basic.gruh.site",
      "basis.agarg.tech",
      "bb.kdf-mail.com",
      "bbcnew.cn",
      "bbcworld-news.net",
      "bc.1d06bfb2.local.update.fia-gov.org",
      "bc.1d06bfb2.scan.update.fia-gov.org",
      "bc.753fa5b2.check.update.fia-gov.org",
      "bcc.gov.bd.pk-mail.org",
      "bcc.gov.bd.ramdaanvibe.info",
      "bcc.gov.bd.upworkoffice.online",
      "bccgov-bd-production.up.railway.app",
      "bd-gov.cdn-dl.cn",
      "bd-govt.com",
      "bd-govt.info",
      "bd.filenest.live",
      "bd.gov-co.org",
      "bd.govt-net.com",
      "bd.govt-org.net",
      "bd.govt-pk.com",
      "bd.hilsa.online",
      "bd.mail-pk.org",
      "bd.mofa-govbd.com",
      "bd.mofa-govtpk.net",
      "bd.officemuwork.online",
      "bd.pk-mail.org",
      "bd.ramdaanvibe.info",
      "bd.upworkoffice.online",
      "bdgov-mopa.cdn-dl.cn",
      "bdgov.info",
      "bdgovt.com",
      "bdmil.alit.live",
      "bdnavy.download-msoffice.com",
      "bdnews.info",
      "beaxor.xyz",
      "behr.ppinewsagency.live",
      "bentec.tech",
      "beoe.gov.pk-govt.com",
      "beoe.govtpk.co",
      "berec.live",
      "bgb.gov.bd.mofa-govtpk.net",
      "bgevin.live",
      "bgmea-com-bd.loadpath.net",
      "bgmea.com.bd.mail-pk.org",
      "biaa-org-bd.cdn-dl.cn",
      "biaa-org.cdn-dl.cn",
      "bismi.pro",
      "bitlyy.me",
      "bizor.live",
      "blabla.apl-com.icu",
      "blesico.site",
      "blesis.live",
      "bless.agarg.tech",
      "blog.fbmastery.com",
      "blog.grabfiles.org",
      "blty.at",
      "blue-term-c168.gov-pkgov.workers.dev",
      "blue.win-service-update.top",
      "bluedoor.click",
      "blueoceancode.com",
      "bluket.live",
      "bmac-g0v-cn-aman-exercise-1etter.netlify.app",
      "bmac-org-cn-exercise-observer-invites.netlify.app",
      "bmac-pla-exercise-aman-2024-letter.netlify.app",
      "bmac.iugur.live",
      "bnepon.xyz",
      "boc-cn.81-cn.info",
      "boc.cn.81-cn.info",
      "bodec.site",
      "bok.pkgov.org",
      "boket.tech",
      "bol-north.com",
      "bol-south.com",
      "bol-south.org",
      "bold-bonus-1d3b.malik-jaani786.workers.dev",
      "bookutrips.com",
      "bop.pkgov.org",
      "botcel.info",
      "botim.cc",
      "boundschain.workers.dev",
      "br.mofa-pk.org",
      "brac.tech",
      "brave.agarg.tech",
      "breat.info",
      "brebd-govt-bd.online",
      "brep.cdn-edu.net",
      "browser.apl-org.online",
      "brwse.co",
      "bscic-gov-bd.dwnlld.info",
      "btrc-gov-bd.mail-govt.com",
      "btud.live",
      "buildthenations.info",
      "buzsep.info",
      "c6udy.pmreco.xyz",
      "caa.update.customs-lk.org",
      "caab.gov.bd.pk-govt.net",
      "caapakistan.pk-mail.org",
      "cabinet-division-gov-pk.download-msoffice.com",
      "cabinet-division-pk.fia-gov.com",
      "cabinet-download-server.top",
      "cabinet-gov-bd.donwloaad-file.com",
      "cabinet-gov-bd.dwnlld.info",
      "cabinet-gov-bd.fia-g0v.net",
      "cabinet-gov-bd.nic-svc.net",
      "cabinet-gov-bd.org-liv.net",
      "cabinet-gov-pk.dytt888.net",
      "cabinet-gov-pk.fetchdrive.org",
      "cabinet-gov-pk.ministry-pk.net",
      "cabinet-gov-pk.mora-govpk.co",
      "cabinet-gov-pk.net-co.live",
      "cabinet.gov.bd.mofa-govtpk.net",
      "cabinet.gov.bd.pk-govt.com",
      "cabinet.gov.bd.pk-govt.net",
      "cabinet.gov.bd.pk-mailgov.com",
      "cabinet.gov.mail-pk.org",
      "cabinet.gov.pk-govt.com",
      "cabinet.gov.pk-mail.org",
      "cabinet.pk-govt.net",
      "cabint-division-pk.fia-gov.com",
      "cadetcollege.adobeglobal.com",
      "cag-org-bd.mail-govt.com",
      "caninetdivision.mail-pk.org",
      "cap-mofagovpk.servehttp.com",
      "cap-mofapk.servehttp.com",
      "careitservices.mofa.live",
      "careitservices.paknvay-pk.net",
      "cas.sysu.edu.cn.81-cn.info",
      "cater.sphery.live",
      "cb-govt.com",
      "cbsl-gov-lk.snagdrive.com",
      "cbsl.lk.mail-pk.org",
      "cbsl.lk.mofa-govtpk.net",
      "cbsl.lk.pk-mail.org",
      "cbsl.lk.pk-mailgov.com",
      "cc-cvbs-sco.workers.dev",
      "cc2mm.pmreco.xyz",
      "cdn-aws-s2.net",
      "cdn-aws.net",
      "cdn-caa-sco.pages.dev",
      "cdn-dl.cn",
      "cdn-do.net",
      "cdn-edge.net",
      "cdn-edu.net",
      "cdn-gov.net",
      "cdn-in.net",
      "cdn-list.net",
      "cdn-m1l.net",
      "cdn-noc.net",
      "cdn-pak.net",
      "cdn-pkcert-gov-pk.pages.dev",
      "cdn-ps.net",
      "cdn-re.net",
      "cdn-secure.net",
      "cdn-sop.net",
      "cdn-src.net",
      "cdn.awrah.live",
      "cdn.bgevin.live",
      "cdn.cpec.site",
      "cdn.dolper.top",
      "cdn.dr-doom.xyz",
      "cdn.fritor.xyz",
      "cdn.gearfill.biz",
      "cdn.geoloc.top",
      "cdn.ghaflah.top",
      "cdn.greploc.live",
      "cdn.hread.live",
      "cdn.nelpec.top",
      "cdn.plors.tech",
      "cdn.polvcrit.info",
      "cdn.preag.info",
      "cdn.preat.info",
      "cdn.prol.info",
      "cdn.torsey.xyz",
      "cdn.ubrig.live",
      "cdn.verocal.info",
      "cdsve.bol-north.com",
      "ceh.download-msoffice.com",
      "ceiling.kalpo.xyz",
      "centralized-email-system-np.com",
      "cert.pk-gov.org",
      "cert.repta.live",
      "cespkom.info",
      "cfau.edu.cn.81-cn.info",
      "cga.gov.bd.pk-govt.net",
      "cgate.ruve.live",
      "cgd64-gkgiot9lg0-ghbasbousa-01156egog.netlify.app",
      "cgwic-sessionexpired-challenge.pages.dev",
      "cgwic-sessionexpired-challenges.pages.dev",
      "changeworld.hopto.org",
      "check.update.fia-gov.org",
      "china-immigration-department-letter.netlify.app",
      "china.bbcnew.cn",
      "chinese-pla-a1rforce-0fficil-drive.netlify.app",
      "chrom3.net",
      "chughtai.medicallab.site",
      "ciamat.info",
      "circular-financegov.servehalflife.com",
      "circular.nrtcpk-net.com",
      "circulars.ntcpk.co",
      "cirt-gov-bd.org-liv.net",
      "cirt-gov-mm.fia-gov.net",
      "civil.leyra.tech",
      "civix.live",
      "civix.site",
      "claimmofnewbudgetsgp-ars.zeabur.app",
      "claimmofnewbudgetsgp-ck.zeabur.app",
      "claimmofnewbudgetsgp-fm.zeabur.app",
      "claimmofnewbudgetsgp-jz.zeabur.app",
      "claimmofnewbudgetsgp-pd.zeabur.app",
      "claimmofnewbudgetsgp-rk.zeabur.app",
      "claimmofnewbudgetsgp-vn.zeabur.app",
      "claimmofnewbuedgetsg-ars.zeabur.app",
      "claimmofnewbuedgetsg-ck.zeabur.app",
      "claimmofnewbuedgetsg-fm.zeabur.app",
      "claimmofnewbuedgetsg-jz.zeabur.app",
      "claimmofnewbuedgetsg-pd.zeabur.app",
      "claimmofnewbuedgetsg-rk.zeabur.app",
      "claimmofnewbuedgetsg-vn.zeabur.app",
      "claimmofnewbuedgetsgp-ars.zeabur.app",
      "claimmofnewbuedgetsgp-ck.zeabur.app",
      "claimmofnewbuedgetsgp-fm.zeabur.app",
      "claimmofnewbuedgetsgp-jz.zeabur.app",
      "claimmofnewbuedgetsgp-pd.zeabur.app",
      "claimmofnewbuedgetsgp-rk.zeabur.app",
      "claimmofnewbuedgetsgp-vn.zeabur.app",
      "claimmofnewbuedgetssg-ck.zeabur.app",
      "claimmofnewbuedgetssg-jz.zeabur.app",
      "claimmofnewbuedgetssg-pd.zeabur.app",
      "claimmofnewbuedgetssg-rk.zeabur.app",
      "claimmofnewbuedgetssg-vn.zeabur.app",
      "classifieds.workers.dev",
      "click-here-to-keep-same-password.netlify.app",
      "climb.kalpo.xyz",
      "clopem.info",
      "cloud-apt.net",
      "cloud-ntdc.servehttp.com",
      "cloud-ptclnetpk.servehttp.com",
      "cloud.coremailcloud.com",
      "cloud.dellicon.top",
      "cloud.desktopserver.top",
      "cloud.moe.gov.cn.81-cn.info",
      "cloud.nitc.gavnp.org",
      "cloudforme.top",
      "cloudmails.live",
      "cloudplatfromservice.one",
      "cloudpmo.top",
      "cluster.jotse.info",
      "cmclient-downloader.serveirc.com",
      "cmm.int-secure.org",
      "cms.bahria-edu.workers.dev",
      "cms.grabfiles.org",
      "cn.cvix.live",
      "cnmm.int-secure.org",
      "cnsa-gov.com",
      "cnsa-gov.org",
      "collector.nbppakistan.com",
      "colot.info",
      "com-e-visa.online",
      "com.bd.mail-pk.org",
      "com.gov-co.org",
      "com.govt-net.com",
      "com.mail-pk.org",
      "com.news-bd.com",
      "com.pakchinavest.info",
      "com.pk-mail.org",
      "combined-training-and-administrative.netlify.app",
      "command.ms-office.app",
      "commerce-gov-in.iima.remotexs.in",
      "commerce-gov-pk.directt888.com",
      "commerce-gov-pk.fetchdrive.org",
      "commerce.gov.pk.mail-pk.org",
      "commerce.gov.pk.pk-mailgov.com",
      "commerce.govpk.me",
      "communications.gov.mail-pk.org",
      "complaints-ntcgovpk.viewdns.net",
      "compnetworkservices.ddns.net",
      "compress.bahariafoundation.live",
      "comptes.tech",
      "comsates.org",
      "comsats-mail.pk",
      "comsats-net.com",
      "comsats.xyz",
      "condet.org",
      "confidential.ndma-govpk.co",
      "confidential.zapto.org",
      "confluence.assbutt.xyz",
      "conft.live",
      "connectiiest.com",
      "cons-mofa-gov-pk-hqr-1777839.online",
      "cons-mofa-gov-pk.rf.gd",
      "cons-mofa-govt.pk",
      "cons-mofagovpk.servehttp.com",
      "cons.gov-pk.pk",
      "cons.mofa-gov-pk.site",
      "cons.mofa.gov.pk-hq.qrrl.net",
      "cons.mofa.gov.pk.2let.org",
      "cons.mofa.gov.pk.cons1.mfa-ir.cn",
      "cons.mofagovpk.co",
      "consmofa-gov-pk.com",
      "consmofa.gov-pk.pk",
      "consmofagov.com",
      "consmofagovhqipk.com",
      "contact.gov-pak.org",
      "contract-agreement-with-staff.zeabur.app",
      "control.pk-mailgov.com",
      "coordination-cas-visit.netlify.app",
      "coremailcloud.com",
      "corporate-social-activity-updates.ciecc.com.cn.81-cn.info",
      "cosmic.cvix.live",
      "count.plokin.top",
      "countpro.info",
      "covid.bbcnew.cn",
      "covid.pakgov.net",
      "covid.pkrepublic.org",
      "covid19.mohp-gov.org",
      "cpanel-nha-gov-pk.pakistan-gov-pk.workers.dev",
      "cpanel.govpk.info",
      "cpanel.govpk.live",
      "cpanel.mofagov-pk.online",
      "cpanel.news-bd.com",
      "cpanel.pk-mail.org",
      "cpcalendars.bdgov.info",
      "cpcalendars.govpk.live",
      "cpcalendars.mofagov-pk.online",
      "cpcalendars.pk-mail.org",
      "cpcontacts.govpk.live",
      "cpcontacts.mofagov-pk.online",
      "cpcontacts.pk-mail.org",
      "cpec.site",
      "cpj.org.pk-mailgov.com",
      "cr20g.org",
      "crclab-bahria.org",
      "crec-bangladesh.ddns.net",
      "crec-bd.site",
      "crisismanagementunit.comsates.org",
      "critical-patch-update.com",
      "crontec.site",
      "crypto-wise.co",
      "crypton0019.workers.dev",
      "csd-govpk.servehttp.com",
      "csd-pk.co",
      "csd-pk.online",
      "csd.bitlyy.me",
      "csd.govpk-mail.net",
      "csd.paf-govt.net",
      "csd.pakgov.net",
      "csd.pkgov.org",
      "csdstore.app",
      "csla.blesis.live",
      "cssc-net.co",
      "cssc.info",
      "cssc.live",
      "cstc-spares-vip-163.dowmload.net",
      "ctd.govt-pk.com",
      "ctd2.police.fia-gov.com",
      "customs-gov-lk.net-co.info",
      "customs-lk.org",
      "customs.document-viewer.info",
      "cvix.cc",
      "cvix.live",
      "cxvdfg.aliit.org",
      "cyber.pmd-offc.info",
      "cybernet.pkgov.org",
      "cybersecurity.nepalarmy-milnp.info",
      "cylit.info",
      "d01fa.net",
      "d0cumentview.info",
      "d0ownload.com",
      "d0wnlaod.com",
      "d0wnlaod.org",
      "d101c4a583c3acdd2a06ca2fb183cf99d6fm7fjdf8djf9lfjf4mfi89.pages.dev",
      "d2klia4zfdp2mg.cloudfront.net",
      "d515dc5c-16cd-4443-8f83-0ab5cb549050.us-east-1.cloud.genez.io",
      "dacastexpo.com",
      "dad.fia-gov.com",
      "dafillio.com",
      "dafpak.org",
      "daraz-pk.com",
      "dasds.pak-gov.com",
      "dasdsadsa.pak-gov.com",
      "dashboard.onesom.biz",
      "data-protect.tech",
      "data-sob-gov-bd.live-co.org",
      "dawn.apl-org.online",
      "dawn.pakgov.org",
      "dawn.pkgov.org",
      "dawnnews.workers.dev",
      "dawnpk.org",
      "dbarny-fdtref.up.railway.app",
      "dbms.crclab-bahria.org",
      "dc-4c46fcf37468.news-bd.com",
      "deb-cn.net",
      "debcon.live",
      "decoty.tech",
      "defence-bd.net",
      "defence-lk.military-bd.org",
      "defence-np.net",
      "defence.lk.gov-co.org",
      "defence.lk.gov-org.net",
      "defencearmy.pro",
      "defencelk.cvix.live",
      "defenec.net",
      "defense-housing-authority.vagued.live",
      "defpak.net",
      "defpak.org",
      "defrgthyj.ksewpk.com",
      "dekl-dgprocur2028200-ljakefli.leapcell.dev",
      "del-ivery.net",
      "dellicon.top",
      "demcon.live",
      "demo.fetchdrive.info",
      "demo.grabfiles.org",
      "demsflygerxamy.com",
      "density.meplor.xyz",
      "depo-gov-pk.loadpath.net",
      "depo-govpk.com",
      "depo.govpk.me",
      "deputy.meplor.xyz",
      "desco-gov-bd.workers.dev",
      "desk.fia-gov.com",
      "desktopserver.top",
      "detru.info",
      "dev.fetchdrive.info",
      "dev.govpk.info",
      "dev.grabfiles.org",
      "dev.onesom.biz",
      "df.donwloaad-file.com",
      "dfd-punjab.govt-pk.com",
      "dfd.punjab.govt-pk.com",
      "dfgrthy.moma-pk.org",
      "dfkl-mdalifhossen595864-bqa6juqe.leapcell.dev",
      "dgdfvdf.bol-north.com",
      "dgdp-account-file-data-doc-procuremen.netlify.app",
      "dgdp-drive-file-sharing-pdf-files-doc.netlify.app",
      "dgdp-gov-pk-technical-specification.pages.dev",
      "dgdp-gov-pk-technical-specification1.pages.dev",
      "dgdp-product-details-2025-turkey.netlify.app",
      "dgdp.cloud.secured.file.updatemind52.com",
      "dger.bol-north.com",
      "dgfi.gov.bd",
      "dgmi-share-folder-nepalarmy-mil-np-coas-sambodhan-pdf.netlify.app",
      "dgmp-paknavy.mod-pk.com",
      "dgms.paknavy-gov.com",
      "dgpr.paknvay-pk.net",
      "dgps-govpk.co",
      "dgps-govpk.com",
      "dgps-govpk.org",
      "dgps-govtpk.com",
      "dgtk.depo-govpk.com",
      "dha.pakgov.org",
      "diagov.ddns.net",
      "digitalworldonline.net",
      "dinfed.co",
      "dirbspta.govpk.live",
      "dirco.gov.za.mail-pk.org",
      "dirctt88.co",
      "dirctt88.info",
      "dirctt88.net",
      "dirctt88.org",
      "dirctt888.com",
      "dirctt888.info",
      "dirctt888.net",
      "direct88.co",
      "direct88.org",
      "direct880.net",
      "direct888.net",
      "direct888.org",
      "directt88.com",
      "directt88.org",
      "directt888.com",
      "dirsports.milqq.info",
      "discount.kpt-gov.org",
      "discount.srvapp.co",
      "discounts-ptclnetpk.servehttp.com",
      "dl.vlc-services.cfd",
      "dlimpunjabgov.com",
      "dlimsindhgov.com",
      "dlimsitp-gov.com",
      "dlimskpk-gov.com.pk",
      "dlimspunjab.gov-pk.com",
      "dlimspunjabgovpk.com",
      "dlimssindh.gov-pk.com",
      "dlimssindh.gov-pk.site",
      "dma.treasury.gov.lk.pk-mail.org",
      "dmerpccc.gov.pk.gmail.com.pk-mailgov.com",
      "dns-mofgovbt.ddns.net",
      "dns.andc.govaf.org",
      "dns.govnp.org",
      "dns.nepal.gavnp.org",
      "dns1.pk-gov.org",
      "dnsvay8faydj3f79dje9djr02j101c4a583c3acdd2a06ca2fb183cf995.pages.dev",
      "dnsvay8faydj3f79dje9djr02j101c4atg3c3acdd2a06ca2fb183cf995.pages.dev",
      "dntnavymil.mofw.pro",
      "doc-downlod.com",
      "doc-ye9wbezc.b4a.run",
      "docs.apl-com.icu",
      "docs.files-windows.top",
      "docs.mofa-services-server.top",
      "docum.store",
      "document-viewer.info",
      "document-viewer.live",
      "documents-server-pk.top",
      "documentviewer.info",
      "docuserve.ltd",
      "docusserve.cc",
      "docusserve.ltd",
      "docx2a2e3e78e76bcc759905da3f1532a4b8c2word.download-msoffice.com",
      "dof-govmm.sytes.net",
      "doken.xyz",
      "dolper.top",
      "donwloaad-file.com",
      "donwload-file.com",
      "donwloaded.com",
      "donwloaded.net",
      "dopm.gov.np.totheeverest.com",
      "dowmload.co",
      "dowmload.info",
      "dowmload.net",
      "dowmload.org",
      "dowmloade.org",
      "downl0ad.org",
      "downld.net",
      "downld.org",
      "download-doc.com",
      "download-doc.net",
      "download-file.net",
      "download-files-0pen-err0r-l0gin.netlify.app",
      "download-msoffice.com",
      "download-secure-app-from-icloud.malik-jaani786.workers.dev",
      "download-services.online",
      "download-store.tech",
      "downloadabledocx.com",
      "downloadfileddssdrrg.zeabur.app",
      "downloadfiles-mail.pages.dev",
      "downloads.masarh.live",
      "downnload.net",
      "downnload.org",
      "dp.islamic-finder.org",
      "dr-doom.xyz",
      "draft-paper-advertisementfdg.netlify.app",
      "drive-acct-offl-pdf.com",
      "drive-afd-gov-bd-account-file.netlify.app",
      "drive-armed-force-day-cas-msg.netlify.app",
      "drive-army-mil-bd-account-data-file.netlify.app",
      "drive-baf-mil-bd-share-file.netlify.app",
      "drive-bcc-registraion-cloud-storage.netlify.app",
      "drive-dgdp-gov-bd-confidential-files.netlify.app",
      "drive-dgdp-gov-bd-files.netlify.app",
      "drive-mha-gov-bd-files-acctn-doct.netlify.app",
      "drive-nepal-gov-np-files.netlify.app",
      "drive-nepal-gov.com",
      "drive-newmail-arm-mil-bd-account-data.netlify.app",
      "drive-rokectsaans-com-tr-account-file.netlify.app",
      "drive-roketsans-com-tr-account-files.netlify.app",
      "drive.desktopserver.top",
      "driveattachment-mofa.com",
      "drsasa.hopto.org",
      "drtgfhj.mofss.co",
      "dsadsa.pakmarines.com",
      "dsasa.cr20g.org",
      "dsf.army-lk.com",
      "dsfbgnh.office-drive.live",
      "dsfgb.pmdu-gov.org",
      "dsfvgbh.mofa.live",
      "dsmes.xyz",
      "dsocem.site",
      "dtecyber.nepalarmy-milnp.info",
      "dteofmediapsyops.army-lk.com",
      "ducane.info",
      "dumping-open-burning-of-hazardous-waste.zeabur.app",
      "dvdbhjk.pakgov.net",
      "dvdf.bol-north.com",
      "dwnlld.com",
      "dwnlld.info",
      "dwnlld.infomfa-gov-lk.dwnlld.info",
      "dxfgbdfh.paknavy.live",
      "dynamic.nactagovpk.org",
      "dynat.tech",
      "dytt88.co",
      "dytt88.org",
      "dytt888.net",
      "dytt888.org",
      "e-mopf.gov.mm.gov-co.org",
      "e-nothi.ddns.net",
      "e-servicesptclnetpk.servehttp.com",
      "e-supportntc.servehttp.com",
      "e-tohfa.net",
      "e1ix.mov",
      "e1x.tech",
      "ead.gov.pk-govt.com",
      "ead.govpk.me",
      "eairr.mom",
      "ebill-ptclnetpk.servehttp.com",
      "ecility.xyz",
      "ecloudsmails.com",
      "ecp.govpk.live",
      "ecp.govt-pk.com",
      "ecs.pk-govt.net",
      "edgeupdate.redirectme.net",
      "edms-vpn.ddns.net",
      "edu-cx.org",
      "edu-mil.cn",
      "ee-visa.com",
      "eede6f46.cdn-caa-sco.pages.dev",
      "efes-mindef-gov-pk.dowmload.org",
      "efes-mindef-qov-pk.dowmload.org",
      "efrgfh.pak-ntc.org",
      "elaopsu.live",
      "elccorp-net.ntc-telecomcorporation.workers.dev",
      "elchxdnj.pmdu-gov.org",
      "elestech.com.pk-mail.org",
      "elopter.top",
      "emaiil.co",
      "email-gov-in.digital",
      "email-nepalarmy-mil-np-owa.netlify.app",
      "email-sco-gov-pk.zeabur.app",
      "email.bcc.gov.bd.ramdaanvibe.info",
      "email.mofa.gov.pk.docum.store",
      "email.moitt.gov.pk.hilsa.online",
      "email.moitt.gov.pk.viewdoc.online",
      "email.navy.gov.bd.docum.store",
      "email.nespak.pkgov.org",
      "email.nitb.pkgov.org",
      "email.nlc.pkgov.org",
      "email.ntc.gov.pk.viewdoc.online",
      "email.nvy.milbd.onlinestatus.live",
      "email.paf.gov.pk.viewdoc.online",
      "email.pk-govt.net",
      "email.pof.gov.pk.viewdoc.online",
      "email.sco.gov.pk.viewdoc.online",
      "emails.mofa.gov.pk.docum.store",
      "emails.moitt.gov.pk.hilsa.online",
      "embajadadenepal.es.govt-pk.com",
      "embassy-of-italy-visit-to-cxb.netlify.app",
      "employ.fdrek.live",
      "emv1.army-govbd.info",
      "emv1.crypto-wise.co",
      "emv1.mofa-gov.org",
      "emv1.mofss.co",
      "emv1.ntc-net.co",
      "emv1.pak-ntc.org",
      "emv1.pkgov-mail.com",
      "encetion.live",
      "enclose.info",
      "encrypted-files-paknavy-0pen.netlify.app",
      "endofmission.govpk.info",
      "endure.sphery.live",
      "eneralbqark.shop",
      "energy.fdrek.live",
      "energy.pkgov.org",
      "ep-gov-pk.christmas",
      "ep-gov-pk.icu",
      "ep-mocha.vercel.app",
      "epaper.dawn-323.workers.dev",
      "epyi-zimbat-five.vercel.app",
      "erd.gov.lk.mofa-govbd.com",
      "erd.gov.lk.pk-mail.org",
      "ereribe.tech",
      "erty.nrtcpk-net.com",
      "eservice-ptclnetpk.servehttp.com",
      "estabiishment.gov.ministry-gov.org",
      "estabiishment.gov.pk-mailgov.com",
      "establishment.gov.pk-govt.net",
      "establishment.mails-pk.com",
      "estate.ovil.tech",
      "estsaln.site",
      "esxipubad-gov-lk.org-co.net",
      "eterplicity.live",
      "ethanhunthero125.workers.dev",
      "eurekawatersolution.com",
      "evisa-nadra-govpak.com",
      "ex1.mov",
      "exmail-qq-drive.com",
      "exosel.info",
      "expo.com.cn.mail-files-open-preview.com",
      "expo.infinityfreeapp.com",
      "expo.test-links.com",
      "expolanka.serveftp.com",
      "f.edu-cx.org",
      "fa-gov-lk.dwnlld.info",
      "fab-gov-pk-account.pages.dev",
      "fancy-voice-b182.goldibrowhoami.workers.dev",
      "fauji.pkgov.org",
      "faujifoundation.bitlyy.me",
      "fb-dn.net",
      "fbmastery.com",
      "fbr-g0v.pk",
      "fbr-gov-pk.donwloaad-file.com",
      "fbr-gov.net",
      "fbr-taxupdates.serveblog.net",
      "fbr.gov-pk.com",
      "fbr.gov.pk-mailgov.com",
      "fbr.mod-pak.co",
      "fbr.net-pk.org",
      "fbr.pak-web.com",
      "fbrgov-pk.ddns.net",
      "fbrgov.com",
      "fbrgov.ddns.net",
      "fcgzbgcvzsgrjbnndsfdsdfffcffgzsfwferfvd4hfgtyghjtghjrhgts.pages.dev",
      "fdb74.pmreco.xyz",
      "fdgnyt.tsinghua.institute",
      "fdn-en.net",
      "fdn-mac.net",
      "fdn-trace.net",
      "fdrek.live",
      "fdscv.tin-url.com",
      "febgif.pk-mail.org",
      "feedback.army-lk.info",
      "feedback.info-bdgov.com",
      "feew6.pmreco.xyz",
      "fenctor.top",
      "fetchdrive.info",
      "fetchdrive.org",
      "fetchdrives.info",
      "ffc.gov.pk-mail.org",
      "fia-g0v.net",
      "fia-gob.net",
      "fia-gov.com",
      "fia-gov.net",
      "fia-gov.org",
      "fia-govt-net.com.govt-net.com",
      "fia.gov.pk-govt.com",
      "fia.gov.pk.pk-govt.com",
      "fia.govpk.me",
      "fia.govt-net.com",
      "file-download.co",
      "file-downlod.org",
      "file-dwnld.net",
      "file-dwnld.org",
      "file-preview-session-expired.pages.dev",
      "file-server.co",
      "file.services-download.top",
      "filebox-1-y7125191.deta.app",
      "filedownload.work",
      "filenest.live",
      "filenesthub.org",
      "files-ci.com",
      "files-windows.top",
      "files.pdf-download.live",
      "fileserve.work",
      "fileserver.81-cn.info",
      "filesrvr.net",
      "finance-gov-pk.rf.gd",
      "finance-govnp.servehalflife.com",
      "finance-govpk.serveblog.net",
      "finance-govpk.serveftp.com",
      "finance-govpk.servehttp.com",
      "finance.gov-net.co",
      "finance.gov.bd.mail-pk.org",
      "finance.gov.mv.gov-co.org",
      "finance.gov.pk-govt.com",
      "finance.gov.pk-govt.net",
      "finance.gov.pk-mail.org",
      "finance.gov.pk.mail-pk.org",
      "finance.gov.pk.ntc-gov.com",
      "finance.govpk-mail.net",
      "finance.paf-gov.org",
      "finance.pakgov.net",
      "financegovpk.servehttp.com",
      "financeptcl-govpk.servehttp.com",
      "financial.pakgov.net",
      "fincruitconsulting.in",
      "fir.islamabadpolice.gov-pk.site",
      "firsatburdaavm.com",
      "fisheries.gov.bd.pk-govt.net",
      "flix.pakgov.net",
      "flomen.xyz",
      "flysmart-piac.servehttp.com",
      "flysmart-piaccompk.servehttp.com",
      "fmprc-gov-cn.dowmload.co",
      "fmprc.cdn-pak.net",
      "focus.mectel.tech",
      "focus.semain.tech",
      "fonts.apl-org.online",
      "foodies.alit.info",
      "foooders.fia-gov.com",
      "for.gov-co.org",
      "forecast.comsats-net.com",
      "foreign.gov.mv.gov-co.org",
      "found.neger.site",
      "found.troks.site",
      "fpsc.gov.pk-mailgov.com",
      "fqn-cloud.net",
      "fqn-mil.net",
      "freay.tech",
      "freedom.olerpic.info",
      "freshg-dgprocur2028200-ou4zqmub.leapcell.dev",
      "fritor.xyz",
      "front.bentec.tech",
      "frzpwdev.grabfiles.org",
      "fsfdsf.edu-cx.org",
      "fssp.tech",
      "ftp.desco-gov-bd.workers.dev",
      "ftp.mofa-govbd.com",
      "ftp.pk-mail.org",
      "ftp.true-islam.org",
      "fujit.info",
      "fwd-transaction-slip-52923640.gov1-lk.com",
      "fx1.live",
      "fyujv.bol-north.com",
      "g0v-pk.net",
      "g0vt.pk",
      "g20-org-za.loadpath.net",
      "gateway.ceair.com.81-cn.info",
      "gavaf.org",
      "gavnp.org",
      "gbpay.gov.pk",
      "gbpay.pmrugb.gov.pk",
      "gclouddrives.com",
      "gearfill.biz",
      "gebre.tech",
      "generic.update.fia-gov.org",
      "geneva-mofa-gov-bd.direct880.net",
      "geninstr.army-govbd.info",
      "geo.org.pk",
      "geoloc.top",
      "geopk.org",
      "georgion.info",
      "getnew.file.update.up2dts.online",
      "ghaflah.top",
      "ghckjxvo.fia-gov.com",
      "ghj.pmdu-gov.org",
      "girlfriendparty42.workers.dev",
      "github.nbppakistan.com",
      "gitlab.enclose.info",
      "gitlab.seoshz.live",
      "gleaming-praline-dcd579.netlify.app",
      "globaltimes-cn.org",
      "glorec.tech",
      "gmail-1-production-3004.up.railway.app",
      "gmail.com.mail-pk.org",
      "gmail.com.mofa-govlk.com",
      "gmail.com.pk-mail.org",
      "gmail.com.pk-mailgov.com",
      "gmails-downloadnew-production.up.railway.app",
      "gmals-downloadpdfs-gdrive.up.railway.app",
      "gmapp.info",
      "go.edu-cx.org",
      "go709p.dytt888.net",
      "goc-visit-program-details-pdf.netlify.app",
      "goinfinity.tech",
      "goldibrowhoami.workers.dev",
      "google.com.d-dns.co",
      "google.gov-pok.net",
      "google.play-store.co",
      "gooogle.files-cyber-net-pk.workers.dev",
      "gooogle.live",
      "goov.pk",
      "goslin.info",
      "gov-af.net",
      "gov-af.org",
      "gov-cn.cdn-dl.cn",
      "gov-cn.co",
      "gov-cn.net",
      "gov-cnn.net",
      "gov-co.org",
      "gov-crt.net",
      "gov-govpk.info",
      "gov-mail.net",
      "gov-mil.cn",
      "gov-nadra.net",
      "gov-net.co",
      "gov-netpk.net",
      "gov-np.org",
      "gov-office.org",
      "gov-org.com",
      "gov-org.net",
      "gov-pak.com",
      "gov-pak.org",
      "gov-pbs.net",
      "gov-pk.cdn-dl.cn",
      "gov-pk.com",
      "gov-pk.info",
      "gov-pk.net",
      "gov-pk.online",
      "gov-pk.org",
      "gov-pk.pk",
      "gov-pk.site",
      "gov-pk.workers.dev",
      "gov-pkgov.workers.dev",
      "gov-pknet.org",
      "gov-pmo.net",
      "gov-pok.net",
      "gov.bd.account.file.updatemind52.com",
      "gov.bd.account.login.sessions.webmailarmy.com",
      "gov.bd.gov-co.org",
      "gov.bd.govt-net.com",
      "gov.bd.govt-org.net",
      "gov.bd.mail-pk.org",
      "gov.bd.mofa-govbd.com",
      "gov.bd.mofa-govtpk.net",
      "gov.bd.pk-mail.org",
      "gov.bd.ramdaanvibe.info",
      "gov.bd.upworkoffice.online",
      "gov.lk.gov-org.net",
      "gov.lk.govt-net.com",
      "gov.lk.govt-org.com",
      "gov.lk.govt-org.net",
      "gov.lk.mail-pk.org",
      "gov.lk.mofa-govbd.com",
      "gov.lk.mofa-govlk.org",
      "gov.lk.mofa-govtpk.net",
      "gov.lk.pk-mail.org",
      "gov.mail-pk.org",
      "gov.ministry-gov.org",
      "gov.mm.gov-co.org",
      "gov.mm.gov-org.net",
      "gov.mv.gov-org.net",
      "gov.np.farwestkhabar.com",
      "gov.np.gov-co.org",
      "gov.np.gov-org.net",
      "gov.np.govt-net.com",
      "gov.np.mail-pk.org",
      "gov.np.namlo.com.np",
      "gov.np.officemuwork.online",
      "gov.np.pk-mail.org",
      "gov.np.totheeverest.com",
      "gov.np.unsilk.com",
      "gov.np.webproxy.to",
      "gov.pakmarines",
      "gov.pakmarines.com",
      "gov.pk-cam.online",
      "gov.pk-hhq.cc",
      "gov.pk-hq.cc",
      "gov.pk-hq.qrrl.net",
      "gov.pk-hq.us",
      "gov.pk-hqr-online.co",
      "gov.pk-hqr.co",
      "gov.pk-hqr.online",
      "gov.pk-ht.pk",
      "gov.pk-mail.co",
      "gov.pk-mail.org",
      "gov.pk-mailgov.com",
      "gov.pk.1.modp-pk.org",
      "gov.pk.2let.org",
      "gov.pk.emaiil.co",
      "gov.pk.govt-pk.com",
      "gov.pk.hilsa.online",
      "gov.pk.mail-pk.org",
      "gov.pk.modp-pk.org",
      "gov.pk.officemuwork.online",
      "gov.pk.onev.online",
      "gov.pk.pk-mail.org",
      "gov.pk.viewdoc.online",
      "gov.qrpk.info",
      "gov.za.mail-pk.org",
      "gov1-lk.com",
      "govaf.org",
      "govaruba.duckdns.org",
      "govbd-div.com",
      "gove.pw",
      "goverment-pk-update.top",
      "government-pak.workers.dev",
      "govmm.me",
      "govmm.org",
      "govnp.live",
      "govnp.org",
      "govpk-mail.net",
      "govpk.email",
      "govpk.info",
      "govpk.live",
      "govpk.me",
      "govpk.net",
      "govpk.org",
      "govpk.site",
      "govt-cn.co",
      "govt-cn.org",
      "govt-net.com",
      "govt-org.com",
      "govt-org.net",
      "govt-pk.com",
      "govt-pk.org",
      "govtpak.workers.dev",
      "govtpk.co",
      "govvv.pk",
      "gpk-production.up.railway.app",
      "grabfiles.net",
      "grabfiles.org",
      "graty.tech",
      "greatslols.com",
      "greenpaktourism.pk-mail.org",
      "greenstream.top",
      "greploc.live",
      "gretic.info",
      "groove.olipy.info",
      "grouit.tech",
      "gruve.site",
      "gso2.mail163.info",
      "gtrec.info",
      "guide.graty.tech",
      "gunaso.pk-mailgov.com",
      "guosapp.vip",
      "guotoujgvip.vip",
      "gvo-pk.cc",
      "gwadar-port.zapto.org",
      "gwadarport-gov-pk.gwadarportt.workers.dev",
      "gwadarport.ddns.net",
      "gwadarport.gov.jzbnco.com",
      "gwadarport.gov.packetfilters.org",
      "gwadarport.gov.pk.migkua.com",
      "gwadarport.gov.pk.rankglobe.com",
      "gwadarportt.workers.dev",
      "gygaxf.com",
      "gyre.site",
      "gysdj.mod-gov.org",
      "hajj.pakgov.net",
      "hajjplanner.bitlyy.me",
      "hajjplanner.tin-url.com",
      "hakimiya.live",
      "halcor.site",
      "halterarks.co.uk",
      "handle.proey.tech",
      "happyhours.sbs",
      "hare-ap.live",
      "hascolgov.info",
      "hbl.pakgov.org",
      "hblbank.co",
      "health.gov.lk.gov-co.org",
      "health.gov.mv.gov-co.org",
      "healththebest.com",
      "heartissuehigh.win",
      "heatwave.paknavy.store",
      "hec-gov.com",
      "helpdesk-gov.info",
      "helpdesk-lab.site",
      "helpful-national-poilcy-nepla-gov-np.netlify.app",
      "heplor.biz",
      "herald-b2a.workers.dev",
      "hertic.tech",
      "hesco.hascolgov.info",
      "hetlic.tech",
      "hillview.net.pk.hilsa.online",
      "hilsa.online",
      "hinoms.com",
      "hisidewindersidewinder.pimec-paknavy.updates-installer.store",
      "hit-deop-hasan7169004254-f24834bv.leapcell.dev",
      "hit-pk.org",
      "hit-view-message-preview.malik-jaani786.workers.dev",
      "hit.gov.pk.81-cn.info",
      "hitpak.org",
      "hkunionpoy.vip",
      "hldren.info",
      "hlones.xyz",
      "holemn.xyz",
      "holiday.ms-office.app",
      "hostmaster.cdn-dl.cn",
      "hostmaster.enclose.info",
      "hostmaster.news-bd.com",
      "hostmaster.play-store.co",
      "hotmail.pk-mailgov.com",
      "hpqumyre.grabfiles.org",
      "hpuniversity.in",
      "hpupdate.csd-pk.co",
      "hread.live",
      "hrka1.pmreco.xyz",
      "hrmis-financegovpk.serveftp.com",
      "huangjianglee.top",
      "humariweb.info",
      "huneme.live",
      "hurr.zapto.org",
      "hust.edu.cn.81-cn.info",
      "hyat.tech",
      "i737461746963o6578706fo646576z.oszar.com",
      "ib.govpk.me",
      "ib.govvv.pk",
      "ibas-finance-gov-bd.downnload.org",
      "ibn.cdn-pak.net",
      "icd.punjab.gov.pk-govt.net",
      "iclod.org",
      "ics.govt-pk.com",
      "ics1.govt-pk.com",
      "ideas2024-pakistan.myvnc.com",
      "ideaspakistan-govpk.myvnc.com",
      "idef-2025-conf-data-file-tr-account-d.netlify.app",
      "idef2025-com-tr-files-drive-account.netlify.app",
      "ier-modile.shop",
      "igqlc.pmreco.xyz",
      "igyg8z.sepweo.info",
      "iididbiy.mod-gov.org",
      "ik-gost.ru",
      "images-11d.workers.dev",
      "imail.aop.gov-af.org",
      "imail.aop.gov.af.egateway.nsc-gov.com",
      "img-google.paf-gov.com",
      "immigration.gov.mv.gov-org.net",
      "immigration.gov.np.gov-co.org",
      "ims.sudurpashchim.gov.np.farwestkhabar.com",
      "inboxofficial-bd.com",
      "incometaxreturn.aeltron.xyz",
      "independenceday.pafwa.info",
      "indianarmy.mailnic.info",
      "info-account.cdn-dl.cn",
      "info-bdgov.com",
      "info-lanka.org",
      "info.bangladesh-islamic-baank.workers.dev",
      "info.pk-mailgov.com",
      "info2.pk-mailgov.com",
      "infomfa-gov-lk.dwnlld.info",
      "infomofa.workers.dev",
      "inkly.net",
      "inkora.org",
      "inporta.org",
      "input.info-bdgov.com",
      "insert.roteh.site",
      "install-e.store",
      "install-manager.com",
      "instructions.aeltron.xyz",
      "int-secure.org",
      "intdtebangladesh.govpk.info",
      "interior-gov-pk.com",
      "interior-gov-pk.direct880.net",
      "interior-gov-pk.file-dwnld.net",
      "interior-gov-pk.mail-govt.org",
      "interior-ministry.com",
      "interior-pk.org",
      "interior.gov.pk-mailgov.com",
      "interiorgovpk.life",
      "interiorgovpk.site",
      "interiorgovt.com",
      "interiorministrygov.site",
      "interiorministrypk.com",
      "interiorsgovpk.site",
      "internal-advisory-azerbaijan-russia-diplomatic-crisis.defence-np.net",
      "internal-portal.ceair.com.81-cn.info",
      "investgov.info",
      "investigation04.session-out.com",
      "investinnepal.gov.np.govt-pk.com",
      "invitation-letter.govpk.info",
      "invitation-mofa-nepli-gov-np-file.netlify.app",
      "invitation.army-lk.info",
      "invitation.bahariafoundation.live",
      "iportal-ntdcgovpk.myvnc.com",
      "ipv6.seoshz.live",
      "iran-war-or-deal.zeabur.app",
      "iseonea.live",
      "ishd.directt88.org",
      "islamabadclub.docuserve.ltd",
      "islamabadpk.site",
      "islamabadpolice.org",
      "islamic-finder.org",
      "islamic-path.com",
      "islamicfinder.bitlyy.me",
      "it-pakistan-gov-pk.workers.dev",
      "itsupport-gov.com",
      "itsupport.apps-sco-gov-pk.workers.dev",
      "iugur.live",
      "j2zfz.pmreco.xyz",
      "jestec.info",
      "jester.hyat.tech",
      "ji.pakgov.net",
      "jingjang-duduva.000webhostapp.com",
      "jmicc-gov-pk.pakmarines.com",
      "jmicc.xyz",
      "job.cssc.info",
      "job.kpt-pk.net",
      "jobfreeeco.it.com",
      "jomeno.site",
      "jomens.live",
      "jotse.info",
      "jp.pkrepublic.org",
      "jtops.milqq.info",
      "jupyt.tech",
      "justice-gov.info",
      "kafka.dirctt888.info",
      "kaleido.moe",
      "kalpo.xyz",
      "karachishipyard.krlwin.org",
      "kashmirawareness.loadpath.net",
      "kat0x.net",
      "kavach.mailnic.info",
      "kdf-mail.com",
      "kenaikan.portdedjibouti.live",
      "kenose.live",
      "kernet.info",
      "ketin.live",
      "ketle.site",
      "khaleejtimes.cc",
      "khanlab.medicallab.site",
      "kicov.site",
      "kintecc.com",
      "kito.countpro.info",
      "kmz.fetchdrive.info",
      "koepasc.live",
      "koitic.org",
      "kpkarmslicense.site",
      "kppolice.gov.pk-mail.org",
      "kpt-gov.org",
      "kpt-pk.net",
      "kptgov.org",
      "kptkp.online",
      "kr-i-sas-orv-e-l-a.workers.dev",
      "kra20.fun",
      "kretic.info",
      "krlwin.org",
      "krontab.info",
      "krontec.info",
      "krotab.info",
      "ksew.kpt-gov.org",
      "ksew.org",
      "ksewpk.com",
      "kuknalim.com.pk-mail.org",
      "l0gin-cetc1-files-0pen-expired.netlify.app",
      "l1kdine.com",
      "lalosop.biz",
      "lankabelltd.myftp.org",
      "laspzo.site",
      "latestupdate.adobeglobal.com",
      "lax036.relay.arandomserver.com",
      "lcbkp-gov-pk-sedang-berbunga.pages.dev",
      "leave.portdedjibouti.live",
      "leron.info",
      "lescrip.live",
      "lesporc.live",
      "letcrip.xyz",
      "leyra.tech",
      "lforvk.com",
      "lgcd.punjab.gov.pk.govt-pk.com",
      "libqstur.tech",
      "libreofficeupdates.com",
      "licenceinteriorministrypk.com",
      "license.interiorministrypk.com",
      "licenseinterior.gov-pk.com",
      "licenseinterior.gov-pk.site",
      "licenseinterior.govpk.site",
      "limkdin.com",
      "line-wqeyoiua.top",
      "lines.aeryple.xyz",
      "link-cdnl.net",
      "linkeden.net",
      "live-co.org",
      "livestreaming.adobeglobal.com",
      "livo.silvon.site",
      "lk.aliyumm.pro",
      "lk.gov-co.org",
      "lk.gov-org.net",
      "lk.govt-net.com",
      "lk.govt-org.com",
      "lk.govt-org.net",
      "lk.mail-pk.org",
      "lk.mofa-govbd.com",
      "lk.mofa-govlk.org",
      "lk.mofa-govtpk.net",
      "lk.pk-mail.org",
      "lms.update.fia-gov.org",
      "lnkly.net",
      "loadpath.info",
      "loadpath.net",
      "loasem.live",
      "loasen.xyz",
      "locaal.navybd-gov.info",
      "local.update.fia-gov.org",
      "localhost.apl-com.icu",
      "localhost.srvapp.co",
      "locall.hascolgov.info",
      "login.apl-org.online",
      "lolsidewindersidewinder.nic-svc.net",
      "lonime.xyz",
      "lotussrv01.fauji.pkgov.org",
      "ltd.cdn-pak.net",
      "lubeleaf.com",
      "lucas.hertic.tech",
      "luckjav.com",
      "luckydraw.csd-pk.co",
      "m.fia-gov.com",
      "m1n.mov",
      "maajankidevisevasansthan.org",
      "macop.site",
      "madhouse.cloud",
      "magento.seoshz.live",
      "mai1-sco-gov-pk-sdf.rf.gd",
      "maif-piac-aero.gov-pkgov.workers.dev",
      "mail-163cn.com",
      "mail-776f305796709f2d567e6868feaba274-gov-pk-investment.pages.dev",
      "mail-account-data.github.io",
      "mail-afd-gov-bd-account-error-issues.netlify.app",
      "mail-airforce-lk1b8470bce36a0e858a410b4169b23e1c.pages.dev",
      "mail-apfgavnp.hopto.org",
      "mail-apfgovnp.ddns.net",
      "mail-argaf.myftp.org",
      "mail-army-sl-dte-of-welfare-session-out.pages.dev",
      "mail-armybd.servehttp.com",
      "mail-armylk.myvnc.com",
      "mail-armylk.servehalflife.com",
      "mail-arny-nil-db.up.railway.app",
      "mail-aselsans-com-tr-account-files-da.netlify.app",
      "mail-asian-parliament-org.pakistan-gov-pk.workers.dev",
      "mail-aviation-gov-pk-pdf.pages.dev",
      "mail-baf-mil-bd-account-data-files-document.pages.dev",
      "mail-baf-mil-bd-fils-cas-visit-to-chi.netlify.app",
      "mail-bafmilbd.myvnc.com",
      "mail-bafmilbd.servequake.com",
      "mail-bcc-gov-bd-7j5la.bunny.run",
      "mail-bcc-gov-bd-condepakuregoda4533-fxr7ofbc.leapcell.dev",
      "mail-bcc-gov-bd.vercel.app",
      "mail-bccgov.gotdns.ch",
      "mail-bccnetdd.ddns.net",
      "mail-bfsa-gov-bd.netlify.app",
      "mail-bof-gov-bd-cas-visit.netlify.app",
      "mail-bof-gov-file-account-conf-files.netlify.app",
      "mail-corp.cybernet.pkgov.org",
      "mail-cscec.ddns.net",
      "mail-defence-lk-loging-horde.pages.dev",
      "mail-defence-lk-session-out.pages.dev",
      "mail-defence-lk-webmail-imp-view-php-actiob-ri5it-kgfi5kg9.pages.dev",
      "mail-depo-gov-pk.government-pak.workers.dev",
      "mail-depo-gov-pk.govtpak.workers.dev",
      "mail-depo-gov-pk.ntc-telecomcorporation.workers.dev",
      "mail-depogovpk.myvnc.com",
      "mail-depogovpk.servehttp.com",
      "mail-dgdp-gov-pk.ntc-telecomcorporation.workers.dev",
      "mail-dgdpgovpk.servehalflife.com",
      "mail-dgfi-gov-bd-accounts-file-data-d.netlify.app",
      "mail-dmp-navy-pk.dytt88.org",
      "mail-doc-download-pdf.up.railway.app",
      "mail-dor.hopto.org",
      "mail-download-army-mii-bd.up.railway.app",
      "mail-ead.gov-pk.online",
      "mail-ecp-gov-pk.ntc-telecomcorporation.workers.dev",
      "mail-files-open-preview.com",
      "mail-fisheries-gov-bd.netlify.app",
      "mail-gov.org",
      "mail-govpk.com",
      "mail-govt.com",
      "mail-govt.org",
      "mail-gwadarport-gov-pk.kr-i-sas-orv-e-l-a.workers.dev",
      "mail-gwadarport-gov-pk.ntc-telecomcorporation.workers.dev",
      "mail-hit-gov-pk.government-pak.workers.dev",
      "mail-hit-gov-pk.ntc-telecomcorporation.workers.dev",
      "mail-hit-gov.leapcell.app",
      "mail-hitgovpk.government-pak.workers.dev",
      "mail-hitgovpk.govtpak.workers.dev",
      "mail-hitgovpk.myvnc.com",
      "mail-hitgovpk.servegame.com",
      "mail-hitgovpk.servehttp.com",
      "mail-ideaspakistan-gov-pk.zeabur.app",
      "mail-invest-gov-pk.gwadarportt.workers.dev",
      "mail-islamabadpolice-gov-pk.ntc-telecommunication-safecity.workers.dev",
      "mail-kdu-lk-inbox-interanl-memo.pages.dev",
      "mail-kmgcom.ddns.net",
      "mail-kpt-gov-pk-2fa-registration.pages.dev",
      "mail-kpt-gov-pk-browserautheintacation.pages.dev",
      "mail-kpt-gov-pk-error.pages.dev",
      "mail-kpt-gov-pk-estblishment-it-park.pages.dev",
      "mail-kpt-gov-pk-joint-coordination-meeting.pages.dev",
      "mail-kpt-gov-pk-meeting-sub-committee.pages.dev",
      "mail-kpt-gov-pk-mod-revised-scheduled.pages.dev",
      "mail-kpt-gov-pk-provision-of-data-for-greater-karachi.pages.dev",
      "mail-kpt-gov-pk-provision-of-karachi-port-vision.pages.dev",
      "mail-kpt-gov-pk-securityupdates-jun2025olertnessegingvsdvs.pages.dev",
      "mail-kpt-gov-pk-training-course-public-finance.pages.dev",
      "mail-kpt-gov-pk-viruspurification-securitypachesjun-2025df.pages.dev",
      "mail-kpt-gov-pk-visit-to-malaysia-final.pages.dev",
      "mail-kpt-gov-pk.pak-gov-pk.workers.dev",
      "mail-meagovmv.hopto.org",
      "mail-mfagovcn.hopto.org",
      "mail-minfinance-gov-np.netlify.app",
      "mail-mod-gov-bd-account-conf-files.netlify.app",
      "mail-mod-gov-bd-account-data-file.netlify.app",
      "mail-mod-gov-np-account-file-data.netlify.app",
      "mail-mod-gov-np-download-pdf.netlify.app",
      "mail-mod-gov-pk.pakistan-gov-pk.workers.dev",
      "mail-modaf.hopto.org",
      "mail-modgav.hopto.org",
      "mail-modgovpk.servehttp.com",
      "mail-modp-gov-pk-view.netlify.app",
      "mail-modp-gov-pk.government-pak.workers.dev",
      "mail-modp-gov-pk.ntc-telecomcorporation.workers.dev",
      "mail-modp-gov-pk.pak-gov-pk.workers.dev",
      "mail-mofa-gov-pk-satellite-proposal-for-pakistan-files-ops.netlify.app",
      "mail-mofa-gov-pk.pakistan-gov-pk.workers.dev",
      "mail-mofa-gov.org-liv.net",
      "mail-mofa.ddns.net",
      "mail-mofa.hopto.org",
      "mail-mofa.myftp.org",
      "mail-mofagovnp.hopto.org",
      "mail-mofagovnp.zapto.org",
      "mail-mofagovpk.ddns.net",
      "mail-mofagovpk.gotdns.ch",
      "mail-mofagovpk.myddns.me",
      "mail-mofagovpk.myftp.org",
      "mail-mofagovpk.servehalflife.com",
      "mail-mofagovpk.servehttp.com",
      "mail-mofagovpk.serveirc.com",
      "mail-mofagovpk.viewdns.net",
      "mail-mofapk.servehttp.com",
      "mail-mofgovbt.hopto.org",
      "mail-mofgovnp.hopto.org",
      "mail-moha-gov-np-download.netlify.app",
      "mail-mohs.ddns.net",
      "mail-mohs.myftp.org",
      "mail-mohs.servehttp.com",
      "mail-moitt-gov-pk-meeting-sun-committee.pages.dev",
      "mail-mopitgovnp.hopto.org",
      "mail-mowr.gov-pk.online",
      "mail-na-gov-pk.na-gov-pk.workers.dev",
      "mail-navy-lk-4326er48fdu49fgu49fgj549fj349fdj3490fdjk390df.pages.dev",
      "mail-navy-lk-43897fyi78945tr78945uio89045iuort89045prt054k.pages.dev",
      "mail-navy-lk-login.pages.dev",
      "mail-navy-lk.up.railway.app",
      "mail-navy-mil-bd-modern-email-inbox-messages.webmailarmy.com",
      "mail-nba-gov-pk.pakistan-gov-pk.workers.dev",
      "mail-ncporgnp.hopto.org",
      "mail-nepalarmy-mil-np-fsdafjsd.herokuapp.com",
      "mail-nepalarmy-mil-np-login-download.netlify.app",
      "mail-nepalarmy-mil-np-view.netlify.app",
      "mail-nepalarmymilnp.duckdns.org",
      "mail-nepalgovnp.duckdns.org",
      "mail-nepalgovnp.zapto.org",
      "mail-nepalpolgavnp.hopto.org",
      "mail-nepalpolice-gov-np-loginn.herokuapp.com",
      "mail-nepalpolice.hopto.org",
      "mail-nepalpolicegov.hopto.org",
      "mail-nepalpolicegovnp.duckdns.org",
      "mail-nespak-com-pk.gwadarportt.workers.dev",
      "mail-np.net",
      "mail-nrborg.hopto.org",
      "mail-nscaf.hopto.org",
      "mail-nscaf.myftp.org",
      "mail-nscgovaf.hopto.org",
      "mail-nssc.sytes.net",
      "mail-ntc-net-pk-pdf.up.railway.app",
      "mail-ntc-net-pk-zimbra-dils-maint213-2q1ntcqz.leapcell.dev",
      "mail-ntc-net-pk.up.railway.app",
      "mail-ntc-net-pk.zeabur.app",
      "mail-ntc.gov-pk.online",
      "mail-ntcgovpk.servehttp.com",
      "mail-ntcnetnp.serveftp.com",
      "mail-ntmail-ntcnetnp.serveftp.comcnetnp.serveftp.com",
      "mail-nudt.sytes.net",
      "mail-opmcmgavnp.hopto.org",
      "mail-paa-gov-pk.pages.dev",
      "mail-paf-gov-pk.ntc-telecomcorporation.workers.dev",
      "mail-pc-gov-pk-login.ethanhunthero125.workers.dev",
      "mail-pc.gov-pk.online",
      "mail-pk.com",
      "mail-pk.org",
      "mail-pmo-gov-lk3u3i495ui3jkdf9d549fgkj45fg94jdfg904j439g.pages.dev",
      "mail-pmogovpk.servehttp.com",
      "mail-pof-gov-pk.government-pak.workers.dev",
      "mail-pofgovpk.3utilities.com",
      "mail-pofgovpk.sytes.net",
      "mail-ppra-org-pk.pakistan-gov-pk.workers.dev",
      "mail-preview-trainingcollabration-bangladesh-srilanka.pages.dev",
      "mail-prevlew-jointworkshop-training-srilanka-bangladesh.pages.dev",
      "mail-punjab-gov-pk.ntc-telecomcorporation.workers.dev",
      "mail-sco-gov-pk.crypton0019.workers.dev",
      "mail-sco-gov-pk.government-pak.workers.dev",
      "mail-sco-gov-pk.mil-bd.workers.dev",
      "mail-sco-gov-pk.netlify.app",
      "mail-sco-gov-pk.ntc-telecomcorporation.workers.dev",
      "mail-sco.gov-pk.online",
      "mail-scogovpk.servehalflife.com",
      "mail-scogovpk.servehttp.com",
      "mail-sessionexpired.com",
      "mail-suparco-gov-pk-owa-auth-logon-aspx.pages.dev",
      "mail-svr.co",
      "mail.a.globaltimes-cn.org",
      "mail.alit.info",
      "mail.allpakarmslicence.com",
      "mail.andc.govaf.org",
      "mail.apl-com.icu",
      "mail.arg.gov-af.org",
      "mail.army-govbd.info",
      "mail.baf.mil.bd.docum.store",
      "mail.baf.mil.bd.hilsa.online",
      "mail.baf.mil.bd.onlinestatus.live",
      "mail.baf.mil.bd.pdf.quickhelpsolve.com",
      "mail.bcc.gov.bd.onlinestatus.live",
      "mail.bcc.gov.bd.pdf.quickhelpsolve.com",
      "mail.bcc.gov.bd.upworkoffice.online",
      "mail.bdgov.info",
      "mail.bgb.gov.bd.account.modern.sessions.webmailarmy.com",
      "mail.bgb.gov.bd.up2dts.online",
      "mail.biitt.cn",
      "mail.bok.pkgov.org",
      "mail.bop.pkgov.org",
      "mail.cao.gov.bd.account.login.sessions.webmailarmy.com",
      "mail.cfau.edu.cn.81-cn.info",
      "mail.cmec.com.globaltimes-cn.org",
      "mail.csd.pkgov.org",
      "mail.dawn.pkgov.org",
      "mail.demsflygerxamy.com",
      "mail.dgdp.gov.pk.pujfjue003hmdhfh99ppjdflsdqwlkls.g0v-pk.net",
      "mail.dlimspunjabgovpk.com",
      "mail.drive.gov.bd.files.updatemind52.com",
      "mail.fwo.com.pk.onlinestatus.live",
      "mail.gavaf.org",
      "mail.gov-pk.com",
      "mail.gov-pk.pk",
      "mail.gov-pk.site",
      "mail.gov.bd.account.file.updatemind52.com",
      "mail.govpk.info",
      "mail.govpk.live",
      "mail.hillview.net.pk.hilsa.online",
      "mail.hilsa.online",
      "mail.hit.gov.pk.81-cn.info",
      "mail.hust.edu.cn.81-cn.info",
      "mail.investgov.info",
      "mail.licenceinteriorministrypk.com",
      "mail.mail.cmec.com.globaltimes-cn.org",
      "mail.mail.spacechina.com.81-cn.info",
      "mail.mfa.gov.cn.81-cn.info",
      "mail.mfaa.gov.cn.globaltimes-cn.org",
      "mail.mobta.govaf.org",
      "mail.mod.gov.bd.account.login.sessions.webmailarmy.com",
      "mail.modcloudspace.com",
      "mail.moe-gov-ae.info",
      "mail.mofa-gov-ae.info",
      "mail.mofa-gov-qa.gq",
      "mail.mofa-gov-qa.ml",
      "mail.mofa-govbd.com",
      "mail.mofa-govtpk.com",
      "mail.mofa.gov.pk.docum.store",
      "mail.mofa.gov.pk.globaltimes-cn.org",
      "mail.mofa.gov.pk.modp-pk.org",
      "mail.mofa.gov.pk.officemuwork.online",
      "mail.mofa.gov.pk.onlinestatus.live",
      "mail.mofa.gov.pk.up2dts.online",
      "mail.mofa.govnp.org",
      "mail.mofa.pkgov.org",
      "mail.mofagov-pk.online",
      "mail.mofagov-sa.info",
      "mail.mofas.gov.pk.updatemaster.info",
      "mail.moi.govaf.org",
      "mail.navy.lk.updatemaster.info",
      "mail.navy.mil.bd.docum.store",
      "mail.navy.mil.bd.officemuwork.online",
      "mail.navy.mil.bd.onlinestatus.live",
      "mail.navy.mil.bd.up2dts.online",
      "mail.nepal.gavnp.org",
      "mail.nepla.gov.np.onlinestatus.live",
      "mail.news-bd.com",
      "mail.nju.edu.cn.81-cn.info",
      "mail.npc.gov.np.officemuwork.online",
      "mail.npc.gov.np.up2dts.online",
      "mail.nrlpak.pkgov.org",
      "mail.ntc.gov.pk.hilsa.online",
      "mail.ntc.net.pk.bismi.pro",
      "mail.ntc.net.pk.onlinestatus.live",
      "mail.ntc.net.pk.vpdf.online",
      "mail.ntc.pkgov.org",
      "mail.ntdc.pkgov.org",
      "mail.nudt.edu.cn.81-cn.info",
      "mail.ogdcl.pkgov.org",
      "mail.oilplus1td.com",
      "mail.paf-gov.net",
      "mail.paf.gov.pk.hilsa.online",
      "mail.paf.gov.pk.onlinestatus.live",
      "mail.paf.gov.pk.pujfjue003hmdhfh99ppjdflsdqwlkls.g0v-pk.net",
      "mail.pak-gov.com",
      "mail.pakarmslicense.com.pk",
      "mail.pakistangov.com",
      "mail.pakoil.pkgov.org",
      "mail.pk-mail.org",
      "mail.pkgov.org",
      "mail.pmsa.pkgov.org",
      "mail.pof-gov-pk.workers.dev",
      "mail.pof.gov.pk.onlinestatus.live",
      "mail.power-govpk.org",
      "mail.ptv.pkgov.org",
      "mail.punjab.gov.pk.hilsa.online",
      "mail.punjabgov.org",
      "mail.radio.pkgov.org",
      "mail.sco.gov.pk.hilsa.online",
      "mail.sco.gov.pk.pujfjue003hmdhfh99ppjdflsdqwlkls.g0v-pk.net",
      "mail.sco.pkgov.org",
      "mail.smmu.edu.cn.81-cn.info",
      "mail.ssf.gov.bd.onlinestatus.live",
      "mail.tsinghua.edu.cn.81-cn.info",
      "mail.tsinghua.institute",
      "mail.voyage-prive.com.ru",
      "mail1.mofa.gov.pk.docum.store",
      "mail1.navy.mil.bd.docum.store",
      "mail126.live",
      "mail163.info",
      "mail163cn.info",
      "mailafdbd.mod-pkgov.org",
      "mailafdgovbd.163inc.org",
      "mailaplf.cvix.live",
      "mailarmy.cssc.live",
      "mailarmylk.126-com.live",
      "mailarmylk.mods.email",
      "mailbaf.mil-bd.workers.dev",
      "mailbox-inbox-bd.com",
      "mailbox3-inbox1-bd.com",
      "mailcantonfair.cssc.info",
      "mailcbmgovmm.pages.dev",
      "mailciieorg.mofa-gov.org",
      "mailcitifs.cssc.info",
      "mailcloucl.com",
      "mailcn.163inc.org",
      "maildefence.alit.info",
      "maildefence.myftp.org",
      "maile.mofa-gov.org",
      "mailgu.cssc.info",
      "mailh.alit.live",
      "mailhit-govpk.hopto.org",
      "mailhitgovpk.servehalflife.com",
      "maill-govtnepal-gov-np.netlify.app",
      "maill-nepalgv-gov-np.netlify.app",
      "mailmfa.mofa-gov.info",
      "mailmfagovnp.cvix.live",
      "mailmofa.alit.info",
      "mailmofa.alit.live",
      "mailmofa.cssc.info",
      "mailmofa.govnp.live",
      "mailmofa.mofa-gov.org",
      "mailmofa.newmofa.com",
      "mailmofagoug.cvix.live",
      "mailmofagovmm.mfa-gov.net",
      "mailmofagovmm.mofa.email",
      "mailmofagovpk.cdn-pak.net",
      "mailmofagovpk.cvix.live",
      "mailnavybd.govpk.net",
      "mailnavymilbd.govpk.net",
      "mailnepalarmy.mofagov.com",
      "mailnepalarmymil.mods.email",
      "mailnic.info",
      "mailotloc.aliyum.org",
      "mailotlook.aliyum.org",
      "mailoutlook.cssc.live",
      "mailoutlookcom.cvix.live",
      "mailpakbj.mofs-gov.org",
      "mailpsab-modgovpk.hopto.org",
      "mailrta.mfagov.org",
      "mails-pk.com",
      "mails-pk.net",
      "mails.baf.mil.bd.updatemaster.info",
      "mails.bcc.gov.bd.updatemaster.info",
      "mails.mofa.gov.np.updatemaster.info",
      "mails.mofa.gov.pk.updatemaster.info",
      "mails.navy.mil.bd.updatemaster.info",
      "mails.nepal.gov.np.updatemaster.info",
      "mails.ntc.net.pk.hilsa.online",
      "mails.paf.gov.pk.hilsa.online",
      "mails.pmo.gov.pk.hilsa.online",
      "mailsco-govpk.hopto.org",
      "mailsco-govpk.myvnc.com",
      "mailscodomain-hubenkks.b4a.run",
      "mailserver-lk.com",
      "mailserver.seoshz.live",
      "mailsiis.alit.info",
      "mailsserver-lk.com",
      "mailstinghua.sinacn.co",
      "mailtest-mofa.servehttp.com",
      "mailtsinghua.sinacn.co",
      "mailturkmenembassy.cssc.info",
      "mailv.mofs-gov.org",
      "mailx.nr3c-govpk.com",
      "mailyafd.mofa-gov.org",
      "mailyahoocom.cvix.live",
      "mainet.info",
      "malik-jaani786.workers.dev",
      "mall-ministryoffinance-np.netlify.app",
      "management.xuzeest.buzz",
      "marine-pak.org",
      "maritimepakistan.kpt-pk.net",
      "marksafe.org",
      "maroos.live",
      "masarh.live",
      "mat.trelin.tech",
      "mawazna.info",
      "me7q1.pmreco.xyz",
      "mectel.tech",
      "medeclinic.ae",
      "medicalbillers.govt-pk.com",
      "medicallab.site",
      "meet.kdf-mail.com",
      "meeting-rigistration-defence-attache.netlify.app",
      "meeting-rigistration-embassy.netlify.app",
      "meplor.xyz",
      "meter-ntdccompk.myvnc.com",
      "meter-ntdccompk.servehttp.com",
      "mevron.tech",
      "mfa-go-ke.dytt88.co",
      "mfa-gov-al.com",
      "mfa-gov-cy.info",
      "mfa-gov-cy.online",
      "mfa-gov-lk.dirctt88.co",
      "mfa-gov-lk.dwnlld.info",
      "mfa-gov.cc",
      "mfa-gov.net",
      "mfa-govt.net",
      "mfa-govtt-az.com",
      "mfa-govtt-mm.com",
      "mfa-ir.cn",
      "mfa-qov.com",
      "mfa.gov.cn.81-cn.info",
      "mfa.gov.lk.gov-co.org",
      "mfa.gov.lk.gov-org.net",
      "mfa.gov.lk.govt-net.com",
      "mfa.gov.lk.govt-org.com",
      "mfa.gov.lk.mofa-govlk.org",
      "mfaa.gov.cn.globaltimes-cn.org",
      "mfacom.org",
      "mfagov.info",
      "mfagov.net",
      "mfagov.org",
      "mfas.pro",
      "mha.gov.bd.mail-pk.org",
      "mha.gov.bd.pk-mail.org",
      "mha.gov.bd.pk-mailgov.com",
      "mhapsd.gov.bd.mofa-govbd.com",
      "mhealth.dopm.gov.np.totheeverest.com",
      "micret.live",
      "microsoft-365.directt88.org",
      "microsoft-winupdate.servehttp.com",
      "microsoft.update.fia-gov.org",
      "microsoftfp.hopto.org",
      "microsoftupdte.redirectme.net",
      "mil-bd.workers.dev",
      "mil-pk.net",
      "mil.bd.hilsa.online",
      "mil.bd.officemuwork.online",
      "mil.np.gov-co.org",
      "milbdarmy.live",
      "military-bd.org",
      "milqq.info",
      "min-pk.com",
      "min.tin-url.com",
      "mindef.gov.pk-mail.org",
      "mindef.gov.pk.govt-pk.com",
      "mindef.govvv.pk",
      "ministry-gov.cdn-dl.cn",
      "ministry-gov.org",
      "ministry-interior-gov-pk.cdn-dl.cn",
      "ministry-pk.net",
      "ministryofdefencechinadrive.pages.dev",
      "ministryofficedownloadcloudserver.screenpont.xyz",
      "ministryofforeignaffairs-mofa-gov-pk.dytt88.org",
      "ministryofinterior.fileserve.work",
      "ministryofinterior.shop",
      "ministryofinteriorlicense.gov-pk.com",
      "ministryofinteriorlicense.gov-pk.site",
      "ministryofinteriorlicense.govpk.site",
      "ministryofinteriorpermit.gov-pk.com",
      "ministryofinteriorpermit.gov-pk.site",
      "minland.pk-govt.net",
      "minutes-interministryproduction.up.railway.app",
      "minutes-of-meeting.zeabur.app",
      "mishal.com.pk-mailgov.com",
      "misty-pond-6b85.infomofa.workers.dev",
      "mitgiied.vip",
      "mitlec.site",
      "mm.download-msoffice.com",
      "mm.gov-org.net",
      "mmcert-org-mm.donwloaded.com",
      "mms.phone-update.click",
      "mo.treasury.gov.lk.mail-pk.org",
      "mo.treasury.gov.lk.pk-mail.org",
      "mo.treasury.gov.lk.pk-mailgov.com",
      "mobta.govaf.org",
      "mocat-gov-bd.filenest.live",
      "mocat.gov.bd.pk-mail.org",
      "mochta.pk-govt.net",
      "mod-cn.trans-del.net",
      "mod-gov-bd.direct888.net",
      "mod-gov-bd.dowmload.co",
      "mod-gov-bd.downld.org",
      "mod-gov-bd.dwnlld.com",
      "mod-gov-bd.dwnlld.info",
      "mod-gov-bd.filenest.live",
      "mod-gov-bd.info",
      "mod-gov-bd.live-co.org",
      "mod-gov-bd.net-src.org",
      "mod-gov-bd.org-liv.net",
      "mod-gov-bd.snagdrive.com",
      "mod-gov-pk.live",
      "mod-gov.cdn-dl.cn",
      "mod-gov.com",
      "mod-gov.org",
      "mod-govbd.com",
      "mod-kh.info",
      "mod-pak.co",
      "mod-pk.com",
      "mod-pkgov.org",
      "mod-portal-gov-bd.mail-govt.com",
      "mod.gov.ba.pk-govt.com",
      "mod.gov.bd.govt-org.net",
      "mod.gov.bd.govt-pk.com",
      "mod.gov.bd.mail-pk.org",
      "mod.gov.bd.mofa-govlk.com",
      "mod.gov.bd.mofa-govtpk.net",
      "mod.gov.bd.pk-govt.com",
      "mod.gov.bd.pk-govt.net",
      "mod.gov.bd.pk-mail.org",
      "mod.gov.bd.pk-mailgov.com",
      "mod.gov.np.gov-co.org",
      "mod.gov.np.gov-org.net",
      "mod.gov.np.govt-pk.com",
      "mod.gov.np.pk-mail.org",
      "mod.gov.pk-govt.net",
      "mod.gov.pk.emaiil.co",
      "mod.mailnic.info",
      "mod.mofa-govbd.com",
      "mod.mofa-govlk.org",
      "modcloudspace.com",
      "moddirectoratecloud.com",
      "modeso.info",
      "modltr.info-lanka.org",
      "modp-gov-pk.d0wnlaod.org",
      "modp-pk.org",
      "modp-view-full-message.malik-jaani786.workers.dev",
      "modp.gov.pk-govt.net",
      "modp.gov.pk-mail.org",
      "modpak-info.services",
      "modpak.info",
      "modpak.live",
      "mods.email",
      "moe-gov-ae.info",
      "moe-gov.cdn-dl.cn",
      "moe.gov.cn.81-cn.info",
      "moef.gov.bd.pk-mail.org",
      "moemaldives.pmd-office.com",
      "mof-gov-bd.loadpath.net",
      "mof-gov-bd.nic-svc.net",
      "mof-gov-np.dwnlld.info",
      "mof-govn.online",
      "mof-govnp.servehttp.com",
      "mof-newbudget25-ck.zeabur.app",
      "mof-newbudget25-fm.zeabur.app",
      "mof-newbudget25-jz.zeabur.app",
      "mof-newbudget25-pdx.zeabur.app",
      "mof-newbudget25-rk.zeabur.app",
      "mof-newbudget25-vn.zeabur.app",
      "mof-newbuedget2025-jz.zeabur.app",
      "mof-newbuedget25-ars.zeabur.app",
      "mof-newbuedget25-jz.zeabur.app",
      "mof-newbuedget25-rk.zeabur.app",
      "mof-portal-gov-bd.downnload.org",
      "mof-portal-gov-bd.loadpath.net",
      "mof.gov.np.mail-pk.org",
      "mof.gov.np.pk-mail.org",
      "mof.gov.np.pk-mailgov.com",
      "mof.pk-govt.net",
      "mofa-filetransfer.servehttp.com",
      "mofa-g0v-pk.workers.dev",
      "mofa-go-np.direct880.net",
      "mofa-gov-ae.info",
      "mofa-gov-bd-mailll.rf.gd",
      "mofa-gov-bd.com",
      "mofa-gov-bd.dowmload.co",
      "mofa-gov-bd.downld.org",
      "mofa-gov-bd.downnload.org",
      "mofa-gov-bd.dwnlld.info",
      "mofa-gov-bd.fetchdrive.org",
      "mofa-gov-bd.fetchdrives.info",
      "mofa-gov-bd.fia-gov.net",
      "mofa-gov-bd.file-dwnld.net",
      "mofa-gov-bd.filenest.live",
      "mofa-gov-bd.grabfiles.net",
      "mofa-gov-bd.interior-ministry.com",
      "mofa-gov-bd.live-co.org",
      "mofa-gov-bd.mail-svr.co",
      "mofa-gov-bd.snagdrive.com",
      "mofa-gov-mail-view-pk.rf.gd",
      "mofa-gov-msg-view.rf.gd",
      "mofa-gov-np.dirctt88.co",
      "mofa-gov-np.dirctt888.info",
      "mofa-gov-np.direct880.net",
      "mofa-gov-np.direct888.net",
      "mofa-gov-np.downld.org",
      "mofa-gov-np.downnload.org",
      "mofa-gov-np.dwnlld.com",
      "mofa-gov-np.dytt888.net",
      "mofa-gov-np.fia-g0v.net",
      "mofa-gov-np.fia-gob.net",
      "mofa-gov-np.fia-gov.net",
      "mofa-gov-np.live-co.org",
      "mofa-gov-np.min-pk.com",
      "mofa-gov-np.net-src.info",
      "mofa-gov-np.org-liv.net",
      "mofa-gov-pk-692e658f-19ac-8320-a0ee-b52b2198b13c-visit.pages.dev",
      "mofa-gov-pk-692e658f-19ac-8320-a0ee-b52b2198b13c.pages.dev",
      "mofa-gov-pk-download.rf.gd",
      "mofa-gov-pk-foreignministry-documents.timeoflahore.com",
      "mofa-gov-pk-press-release-training-course-public-finance.pages.dev",
      "mofa-gov-pk-wireless.comsates.org",
      "mofa-gov-pk.asianetnews.xyz",
      "mofa-gov-pk.co",
      "mofa-gov-pk.directt888.com",
      "mofa-gov-pk.donwloaded.com",
      "mofa-gov-pk.dowmload.co",
      "mofa-gov-pk.dowmload.info",
      "mofa-gov-pk.download.info",
      "mofa-gov-pk.dwnlld.com",
      "mofa-gov-pk.fdn-trace.net",
      "mofa-gov-pk.fia-g0v.net",
      "mofa-gov-pk.pages.dev",
      "mofa-gov-pk.rf.gd",
      "mofa-gov-pk.site",
      "mofa-gov-pk.xyz",
      "mofa-gov-qa.gq",
      "mofa-gov-qa.ml",
      "mofa-gov-qa.srvssl.cf",
      "mofa-gov-sa.direct888.net",
      "mofa-gov.info",
      "mofa-gov.interior-pk.org",
      "mofa-gov.org",
      "mofa-govbd.com",
      "mofa-govbd.org",
      "mofa-govlk.com",
      "mofa-govlk.net",
      "mofa-govlk.org",
      "mofa-govpk.co",
      "mofa-govtpk.com",
      "mofa-govtpk.net",
      "mofa-lk.org",
      "mofa-pk.co",
      "mofa-pk.org",
      "mofa-portal-gov-bd.mail-govt.com",
      "mofa-qov.com",
      "mofa-services-server.top",
      "mofa.bd.gov-co.org",
      "mofa.cdn-pak.net",
      "mofa.cssc.info",
      "mofa.email",
      "mofa.g0v.cq.cn",
      "mofa.gov-pk.online",
      "mofa.gov.bd.gov-co.org",
      "mofa.gov.bd.govt-net.com",
      "mofa.gov.bd.govt-pk.com",
      "mofa.gov.bd.mail-pk.org",
      "mofa.gov.bd.mofa-govbd.com",
      "mofa.gov.bd.mofa-govlk.com",
      "mofa.gov.bd.mofa-govtpk.net",
      "mofa.gov.bd.pk-govt.com",
      "mofa.gov.bd.pk-govt.net",
      "mofa.gov.bd.pk-mail.org",
      "mofa.gov.bd.pk-mailgov.com",
      "mofa.gov.lk.govt-net.com",
      "mofa.gov.lk.govt-org.net",
      "mofa.gov.mail-pk.org",
      "mofa.gov.np.gov-co.org",
      "mofa.gov.np.gov-org.net",
      "mofa.gov.np.govt-net.com",
      "mofa.gov.np.govt-pk.com",
      "mofa.gov.np.mail-pk.org",
      "mofa.gov.np.pk-govt.com",
      "mofa.gov.np.pk-govt.net",
      "mofa.gov.np.updatemaster.info",
      "mofa.gov.pk-govt.com",
      "mofa.gov.pk-govt.net",
      "mofa.gov.pk-hq.qrrl.net",
      "mofa.gov.pk-hqr-online.co",
      "mofa.gov.pk-mail.org",
      "mofa.gov.pk.1.modp-pk.org",
      "mofa.gov.pk.2let.org",
      "mofa.gov.pk.globaltimes-cn.org",
      "mofa.gov.pk.modp-pk.org",
      "mofa.gov.pk.officemuwork.online",
      "mofa.gov.pk.pk-govt.com",
      "mofa.govnp.live",
      "mofa.govnp.org",
      "mofa.govpk.email",
      "mofa.govpk.info",
      "mofa.govpk.me",
      "mofa.govvv.pk",
      "mofa.iugur.live",
      "mofa.live",
      "mofa.mail-pk.org",
      "mofa.moma-pk.org",
      "mofa.paknvay-pk.net",
      "mofa.pk-govt.net",
      "mofa.pkgov.org",
      "mofabn.ksewpk.com",
      "mofadividion.ptcl-gov.com",
      "mofaga.gov.np.pk-mail.org",
      "mofagov-pk.naatlibrary.com",
      "mofagov-pk.online",
      "mofagov-sa.info",
      "mofagov.com",
      "mofagov.info",
      "mofagov.live",
      "mofagov.online",
      "mofagovbd.com",
      "mofagovpk-hq.co",
      "mofagovpk.cheematrd.com",
      "mofagovpk.co",
      "mofagovpk.com",
      "mofagovpk.edu-cx.org",
      "mofagovpk.info",
      "mofagovs.org",
      "mofapak.info",
      "mofbudget-ars.zeabur.app",
      "mofbudget-ck.zeabur.app",
      "mofbudget-fld.zeabur.app",
      "mofbudget-fm.zeabur.app",
      "mofbudget-jz.zeabur.app",
      "mofbudget-pd.zeabur.app",
      "mofbudget-vn.zeabur.app",
      "mofbudget.zeabur.app",
      "mofnewbuedgetsgp-jz.zeabur.app",
      "mofnewbuedgetsgp-pd.zeabur.app",
      "mofnewbuedgetssg-ck.zeabur.app",
      "mofnewbuedgetssg-jz.zeabur.app",
      "mofnewbuedgetssg-pd.zeabur.app",
      "mofnewbuedgetssg-rk.zeabur.app",
      "mofnewbuedgetssgp-ck.zeabur.app",
      "mofnewbuedgetssgp-jz.zeabur.app",
      "mofnewbuedgetssgp-pd.zeabur.app",
      "mofs-gov.org",
      "mofserviceserver.top",
      "mofsgpbudget-ars.zeabur.app",
      "mofsgpbudget-ck.zeabur.app",
      "mofsgpbudget-jz.zeabur.app",
      "mofss.co",
      "mofw.pro",
      "moha-gov-bd.filenest.live",
      "moha-gov-bd.snagdrive.com",
      "moha-gov-np.direct880.net",
      "moha-gov-np.filenest.live",
      "moha-gov-np.interior-ministry.com",
      "moha-gov-np.snagdrive.com",
      "moha-portal-gov-bd.fia-g0v.net",
      "moha.gov.bd.mail-pk.org",
      "moha.gov.bd.pk-mailgov.com",
      "moha.gov.np.gov-org.net",
      "moha.gov.np.mail-pk.org",
      "moha.gov.np.pk-govt.net",
      "moha.gov.np.pk-mail.org",
      "moha.gov.np.pk-mailgov.com",
      "mohgovsg.bahariafoundation.live",
      "mohp-gov.org",
      "mohpw.gov.bd.pk-mail.org",
      "mohre-gov.info",
      "mohrss.help",
      "mohs.gov.mm.gov-org.net",
      "moi-nadra.cdn-dl.cn",
      "moi.govaf.org",
      "moib.gov.pk-mailgov.com",
      "moitt-gov-pk-presentation-visit-pm.pages.dev",
      "moitt-gov-pk.dwnlld.info",
      "moitt-gov-pk.dytt88.co",
      "moitt-gov-pk.fia-gov.net",
      "moitt.gov.pk.hilsa.online",
      "moitt.gov.pk.pk-mail.org",
      "moitt.gov.pk.viewdoc.online",
      "moitt.govpk.me",
      "moitt.paknavy-govpk.info",
      "moittadvisory.pmd-offc.info",
      "moittpk.net",
      "moittpk.org",
      "molwa-gov-bd.mail-govt.com",
      "moma-gov-pk.org",
      "moma-pk.org",
      "moma.comsats-net.com",
      "moma.islamabadpk.site",
      "moma.kptkp.online",
      "moon.tfrend.org",
      "mopa-bd.cdn-dl.cn",
      "mopa-bdgov.cdn-dl.cn",
      "mopa-gov-bd.dwnlld.com",
      "mopa-gov-bd.mail-govt.com",
      "mopa-gov-bd.snagdrive.org",
      "mopa-govbd.cdn-dl.cn",
      "mopa.gov.bd.mofa-govtpk.net",
      "mopa.gov.bd.pk-govt.net",
      "mopa.pk-govt.net",
      "mopf-gov-mm.direct888.net",
      "mopiler.top",
      "mora-govpk.co",
      "mora.govpk.live",
      "mora.pdfadobe.com",
      "moragovt.net",
      "mos-gov-bd.snagdrive.com",
      "mos.gov.bd.pk-mail.org",
      "moto.dirctt88.co",
      "mowr-gov-pk.loadpath.net",
      "mowr.gov.pk.mail-pk.org",
      "mozilla.apl-org.online",
      "mpnr.govpk.me",
      "mpt-ap.servehttp.com",
      "ms-db.net",
      "ms-ethics.net",
      "ms-office.app",
      "ms-office.pro",
      "ms-trace.net",
      "ms.dufichiers.fr",
      "ms.teckblog.live",
      "msacn.ntcpk.net",
      "msftupdate.srv-cdn.com",
      "mshealthcheck.live",
      "msofficeupdate.vagued.live",
      "msofficeupdator.vagued.live",
      "msoft-updt.net",
      "msonlineoffice.com",
      "mta-sts.crypto-wise.co",
      "mteron.info",
      "mtss.bol-south.org",
      "mu-api.anyremote.cn",
      "mv.gov-co.org",
      "mv.gov-org.net",
      "mx1.nepal.gavnp.org",
      "mx1.nepal.govnp.org",
      "mx2.nepal.gavnp.org",
      "mxhichina.info",
      "my-gov-confirm.org",
      "my.refnameit.life",
      "myanmar-apn.serveftp.com",
      "myanmar-gov-mm.fia-gov.net",
      "myanmar-org-mail.com",
      "myanmar.gov-co.org",
      "myoffice.fia-gov.net",
      "mystore.prepforce.site",
      "mytel-mm.servehttp.com",
      "myth.pkgov.org",
      "n2pro.pmreco.xyz",
      "na-gov-pk-meeting-pac.pages.dev",
      "na-gov-pk.workers.dev",
      "na.gov.mail-pk.org",
      "naatlibrary.com",
      "nactagovpk.org",
      "nadra-gov-pk.com",
      "nadra-gov.ee-visa.com",
      "nadra-gov.online",
      "nadra-gov.pt",
      "nadra-govpk.com",
      "nadra-interior.cdn-dl.cn",
      "nadra-moi.cdn-dl.cn",
      "nadra-pk.org",
      "nadra.gov-pk.com",
      "nadra.gov-pk.site",
      "nadra.gov.pk.d-dns.co",
      "nadra.gove.pw",
      "nadra.gvo-pk.cc",
      "nadra.pakgov.net",
      "nadra.update.customs-lk.org",
      "nadracloudx.pages.dev",
      "nanfung.servehttp.com",
      "narda-moi.cdn-dl.cn",
      "nastp-govpk.com",
      "nationalhelpdesk.pk",
      "nationpk.org",
      "navy-govbd.servehttp.com",
      "navy-lk.direct888.net",
      "navy-mil-bd-download.up.railway.app",
      "navy-mil-bd.jmicc.xyz",
      "navy-mil.co",
      "navy-pk-dils-maint213-ifwcnxl4.leapcell.dev",
      "navy-support.org",
      "navy.jmicc.xyz",
      "navy.lk.gov-co.org",
      "navy.lk.gov-org.net",
      "navy.mil.bd.officemuwork.online",
      "nbcot.info",
      "nbppakistan.com",
      "nccs.pk-gov.org",
      "ncoc.pakgov.net",
      "ncsc-gov.com",
      "ndma-govpak.org",
      "ndma-govpk.co",
      "ndma-govpk.info",
      "ndma.gov.pk-mailgov.com",
      "ndmagovpk.com",
      "neger.site",
      "nelcec.info",
      "nelpec.top",
      "nemln.pmreco.xyz",
      "nepal.gavnp.org",
      "nepal.gov.np.gov-co.org",
      "nepal.gov.np.mail-pk.org",
      "nepal.govnp.org",
      "nepalarmy-milnp.info",
      "nepalarmy.trans-del.net",
      "nepalcert-org.fia-gov.net",
      "nepalembassyusa.org.pk-govt.com",
      "nepalpolice-govnp.com",
      "nepembassy.org.uk.pk-govt.com",
      "nepra-org-pk.grabfiles.net",
      "nepra.org.pk.mail-pk.org",
      "nespak.com.pk-govt.net",
      "nespak.pkgov.org",
      "net-co.info",
      "net-co.live",
      "net-pk.org",
      "net-src.info",
      "net-src.org",
      "net.pk.hilsa.online",
      "neteease.cdn-dl.cn",
      "netof66867.workers.dev",
      "new-mof-budgetsgp-ars.zeabur.app",
      "new-year-message-from-the-chief-of-the-army-staff.gov1-lk.com",
      "new.apl-org.online",
      "newfile.pdf-download.live",
      "newmail-army-mil-bd-owa-apth-mail-dat.netlify.app",
      "newmail-army-mil-bd-pso-meeting-file.netlify.app",
      "newmail-armymilbd.servehttp.com",
      "newmailarmyy-53ufzg0t.b4a.run",
      "newmake.pw",
      "newmofa.com",
      "newmofa.org",
      "newoutlook.live",
      "news-bd.com",
      "news-bd.com.news-bd.com",
      "news-gov-cn.info",
      "news-lk.com",
      "news-pk-media.news",
      "news-ptvcompk.servehttp.com",
      "news.bitlyy.me",
      "news.dawnpk.org",
      "news.kdf-mail.com",
      "news.ntc-telecomcorporation.workers.dev",
      "news.pakgov.org",
      "news.pkrepublic.org",
      "newsinbbc.com",
      "newsroom247.xyz",
      "nextgen.fia-gov.net",
      "nextgen.paknavy-govpk.net",
      "ngmail-downloadsnew-pdf.up.railway.app",
      "nha-gov-pk-mohd-dam-hydropower-project.pages.dev",
      "nha-gov-pk.pakistan-gov-pk.workers.dev",
      "nhsrc.pakgov.net",
      "nhsrc.pk.gov-co.org",
      "nhsrcgovpk.servehttp.com",
      "nia-china-inviation-package-zip.netlify.app",
      "nic-share.myftp.org",
      "nic-svc.net",
      "nih.pk-mail.org",
      "niims.pakgov.org",
      "nima.ppra.live",
      "nims.nadra.gov-pk.com",
      "nitb-gov-pk-vpn-for-secure-webmail-access.pages.dev",
      "nitb-update-services.top",
      "nitb.pk-gov.org",
      "nitb.pkgov.org",
      "nitc.gavnp.org",
      "nitc.govnp.org",
      "nitcgov-np.hopto.org",
      "nju.edu.cn.81-cn.info",
      "nlc-govpk.servehttp.com",
      "nlc.pkgov.org",
      "nocet.info",
      "nolotion.info",
      "nomination.army-bd.com",
      "nomination.info-bdgov.com",
      "nopler.live",
      "noreplyuser.site",
      "normal.aeryple.xyz",
      "norter.xyz",
      "note.info-bdgov.com",
      "note1582023.govpk.info",
      "notice.portdedjibouti.live",
      "notifications-khmod.d0cumentview.info",
      "np.gov-co.org",
      "np.gov-org.net",
      "np.govt-net.com",
      "np.govt-pk.com",
      "np.mail-pk.org",
      "np.officemuwork.online",
      "np.pk-mail.org",
      "np.pkgov.org",
      "npc.gov.np.officemuwork.online",
      "nr3c-govpk.com",
      "nrdi-gov.com",
      "nrdi-govt.com",
      "nrlpak.pkgov.org",
      "nrots.net",
      "nrtc-com-pk.pages.dev",
      "nrtc-supporl2.com",
      "nrtc-support.com",
      "nrtcpk-net.com",
      "ns.seiffenn.nohost.me",
      "ns1.army-lk.org",
      "ns1.news-bd.com",
      "ns1.news-bd.com.news-bd.com",
      "ns1.pkgov.org",
      "ns2.army-lk.org",
      "ns2.news-bd.com",
      "ns2.pkgov.org",
      "nsc-gov.com",
      "nsc-gov.net",
      "nslow.pmreco.xyz",
      "nsvay8faydj3f79dje9djr02j101c4a583c3acdd2a06ca2fb183cf995.pages.dev",
      "ntc-06gd0upz.b4a.run",
      "ntc-firewall.safeurl-content.online",
      "ntc-gov.com",
      "ntc-govpk.serveftp.com",
      "ntc-govpk.servehalflife.com",
      "ntc-govpk.servehttp.com",
      "ntc-net.co",
      "ntc-net.com",
      "ntc-pak.org",
      "ntc-pk.com",
      "ntc-pk.org",
      "ntc-pk.sytes.net",
      "ntc-telecomcorporation.workers.dev",
      "ntc-telecommunication-safecity.workers.dev",
      "ntc.gov-pk.online",
      "ntc.gov.pk.hilsa.online",
      "ntc.gov.pk.viewdoc.online",
      "ntc.net.pk.bismi.pro",
      "ntc.net.pk.hilsa.online",
      "ntc.pkgov.org",
      "ntcmail.gov-pk.online",
      "ntcpak.live",
      "ntcpak.org",
      "ntcpk.co",
      "ntcpk.info",
      "ntcpk.net",
      "ntdc-govpk.viewdns.net",
      "ntdc.pkgov.org",
      "nucleusvision.co",
      "nudt.edu.cn.81-cn.info",
      "nugmyanmar.org.gov-co.org",
      "numpy.info",
      "numzy.net",
      "nventic.info",
      "nvloi.mofagovbd.com",
      "o.nr3c-govpk.com",
      "o1ghs.pmreco.xyz",
      "oalems.com",
      "obituary.workers.dev",
      "ofa-gov-pk.asianetnews.xyz",
      "ofac-gov.net",
      "ofc.cloudpmo.top",
      "ofc.mofserviceserver.top",
      "offer-ptclnetpk.servehttp.com",
      "offers-ptclnetpk.serveblog.net",
      "offers-ptclnetpk.serveftp.com",
      "offers-ptclnetpk.servehttp.com",
      "offers-ptclnetpk.serveirc.com",
      "office-addonsmis.com",
      "office-drive.live",
      "office.dirctt88.co",
      "office.document-viewer.info",
      "office.ntcpak.live",
      "office.pmd-office.info",
      "office.seoshz.live",
      "office365-server.ddns.net",
      "officedrive.live",
      "officemuwork.online",
      "offshore.leron.info",
      "ogdcl.pkgov.org",
      "ogdcl.servehttp.com",
      "ogdclcloud-mysharep.servehalflife.com",
      "oidc.idp.elogin.att.govt-pk.com",
      "oil.hascolgov.info",
      "oilplus1td.com",
      "oimc.cdn-pak.net",
      "ol.interior-ministry.com",
      "olerpic.info",
      "olipy.info",
      "onedrives.pk-gov.org",
      "onesom.biz",
      "onev.online",
      "online-csdgovpk.servehttp.com",
      "onlinestatus.live",
      "ootbp.pmreco.xyz",
      "openkm.paknavy-pk.org",
      "opensign-delta3e.com",
      "opertingsmail.us",
      "opesc.info",
      "opmcm-gov-np.fia-gov.net",
      "opmcm.govnp.live",
      "oprad.top",
      "opt.freay.tech",
      "org-co.net",
      "org-liv.net",
      "org.gov-co.org",
      "org.hitpak.org",
      "org.pk-mailgov.com",
      "org.pk.mail-pk.org",
      "orrwv.pmreco.xyz",
      "ortra.tech",
      "osacadmin.pk-mailgov.com",
      "ostcone.site",
      "outlook.gavaf.org",
      "outlookk.co",
      "ov-pk.workers.dev",
      "ov.bd.account.modern.sessions.webmailarmy.com",
      "ovil.tech",
      "owa-spamcheck.apl-org.online",
      "owa-suparco-gov-pk-logon-aspx.pages.dev",
      "owa-suparco-gov-pk-owa-autho.pages.dev",
      "p1x.live",
      "p2m3o4j3j101c4a583c3acdd2a06ca2fb183cf995mrfi34ur9rj40fm49.pages.dev",
      "paa.gov.pk-mail.org",
      "packageupdates.net",
      "paec.gov-pk.online",
      "paf-gov.com",
      "paf-gov.net",
      "paf-gov.org",
      "paf-govt.com",
      "paf-govt.info",
      "paf-govt.net",
      "paf-govt.org",
      "paf-mail.com",
      "paf-media.com",
      "paf-pk-gov.org",
      "paf.gov-mail.net",
      "paf.gov.pk.hilsa.online",
      "paf.gov.pk.viewdoc.online",
      "pafgovt.com",
      "pafmodernwebclient-srirj3dq.b4a.run",
      "pafroa.pak-gov.com",
      "pafwa.info",
      "page-view-mail.zeabur.app",
      "pak-army.com",
      "pak-gov-pk.workers.dev",
      "pak-gov.com",
      "pak-gov.info",
      "pak-gov.net",
      "pak-govt.net",
      "pak-navy.co",
      "pak-news.info",
      "pak-web.com",
      "pakarmslicense.com.pk",
      "pakarmslisense.com",
      "pakarmy-govpk.net",
      "pakbj.cdn-pak.net",
      "pakchinainvest.com.pakchinavest.info",
      "pakchinavest.info",
      "pakgov.net",
      "pakgov.org",
      "pakgovt.online",
      "pakgovt.site",
      "pakistan-gov-pk.workers.dev",
      "pakistan-mofa.cloud",
      "pakistan-server-auth0.cloudforme.top",
      "pakistanarmslicense.com",
      "pakistanarmy.xyz",
      "pakistangov.com",
      "pakmail.cloud",
      "pakmarines.com",
      "paknavy-gov-cvic.fbise.org",
      "paknavy-gov-pk.dirctt888.info",
      "paknavy-gov-pk.downld.net",
      "paknavy-gov-pk.mail-np.net",
      "paknavy-gov-pkp.downld.net",
      "paknavy-gov.com",
      "paknavy-gov.net",
      "paknavy-gov.org",
      "paknavy-govpk.com",
      "paknavy-govpk.info",
      "paknavy-govpk.net",
      "paknavy-govpk.org",
      "paknavy-pk.org",
      "paknavy.cloud",
      "paknavy.comsats.xyz",
      "paknavy.defpak.org",
      "paknavy.edu-cx.org",
      "paknavy.gov.pk-govt.com",
      "paknavy.gov.pk.ap1-port.net",
      "paknavy.gov.pk.mail-pk.org",
      "paknavy.gov.pk.pk-govt.com",
      "paknavy.govpk.email",
      "paknavy.govvv.pk",
      "paknavy.info",
      "paknavy.jmicc.xyz",
      "paknavy.live",
      "paknavy.modpak.live",
      "paknavy.mofa.live",
      "paknavy.net",
      "paknavy.online",
      "paknavy.org.pk",
      "paknavy.paknavy.live",
      "paknavy.rf.gd",
      "paknavy.store",
      "paknavy.tech",
      "paknavygov.org",
      "paknvay-pk.net",
      "pakoil.pkgov.org",
      "pakun-org.direct880.net",
      "pakun.org.pk-mailgov.com",
      "pakvisa.online",
      "pakvisanadra.gov-pk.com",
      "pakvisanadra.gov-pk.site",
      "paletec.live",
      "pandalyticsresearch.sbs",
      "panel.onesom.biz",
      "parchqwebmail.parco.pkgov.org",
      "parco.pkgov.org",
      "pareing.info",
      "pargue.tech",
      "parliament.lk.pk-mail.org",
      "pasb.mod.gov.pk-govt.com",
      "pasoale.info",
      "passapp.mailnic.info",
      "pastlet.live",
      "paypal.es-profils.me",
      "pbm-gov-pk.ignitebiz.de",
      "pc-gov-pk.download-doc.com",
      "pc-gov-pk.downnload.net",
      "pc.gov-pk.online",
      "pc.gov.pk-mail.org",
      "pc.gov.pk.mail-pk.org",
      "pc.govpk.me",
      "pd.gov.bd.pk-mail.org",
      "pdf-download.live",
      "pdf-downlod.com",
      "pdf-shanstate.redirectme.net",
      "pdf-shanstate.serveftp.com",
      "pdfadobe.com",
      "pdfofficialdocument.com",
      "pdfrdr-update.com",
      "pdfrdr-update.info",
      "pectec.live",
      "pemra.gov.pk-mail.org",
      "permitinterior.gov-pk.com",
      "permitinterior.gov-pk.site",
      "permitsinteriors-gov-pk.com",
      "pertest-ntdccompk.ddnsking.com",
      "phone-update.click",
      "piac-compk.servehttp.com",
      "pimec-paknavy.updates-installer.store",
      "pimec.gov.mail-pk.org",
      "pimec.gov.pk.mail-pk.org",
      "pin-up.amazingbonis.com",
      "pinup.greatslols.com",
      "pitb.gov-pkgov.workers.dev",
      "pitb.zapto.org",
      "pk-cam.online",
      "pk-cc.com",
      "pk-co.info",
      "pk-ev.online",
      "pk-go.net",
      "pk-gods.com",
      "pk-gov.org",
      "pk-govt.com",
      "pk-govt.net",
      "pk-hhq.cc",
      "pk-hq.cc",
      "pk-hq.qrrl.net",
      "pk-hq.us",
      "pk-hqr-online.co",
      "pk-hqr.co",
      "pk-hqr.online",
      "pk-ht.pk",
      "pk-mail.org",
      "pk-mailgov.com",
      "pk-o.xyz",
      "pk-post.top",
      "pk-qrs.online",
      "pk-soft.online",
      "pk.1.modp-pk.org",
      "pk.2let.org",
      "pk.emaiil.co",
      "pk.gmail.com.pk-mailgov.com",
      "pk.hilsa.online",
      "pk.kdf-mail.com",
      "pk.mail-pk.org",
      "pk.modp-pk.org",
      "pk.officemuwork.online",
      "pk.pk-mail.org",
      "pk.pk-mailgov.com",
      "pkcert-arbeitssicherheit.de",
      "pkcert-gov-pk.workers.dev",
      "pkcert.com",
      "pkcert.gov.pk-mail.co",
      "pkcert.live",
      "pkcert.net",
      "pkcert.news",
      "pkcert.org",
      "pkcert.report",
      "pkflix.bitlyy.me",
      "pkflix.tin-url.com",
      "pkgov-mail.com",
      "pkgov.org",
      "pkgov.xyz",
      "pkgovk.info",
      "pkinfo.live",
      "pkmpunjabcode.com",
      "pkpolice.gov.pk-mail.org",
      "pkrepublic.org",
      "pl1.mov",
      "plaaf-a1irshow-registrati0n-2024.netlify.app",
      "plaaf-zhuhaiairshow-registration-2024.netlify.app",
      "plainboardssixty.com",
      "plandiv.gov.bd.gov-co.org",
      "play-store.co",
      "playservicess.com",
      "playsevices.com",
      "playstore.cloud",
      "plbulcbo.fia-gov.com",
      "plokin.top",
      "plors.tech",
      "pm-gov.cloud",
      "pmad-gov-pk-2fa-registration.pages.dev",
      "pmaesa.bahariafoundation.org",
      "pmaesa.pakmarines.com",
      "pmd-offc.info",
      "pmd-office.com",
      "pmd-office.info",
      "pmd-office.live",
      "pmd-office.org",
      "pmd.paknavy-gov.com",
      "pmdc.gov.pk-hq.cc",
      "pmdu-gov.org",
      "pmmd.treasury.gov.lk.mail-pk.org",
      "pmo-gov-pk.file-dwnld.net",
      "pmo-gov-pk.filenest.live",
      "pmo-gov-pk.loadpath.info",
      "pmo-gov-pk.net-src.org",
      "pmo-gov-pk.snagdrive.com",
      "pmo.cdn-load.net",
      "pmo.documents-server-pk.top",
      "pmo.gov.bd.mofa-govlk.com",
      "pmo.gov.bd.pk-govt.com",
      "pmo.gov.pk-mail.org",
      "pmo.gov.pk.hilsa.online",
      "pmo.gov.pk.pk-govt.com",
      "pmo.nationalhelpdesk.pk",
      "pmofficepakistancloudserver.shiftroof.top",
      "pmreco.xyz",
      "pmrugb.gov.pk",
      "pmsa.paknavy.live",
      "pmsa.pkgov.org",
      "pn0fficial.info",
      "pncert.info",
      "pncert.pro",
      "pnra-gov-view.000webhostapp.com",
      "pnra.gov-pk.online",
      "pnra.pk-govt.net",
      "pnra.pk-mail.org",
      "pnscpk.com",
      "pnwc-gov-pk.pakmarines.com",
      "pnwc.bahariafoundation.live",
      "pnwc.bahriafoundation.live",
      "pnwc.bol-north.com",
      "po.gov.mv.gov-co.org",
      "po.gov.mv.gov-org.net",
      "pof.gov.pk.viewdoc.online",
      "police-circular-gov-bd.fia-gov.net",
      "police-gov-bd.donwloaded.com",
      "police-gov-bd.fia-gov.net",
      "police.fia-gov.com",
      "police.gov.bd.pk-govt.com",
      "police.gov.bd.updatemind52.com",
      "policy.mail163cn.info",
      "policy.session-out.com",
      "polvcrit.info",
      "poly.cdn-pak.net",
      "polyinc-global.trans-del.net",
      "porket.info",
      "portal-ptclnetpk.servehttp.com",
      "portal.alibababackupcloud.com",
      "portal.breat.info",
      "portdedjibouti.live",
      "portdedjibouti.shipping-policy.info",
      "portdjibouti.pmd-office.org",
      "portmin-gov-lk.fetchdrive.org",
      "portmin.download-msoffice.com",
      "portmin.gov.lk.mail-pk.org",
      "posta-nhq43i6x.b4a.run",
      "postfix.hondeman.net",
      "postmaster.net-co.info",
      "power-govpk.org",
      "pp4gk.pmreco.xyz",
      "ppinewsagency.live",
      "ppra.live",
      "ppra.org.pk.mail-pk.org",
      "pqa-gov-pk.workers.dev",
      "pqa.gov.pakmarines.com",
      "pr-21356.expo.dev",
      "preag.info",
      "preat.fujit.info",
      "preat.info",
      "premier.mods.email",
      "premier.moittpk.org",
      "prepforce.site",
      "president-gov-ik.donwloaded.net",
      "president-gov-lk.donwloaded.net",
      "presidentoffice.lk.gov-co.org",
      "presidentoffice.lk.gov-org.net",
      "presidentsoffice-gov-lk.dytt888.org",
      "presidentsoffice.lk.mofa-govtpk.net",
      "presidentsoffice.mofa-govlk.org",
      "preview-attachments-f1les-0pen-pdf.netlify.app",
      "preview-mail-from-mofa-gov-pk-user-com-center.malik-jaani786.workers.dev",
      "primary.news-bd.com",
      "prison-gov-bd.dwnlld.info",
      "prisons.punjab.gov.pk-govt.com",
      "prisons.punjab.govt-pk.com",
      "prisons.punjab.pk-govt.com",
      "prisons.punjab.pk-govt.net",
      "privacy.olerpic.info",
      "private.hldren.info",
      "probashi-gov-bd.mail-govt.org",
      "probashi-gov-bd.net-src.info",
      "proey.tech",
      "prol.info",
      "promotionlist.comsats-net.com",
      "psdgbgb-cell.github.io",
      "psdph.dopm.gov.np.totheeverest.com",
      "psw-gov-pk.net",
      "pt.pakgov.net",
      "pta-gov-pk.workers.dev",
      "pta-govpk.com",
      "pta.gov-pk.online",
      "pta.mail-pk.org",
      "ptcl-gov.com",
      "ptcl-gov.info",
      "ptcl-gov.net",
      "ptcl-gov.org",
      "ptcl-govp.org",
      "ptcl-net.com",
      "ptcl.govpk.live",
      "ptcl.pkgov.org",
      "ptd.gov.bd.pk-mail.org",
      "ptdi.govt-net.com",
      "ptgovt.top",
      "ptpkp-govt.site",
      "ptpkp.gov-pk.com",
      "ptt-govt.blog",
      "ptt-govt.ink",
      "ptt-govt.lat",
      "pttgovt.bond",
      "ptv.pkgov.org",
      "pubad-gov-ik.fia-g0v.net",
      "pubad-gov-lk.donwloaad-file.com",
      "pubad-gov-lk.downld.org",
      "pubad-gov-lk.download-doc.net",
      "pubad-gov-lk.fia-g0v.net",
      "pubad-gov-lk.filenest.live",
      "pubad-gov-lk.filenesthub.org",
      "pubad-gov-lk.grabfiles.net",
      "pubad-gov-lk.interior-ministry.com",
      "pubad-gov-lk.live-co.org",
      "pubad-gov-lk.loadpath.net",
      "pubad-gov-lk.net-src.info",
      "pubad-gov-lk.org-co.net",
      "pubad-gov-lk.org-liv.net",
      "pubad.gov.lk.govt-pk.com",
      "pubad.gov.lk.mail-pk.org",
      "pubad.gov.lk.mofa-govtpk.net",
      "pubad.gov.lk.pk-mail.org",
      "pubad.gov.lk.pk-mailgov.com",
      "pubad.mofa-govlk.org",
      "pubsec.gov.lk.gov-co.org",
      "pujfjue003hmdhfh99ppjdflsdqwlkls.g0v-pk.net",
      "punjab-bankpk.org",
      "punjab-ministry-pk.com.gov-co.org",
      "punjab-pk.org",
      "punjab.gov.pk-govt.net",
      "punjab.gov.pk-mail.org",
      "punjab.gov.pk.hilsa.online",
      "punjab.interior-pk.org",
      "punjabgov.org",
      "punjabgovpk.org",
      "punjabgovpolice.org",
      "punjabpolice-gov-pk.dowmload.co",
      "punjabpolice-gov-pk.fia-gov.com",
      "punjabpolice-pk.org",
      "punjabpolice.gov-pk.com",
      "punjabpolice.gov-pk.site",
      "punjabpolice.gov.pk-govt.com",
      "punjabpolice.gov.pk-govt.net",
      "punjabpolice.gov.pk-mail.org",
      "punjabpolice.gov.pk.standingoperatingprocedureforemergencythreat.cdn-in.net",
      "punjabpolicegovernmentofpakistan.org",
      "punjabpolicegovpk.org",
      "punjabpolicepakistan.org",
      "punjabsafecities.com",
      "pygovt.com",
      "qa.min-pk.com",
      "qakt3.pmreco.xyz",
      "qh.min-pk.com",
      "qhacgeao.pmdu-gov.org",
      "qq.mailcloucl.com",
      "qrpk.info",
      "qrrl.net",
      "quickhelpsolve.com",
      "quran-books.store",
      "quwa-paf.servehttp.com",
      "r.nr3c-govpk.com",
      "r0dps.net",
      "rack.nelcec.info",
      "radio.pkgov.org",
      "ramdaanvibe.info",
      "rancher.cssc.info",
      "reas.tech",
      "reasoen.org",
      "reawk.net",
      "reay.tech",
      "recovar.org",
      "recred.live",
      "redzone.apl-org.online",
      "redzone2.apl-org.online",
      "reecesayer.com",
      "refnameit.life",
      "register.srvapp.co",
      "reliefweb.int.pk-mailgov.com",
      "reports.dgps-govtpk.com",
      "repta.live",
      "republicofaf.xyz",
      "resolve.preat.info",
      "restless-brook-f09b.boundschain.workers.dev",
      "reth.cvix.cc",
      "reveal.troks.site",
      "rewards-ptclnetpk.servehttp.com",
      "rewards-ptclnetpk.viewdns.net",
      "rgdtyt.aeltron.xyz",
      "ridlay.live",
      "ritenoc.live",
      "rk7l0o.onesom.biz",
      "rkvisa200de.edu-cx.org",
      "rmdjkuceitapp.grabfiles.org",
      "rnail.mfa-qov.com",
      "rnail.mofa-qov.com",
      "rock.tonse.info",
      "roensa.xyz",
      "roncez.tech",
      "roof.wsink.live",
      "routinework.sbs",
      "royal-field-9144.girlfriendparty42.workers.dev",
      "royalmigration.buzz",
      "rrkvisa200de.edu-cx.org",
      "rugby.wsink.live",
      "rustore.fetchdrive.info",
      "rustore.pmreco.xyz",
      "ruve.live",
      "s12.cdn-apn.net",
      "s2.cdn-edge.net",
      "s3-ap-northeast-1-amazonaws-com.pages.dev",
      "s3-eu-central-1amazonaws-com-2n4.pages.dev",
      "s3-network-pakistan.online",
      "saarc-sec-org.snagdrive.com",
      "safecityctd.com",
      "safeurl-content.online",
      "saffsdf-fgjhhgj-fhfgjrt65df-tfgy54hgf.netlify.app",
      "salary-cutting.session-out.com",
      "salary-cuxxing.session-out.com",
      "samaa-tv.com",
      "sarabanmithnavvtni-mil.com",
      "sarabanmithnavy.tni-mil.com",
      "sbd1u.pmreco.xyz",
      "sbp-pk.org",
      "sbp.pakgov.org",
      "scan.update.fia-gov.org",
      "scandalsofallovertheworld.gov-pk.com",
      "school.gov-pk.pk",
      "sco.gov-pk.online",
      "sco.gov.pk.hilsa.online",
      "sco.gov.pk.viewdoc.online",
      "sco.mail163cn.info",
      "sco.pkgov.org",
      "sco.pkgov.xyz",
      "sco.zapto.org",
      "scout.fontsplugins.com",
      "scouttable.xyz",
      "scrabt.tech",
      "screenpont.xyz",
      "sd1-bin.net",
      "sdf-sdgyhsdfg-sdfglksdjh-sdglkjsdglhks-gsdflsdfhhsdfgjklls.pages.dev",
      "sdfgsdfsdhfgdfgdsgfsdjfdjsghfsdgfjkdsfdsbfbsdfjksdkjfdsfks.pages.dev",
      "sdfsdf-tfghfghf546rty6ytuuyjgutyjghj-rtfytr54fghf-fghfg-fg.pages.dev",
      "sdfsdg.enclose.info",
      "sdfsdgfsd-sdfjdgsjff-sdfg44gdfgjf-dfghkjfdhkj-dfgklhfghklf.pages.dev",
      "sdgf9af72f31706769d32bf1ff66cdec1d1gkj5jg95jg5k0hkg95kg0tk.pages.dev",
      "sdgsfg.cssc.info",
      "sdkfjsh23-sdfgdklhg4-efglhdfg4-dfgjkl.netlify.app",
      "sdmx-financegovpk.servehttp.com",
      "sec-vpn.bitlyy.me",
      "secp.pakgov.org",
      "secure-ntc.net",
      "secure.alibababackupcloud.com",
      "secure.tin-url.com",
      "securecheker.in",
      "securedesk.one",
      "security-it1.com",
      "securitycouncilreport.org.pk-mailgov.com",
      "see.gov.np.unsilk.com",
      "seiffenn.nohost.me",
      "sellersprofile.sbs",
      "semain.tech",
      "senate-pak.site",
      "senine.info",
      "seoshz.live",
      "sepweo.info",
      "sercha.info",
      "sercoten.info",
      "serve-dropbx-ap-east1.cdn-dl.cn",
      "server.mofagov.online",
      "server.oilplus1td.com",
      "service.mod-gov.org",
      "service.mofss.co",
      "service.ntc-net.co",
      "service.pak-ntc.org",
      "service.pkgov-mail.com",
      "service.true-islam.org",
      "services-download.top",
      "services-pk-users.top",
      "services-ptclnetpk.servehttp.com",
      "session-expired-file-download-cetcimail.pages.dev",
      "session-out.com",
      "sezti.org",
      "sg21-production.up.railway.app",
      "sgad-punjab-gov-pk.dirctt888.info",
      "sgad.punjab.gov.pk-govt.net",
      "shafaftech.com",
      "shaheenfoundation.mod-pak.co",
      "sharepakistan-mofa.viewdns.net",
      "sharepakistan.mofa-g0v-pk.workers.dev",
      "sharepakistanmofa.servehttp.com",
      "sharepoint-punjab.sharepoint-e13.workers.dev",
      "shiftroof.top",
      "shipping-policy.info",
      "shoemo.xyz",
      "shoprex.bitlyy.me",
      "shortney.org",
      "shrtny.co",
      "shrtny.live",
      "silk.freat.site",
      "silvon.site",
      "sinacn.co",
      "sinantion.com",
      "sindh.police.fia-gov.com",
      "sindhpolice-govpk.org",
      "sindhpolice.gov.pk-mail.org",
      "site4-map-com.zeabur.app",
      "sjfu-edu.co",
      "sk.krontec.info",
      "sl-navy.office-drive.live",
      "sl-navy.officedrive.live",
      "slap-games.club",
      "slic.live",
      "slpa-lk.nrdi-gov.com",
      "slpa.mod-gov.org",
      "slpa.news",
      "slservices-lk.com",
      "sltelecom.servehttp.com",
      "sltmobitel.hopto.org",
      "sltnet.lk.mail-pk.org",
      "sltnet.lk.pk-mailgov.com",
      "smmu.edu.cn.81-cn.info",
      "smstest.kdf-mail.com",
      "smtp.dytt888.net",
      "snagdrive.com",
      "snagdrive.org",
      "sngpl.com.pk-mail.org",
      "sngpl.org.pk",
      "snnp.gov.np.namlo.com.np",
      "sob.mofa-govlk.org",
      "social-welfare.ddns.net",
      "songlong88.net",
      "sopeor.com",
      "sp-nepalembassy-gov-np.dirctt88.co",
      "spacechina.com.81-cn.info",
      "spark.126-com.live",
      "sparrso-gov-bd.dirctt88.co",
      "sparrso.gov.bd.govt-pk.com",
      "sparrso.gov.bd.mofa-govlk.com",
      "sparrso.gov.bd.pk-govt.com",
      "spec.trelin.tech",
      "spfc-punjab-gov-pk.com",
      "spfc-punjab-gov-pk.online",
      "spfc-punjab-govpk.xyz",
      "spfc-punjab-pk.cc",
      "spfc-punjabgov-pk.co",
      "spfc-punjabgov-pk.com",
      "spfc.pk",
      "spfcpkm.online",
      "spfcpungov.site",
      "spfcpunjab-gov-pk.com",
      "spfcpunjabgov.com",
      "spfcpunjabsgovs.pk",
      "sphery.live",
      "split.tyoin.biz",
      "sppc.moma-pk.org",
      "sqrt.ovh",
      "square.oprad.top",
      "sri-lanka-it.com",
      "sri-lanka.it.com",
      "srilanka-navy.lforvk.com",
      "srilankanairlines.redirectme.net",
      "srilankanavy.ksew.org",
      "srv-app.co",
      "srvapp.co",
      "srvssl.cf",
      "ssgc.pkgov.org",
      "stae-org-mz.document-viewer.live",
      "stage.onesom.biz",
      "staging.grabfiles.org",
      "staging.onesom.biz",
      "state.gov.pk-mailgov.com",
      "storage-e13.sharepoint-e13.workers.dev",
      "storeapp.site",
      "straight.hldren.info",
      "submitsurvey.info",
      "sudden.nepalarmy-milnp.info",
      "suezcanal.portdedjibouti.live",
      "sui.nationalhelpdesk.pk",
      "summer.paf-gov.org",
      "suodeshui.cdn-dl.cn",
      "suparco-gov-pk-6866387a-44d0-8009-a76e-6948da2c3278.pages.dev",
      "suparco.gov-pk.online",
      "superback.space",
      "superset.mfa-qov.com",
      "support-gov.myftp.org",
      "support-ntc.servehttp.com",
      "support-twitter.com",
      "support-update.info",
      "support.cc-cvbs-sco.workers.dev",
      "support.gov-pak.org",
      "support.govt-pk.org",
      "support.it-pakistan-gov-pk.workers.dev",
      "supportgovpk.co",
      "supremeallah.world",
      "surveydocs.online",
      "surveyofpakistan.org",
      "swo-gov-pk.grabfiles.net",
      "swo.gov.pk.mail-pk.org",
      "syncscheduler.com",
      "synoslabs-test.com",
      "system-services-manual.life",
      "systemhealthservices.top",
      "systemupdateanalysis.blog",
      "systemupgradationservices.net",
      "t.bitlyy.me",
      "tab.gruve.site",
      "tactin.info",
      "tamhuudung.com",
      "tar-gz.net",
      "taxsys-fbrgovpk.servehttp.com",
      "tazze.co",
      "tchgin.site",
      "tcp.gov.pk-govt.net",
      "tdap.gov-pk.online",
      "teamchat.hopto.org",
      "techfriend.hopto.org",
      "technicaladivsory.click",
      "technicaladvisory.sbs",
      "technologysupport.help",
      "teckblog.live",
      "telcec.site",
      "telemart-pk.com",
      "telemart.bitlyy.me",
      "telenor-mm.redirectme.net",
      "tercom.site",
      "test.api.68wx.com",
      "test.api.g.luohu8.com",
      "test.api.hzy.68wx.com",
      "test.es.68wx.com",
      "test.fetchdrive.info",
      "test.fia-gov.com",
      "test.gbpay.gov.pk",
      "test.netof66867.workers.dev",
      "test.onesom.biz",
      "tex-ideas.info",
      "tfrend.org",
      "themegaprovider.ddns.net",
      "tiexue.cdn-dl.cn",
      "tight-lake-webuploader.malik-jaani786.workers.dev",
      "tiinly.co",
      "timeoflahore.com",
      "timoney.getexpo.com",
      "tin-url.com",
      "tinlly.co",
      "tinly.org",
      "tinurl.click",
      "tmlbxveb.fia-gov.com",
      "tni-mil.com",
      "tni-mil.org",
      "tnial-mil.net",
      "tod.treasury.gov.lk.mofa-govbd.com",
      "toepsai.tech",
      "tolera.live",
      "tonse.info",
      "torsey.xyz",
      "toss.tercom.site",
      "training-course-on-improving-safety.up.railway.app",
      "training.detru.info",
      "training.docx2a2e3e78e76bcc759905da3f1532a4b8c2word.download-msoffice.com",
      "trans-aws.net",
      "trans-can.net",
      "trans-del.net",
      "trans-pre.net",
      "tray.balcon.live",
      "treasury.gov.lk.mail-pk.org",
      "treasury.gov.lk.mofa-govbd.com",
      "treasury.gov.lk.pk-mail.org",
      "treasury.gov.lk.pk-mailgov.com",
      "treat.fraty.info",
      "treaty.balcon.live",
      "tref.tech",
      "trelin.tech",
      "trgdte.cdn-pak.net",
      "trik.live",
      "troks.site",
      "true-islam.org",
      "trust-crypto.net",
      "tsinghua-edu.tech",
      "tsinghua.edu.cn.81-cn.info",
      "tsinghua.institute",
      "tumet.info",
      "turkavic.org",
      "twilight-violet-55a5.malik-jaani786.workers.dev",
      "tyoin.biz",
      "u1x.co",
      "uat-updates.gateway.ceair.com.81-cn.info",
      "ubl.pakgov.org",
      "ubrig.live",
      "ujsen.net",
      "uk-gov.cyou",
      "uk-gov.icu",
      "uk-gov.qpon",
      "uk-gova.today",
      "uk.royalmigration.buzz",
      "un.org.pk-mailgov.com",
      "up2dts.online",
      "update-govpk.co",
      "update.apl-org.online",
      "update.customs-lk.org",
      "update.fia-gov.org",
      "update.ms-office.app",
      "update1.store",
      "updatemanager.ddns.net",
      "updatemaster.info",
      "updatemind52.com",
      "updatepdf.workers.dev",
      "updates-installer.store",
      "updates.moe.gov.cn.81-cn.info",
      "updotes.co",
      "updpcn.online",
      "updtesession.online",
      "uploads.ptcl-gov-pk.workers.dev",
      "upones.site",
      "uptownhigh.live",
      "upworkoffice.online",
      "user.onesom.biz",
      "usermail-output-panel.000webhostapp.com",
      "utilize.elopter.top",
      "uw9i.pmreco.xyz",
      "uy.vagued.live",
      "v1d.mov",
      "vaccine.moha.gov.np.webproxy.to",
      "vaccine.mohp.gov.np.webproxy.to",
      "vagued.live",
      "valac.biz",
      "vateno.info",
      "vehicleverificationsystem.com",
      "velopen.info",
      "veorey.live",
      "verification.ptcl.govpk.live",
      "verify.mod-defence-lk.workers.dev",
      "verocal.info",
      "vibe-ptclnetpk.servehalflife.com",
      "vibe-ptclnetpk.servehttp.com",
      "vibe-ptclnetpk.viewdns.net",
      "view.full.pdf.file.up2dts.online",
      "view.proey.tech",
      "viewdoc.online",
      "viewpdfonline-1wgtaeus.b4a.run",
      "vim.kdf-mail.com",
      "vinver.live",
      "visa-nadra-gov-pk.desynt.com",
      "visa-nadra-gov-pk.info",
      "visa-nadra-gov-pk.lubeleaf.com",
      "visa-nadra-gov-pk.pages.dev",
      "visa-nadra-gov-pk.pk",
      "visa-nadra-gov-pk.shafaftech.com",
      "visa-nadra-gov-pk.xo.je",
      "visa.nadra-gov.click",
      "visa.nadra-gov.online",
      "visa.nadra-gov.pt",
      "visa.nadra.gov-pak.com",
      "visa.nadra.gov-pk.info",
      "visa.nadra.gov.pk-cam.online",
      "visa.nadra.gov.pk-cc.com",
      "visa.nadra.gov.pk-ev.online",
      "visa.nadra.gov.pk-o.xyz",
      "visa.nadra.gov.pk.com-e-visa.online",
      "visa.nadra.gov.pk.pakvisa.online",
      "visa.nadra.gov.pk.rdpip.com",
      "visa.nadra.gov.qrpk.info",
      "visa.nadra.gove.pw",
      "visa.nadra.gvo-pk.cc",
      "vistavue.shop",
      "vlc-services.cfd",
      "vmi1789770.contaboserver.net",
      "vmi2186317.contaboserver.net",
      "volt.ruve.live",
      "vopler.tech",
      "voyage-prive.com.ru",
      "vpdf.online",
      "vpn-ptclnetpk.servehalflife.com",
      "vpn-ptclnetpk.servehttp.com",
      "vpn-ptclnetpk.viewdns.net",
      "vpn-secure.co",
      "vpn.alibababackupcloud.com",
      "vpn.fia-gov.com",
      "vpn.pakgov.net",
      "vpn.tin-url.com",
      "vpsaren.site",
      "vrms.bangladeshbaank-gov-bd.workers.dev",
      "vtray.tech",
      "wandering-pond-e7f4.foxiproxi.workers.dev",
      "wapda.gov.mail-pk.org",
      "wapda.pkgov.org",
      "wapda.pkgov.xyz",
      "warecon.xyz",
      "watch-earn.live",
      "we-are-under-gain.000webhostapp.com",
      "web.sngpl.org.pk",
      "webapp-getdocumentodwnload-pacapp.malik-jaani786.workers.dev",
      "webarchive-datacenter.herokuapp.com",
      "webdisk.bdgov.info",
      "webdisk.govpk.info",
      "webdisk.govpk.live",
      "webdisk.mofagov-pk.online",
      "webdisk.news-bd.com",
      "webdisk.pk-mail.org",
      "webdisk.pk-mailgov.com",
      "webmaii-bcc-gov-bd-newfiles.up.railway.app",
      "webmail-accbt.hopto.org",
      "webmail-gda-gov-pk.gwadarportt.workers.dev",
      "webmail-gov-pk-action-plan-cpec-inbox-download.pages.dev",
      "webmail-hubpower-com-error.pages.dev",
      "webmail-mofa-gov-pk.zeabur.app",
      "webmail-morrgovaf.hopto.org",
      "webmail-pacorgpk.myvnc.com",
      "webmail-pnra.gov-pk.workers.dev",
      "webmail-wapda-gov-pk.pakistan-gov-pk.workers.dev",
      "webmail.bdgov.info",
      "webmail.cybar-net-pk.workers.dev",
      "webmail.cybernet.pkgov.org",
      "webmail.fwo.com.pk.docum.store",
      "webmail.gavaf.org",
      "webmail.govpk.info",
      "webmail.govpk.live",
      "webmail.mfa-gov.net",
      "webmail.mofa-gov-qa.gq",
      "webmail.mofagov-pk.online",
      "webmail.news-bd.com",
      "webmail.pakchinainvest.com.pakchinavest.info",
      "webmail.pk-mail.org",
      "webmail.pk-mailgov.com",
      "webmail.police.gov.bd.updatemind52.com",
      "webmail.ssgc.pkgov.org",
      "webmail.wapda.pkgov.org",
      "webmailarmy.com",
      "webserv-redir.net",
      "webservermail-g2689far.b4a.run",
      "wetransfer.servehttp.com",
      "wg.direct880.net",
      "whale.pkgov.org",
      "whm.pk-mail.org",
      "whm.pk-mailgov.com",
      "wide.storeapp.site",
      "widge.info",
      "win-service-update.top",
      "wind.ridlay.live",
      "windows-update.hopto.org",
      "windowupdate.myftp.org",
      "winger.live",
      "winhost.redirectme.net",
      "winupdate.redirectme.net",
      "wl8aq8.nocet.info",
      "wmail-zim-gov-rj-se-sp-br-63330a.netlify.app",
      "wndro.fia-gov.com",
      "wnic-svc.net",
      "word.download-msoffice.com",
      "worker-crimson-bread-052d.crypton0019.workers.dev",
      "worker-orange-unit-abfb.gwadarportt.workers.dev",
      "worker-plain-wind-01a9.pakistan-gov-pk.workers.dev",
      "workermdxxx.naychilin-pk.workers.dev",
      "wpda-mom-meeting-invitation-letter.netlify.app",
      "wps-hakjgyu.top",
      "wps-yoiuzuiof.top",
      "wqkwqcwvcn.filenest.live",
      "wqqwysd-qwbeaxsb.zeabur.app",
      "wsde.pakgov.net",
      "wsed.pkrepublic.org",
      "wsink.live",
      "ww1.govpk.info",
      "ww2.pakgov.net",
      "ww25.govpk.info",
      "ww25.mail-dmp-navy-pk.dytt88.org",
      "ww25.ministryofforeignaffairs-mofa-gov-pk.dytt88.org",
      "ww38.govpk.info",
      "www-airforcelk-preview-com.netlify.app",
      "www-airport-lk.mail-gov.org",
      "www-army-mil-bd.dirctt88.co",
      "www-army-mil-bd.dowmload.co",
      "www-cabinetoffice-gov-lk.mail-govt.org",
      "www-cbsl-gov-lk.download-doc.com",
      "www-cbsl-gov-lk.download-doc.net",
      "www-cbsl-gov-lk.dwnlld.com",
      "www-cbsl-gov-lk.dwnlld.info",
      "www-cbsl-gov-lk.dwnlld.infomfa-gov-lk.dwnlld.info",
      "www-cbsl-gov-lk.fia-g0v.net",
      "www-cbsl-gov-lk.filenest.live",
      "www-cbsl-gov-lk.grabfiles.net",
      "www-cbsl-gov-lk.loadpath.info",
      "www-cbsl-gov-lk.snagdrive.com",
      "www-ccdi-gov-cn.hkbmwzone.com",
      "www-cdn.net",
      "www-chinaneast-gov-cn.videoem.com",
      "www-commerce-gov-pk.fia-g0v.net",
      "www-communications-gov-pk.fetchdrive.org",
      "www-creditjx-gov-cn.aaaqb.com",
      "www-customs-gov-lk.net-co.info",
      "www-enfotss-gov-ao.pages.dev",
      "www-erd-gov-lk.downld.org",
      "www-erd-gov-lk.dwnlld.info",
      "www-erd-gov-lk.nic-svc.net",
      "www-establishment-gov-pk.fia-g0v.net",
      "www-fbr-gov-pk.direct880.net",
      "www-fbr-gov-pk.donwloaad-file.com",
      "www-finance-gov-pk.fetchdrive.org",
      "www-finance-gov-pk.filenesthub.org",
      "www-finance-gov-pk.grabfiles.net",
      "www-finance-gov-pk.loadpath.net",
      "www-foreignaffairs-nepal-com.netlify.app",
      "www-hernandarias-gov-py.pages.dev",
      "www-kashmirawareness-org.loadpath.net",
      "www-mof-gov-np.mail-govt.com",
      "www-moha-gov-lk.direct888.net",
      "www-mopa-gov-bd.dytt888.org",
      "www-navl-com-lk.pages.dev",
      "www-ndma-gov-pk.interior-ministry.com",
      "www-nea-gov-cn.fetchdrives.info",
      "www-nepalgovernment-genz-agendapdf.netlify.app",
      "www-officialregistration-accounts.netlify.app",
      "www-opmcm-gov-np.direct888.net",
      "www-parliament-lk.snagdrive.com",
      "www-pmo-gov-pk.dytt888.net",
      "www-police-gov-bd.direct888.net",
      "www-prc-mhapsd-gov-bd.mail-govt.com",
      "www-presidentsoffice-gov-lk.dwnlld.com",
      "www-presidentsoffice-gov-lk.dytt888.org",
      "www-punjabpolice-gov-pk-sopforsecurityofforeignersandchinese.trans-aws.net",
      "www-sbp-org-pk.interior-ministry.com",
      "www-securitycouncilreport-org.direct880.net",
      "www-shshjs-gov-cn.videoem.com",
      "www-srilankanavy-cabinet-decision.netlify.app",
      "www-tic-gov-tl.outlookowa.com",
      "www-tic-gov-tl.selectpaw.com",
      "www-tjlsj-gov-cn.syyjc.net",
      "www-toki-gov-tr.sa.com",
      "www-treasury-gov-lk.downld.org",
      "www-treasury-gov-lk.filenest.live",
      "www-treasury-gov-lk.nic-svc.net",
      "www-treasury-gov-lk.org-liv.net",
      "www-treasury-gov-lk.snagdrive.com",
      "www-unocha-org.mail-svr.co",
      "www-ymbq-gov-cn.drron.net",
      "wwww.direct888.net",
      "wwww.govpk.info",
      "wwww.invitation-letter.govpk.info",
      "wwww.mofa-gov-sa.direct888.net",
      "wwww.notice.portdedjibouti.live",
      "wwww.portdedjibouti.live",
      "xcfhg.dwnlld.info",
      "xdappxz.vip",
      "xdlxweb.vip",
      "xmpp-upload.seiffenn.nohost.me",
      "xn--micosoftonline-iwc.com",
      "xuzeest.buzz",
      "xyz.kdf-mail.com",
      "y1x.org",
      "y9zz2.pmreco.xyz",
      "yahoo.com.mofa-govbd.com",
      "yahoo.edu-cx.org",
      "yayoi.it.com",
      "yerac.live",
      "yes2khalistan.online",
      "yfghvjb.paknavy.live",
      "yhue2.pmreco.xyz",
      "yrak.info",
      "za.mail-pk.org",
      "zamannindaindirimlerimm.com",
      "zeanos.live",
      "zed.shrtny.live",
      "zeltech.live",
      "zero-berlin-covenant.apl-org.online",
      "zhenpinxuanji.vip",
      "zhuhai-a1rsh0w-reg1strat1i0n-2o24.netlify.app",
      "zimbra-com.up.railway.app",
      "zimbra-nyatel-production.up.railway.app",
      "zimbra10-internationalrelation40-beep5751-brqupv53.leapcell.dev",
      "zimbra10-nml3wp-max8143-3ipio7e5.leapcell.dev",
      "zimbra10-nml3wp-max8143-fn1rsf7l.leapcell.dev",
      "zimbramail-nayatel-com.zeabur.app",
      "zimbramail-nayatel.leapcell.app",
      "zimbramail-nyatel-com.up.railway.app",
      "zimramail-nayatel.girlfriendparty42.workers.dev",
      "ziptec.info",
      "zlaeso.xyz",
      "zmail.ptcl.pkgov.org",
      "zolosy.top",
      "zone.vtray.tech",
      "zoom.osutuga7.workers.dev",
      "zretw.xyz",
      "zruod.pmreco.xyz",
      "zyu43.pmreco.xyz"
    ],
    "ipv4": [
      "110.10.176.193:4443",
      "141.136.0.91:443",
      "144.91.72.17:8080",
      "149.102.131.122:41521",
      "151.236.11.147:57670",
      "164.68.108.153:4142",
      "164.68.108.153:5000",
      "164.68.108.153:8062",
      "167.86.94.42:18745",
      "173.212.242.43:57149",
      "185.159.128.117:443",
      "185.225.17.239:443",
      "185.225.19.46:4589",
      "185.225.19.46:4875",
      "193.200.16.230:443",
      "202.58.104.100:81",
      "213.227.154.175:443",
      "31.15.17.230:443",
      "31.58.137.246:443",
      "38.60.235.109:9876",
      "46.8.226.5:443",
      "47.236.177.123:9090",
      "47.76.135.130:443",
      "47.84.196.148:443",
      "5.230.40.141:443",
      "5.230.42.202:443",
      "5.230.43.203:443",
      "5.230.52.133:443",
      "5.230.54.162:443",
      "5.230.54.63:443",
      "5.230.55.29:443",
      "5.230.70.181:443",
      "5.230.71.148:443",
      "5.230.74.96:443",
      "5.230.77.142:443",
      "5.252.178.27:443",
      "5.252.178.27:9889",
      "62.171.172.199:443",
      "62.171.172.199:81",
      "62.171.172.199:88",
      "62.171.187.53:43",
      "62.171.187.53:44",
      "62.171.187.53:45",
      "64.46.102.122:8443",
      "64.46.102.26:443",
      "64.46.102.63:8443",
      "74.125.196.113:53",
      "8.222.250.160:443",
      "89.46.65.19:443",
      "91.193.18.248:443"
    ],
    "url": [
      "cornerstonebeverly.org/js/files/DRDO-K4-Missile-Clean-room",
      "cornerstonebeverly.org/js/files/docufentososo/doecumentosoneso/pantomime.hta",
      "cornerstonebeverly.org/js/files/ntfonts/",
      "cornerstonebeverly.org/js/files/ntfonts/avena",
      "http://111.229.73.84",
      "http://112.13.121.89",
      "http://146.190.235.137",
      "http://149.129.237.253",
      "http://160.20.147.84",
      "http://167.86.116.39",
      "http://185.159.128.117",
      "http://185.163.47.226",
      "http://185.243.112.186",
      "http://185.248.101.231",
      "http://185.248.102.15",
      "http://194.32.76.244",
      "http://213.109.192.93",
      "http://213.183.55.52",
      "http://213.227.154.175",
      "http://31.15.17.230",
      "http://31.58.137.246",
      "http://45.153.240.66",
      "http://45.92.156.114",
      "http://46.30.188.222",
      "http://46.8.226.5",
      "http://47.76.135.130",
      "http://47.84.196.148",
      "http://5.2.79.135",
      "http://62.171.172.199",
      "http://78.142.29.118",
      "http://8.222.250.160",
      "http://83.171.236.49",
      "http://89.46.65.19",
      "kcps.edu.in/css/fonts/files/docs/graentsodocumentso/ganeshostwoso/",
      "kcps.edu.in/css/fonts/files/jquery/",
      "kcps.edu.in/css/fonts/files/ntsfonts/",
      "nepra.org.pk/css/32-Advisory-No-32.iso",
      "paryavaranindia.com/css/files/docs/Updated-Leave-Rules-Fourth-Edition/css",
      "paryavaranindia.com/css/files/hulfz/",
      "vidyasagaracademybrg.in/scripts/am/",
      "vidyasagaracademybrg.in/scripts/lnk/"
    ],
    "url_path": [
      "/?ausbduabxyasgdbaskbbx=",
      "/?dhsfiourewjdfjgkfdgkldfjiorejfdjgfdgjkdfjgreioo=",
      "/?evfdbskjfbksjlfkjsengknsjbgwg34vf",
      "/?hebjwhihsdbwbsdbwudiok",
      "/?ioewroiewrioweroiriwwoei=",
      "/?jcvjeijnasdncadasdbfdfurhtnbfgbsydbx=",
      "/?lfdkjgiroetuiroyhgfhnbjkfsdfiowerierehjre",
      "/@/@/h31l0",
      "/AFA/RWlVOGJCSUxEaVljT0dKaQ==.aspx",
      "/F453457Pl_TMP347923592380/",
      "/R0FNd0lCb0RGbU1VTUdwcQ==.php",
      "/R1JNU1p4a1RGbU1VTUdwcQ==.php",
      "/RWlVOGJCSUxEaVljT0dKaQ==.aspx",
      "/W6taHcwqKwhgzWGWr7ElpRAfWA7JcsXC0A2a4eFv/",
      "/api/root_3977413298779/hello",
      "/api/root_3977413298779/upload",
      "/cetcc/crud.php",
      "/cvbnhmj7.php",
      "/fbd901_harassment/",
      "/ganeshostwoso/",
      "/graentsodocumentso/",
      "/graentsodocumentso/ganeshostwoso/",
      "/krypt0kickoswk1wokic.html",
      "/load/?lfdkjgiroetuiroyhgfhnbjkfsdfiowerierehjre",
      "/login/?dhsfiourewjdfjgkfdgkldfjiorejfdjgfdgjkdfjgreioo=",
      "/login/?jcvjeijnasdncadasdbfdfurhtnbfgbsydbx=",
      "/mail/AFA/RWlVOGJCSUxEaVljT0dKaQ==.aspx",
      "/opx/mailflair/r/EZ6n6FMhSh",
      "/pl200_TMP2831474WDF.php",
      "/r3diRecT/redirector/",
      "/r3diRecT/redirector/proxy.php",
      "/swpGMooD",
      "/uPSnswhC",
      "/update/R0FNd0lCb0RGbU1VTUdwcQ==.php",
      "/update/R1JNU1p4a1RGbU1VTUdwcQ==.php",
      "/wh/glass.php",
      "/x9238vnhajerh.html"
    ]
  },
  "last_modified": "2026-08-07T09:48:37+00:00",
  "maltrail_groups": [
    "SIDEWINDER"
  ],
  "references": [
    "http://blog.talosintelligence.com/2022/02/whats-with-shared-vba-code.html",
    "http://hackdig.com/02/hack-280699.htm",
    "http://malasada.tech/open-directory-search-leads-to-aged-apt-c-35-findings/",
    "https://app.any.run/tasks/3abfc241-3ab0-4016-acbb-040b44199d52/",
    "https://app.any.run/tasks/b88e935c-b17a-4429-acdc-65156804ad1c/",
    "https://app.any.run/tasks/c8469e19-96a0-4f2f-9765-72acf72dee05/",
    "https://app.any.run/tasks/d7ce191d-c04f-4eff-a13c-02cbe746c256/",
    "https://app.any.run/tasks/e15e1cd1-0c38-41b9-aa1e-a29562f17b3d/",
    "https://app.any.run/tasks/e3501b33-28a2-4b7c-bc79-d20891c4832e/",
    "https://app.docguard.io/23f3a046884bf94ec706f98000a9efbda48455b4dd86f0665409937b1fb811cb/112148fa-67fb-4646-8dcd-9007ddf87e00/0/results/dashboard",
    "https://app.validin.com/axon?find=*.govpk.live&type=dom",
    "https://app.validin.com/axon?find=213.109.192.93&type=ip",
    "https://app.validin.com/axon?find=47.74.90.0&type=ip",
    "https://app.validin.com/axon?find=47.74.90.10&type=ip",
    "https://app.validin.com/detail?find=2.58.15.89&type=ip4&ref_id=227c9fab6be#tab=resolutions",
    "https://app.validin.com/detail?find=209.74.80.196&type=ip4&ref_id=aed6130bdda#tab=host_pairs",
    "https://app.validin.com/detail?find=3004e97990e49dc01e5377263f9cd5a75f1d0c7c3bf16cc596be5c84c510c96e&type=hash&ref_id=6f07ea3f6ef#tab=host_pairs",
    "https://app.validin.com/detail?find=38.60.198.71&type=ip4&ref_id=612fb65def6#tab=resolutions",
    "https://app.validin.com/detail?find=5.181.159.226&type=ip4&ref_id=99333d38ae6#tab=resolutions",
    "https://app.validin.com/detail?find=69c8a3baf76640c8385adcc2b8ef3174ead8a1fc&type=hash&ref_id=99333d38ae6#tab=host_pairs (# 2025-09-05)",
    "https://app.validin.com/detail?find=Nepal%20Emergency%20Helpline&type=raw&ref_id=8e81c44632d#tab=host_pairs (# 2025-09-18)",
    "https://app.validin.com/detail?find=b39c305a502803d29b370488c7e55f2879d57358&type=hash&ref_id=6a40730d8aa#tab=host_pairs (# 2025-07-07)",
    "https://app.validin.com/detail?type=dom&find=mailcloucl.com#tab=host_pairs",
    "https://app.validin.com/detail?type=hash&find=5bdf6ee243a03479ed1b1f05c2cee35a#tab=host_pairs (# 2025-10-12)",
    "https://app.validin.com/detail?type=hash&find=9d38a97bccfc3cffbb72786a0c02ce140e6ef25b#tab=host_pairs (# 2025-08-19)",
    "https://app.validin.com/detail?type=hash&find=f7ea7521e47f6071c33f72316691557f#tab=host_pairs (# 2025-08-19)",
    "https://app.validin.com/lookalikes?limit=1000&lookback=90&depth=0&find=pmo-gov-pk (# 2025-06-11)",
    "https://arcticwolf.com/resources/blog/sloppylemming-deploys-burrowshell-and-rust-based-rat-to-target-pakistan-and-bangladesh/",
    "https://assets.sentinelone.com/sentinellabs-apt/modified-elephant-apt",
    "https://blog.checkpoint.com/2022/07/13/a-hit-is-made-suspected-india-based-sidewinder-apt-successfully-cyber-attacks-pakistan-military-focused-targets/",
    "https://blog.group-ib.com/sidewinder-antibot",
    "https://blog.malwarebytes.com/threat-intelligence/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure/",
    "https://blog.strikeready.com/blog/rattling-the-cage-of-a-sidewinder/",
    "https://blog.trendmicro.com/trendlabs-security-intelligence/first-active-attack-exploiting-cve-2019-2215-found-on-google-play-linked-to-sidewinder-apt-group/",
    "https://blogs.blackberry.com/en/2023/05/sidewinder-uses-server-side-polymorphism-to-target-pakistan",
    "https://blogs.blackberry.com/en/2024/11/suspected-nation-state-adversary-targets-pakistan-navy-in-cyber-espionage-campaign",
    "https://cybersecuritynews.com/sidewinder-hacking-group-uses-clickonce-based-infection-chain/",
    "https://en.fofa.info/result?qbase64=ZmlkPSJhRnJ1NVZDRW1PWWN2KzlIVUczU3J3PT0i (# 2025-03-26)",
    "https://en.fofa.info/result?qbase64=amFybT0iMjFkMTlkMDAwMjFkMjFkMjFjMjFkMTlkMjFkMjFkZGRjNzVlYThiYjA1MzEzNGU3NDc4ZTAwNGQwM2ZmNjUiICYmIGhlYWRlcj0iSFRUUC8xLjEgNDA0IE5vdCBGb3VuZCIgJiYgaGVhZGVyPSJDb25uZWN0aW9uOiBjbG9zZSIgJiYgaGVhZGVyPSJDb250ZW50LVR5cGU6IHRleHQvaHRtbCIgJiYgaGVhZGVyPSJTZXJ2ZXI6IG5naW54IiAmJiBhc249IjU5NzExIg%3D%3D&page=1&page_size=10 (# 2025-03-22)",
    "https://en.fofa.info/result?qbase64=amFybT0iMmFkMmFkMDAwMmFkMmFkMjJjNDJkNDJkMDAwMDAwOGE1OTQxYzEzZjY3ZTBjMGEyYzhhMzZiZmVlZjY5MjAiICYmIGJhbm5lcj0iSFRUUC8xLjEgNDA0IE5vdCBGb3VuZCIgJiYgYmFubmVyPSJTZXJ2ZXI6IG5naW54IiAmJiBiYW5uZXI9IkNvbnRlbnQtVHlwZTogdGV4dC9odG1sIiAmJiBiYW5uZXI9IkNvbm5lY3Rpb246IGtlZXAtYWxpdmUiICYmIGFzbj0iNjA0MDQiICYmIHNlcnZlcj09Im5naW54Ig%3D%3D (# 2025-03-22)",
    "https://github.com/blackorbird/APT_REPORT/tree/master/sidewinder",
    "https://hunt.io/blog/apt-sidewinder-netlify-government-phishing",
    "https://hunt.io/blog/operation-southnet-sidewinder-south-asia-maritime-phishing",
    "https://intel.breakglass.tech/post/sidewinder-z2fa-lts-moincox-bangladesh-navy-pakistan-mofa-opsec-burn",
    "https://medium.com/@Sebdraven/apt-sidewinder-changes-theirs-ttps-to-install-their-backdoor-f92604a2739",
    "https://medium.com/@fofabot/practical-fofa-asset-expansion-sidewinder-apt-389714a70061",
    "https://mp.weixin.qq.com/s/8j_rHA7gdMxY1_X8alj8Zg (Chinese)",
    "https://mp.weixin.qq.com/s/GWVz02_jGaUt_n9JxB1OwQ",
    "https://mp.weixin.qq.com/s/L3dVwbkfTABtE4ZYtv5r4w",
    "https://mp.weixin.qq.com/s/PALBLusD4umh_52gy2wVAg",
    "https://mp.weixin.qq.com/s/dMFyLxsErYUZX7BQyBL9YQ (Chinese)",
    "https://mp.weixin.qq.com/s/ewGyvlmWUD45XTVsoxeVpg",
    "https://mp.weixin.qq.com/s/iWx2tGCLOR0JtDBnC3FOwQ (Chinese)",
    "https://mp.weixin.qq.com/s/pJ-rnzB7VMZ0feM2X0ZrHA",
    "https://mp.weixin.qq.com/s/qsGxZIiTsuI7o-_XmiHLHg",
    "https://mp.weixin.qq.com/s/wxRSVugKHy7x1SmANQOrAA",
    "https://otx.alienvault.com/pulse/5e133ac9f5eaf331885e74b4",
    "https://otx.alienvault.com/pulse/5e206d8b77de0b2690b9946c",
    "https://otx.alienvault.com/pulse/5fd10760f9afb730d37c4742",
    "https://otx.alienvault.com/pulse/6033e84e6fb8fc369323e8e3/",
    "https://otx.alienvault.com/pulse/624c29baad734a210134b02c",
    "https://otx.alienvault.com/pulse/6285048d921d21c8d9beaf1f",
    "https://otx.alienvault.com/pulse/62987c8eafd38f2088986035",
    "https://otx.alienvault.com/pulse/62a864daa688835ed774c449",
    "https://otx.alienvault.com/pulse/62cffda72568807d4e9a9f2e",
    "https://otx.alienvault.com/pulse/64a445050a5e0f1018b5bf6d",
    "https://pastebin.com/5tvyLKZM",
    "https://pastebin.com/9HwieuS2",
    "https://pastebin.com/raw/eEBba59X",
    "https://pastebin.com/rccqdjNB",
    "https://pastebin.com/vPLMDA1U",
    "https://raw.githubusercontent.com/StrikeReady-Inc/samples/refs/heads/main/2025-01-06%205000%20BDT/urls.txt",
    "https://research.checkpoint.com/2022/state-sponsored-attack-groups-capitalise-on-russia-ukraine-war-for-cyber-espionage/",
    "https://research.checkpoint.com/2024/foxit-pdf-flawed-design-exploitation/",
    "https://securelist.com/sidewinder-apt-updates-its-toolset-and-targets-nuclear-sector/115847/",
    "https://securelist.com/sidewinder-apt/114089/",
    "https://strikeready.com/blog/apt-android-phishing-microsoft/",
    "https://strikeready.com/blog/sidewinder-apt-leverages-nepal-protests-to-push-mobile-malware/",
    "https://threatbook.io/domain/ntc-pk.org",
    "https://tria.ge/251204-m88xqavkd1/behavioral2",
    "https://twitter.com/0xCARNAGE/status/1203882560176218113",
    "https://twitter.com/0xrb/status/1412727167151005703",
    "https://twitter.com/0xrb/status/1529709439808602113",
    "https://twitter.com/500mk500/status/1478758092611407876",
    "https://twitter.com/500mk500/status/1653860821020049410",
    "https://twitter.com/Arkbird_SOLG/status/1260727623539404800",
    "https://twitter.com/Arkbird_SOLG/status/1293221669134372865",
    "https://twitter.com/Axel_F5/status/1597978238542057473",
    "https://twitter.com/Axel_F5/status/1669794530592170001",
    "https://twitter.com/Axel_F5/status/1681354510642429982",
    "https://twitter.com/BaoshengbinCumt/status/1342297125141454848",
    "https://twitter.com/BaoshengbinCumt/status/1354270351702691843",
    "https://twitter.com/BaoshengbinCumt/status/1369916500014821377",
    "https://twitter.com/BaoshengbinCumt/status/1384792855692988416",
    "https://twitter.com/BaoshengbinCumt/status/1387233200871673856",
    "https://twitter.com/BaoshengbinCumt/status/1403292104671916032",
    "https://twitter.com/BaoshengbinCumt/status/1545247231938244610",
    "https://twitter.com/BaoshengbinCumt/status/1727517020269527069",
    "https://twitter.com/Cuser07/status/1738790090326061060",
    "https://twitter.com/Cuser07/status/1743214744910401794",
    "https://twitter.com/Cuser07/status/1752266296463667343",
    "https://twitter.com/Cyberteam008/status/1773587888279630292",
    "https://twitter.com/Cyberteam008/status/1774703213390057829",
    "https://twitter.com/Cyberteam008/status/1788436206528680124",
    "https://twitter.com/DeadlyLynn/status/1367746507974270981",
    "https://twitter.com/Des00464472/status/1399969790471507968",
    "https://twitter.com/Des00464472/status/1528935733888970753",
    "https://twitter.com/Des00464472/status/1531519247293513728",
    "https://twitter.com/Des00464472/status/1548924681008590853",
    "https://twitter.com/Des00464472/status/1550064523964338176",
    "https://twitter.com/Des00464472/status/1553931751852244992",
    "https://twitter.com/Des00464472/status/1555024895020769280",
    "https://twitter.com/Des00464472/status/1559010528013729792",
    "https://twitter.com/Des00464472/status/1559395659559899136",
    "https://twitter.com/Des00464472/status/1567657961887252480",
    "https://twitter.com/Des00464472/status/1569818563657224193",
    "https://twitter.com/Des00464472/status/1571639928483885056",
    "https://twitter.com/Des00464472/status/1582922779707703297",
    "https://twitter.com/Des00464472/status/1585171289261891585",
    "https://twitter.com/Des00464472/status/1586959212596563968",
    "https://twitter.com/Des00464472/status/1592039315823276032",
    "https://twitter.com/Des00464472/status/1592393354138259457",
    "https://twitter.com/Des00464472/status/1597099850075901957",
    "https://twitter.com/Des00464472/status/1597474158367379456",
    "https://twitter.com/Des00464472/status/1599652629403299840",
    "https://twitter.com/Des00464472/status/1621434286816759808",
    "https://twitter.com/GGGGh0st/status/1471323446713864193",
    "https://twitter.com/Glacius_/status/1727968223088214182",
    "https://twitter.com/Glacius_/status/1736687727721013448",
    "https://twitter.com/GroupIB_GIB/status/1532651046111023104",
    "https://twitter.com/GroupIB_GIB/status/1532651049776865280",
    "https://twitter.com/GroupIB_TI/status/1625762101758140416",
    "https://twitter.com/JVPv5sIM3eFmGyi/status/1626044765874814977",
    "https://twitter.com/JVPv5sIM3eFmGyi/status/1648890379943706625",
    "https://twitter.com/JVPv5sIM3eFmGyi/status/1697074761380278599",
    "https://twitter.com/JVPv5sIM3eFmGyi/status/1713750113167053187",
    "https://twitter.com/Joseliyo_Jstnk/status/1740672426906927562",
    "https://twitter.com/Joseliyo_Jstnk/status/1743190819245326808",
    "https://twitter.com/Joseliyo_Jstnk/status/1743223664391160170",
    "https://twitter.com/Joseliyo_Jstnk/status/1753385273587626057",
    "https://twitter.com/Joseliyo_Jstnk/status/1765304025358954689",
    "https://twitter.com/Joseliyo_Jstnk/status/1765727342263988567",
    "https://twitter.com/Malwar3Ninja/status/1545376308196147200",
    "https://twitter.com/ReBensk/status/1532245757322924032",
    "https://twitter.com/RedDrip7/status/1206898954383740929",
    "https://twitter.com/RedDrip7/status/1328639418110865409",
    "https://twitter.com/RedDrip7/status/1575745702021705728",
    "https://twitter.com/RedDrip7/status/1598252489866121216",
    "https://twitter.com/RedDrip7/status/1719897373185560890",
    "https://twitter.com/RedDrip7/status/1765935716964675683",
    "https://twitter.com/Sebdraven/status/1052864520522223616",
    "https://twitter.com/Sebdraven/status/1140597344720830471",
    "https://twitter.com/ShadowChasing1/status/1252547080070914048",
    "https://twitter.com/ShadowChasing1/status/1268214042637684738",
    "https://twitter.com/ShadowChasing1/status/1284319235481538565",
    "https://twitter.com/ShadowChasing1/status/1296710024643796992",
    "https://twitter.com/ShadowChasing1/status/1297902086747598852",
    "https://twitter.com/ShadowChasing1/status/1308620752703299585",
    "https://twitter.com/ShadowChasing1/status/1316680709478604800",
    "https://twitter.com/ShadowChasing1/status/1324349418162720769",
    "https://twitter.com/ShadowChasing1/status/1324349684664528897",
    "https://twitter.com/ShadowChasing1/status/1345559958796914694",
    "https://twitter.com/ShadowChasing1/status/1384743822953877505",
    "https://twitter.com/ShadowChasing1/status/1391976060472860675",
    "https://twitter.com/ShadowChasing1/status/1396809305194590211",
    "https://twitter.com/ShadowChasing1/status/1397135889327804417",
    "https://twitter.com/ShadowChasing1/status/1398171992554053632",
    "https://twitter.com/ShadowChasing1/status/1412695070659153925",
    "https://twitter.com/ShadowChasing1/status/1420762840479109122",
    "https://twitter.com/ShadowChasing1/status/1420762846980308999",
    "https://twitter.com/ShadowChasing1/status/1427258373532119044",
    "https://twitter.com/ShadowChasing1/status/1433038639961804800",
    "https://twitter.com/ShadowChasing1/status/1435546349856907268",
    "https://twitter.com/ShadowChasing1/status/1466001768765018116",
    "https://twitter.com/ShadowChasing1/status/1466686780531363840",
    "https://twitter.com/ShadowChasing1/status/1474901903418949636",
    "https://twitter.com/ShadowChasing1/status/1474901905474129922",
    "https://twitter.com/ShadowChasing1/status/1481583143735808001",
    "https://twitter.com/ShadowChasing1/status/1490984172797984770",
    "https://twitter.com/ShadowChasing1/status/1504347312838959106",
    "https://twitter.com/ShadowChasing1/status/1512011407838961664",
    "https://twitter.com/ShadowChasing1/status/1518594904393355264",
    "https://twitter.com/ShadowChasing1/status/1583063616667799552",
    "https://twitter.com/StopMalvertisin/status/1630934296113577984",
    "https://twitter.com/StopMalvertisin/status/1634084568608264192",
    "https://twitter.com/StopMalvertisin/status/1634084573620604934",
    "https://twitter.com/StopMalvertisin/status/1638194026162827265",
    "https://twitter.com/StopMalvertisin/status/1668668882108940288",
    "https://twitter.com/TLP_R3D/status/1672174181935464448",
    "https://twitter.com/TLP_R3D/status/1676537779574931457",
    "https://twitter.com/TLP_R3D/status/1676680838774136832",
    "https://twitter.com/TLP_R3D/status/1706262046587682998",
    "https://twitter.com/TLP_R3D/status/1708843583778763109",
    "https://twitter.com/TLP_R3D/status/1722667675468312942",
    "https://twitter.com/ThreatBookLabs/status/1628764544331059201",
    "https://twitter.com/ThreatBookLabs/status/1644346009198395392",
    "https://twitter.com/ThreatBookLabs/status/1645269421873840129",
    "https://twitter.com/ThreatBookLabs/status/1655769610116038657",
    "https://twitter.com/ThreatBookLabs/status/1656499255056687104",
    "https://twitter.com/ThreatBookLabs/status/1657207787397718018",
    "https://twitter.com/ThreatBookLabs/status/1657941419401805824",
    "https://twitter.com/ThreatBookLabs/status/1658323281420881926",
    "https://twitter.com/ThreatBookLabs/status/1658669939010715653",
    "https://twitter.com/ThreatBookLabs/status/1659021576841601026",
    "https://twitter.com/ThreatBookLabs/status/1660854037149884417",
    "https://twitter.com/ThreatBookLabs/status/1661558607857717248",
    "https://twitter.com/ThreatBookLabs/status/1663400816907272192",
    "https://twitter.com/ThreatBookLabs/status/1663729069811458048",
    "https://twitter.com/ThreatBookLabs/status/1675852641874632705",
    "https://twitter.com/ThreatBookLabs/status/1678384704679182336",
    "https://twitter.com/ThreatBookLabs/status/1678934448186728448",
    "https://twitter.com/ThreatBookLabs/status/1679132754842390529",
    "https://twitter.com/ThreatBookLabs/status/1680766347255611394",
    "https://twitter.com/ThreatBookLabs/status/1680943216114253825",
    "https://twitter.com/ThreatBookLabs/status/1681132716534923267",
    "https://twitter.com/ThreatBookLabs/status/1696504153500213519",
    "https://twitter.com/ThreatBookLabs/status/1697240572417974285",
    "https://twitter.com/ThreatBookLabs/status/1698883638937657412",
    "https://twitter.com/Timele9527/status/1147750939576586244",
    "https://twitter.com/Timele9527/status/1150597482310619136",
    "https://twitter.com/Timele9527/status/1195272502135549953",
    "https://twitter.com/Timele9527/status/1211852764688478216",
    "https://twitter.com/Timele9527/status/1247325070520750080",
    "https://twitter.com/Timele9527/status/1247327952238284800",
    "https://twitter.com/Timele9527/status/1247376905956765697",
    "https://twitter.com/Timele9527/status/1585824832842653696",
    "https://twitter.com/Timele9527/status/1585824983598538752",
    "https://twitter.com/ValidinLLC/status/1788210860017553882",
    "https://twitter.com/__0XYC__/status/1502593457201811459",
    "https://twitter.com/__0XYC__/status/1528616671103131649",
    "https://twitter.com/__0XYC__/status/1529707301979947009",
    "https://twitter.com/__0XYC__/status/1580083623717658624",
    "https://twitter.com/__0XYC__/status/1580796395052670976",
    "https://twitter.com/__0XYC__/status/1648577567840952321",
    "https://twitter.com/__0XYC__/status/1664581189766610944",
    "https://twitter.com/__0XYC__/status/1676905915885187073",
    "https://twitter.com/__0XYC__/status/1752238025269272906",
    "https://twitter.com/alex_lanstein/status/1479569375971713029",
    "https://twitter.com/alex_lanstein/status/1727280460022300924",
    "https://twitter.com/alex_lanstein/status/1773817732426863037",
    "https://twitter.com/alex_lanstein/status/1775623052941799483",
    "https://twitter.com/alex_lanstein/status/1788200111966658963",
    "https://twitter.com/alex_lanstein/status/1788203426020499698",
    "https://twitter.com/blackorbird/status/1160734383864610816",
    "https://twitter.com/blackorbird/status/1189116884626493440",
    "https://twitter.com/blackorbird/status/1526840629010894848",
    "https://twitter.com/blackorbird/status/1534373342446202881",
    "https://twitter.com/bofheaded/status/1634290081627271168",
    "https://twitter.com/bofheaded/status/1634309581705715712",
    "https://twitter.com/botlabsDev/status/1522500574956109825",
    "https://twitter.com/ccxsaber/status/1195281985335201794",
    "https://twitter.com/ccxsaber/status/1260775018306236416",
    "https://twitter.com/ccxsaber/status/1281413683013287936",
    "https://twitter.com/cyber__sloth/status/1293183011916193793",
    "https://twitter.com/cyber__sloth/status/1293187616897028098",
    "https://twitter.com/cyber__sloth/status/1298187291295461376",
    "https://twitter.com/cyber__sloth/status/1346100925199478784",
    "https://twitter.com/cyber__sloth/status/1485361081329631236",
    "https://twitter.com/doc_guard/status/1785422860741202184",
    "https://twitter.com/fmc_nan/status/1634096201577660416",
    "https://twitter.com/fr0s7_/status/1605917826711048193",
    "https://twitter.com/ginkgo_g/status/1727155248081555886",
    "https://twitter.com/ginkgo_g/status/1768477798191263970",
    "https://twitter.com/ginkgo_g/status/1774639942628761827",
    "https://twitter.com/h2jazi/status/1363683531067715584",
    "https://twitter.com/h2jazi/status/1469399194435735553",
    "https://twitter.com/h2jazi/status/1469399196369313792",
    "https://twitter.com/h2jazi/status/1478496217789341698",
    "https://twitter.com/h2jazi/status/1479502335328112645",
    "https://twitter.com/h2jazi/status/1536330475656171520",
    "https://twitter.com/h2jazi/status/1536707820799807489",
    "https://twitter.com/h2jazi/status/1549762807624880128",
    "https://twitter.com/h2jazi/status/1550524741202726919",
    "https://twitter.com/h2jazi/status/1570070185620512768",
    "https://twitter.com/h2jazi/status/1762874221493879011",
    "https://twitter.com/jaydinbas/status/1591096310870179840",
    "https://twitter.com/jaydinbas/status/1629149185806069761",
    "https://twitter.com/jaydinbas/status/1653361390491430915",
    "https://twitter.com/jfslowik/status/1362782587345727492",
    "https://twitter.com/k3yp0d/status/1727612826661896390",
    "https://twitter.com/k3yp0d/status/1727613488967614761",
    "https://twitter.com/k3yp0d/status/1727695607203078193",
    "https://twitter.com/k3yp0d/status/1789806184175685805",
    "https://twitter.com/mal_analysis136/status/1788219355446075756",
    "https://twitter.com/malwareforme/status/1540037682314629120",
    "https://twitter.com/malwareforme/status/1600150609616949248",
    "https://twitter.com/malwrhunterteam/status/1109085127290900480",
    "https://twitter.com/malwrhunterteam/status/1570061932706635781",
    "https://twitter.com/malwrhunterteam/status/1762199010062766152",
    "https://twitter.com/mg2_tracy1/status/1316688407280586752",
    "https://twitter.com/mg2_tracy1/status/1331153718931177473",
    "https://twitter.com/nahamike01/status/1747167370190458924",
    "https://twitter.com/s1ckb017/status/1478750005594927109",
    "https://twitter.com/s1ckb017/status/1478750907827429380",
    "https://twitter.com/souiten/status/1467674804211777536",
    "https://twitter.com/souiten/status/1467689489145339915",
    "https://twitter.com/souiten/status/1467693133001486337",
    "https://twitter.com/souiten/status/1474200802344386560",
    "https://twitter.com/souiten/status/1491681294391992325",
    "https://twitter.com/suyog41/status/1633822870601363457",
    "https://twitter.com/suyog41/status/1706194781112537213",
    "https://twitter.com/suyog41/status/1708827613727531181",
    "https://twitter.com/suyog41/status/1768558626929860749",
    "https://twitter.com/suyog41/status/1773224136095023435",
    "https://twitter.com/t3ft3lb/status/1582838910857932802",
    "https://twitter.com/t3ft3lb/status/1605501885531553797",
    "https://twitter.com/t3ft3lb/status/1656554005491859456",
    "https://twitter.com/t3ft3lb/status/1676511378117648386",
    "https://twitter.com/uslss_etr/status/1478784684452720646",
    "https://twitter.com/uslss_etr/status/1489274205917044736",
    "https://twitter.com/uslss_etr/status/1496118824944697345",
    "https://twitter.com/uslss_etr/status/1562641328055336960",
    "https://twitter.com/uslss_etr/status/1570487402694590464",
    "https://twitter.com/uslss_etr/status/1664705054069215252",
    "https://twitter.com/virqdroid/status/1532094635170238464",
    "https://urlscan.io/result/82d6480b-898a-4ea5-9105-557c4096a79c",
    "https://www.acronis.com/en-us/cyber-protection-center/posts/from-banks-to-battalions-sidewinders-attacks-on-south-asias-public-sector/",
    "https://www.bridewell.com/insights/news/detail/the-distinctive-rattle-of-apt-sidewinder",
    "https://www.embeeresearch.io/advanced-guide-to-infrastructure-analysis-tracking-apt-sidewinder-domains/",
    "https://www.freebuf.com/articles/network/196788.html (Chinese)",
    "https://www.group-ib.com/blog/hunting-sidewinder/",
    "https://www.joesandbox.com/joereverser/analysis/2e03ffcc-7c06-455e-bbfd-a5b7188fa521/download?type=reports&report=html",
    "https://www.linkedin.com/posts/smica83_sidewinder-rattlesnake-macedonia-share-7463160755161526273-N2hU",
    "https://www.netskope.com/blog/a-look-at-the-nim-based-campaign-using-microsoft-word-docs-to-impersonate-the-nepali-government",
    "https://www.trellix.com/blogs/research/sidewinders-shifting-sands-click-once-for-espionage/",
    "https://www.trendmicro.com/en_us/research/20/l/sidewinder-leverages-south-asian-territorial-issues-for-spear-ph.html",
    "https://www.virustotal.com/#/ip-address/185.106.120.43",
    "https://www.virustotal.com/gui/collection/f6f862c588961ae94c5c23d92331b85e5023ed7064c00d1299f73d47aadf699d/iocs",
    "https://www.virustotal.com/gui/domain/cdn-dl.cn/relations",
    "https://www.virustotal.com/gui/domain/cdn-noc.net/relations",
    "https://www.virustotal.com/gui/domain/chrom3.net/relations",
    "https://www.virustotal.com/gui/domain/cssc.info/relations",
    "https://www.virustotal.com/gui/domain/cvix.live/relations",
    "https://www.virustotal.com/gui/domain/g0v-pk.net/relations",
    "https://www.virustotal.com/gui/domain/gov-cn.net/relations",
    "https://www.virustotal.com/gui/domain/gov-cnn.net/relations",
    "https://www.virustotal.com/gui/domain/gov-pk.online/relations",
    "https://www.virustotal.com/gui/domain/gov-pok.net/detection",
    "https://www.virustotal.com/gui/domain/interior-pk.org/relations",
    "https://www.virustotal.com/gui/domain/kpt-pk.net/relations",
    "https://www.virustotal.com/gui/domain/mfa-gov-al.com/relations",
    "https://www.virustotal.com/gui/domain/mofa-g0v-pk.workers.dev/relations",
    "https://www.virustotal.com/gui/domain/mofagovpk.info/relations",
    "https://www.virustotal.com/gui/domain/paknavy-gov.net/detection",
    "https://www.virustotal.com/gui/domain/paknvay-pk.net/relations",
    "https://www.virustotal.com/gui/domain/reawk.net/details",
    "https://www.virustotal.com/gui/domain/srvapp.co/relations",
    "https://www.virustotal.com/gui/domain/www-cdn.net/relations",
    "https://www.virustotal.com/gui/file/005188f4c96d1f996e260d4cd1f6cb51de8c02654520673506976004203328cc/detection",
    "https://www.virustotal.com/gui/file/006e5fe0c01712391c54319a9d1579d7208f3cfa9f49fe56a14d93f0d0e8928b/detection",
    "https://www.virustotal.com/gui/file/01afb99be9f3077b9ebd80f0e67e99a5a0162ba1fa4f7e9285154c78389c206c/detection",
    "https://www.virustotal.com/gui/file/01c29e84ad1a5fc1f2d16a93fee1c6386aecef1a99153eccaddbca54549befd3/detection",
    "https://www.virustotal.com/gui/file/01c6bc7bc8b4367205b698b99ad57df27387aa855a3245bdf5fa727e73925d06/detection",
    "https://www.virustotal.com/gui/file/023a9b64f4a97bebca72cbfa58553cf7ab3f6b80beba908447a441ef4870f284/detection",
    "https://www.virustotal.com/gui/file/04016d3ac1b30375de773a8fd63a4d7f60aa36ab5679b1714e2d98ac88979505/detection",
    "https://www.virustotal.com/gui/file/04206a2217be8d09e6dc6989d2a2b9aae8623f8fac962e5e07d9fa1a1577998b/detection",
    "https://www.virustotal.com/gui/file/04e378b653cb975609ab637eef36bf92d26867dcd79fb90c5f7e1993019eff91/detection",
    "https://www.virustotal.com/gui/file/08b273a27150fdb1a84f922ffcf55da614b29c149d1c96873aced3f9547e6365/detection",
    "https://www.virustotal.com/gui/file/0ad752520774efca09add91df67ec72d2b1a8b503975569b077e43f40fc7a599/detection",
    "https://www.virustotal.com/gui/file/0b917833380d87990413d318ecd7ed08710d07aedc1d39b749256530c32f2ca9/detection",
    "https://www.virustotal.com/gui/file/0e51c4f52b63e7ce231959168dbc4270b4fa451c58e3bd2081441e7d83915361/detection",
    "https://www.virustotal.com/gui/file/0fa00d4f4f8e8449883aef7f0459a0fb754d57d55af2b41f5e445f867000fa70/detection",
    "https://www.virustotal.com/gui/file/1202845815bc416bdfd8be09f500b5833e63ba5e06aeb5fafba093edf0f7e1b9/detection",
    "https://www.virustotal.com/gui/file/1246356d78d47ce73e22cc253c47f739c4f766ff1e7b473d5e658ba1f0fdd662/detection",
    "https://www.virustotal.com/gui/file/136dd864f5772a6567aff34fcbe6f0665b7cc04b2d486004c370f410bee259b1/detection",
    "https://www.virustotal.com/gui/file/13c1a063409ad73e068604e4a5a605915d96d3c8e87e466bb49c6f41033d5909/detection",
    "https://www.virustotal.com/gui/file/13dafd14c85aee3ed60ec25284ba39d6ecdd7ddf4b484d2048efc05960da51e2/detection",
    "https://www.virustotal.com/gui/file/146e2c51cd7c904e0eeb641daa6ee956e80b48b198b9d2a9fd9b92b68399f9d1/detection",
    "https://www.virustotal.com/gui/file/15081f25bd44b8591d2895c33db7c238b6d52ffb5fbeb235b62d52e681c99249/detection",
    "https://www.virustotal.com/gui/file/1527cf10f00c798262b3347c00af8028fee3bc88a450bc2df7766b1118c62cd5/detection",
    "https://www.virustotal.com/gui/file/159c47db6c9a162c47167ff4d9ebb892e44acf946c95aaad0ec49935627844fc/detection",
    "https://www.virustotal.com/gui/file/15ce7d3c879975ca81777cf58f47409283e34ec1fe8e966fde608bc7eda16646/detection",
    "https://www.virustotal.com/gui/file/15cf5271c7b9b8ad22c4c96bc8674d9835e8d419fc1a6077f3b59fbd7e59d112/detection",
    "https://www.virustotal.com/gui/file/162a1efb479cc29e8f007168386ff4d6e441c46827e00751c56ff5e389a30d37/detection",
    "https://www.virustotal.com/gui/file/16467586cb1a11ce2e1ca81ae6fb490fbc8f5602245f883c14e940189dfd2b79/detection",
    "https://www.virustotal.com/gui/file/170ccf1225154fa0cd92a14219f0b912479cc4095203646c38a31bb78baafe9f/detection",
    "https://www.virustotal.com/gui/file/1815d9aa261c60dde4abe3d8beea19496a9295775d8824087744276fb18a23e0/detection",
    "https://www.virustotal.com/gui/file/1946315d645d9a8c5114759b350ec4f85dba5f9ee4a63d74437d7a068bff7752/detection",
    "https://www.virustotal.com/gui/file/1955c6914097477d5141f720c9e8fa44b4fe189e854da298d85090cbc338b35a/detection",
    "https://www.virustotal.com/gui/file/1a88ef58675971eb18eeb267b1be90594cd6c7ebddf1c67d66729fa3e68de323/detection",
    "https://www.virustotal.com/gui/file/1bf584616477e16b54d6be7ce4d69f7ea26ee7841ec9a17ed162f4d560ab125a/detection",
    "https://www.virustotal.com/gui/file/1cbec920afe2f978b8f84e0a4e6b757d400aeb96e8c0a221130060b196ece010/detection",
    "https://www.virustotal.com/gui/file/1f7873ffa104f80e306b60d00854849b905beaaccb99ab4505146553f4c7e847/detection",
    "https://www.virustotal.com/gui/file/2027a5acbfea586f2d814fb57a97dcfce6c9d85c2a18a0df40811006d74aa7e3/detection",
    "https://www.virustotal.com/gui/file/2185e15486256a3bf16176f54e765a76fd9b96cb3800920402a137bdc698e7da/detection",
    "https://www.virustotal.com/gui/file/21c0756d52ca7947a83529e2cc7d3341f4626b8da05c256f5ec09034d147c6ba/detection",
    "https://www.virustotal.com/gui/file/21cb07f97127a5427603d9d9540c68e0fce7e1d4863216d86799a84f32074d05/detection",
    "https://www.virustotal.com/gui/file/22527dd1a62dc46dd4edd23a681657cf4c3477e9f90fb1ef63ef657608b9838c/detection",
    "https://www.virustotal.com/gui/file/280fb291d49f277067667838cdf30a940eaed9ed7712448158ea29e1ce6af86f/detection",
    "https://www.virustotal.com/gui/file/29afca6e2c38105952012a51e5b40b789bc5fb9bc7c73e33c399df4b2d58999b/detection",
    "https://www.virustotal.com/gui/file/29f36deedf252bcc1f51882c8f071c9aa128ba7f8acd8dd21d4e2800eb440905/detection",
    "https://www.virustotal.com/gui/file/2ab8d52677ebc2517c79979246e69ed9bd88b2c40170b3061cd49007c1f6fef4/detection",
    "https://www.virustotal.com/gui/file/2aec3dcec0274b498bd5e6996a7ff835980953485f5a96f105bfa8f4eceda98a/detection",
    "https://www.virustotal.com/gui/file/2cf842ec2bac099d200c079375a4be7a4d0b3b5869dd739582b7df168e6c4fb6",
    "https://www.virustotal.com/gui/file/2e48dc76c7cd8cc59db6114359fc6b7cdcc2f883becb7f91c3d59ba42e2f7cb7/detection",
    "https://www.virustotal.com/gui/file/2f5f44863048243c1bbec6e16b1c0902f8c61d61fdb8277f5c514b2f04ce8993/detection",
    "https://www.virustotal.com/gui/file/3003f4084df2f5ef9cdd896abc099f0a3b84dafd05c8d405beb3b276d6348d5b/detection",
    "https://www.virustotal.com/gui/file/3068db7b9b198a82971a353cec4dd775257dd35358745bd471c6784acb05297e/detection",
    "https://www.virustotal.com/gui/file/30be03d9709a15d677b7692855993f1ef3708d568c27c293cc2f02295ce99c4b/detection",
    "https://www.virustotal.com/gui/file/316e01b962bf844c3483fce26ff3b2d188338034b1dbd41f15767b06c6e56041/detection",
    "https://www.virustotal.com/gui/file/31b558d79c20b2d18f404096532156e2a25dff5626589a0b27404f359dc9e8db/detection",
    "https://www.virustotal.com/gui/file/34074546f23b48d31d368b2b1c0c3f475dbc15689853a91d113038eb1cd8d8bb/detection",
    "https://www.virustotal.com/gui/file/341a21538b90c87b40e150967519a695f2c339befde232e2f3cd85caf6885803/behavior",
    "https://www.virustotal.com/gui/file/34e1f529b6ea80483b92ce9604a1028db9133581869690376f9ddfb47cfb6fd9/detection",
    "https://www.virustotal.com/gui/file/372226c831de35186e1c96ec28c9ca8ceb02d69c9fe718e21d35b2e921ccf1de/detection",
    "https://www.virustotal.com/gui/file/37a3855e05c63fdab773fdd39da021f2daf1961cc8137385db079960bdfa18c7/detection",
    "https://www.virustotal.com/gui/file/37baf7415c755688e1e89679130b5cfd713d662330734eb310089d1f2afd82b8/detection",
    "https://www.virustotal.com/gui/file/37eca58386fbf9c1e381f88776435565623e3d2d1e2b01218f7717b963449735/detection",
    "https://www.virustotal.com/gui/file/38853bf262979313483310502d14a78db147586880d34571edf4d90e4bf05eb1",
    "https://www.virustotal.com/gui/file/3958bd2062a15c764427a2cc886743df1b1ac56633e1ae43f190e43db836ddb3/detection",
    "https://www.virustotal.com/gui/file/3b294866be0b9d298121df7fbb2709ceb3dba700526aba68f07871e8005b7891/detection",
    "https://www.virustotal.com/gui/file/3b9432019a80a62fe6760a65f2677783bd60383b60206a5db7237a1b050647a2/detection",
    "https://www.virustotal.com/gui/file/3e35834b72b475952ae60ea8479ebe3638e204df414a838dfe143081f6729d8e/detection",
    "https://www.virustotal.com/gui/file/3ed1dc92e8399f062e5e62e5483a87736e51ad4ce651f0628abf98d5e10aee27/detection",
    "https://www.virustotal.com/gui/file/3ef7b9a872dc1247edb0f3947d0db681ff14be81cb46be22ce4f896f2d2dc7f0/detection",
    "https://www.virustotal.com/gui/file/40159fcfe9793a8a13111131e31f10eb1652343f6b9d172e2cadc821bc5f28fd/detection",
    "https://www.virustotal.com/gui/file/4219de40e65c89ecba9bd392f744fa26b867cad82d1b994e1e9266482089d8f9/detection",
    "https://www.virustotal.com/gui/file/421f7bdc183b51435cf834c6a2841491e2a9d2246826bb56424d7c42c1632e25/detection",
    "https://www.virustotal.com/gui/file/42b828e187e4b7f1ca5d774553c8b85c1fed204a2a5a8c50fd4c7e9a491fb118/detection",
    "https://www.virustotal.com/gui/file/4438df17d22e4df1b430788da31ae0c0f4826b0c9896d1fb7d225cff586f11ad/detection",
    "https://www.virustotal.com/gui/file/44c720bc1adde78e11c202615260fb9e2e4301cf06edfefe06cde09a373a6c0e/detection",
    "https://www.virustotal.com/gui/file/44f7c5e8855fc2c9a0026183759f99635d7b89eee46dc904d5618123ed217435/detection",
    "https://www.virustotal.com/gui/file/468351924d611359fb181855331da98359bb1b926b5ce3ee8cd3330986d6e12c/detection",
    "https://www.virustotal.com/gui/file/46cc2e14b7daeadc9f7e5be5cb2004f1370620c93ac97a31cd9a7d329211fd9e/detection",
    "https://www.virustotal.com/gui/file/47144b2a4fa036692dccc81f0414c5d7898da001075c3e3c9995665cf5603791/detection",
    "https://www.virustotal.com/gui/file/47d77499968244911d0179fb858578de00dbb98079e33f5ed5d229d03eb04d67/detection",
    "https://www.virustotal.com/gui/file/492a46f495a17a0c5d7e59cf362f3f6f57f01c3be39f912e37ec51298fa73d6a/detection",
    "https://www.virustotal.com/gui/file/4b5e0ad20a8d143567cc424edf2010146e24a0b729de7ca0f66292141d363e57/detection",
    "https://www.virustotal.com/gui/file/4bad3e34a192a8f305e188538b4370ea835446cc6ba32fe046d9a5f2bc3df172/detection",
    "https://www.virustotal.com/gui/file/4d11d087acbf9573e3f850a99f5bb67357ed2215de0e96a63c4c151f0714e4f9/detection",
    "https://www.virustotal.com/gui/file/4d8ef13543182fdc5cd5bb270878bcac80b77ac7c3e566c0934450e35141ece0/detection",
    "https://www.virustotal.com/gui/file/4e86f36820d5e96739fa6ed192d410eeca975c3a2ec48e13eb98d3486c9262b0/detection",
    "https://www.virustotal.com/gui/file/4efcee12fc15253ffbfc6c85076e0d675a2210a081a23e59f9b0364fb4279c04/detection",
    "https://www.virustotal.com/gui/file/4f008754902cfc8380f6fc4d9b8d93ac095d9cf3273b544c0aa1cf3d803ea623/detection",
    "https://www.virustotal.com/gui/file/512a83f1a6c404cb0ba679c7a2f3aa782bb5e17840d31a034de233f7500a6cb9/detection",
    "https://www.virustotal.com/gui/file/525b00fc379589a73ebd6471e440220c886b969332360e17fb44d5175b3d945e/detection",
    "https://www.virustotal.com/gui/file/53cc8f46f10e4b3958834d75b15db3aa0d8c86a63b8bd3e6ac180c05ce27d748/detection",
    "https://www.virustotal.com/gui/file/54c4641f709e51622531dc3d04fd2f4a3bad2a42dca287e2777c04d59cbca789/detection",
    "https://www.virustotal.com/gui/file/558de2a01fbd76be171561c3c82fd6a8e2d4c913444850af99d44a4cfb41b680/detection",
    "https://www.virustotal.com/gui/file/56bf8948160e563b835cb3b656d0f3848625433b66cb3f89ba07f04f4e8e78cf/detection",
    "https://www.virustotal.com/gui/file/56ce6048c13a0742f2a00bd75135784a3135c089518d6786242424e5fcb52161/detection",
    "https://www.virustotal.com/gui/file/57b9744b30903c7741e9966882815e1467be1115cbd6798ad4bfb3d334d3523d/detection",
    "https://www.virustotal.com/gui/file/57d761453bbc6ba9ace467f4491d7a19b9c7e097f81d9772efbcd2f43ada4dce/detection",
    "https://www.virustotal.com/gui/file/58b3686e4255d32dbcf7dee9dac1d5be6d4692d086cde167da1e1a5e0e1b315a/detection",
    "https://www.virustotal.com/gui/file/590879c567c6d95b18b34e46e9830ba7b807279d76d83abc066f013d4b6f693e/detection",
    "https://www.virustotal.com/gui/file/5b5a1833d4daaf05699a009316a4d866851130b258f424f066b867a534ba944d/detection",
    "https://www.virustotal.com/gui/file/5ba6e6deae5da0adf35e78319e9c528343a21f09863b879b3976351896578229/detection",
    "https://www.virustotal.com/gui/file/5dca94edf42e5578edccf63a51790e68ec46fa0fb6377c884b056339cfb58dac/detection",
    "https://www.virustotal.com/gui/file/5dfe303f04e3432101b676fa0f230667eb6c9bc1715d5b4042f99d9522aa00fe/detection",
    "https://www.virustotal.com/gui/file/5e1cfa57771084629c2b08757f38d67f0ad28faa412090f1c6ef3fa0fd893bb3/detection",
    "https://www.virustotal.com/gui/file/5eec9df0c62b8a0d8c922d366e38ac91907d2a7f5cd13a717d7714015ae362c1/detection",
    "https://www.virustotal.com/gui/file/5ef25d162827195f2fbdc80fd5c6d119ff41dd16f980692a8c4308465d88c554/detection",
    "https://www.virustotal.com/gui/file/5f0d9a8f26a8ead63c0d2063abdef157138eb59def34c361cdc3a42b0ed2c17d/detection",
    "https://www.virustotal.com/gui/file/5fd3f901163aad60fae9afc8c969bba7ff233c7eba242ce85f17b920f9b70140/detection",
    "https://www.virustotal.com/gui/file/613068422c214b944c7b2e3fb60412ed99d35c9e18d53d45b16965c5a36f734a/detection",
    "https://www.virustotal.com/gui/file/61a839aaba4807e492922a3ba0000b98568669626638acf5e5ed0b597fdd5e40/detection",
    "https://www.virustotal.com/gui/file/623767715bd1a33c41e2de8ab3af341e629105132c3434f454cf249f98adbfd7/detection",
    "https://www.virustotal.com/gui/file/624c6b56ee3865f4a5792ad1946a8e86b876440a5af3bac22ac1dee92f1b7372/detection",
    "https://www.virustotal.com/gui/file/63f5445527c47e17b71e87eef4dd7a86883607a22830bcee5b1fabc5d03bab38/detection",
    "https://www.virustotal.com/gui/file/66ddbdfe9328d6a3f49abbb814252617fce0e05934ceeef9813e8bd30385fe50/detection",
    "https://www.virustotal.com/gui/file/6750a7e6eb02eecab234f42a6cc6a88c1510d557336d53a85c02ad43776d8cb9/detection",
    "https://www.virustotal.com/gui/file/679743ceb283331b973728921406125179f56737f0b4b667f983a7303d36af78/detection",
    "https://www.virustotal.com/gui/file/67ae5f3db5f907c2bcc9f932c5379ec17aba4d2e4bca4cf63160ee182e18ae19/detection",
    "https://www.virustotal.com/gui/file/67c341e187ddfcd5a4a7df8743ae82e72db1e5c3747d5c4e185d99f54182f093/detection",
    "https://www.virustotal.com/gui/file/6842aee028eaa07af8e8eba41bef019aee72fe245ca86be39efd2df883b2402c/detection",
    "https://www.virustotal.com/gui/file/696f57d0987b2edefcadecd0eca524cca3be9ce64a54994be13eab7bc71b1a83/detection",
    "https://www.virustotal.com/gui/file/69eee36642f274c724fadcfdf1f103ae0fd9b5f4bad7ac6a33b3c627d6114426/detection",
    "https://www.virustotal.com/gui/file/6b85e9c7dd33416a096e377303d82ac49c8c3044f969ff72560409a3f1151cfb/detection",
    "https://www.virustotal.com/gui/file/6e4a4d25c2e8f5bacc7e0f1c8b538b8ad61571266f271cfdfc14725b3be02613/detection",
    "https://www.virustotal.com/gui/file/6e89d7eedc4088f1bcdf45171c41deb6c778e14141802c153496550f09b85fb7/detection",
    "https://www.virustotal.com/gui/file/6f4e89fce6a490d619cad9078079c6f6694b2798fc875288faa92b721f25d3cb/detection",
    "https://www.virustotal.com/gui/file/719cbc3e08d90d557d464f1a27498626c1b76d6e8db302cb53cb3013a1c35dee/detection",
    "https://www.virustotal.com/gui/file/7238f4e5edbe0e5a2242d8780fb58c47e7d32bf2c4f860c88c511c30675d0857/detection",
    "https://www.virustotal.com/gui/file/725ded50e7f517addd12f029aeaf9a23f2b9ce6239b98820c8a12ea5cb79dbfa/detection",
    "https://www.virustotal.com/gui/file/736315462b91943de9df6210db3bb52564982dd6c758d06ea79e3a404548569b/detection",
    "https://www.virustotal.com/gui/file/7363887b6b0fe7cece3c21ad18515835922379c7d78c47cea745940a1061a6c4/detection",
    "https://www.virustotal.com/gui/file/74111c9b0ed748fc6bfc025d13a2ed08663b988cb69c044f1c6f153f9020294c/detection",
    "https://www.virustotal.com/gui/file/78cea4a9ee2cce19f961c2ddd4972ec479c196c8e9f9763a95561e0f18776883/detection",
    "https://www.virustotal.com/gui/file/795ea82a7aa424f6d54d975a44d1c69a622217dbf8ebbd67becb64559bd3a909/detection",
    "https://www.virustotal.com/gui/file/7cac51f6941028cf7e77722484e2ced8eb43511f1b1b8d99f6e17703534103de/detection",
    "https://www.virustotal.com/gui/file/7d3574c62df44b74337fc74ec7877792b4ffa1486a49bb19668433c3ca8836b5/detection",
    "https://www.virustotal.com/gui/file/7d8109940eb9b9c5f00f6ff8b4db21585c1a2723766a359eef39e6926e0807ea/detection",
    "https://www.virustotal.com/gui/file/7dc75ac10f838a418f18bf69d867dc77bc36a3342165737d1b9bce9582a8d8b4/detection",
    "https://www.virustotal.com/gui/file/7dca552bc38f54716c80eb2c4f1f35cf6e5b12a78a5cec8bf335453c1b433cfd/detection",
    "https://www.virustotal.com/gui/file/7dcf935a24039dff2d084f41ab8ca318b28c53c01f9de069f087b3be15457ba9/detection",
    "https://www.virustotal.com/gui/file/808058f4e1c47b91cacfc032f348a617961a463d19ee5389f472d29c65197438/detection",
    "https://www.virustotal.com/gui/file/84d5a31227eaa3be1134bb6f5a2f92c2621e738ee0c0c4f84758ae8d79d09526/detection",
    "https://www.virustotal.com/gui/file/85ab1c3ee01c5456eb45bf13c69dda88fa014a1dc5e832bdaa3e801a29d84ccd/detection",
    "https://www.virustotal.com/gui/file/85afc5d78392be685ae84f4391aa4e7ea11bb44eb92a3d94a0329a963abf8932/detection",
    "https://www.virustotal.com/gui/file/85d5c21050bd72c4ee02060d0be234ac35babc785567dca5bfc1d299150576b7/detection",
    "https://www.virustotal.com/gui/file/865f5b3b1ee94d89ad9a9840f49a17d477cddfc3742c5ef78d77a6027ad1caa5/detection",
    "https://www.virustotal.com/gui/file/866f2112ee7e2553b0db0e931dd14f18515020ebc5985d91f6c96f1fce24a56c/detection",
    "https://www.virustotal.com/gui/file/8782aa3b2f8b28b67101532937ab95a47e0d246513c8496c2f6a29cd44d02cf1/detection",
    "https://www.virustotal.com/gui/file/88a174855020c69d7719779a09c9b1058ec6732aa0fb04343c1d82fe13ca2e6e/detection",
    "https://www.virustotal.com/gui/file/88c10674bb6a53791bfe08497948699bf57ea9980a878a3a5fc1afb160d1d234/detection",
    "https://www.virustotal.com/gui/file/896ddb35cde29b51ec5cf0da0197605d5fd754c1f9f45e97d40cd287fb5a2d25/detection",
    "https://www.virustotal.com/gui/file/898513123f0f0342b1c47a4a65c88a60f895f90a9d0fa5fc5928c26dfab622b0/detection",
    "https://www.virustotal.com/gui/file/89d4d85592bf0b5e8b55c2d62c9050bfa8c3017f9f497134dbacbb2a0f13a09e/detection",
    "https://www.virustotal.com/gui/file/8a1c9a28ba0c74bafd71705aa12128831d66bbae06536a81d680cd207e740a65/detection",
    "https://www.virustotal.com/gui/file/8a431314696e82f994dd7fd32e6151232a9bbdc948c64cc6ee8a6e3dc67bb4f6/detection",
    "https://www.virustotal.com/gui/file/8a6e381ab6f1d2ab74e3ee232680d5991c9f751241a6a0c3f0d9082d2cf61a05/detection",
    "https://www.virustotal.com/gui/file/8ae6cf2d0932782784084ff0e792a85146d5073115556e8d05a225e635ec96fa/detection",
    "https://www.virustotal.com/gui/file/8af93bed967925b3e5a70d0ad90eae1f13bc6e362ae3dac705e984f8697aaaad/detection",
    "https://www.virustotal.com/gui/file/8e37838066f5e02e01aa5bf7cfc12f74ed18473d017f00441f57e22e64497c88/detection",
    "https://www.virustotal.com/gui/file/92145633823ed4a4c56915ab81f6bc0582fd27700d8515400edd0a153d39829f/detection",
    "https://www.virustotal.com/gui/file/92dbd7f4399bce8b75e2c248af855df498bbed7e342c2d98ff6fcf15b611c50e",
    "https://www.virustotal.com/gui/file/931aee9ba0e51804cb354a3a41830721e41a0fab6758aa19a43eaf1abe621b4d/detection",
    "https://www.virustotal.com/gui/file/93ebcdc6bee559d9c61f484dd521c917517a5114bbfa3ed7d374547a6d0e08e8/detection",
    "https://www.virustotal.com/gui/file/94214e83441e3a6a5cde971f6abe0d4bf226fd0750a0ad26d2241c085de9b604/detection",
    "https://www.virustotal.com/gui/file/947b81c1ecdb34533f7bc9c41d6678fa525c17eae5b8f383e89c6c66db0743c1/detection",
    "https://www.virustotal.com/gui/file/9572312a12605c6a6ea6447af6fc063f4196aeba523ed38ce2c5ff51c33d4831/detection",
    "https://www.virustotal.com/gui/file/96d429d67a2663ef2cf3f45ccd0619adf0cd030f7fe70f072af1ce1d67ec52a3/detection",
    "https://www.virustotal.com/gui/file/974e7115f257c4c47a8c12c468f29888cbc31a37504a033dd34aa5190c3381ca/detection",
    "https://www.virustotal.com/gui/file/99ed9f44a02a3549d60c58233f793622319ed4d08d2c1c8d6fd17fcb06afa8c0/detection",
    "https://www.virustotal.com/gui/file/9a2ccd6340020c3f4b5ebbdba16b260fd2869e37c43a7a01fcfa17f2d4438f25/detection",
    "https://www.virustotal.com/gui/file/9a3481ad198c0ed8e0e9945a35387631784125d42a2132b8428e7bf041c1d397/detection",
    "https://www.virustotal.com/gui/file/9abd42a9f2cc147db47d4bb9598870eab96a2094964e97a6cb231f58d4d4ada2/detection",
    "https://www.virustotal.com/gui/file/9ae756a44c87dde511f11b521c7643b80b330c87f6cf78db5410278c1dc61996/detection",
    "https://www.virustotal.com/gui/file/9aed0c5a047959ef38ec0555ccb647688c67557a6f8f60f691ab0ec096833cce/detection",
    "https://www.virustotal.com/gui/file/9b76d98c2641512c66e8f2f99b2d0bda86ec1a4809420b74feadfb8f4f7dbf48/detection",
    "https://www.virustotal.com/gui/file/9d02bf092fdcf44a51ae6e264ec3e3e57afbe79622c92a797e33fb62ed495cda/detection",
    "https://www.virustotal.com/gui/file/a03677e263bad0c2ea6ae319c1b0b925b1f3a2f851ed24141d74a65abaf7e70c/detection",
    "https://www.virustotal.com/gui/file/a0a18e76d8af39b9b198d9ea7c67dc372fa3cdb2286ac405fa8e76154af34fff/detection",
    "https://www.virustotal.com/gui/file/a11fab6de2c5111833e9e4a6f69ce5dded17085a3d8ae21c7fcfa00d7e113c9b/detection",
    "https://www.virustotal.com/gui/file/a1b5ca71501c5215b2a7ed637308060e10914e436dcda11c219448e3540ef200/detection",
    "https://www.virustotal.com/gui/file/a28a5417d707ecae61313bd5b7c53736d40afba2280cd7ae673963075ae37072/detection",
    "https://www.virustotal.com/gui/file/a2faee1e5fe8717d6360458f1fd6d83902a2c9c6bb2e84f9ea5e4b67ffafbebd/detection",
    "https://www.virustotal.com/gui/file/a45258389a3c0d4615f3414472c390a0aabe77315663398ebdea270b59b82a5c/detection",
    "https://www.virustotal.com/gui/file/a5f3bffd4adbbc344d1b81c7673d6b037713da07baa4b0a0838780436d182946/detection",
    "https://www.virustotal.com/gui/file/a61335c10cf98064761806af6451b3cddd66641ccb35a6d8b915a02d6279f46a/detection",
    "https://www.virustotal.com/gui/file/a703c6772e8bcf7cd0aef05ecbee4c7f7f39371d45b42bf1030df2be5261717c/detection",
    "https://www.virustotal.com/gui/file/a7b52acc18ce7fd14b4a410019a1f0042a6743dcbe887e82d498130848ce195c/detection",
    "https://www.virustotal.com/gui/file/a84b3dd5f7d29d8d257fdef0ede512ae09e6cd5be7681b9466a5c60f6f877c2b/detection",
    "https://www.virustotal.com/gui/file/a89189f1c7c101c8d9c2637e571c4f8546df3ea557a576090cde7b75009981a9/detection",
    "https://www.virustotal.com/gui/file/a928c417df15814ebee6434742bfec78cf35fcdc61c871a2f07ce4d7a2a13e3d/detection",
    "https://www.virustotal.com/gui/file/acbfbf6fd00fa347a52657e5ca0f5cc6cbcf197a04e2d3fd5dc9235926b319d7/detection",
    "https://www.virustotal.com/gui/file/ae22f9da201032d007a0b3f54c3a53ea7a41292bba6e9855d48dd21b55c048ae/detection",
    "https://www.virustotal.com/gui/file/ae3348414926ec22db313ccd61b0d78c819325b3c6f364903d88da5404a05ac4/detection",
    "https://www.virustotal.com/gui/file/ae9ba351fdeb8f06173770682d0df4caef31774b3e0c8e25e2c998cd96e70fa8/detection",
    "https://www.virustotal.com/gui/file/b27968c0d0f55a06cbf424cacf62d0b22e64f021c72d51d4adb0c1771709fe70/detection",
    "https://www.virustotal.com/gui/file/b3caa7ce9a8de209d5a63ab95485c1181f7fca03346330fe92ff3c0a0a9c1040/detection",
    "https://www.virustotal.com/gui/file/b41d54a9686b312f9e114f62e6bf11e21c8e97dda477d488ca19e2afa45efc9e/detection",
    "https://www.virustotal.com/gui/file/b565bd60e9182746de76feeebe7f85902e22ee3a22d5d55a278be7340923806e/detection",
    "https://www.virustotal.com/gui/file/b5c001cbcd72b919e9b05e3281cc4e4914fee0748b3d81954772975630233a6e/detection",
    "https://www.virustotal.com/gui/file/b60f71bfbdf86b8959cebc7585ec5a39e6cdd1c8efc80aa2bb8b051df4b8889b/detection",
    "https://www.virustotal.com/gui/file/b6b98197133a19a20ef64d6206e4b0e98d8d9db00d66a643577f5d55e00ea58d/detection",
    "https://www.virustotal.com/gui/file/b72ac58d599e6e1080251b1ac45a521b33c08d7d129828a4e82a7095e9f93e53/detection",
    "https://www.virustotal.com/gui/file/b72cd42fae7ff3aae6735891bd41e5a4e84f8bb662de46d07c2548d81ee73a1e/detection",
    "https://www.virustotal.com/gui/file/b7a703096c719d8c70f7ce8f586ed83d50975982c83c5bf48e6faff626c6bdee/detection",
    "https://www.virustotal.com/gui/file/b81c49fe252f763e43d2be298298ecc5d986c59e047efff6ecb928126e17f881/detection",
    "https://www.virustotal.com/gui/file/b8294a2038c3e79a06ad1f35c1083edaa6591b393f8bba681384a103734c27e9/detection",
    "https://www.virustotal.com/gui/file/b9a5a187f850885bf7e9de5c1f957469bb16a65d51b08e2da79202e13e069010/detection",
    "https://www.virustotal.com/gui/file/ba6ca4391a9fb405dd780fd5fb1a8acea22435f1707b2422e2bec6d74dbecc41/detection",
    "https://www.virustotal.com/gui/file/bafd23bf68bcb56f7927d10627c7e361127e8d42acdb7206752182ecadb611bc/detection",
    "https://www.virustotal.com/gui/file/bb58796f79a913a985eb41f0d12446e7ae8fe99fd3f0d432d77d8d82f202bf5f/detection",
    "https://www.virustotal.com/gui/file/bbcca0dc10b700c01e557612f009c050ca618f227e0b8be3d4f471dd9d887a18/detection",
    "https://www.virustotal.com/gui/file/bc9d4eb09711f92e4e260efcf7e48906dca6bf239841e976972fd74dac412e2f/detection",
    "https://www.virustotal.com/gui/file/bdbbb8fc621a1717e0dd373c143279db794a72a5bbd846ede92df412043623f7/detection",
    "https://www.virustotal.com/gui/file/c02108f0b413ecdcb8fe48ff445cb75d45324bfd06734011409de57c7cfdeb73/detection",
    "https://www.virustotal.com/gui/file/c0b4d57dd0a8fe415b35ee452818a6ffe695c75d559bd92324771d9f663ebe14/detection",
    "https://www.virustotal.com/gui/file/c17cbe229e743df8993b96f2887393b2565ae355f3ba61d09c901e552e7ee4d1/detection",
    "https://www.virustotal.com/gui/file/c27843c64f1e9bfbaabe5a98f384ef9d3eb2c32f97efe109690de16dd52d44e8/detection",
    "https://www.virustotal.com/gui/file/c2bc69085df7036bdef980932a2383b34a9fb76a92d85b9f377beca060053c17/detection",
    "https://www.virustotal.com/gui/file/c401fc82d3ffdf118aac1bc247838fcd554b7faa3fd10aaa00ed83d80d00b87b/detection",
    "https://www.virustotal.com/gui/file/c4627139cab65aed8b7639006fa4848516f5681dca4ddf483fd27aa2e9f645c2/detection",
    "https://www.virustotal.com/gui/file/c59c6c18f529c88cf352883b23af36f829b8ae1d17daa0762f028184cba7199b/detection",
    "https://www.virustotal.com/gui/file/c87e8d369a9718304e253ebe24da5267bf3a39f0b456c4191029b6be4bc04a42/detection",
    "https://www.virustotal.com/gui/file/caaf44f16dcbee93071887ab6844ed79975ccd20f9008deb93c13bfdb436e0b0/detection",
    "https://www.virustotal.com/gui/file/cb933361cd6c26ca61c441a40da394a505086f572fd7e9bd425bf086adf50edc/detection",
    "https://www.virustotal.com/gui/file/cd09bf437f46210521ad5c21891414f236e29aa6869906820c7c9dc2b565d8be/detection",
    "https://www.virustotal.com/gui/file/cd1a9ae4a3968643a6fb41b36b67838d952dac83ad63c63ce4ad3c672fac31b8/detection",
    "https://www.virustotal.com/gui/file/cd592c969a3a940e43888a1902ec9e4605ed28676d3945ab84d72175fbc87253/detection",
    "https://www.virustotal.com/gui/file/cd8f065206ead30ae634397d9f9ceb715d7f8b378a23924227850c92b013ec41/detection",
    "https://www.virustotal.com/gui/file/cdcc1e6e62df117cc40103c3b2821c10fd5f0372cf06e238663e634a05741764/detection",
    "https://www.virustotal.com/gui/file/ce4428b9b4455cfc051f195fcab0bfee775a7ef5aa3432a7d807c798444c250d/detection",
    "https://www.virustotal.com/gui/file/ceb93ee3093dbf1a49918ede81055018d9c0f0945a97f904a16951010cfbce61/detection",
    "https://www.virustotal.com/gui/file/cf79ecafd3e1ae354fcf9cf33acdb06b6b64dc9a8128656a9d27ff94e154f9c4/detection",
    "https://www.virustotal.com/gui/file/cfc62931fafc8e73986d80743215e6d3a4c345c387c2654c3a42968906811f4d/detection",
    "https://www.virustotal.com/gui/file/d15f76acb846b237956a6373bd6646ef804419dd9a9fd3c9501acc241fcddff9/detection",
    "https://www.virustotal.com/gui/file/d163ef058710925ef5ea2be66df52d837880d1ec18e6575395cab2cd441404a0/detection",
    "https://www.virustotal.com/gui/file/d236df798c56b2a32ff744f16d93c6a0412b4caaf2ea35b171a3953b19609074/detection",
    "https://www.virustotal.com/gui/file/d28ee2ab42b30c24b2569d9042f182e0a64e8dba2653500046153256e4620505/detection",
    "https://www.virustotal.com/gui/file/d375ad74e3f3994f919a68f97d082f796a8dc426083423141d40d5f095cede09/detection",
    "https://www.virustotal.com/gui/file/d3a0b7c5a1eafbf7d381b6ee064083496476163da5dfed53096fac36c2b30738/detection",
    "https://www.virustotal.com/gui/file/d3fb61c0211bd379bf80f15cf072fdbc1187fe95546fdfcfcbdf8918004f05e2/detection",
    "https://www.virustotal.com/gui/file/d74900bf7418f3ad39a5ab27326ad6591f792d1dfdfe44deb89f1b319b7d83b4/detection",
    "https://www.virustotal.com/gui/file/d7f8173c108696584f9c1e36d72a3bb0785609d8951acab355a2e112a64497a4/detection",
    "https://www.virustotal.com/gui/file/d92961b536f1f8229208b2cd8c099dfaae67219ea6b55cd58e7c90daa4d8fc52/detection",
    "https://www.virustotal.com/gui/file/da08044373bc9bd54fd2ead9705446917e8f6e53d32f0885854e720e601cdbef/detection",
    "https://www.virustotal.com/gui/file/dcca21d91e3f261f998d7caa78660ac86b8b16c3785eef87788b502e84d98a8b/detection",
    "https://www.virustotal.com/gui/file/dec609e4b53e1b9b5fd9ec72f2c012324b25e9eb0539b0d454e89c4bd2e3bd5c/detection",
    "https://www.virustotal.com/gui/file/df0b09c9f359f2e086e5e6b78f6fc6f63c9be1c6023cc6ee1e698d6e0daba31b/detection",
    "https://www.virustotal.com/gui/file/df2be2327ed0062cba45a3f85378d0d386500ffcae20ed155ca106854d706325/detection",
    "https://www.virustotal.com/gui/file/e032080c5afeb99bd8bd87e3f68d2b655162a90a78d1207ec12bc0e81563a077/detection",
    "https://www.virustotal.com/gui/file/e089dc65af44ff334304e52c29755c96460691d93cfd4e4ab75f75bc6078993e/detection",
    "https://www.virustotal.com/gui/file/e36e8244c06d88a5650783bfb3e0e85acd76b803a33018d48391f1ebcc849622/detection",
    "https://www.virustotal.com/gui/file/e3802e7f09f499537271f80af7ca81ee1e6d8559164e644665cf50d0a43bccdc/detection",
    "https://www.virustotal.com/gui/file/e4aa98c1beee901871fd8a78b37b21ef886e507e65fc6499e3df3769081cd1cb/detection",
    "https://www.virustotal.com/gui/file/e5474cad56d35160c83378e6719f7c2331333581ab78a0428d0c425a3049e50f/detection",
    "https://www.virustotal.com/gui/file/e6a6066594160a053fe7d68d688b95920936d5880a37a2c91872fb2fc128adf6/detection",
    "https://www.virustotal.com/gui/file/e74be8bbad2fa8577b7383e6ad4dffd5d0cd44e75c0a7148a971c417d38d8ee7/detection",
    "https://www.virustotal.com/gui/file/e9f44c4e4239b676c8c9afd05edf7cdbb0b1fd95e1be67e021bb40702d045d72/detection",
    "https://www.virustotal.com/gui/file/ed4912f09e212479a319de1e95dd3e7d0e3574658be60782369c0e7a19ae0173/detection",
    "https://www.virustotal.com/gui/file/ee2018f7b42ed56fb8b272c9662bf9ddd01f6058abd756019a857a33e54d8faf/detection",
    "https://www.virustotal.com/gui/file/ee77e136f7df758c2ab9092529dc5c6b64b35bc9f4d2c16c65bcd05965ccd92a/detection",
    "https://www.virustotal.com/gui/file/eebf4a5104d75f8f6536e592d4c7945d56f8431059f2cab980756d9b9e96f0fc/detection",
    "https://www.virustotal.com/gui/file/eeeb99f94029fd366dcde7da2a75a849833c5f5932d8f1412a89ca15b9e9ebb7/detection",
    "https://www.virustotal.com/gui/file/efac11fcecbceb4e6273852207a3875ac1edd69158415c3a0bba704e58adeb2c/detection",
    "https://www.virustotal.com/gui/file/f0ee184cdc7ba2a87a669462942f11ebb8d98e10d887e5a668668b5fd822bdda/detection",
    "https://www.virustotal.com/gui/file/f29de289f33c8c9e4a53d25443e6d949b0028b31accf9abb4a8bab4a9dcbba42/detection",
    "https://www.virustotal.com/gui/file/f2b22a17835034a17d4133cf46bd1339c793b5591822f11179bcbe88b04183c8/detection",
    "https://www.virustotal.com/gui/file/f412f7fdc979e31904b6577ff70741ceaa70eeb5c53b773646d58a3685babfa3/detection",
    "https://www.virustotal.com/gui/file/f464ad5c6aba13b42aa903bda0add7c074d45388da379747c83f2c3756c9b658/detection",
    "https://www.virustotal.com/gui/file/f4777f8751ed6818a693817513a5685f13a249803658d1f12190d7b1aa26079e/detection",
    "https://www.virustotal.com/gui/file/f51361da0c24c1ae422ebe8fb12aa1ff9ec49c71d1d699c9cff68f2ee93fcdfa/detection",
    "https://www.virustotal.com/gui/file/f5a7890fd09909711cd9aed1614f8f2687639c61f4ea26efb57100431a688f05/detection",
    "https://www.virustotal.com/gui/file/f69708c769f3d34fc0798257b472cc48770208b6862ea3e6540d12b9f23f9cdf/detection",
    "https://www.virustotal.com/gui/file/f765b0b6e4a34eb95c6f0ddf058bc88d5ef9ec2b11a5f3504d1673f4f69aceca/detection",
    "https://www.virustotal.com/gui/file/f81d1c47a666d4ec32e69b3e1312dda62c932298e32cc42d5c0c6543589d96be/detection",
    "https://www.virustotal.com/gui/file/f946663a780806693ea3fb034215bd6da25971eb07d28fe9c209594c90ec3225/detection",
    "https://www.virustotal.com/gui/file/f97d5d3e1c2ceb3e9d23ae5b5d4e7c9857155df5acf7f67fee995cb041c797dc/detection",
    "https://www.virustotal.com/gui/file/fa95fadc73e5617305a6b71f77e9d255d14402650075107f2272f131d3cf7b00/detection",
    "https://www.virustotal.com/gui/file/fc39ec35d767a2c0a178ca9874be8aaf87033f8b834ee8dcb57d3904516e4335/detection",
    "https://www.virustotal.com/gui/file/fd7a25223ffd731ad4f4a4083ef4a776e4c6f5b0a068b213859f780f1c44cd82/detection",
    "https://www.virustotal.com/gui/file/fdb90737709a989f8d8f1df4d02e9eae2eb6299dc1a9ee55c62ed2eeb6f54cda/detection",
    "https://www.virustotal.com/gui/file/fec66a9aabf379d150ad51926b318f9c03edbe8f7e655193c036db6c0ba9a6b6/detection",
    "https://www.virustotal.com/gui/file/fedc3b7cdb07f7b6f5a6bc85720528057297282bfae7960b3d33001ab34a51d6/detection",
    "https://www.virustotal.com/gui/file/ff54e9228b7160f9272d67ad1423600d2cb7aa4d335412a28b11f63a517270fe/detection",
    "https://www.virustotal.com/gui/file/ffb1e4d9253ed97cc381826993a8812ac6c53f7a7d01793e282fc148102bdab3/detection",
    "https://www.virustotal.com/gui/ip-address/103.149.46.237/relations",
    "https://www.virustotal.com/gui/ip-address/103.151.111.61/relations",
    "https://www.virustotal.com/gui/ip-address/104.21.29.219/relations",
    "https://www.virustotal.com/gui/ip-address/104.219.248.111/relations",
    "https://www.virustotal.com/gui/ip-address/109.106.251.65/relations",
    "https://www.virustotal.com/gui/ip-address/109.70.148.47/relations",
    "https://www.virustotal.com/gui/ip-address/109.70.236.126/relations",
    "https://www.virustotal.com/gui/ip-address/128.199.145.180/relations",
    "https://www.virustotal.com/gui/ip-address/13.213.47.21/relations",
    "https://www.virustotal.com/gui/ip-address/134.209.86.200/relations",
    "https://www.virustotal.com/gui/ip-address/139.84.131.91/relations",
    "https://www.virustotal.com/gui/ip-address/142.202.191.187/relations",
    "https://www.virustotal.com/gui/ip-address/144.126.141.41/relations",
    "https://www.virustotal.com/gui/ip-address/146.70.157.120/detection",
    "https://www.virustotal.com/gui/ip-address/146.70.161.36/relations",
    "https://www.virustotal.com/gui/ip-address/146.70.80.58/detection",
    "https://www.virustotal.com/gui/ip-address/147.139.140.175/relations",
    "https://www.virustotal.com/gui/ip-address/147.139.145.19/relations",
    "https://www.virustotal.com/gui/ip-address/147.139.212.200/relations",
    "https://www.virustotal.com/gui/ip-address/151.236.21.26/relations",
    "https://www.virustotal.com/gui/ip-address/158.255.211.188/relations",
    "https://www.virustotal.com/gui/ip-address/164.68.108.153/relations",
    "https://www.virustotal.com/gui/ip-address/167.88.164.63/relations",
    "https://www.virustotal.com/gui/ip-address/172.66.47.59/relations",
    "https://www.virustotal.com/gui/ip-address/172.67.133.19/relations",
    "https://www.virustotal.com/gui/ip-address/172.67.135.224/relations",
    "https://www.virustotal.com/gui/ip-address/172.67.137.37/relations",
    "https://www.virustotal.com/gui/ip-address/172.67.143.200/relations",
    "https://www.virustotal.com/gui/ip-address/172.67.166.115/relations",
    "https://www.virustotal.com/gui/ip-address/172.67.184.202/relations",
    "https://www.virustotal.com/gui/ip-address/172.67.192.82/relations",
    "https://www.virustotal.com/gui/ip-address/172.67.194.69/relations",
    "https://www.virustotal.com/gui/ip-address/172.67.215.149/relations",
    "https://www.virustotal.com/gui/ip-address/178.209.51.231/relations",
    "https://www.virustotal.com/gui/ip-address/181.41.35.224/relations",
    "https://www.virustotal.com/gui/ip-address/185.117.90.59/relations",
    "https://www.virustotal.com/gui/ip-address/185.141.25.136/relations",
    "https://www.virustotal.com/gui/ip-address/185.151.30.193/relations",
    "https://www.virustotal.com/gui/ip-address/185.163.45.56/relations",
    "https://www.virustotal.com/gui/ip-address/185.166.188.146/relations",
    "https://www.virustotal.com/gui/ip-address/185.174.135.4/relations",
    "https://www.virustotal.com/gui/ip-address/185.212.70.84/relations",
    "https://www.virustotal.com/gui/ip-address/185.225.19.142/relations",
    "https://www.virustotal.com/gui/ip-address/185.225.19.46/relations",
    "https://www.virustotal.com/gui/ip-address/185.233.166.156/relations",
    "https://www.virustotal.com/gui/ip-address/185.234.72.188/relations",
    "https://www.virustotal.com/gui/ip-address/185.235.138.29/relations",
    "https://www.virustotal.com/gui/ip-address/185.245.180.3/relations",
    "https://www.virustotal.com/gui/ip-address/185.245.180.44/relations",
    "https://www.virustotal.com/gui/ip-address/185.27.134.151/relations",
    "https://www.virustotal.com/gui/ip-address/185.27.134.221/relations",
    "https://www.virustotal.com/gui/ip-address/185.27.134.222/relations",
    "https://www.virustotal.com/gui/ip-address/185.27.134.33/relations",
    "https://www.virustotal.com/gui/ip-address/185.27.134.55/relations",
    "https://www.virustotal.com/gui/ip-address/185.82.22.193/relations",
    "https://www.virustotal.com/gui/ip-address/192.36.27.97/relations",
    "https://www.virustotal.com/gui/ip-address/192.36.41.43/relations",
    "https://www.virustotal.com/gui/ip-address/192.71.166.139/relations",
    "https://www.virustotal.com/gui/ip-address/193.142.58.149/relations",
    "https://www.virustotal.com/gui/ip-address/193.29.57.101/relations",
    "https://www.virustotal.com/gui/ip-address/193.42.36.66/relations",
    "https://www.virustotal.com/gui/ip-address/193.42.39.133/relations",
    "https://www.virustotal.com/gui/ip-address/193.42.39.217/relations",
    "https://www.virustotal.com/gui/ip-address/194.68.44.55/relations",
    "https://www.virustotal.com/gui/ip-address/195.201.179.80/relations",
    "https://www.virustotal.com/gui/ip-address/195.35.10.141/relations",
    "https://www.virustotal.com/gui/ip-address/198.54.116.197/relations",
    "https://www.virustotal.com/gui/ip-address/198.54.120.24/relations",
    "https://www.virustotal.com/gui/ip-address/2.56.245.21/relations",
    "https://www.virustotal.com/gui/ip-address/2.58.14.249/relations",
    "https://www.virustotal.com/gui/ip-address/2.58.14.27/relations",
    "https://www.virustotal.com/gui/ip-address/2.58.15.183/relations",
    "https://www.virustotal.com/gui/ip-address/2.58.15.42/relations",
    "https://www.virustotal.com/gui/ip-address/2.58.15.71/relations",
    "https://www.virustotal.com/gui/ip-address/2.58.15.76/relations",
    "https://www.virustotal.com/gui/ip-address/202.142.177.150/detection",
    "https://www.virustotal.com/gui/ip-address/208.109.19.101/relations",
    "https://www.virustotal.com/gui/ip-address/212.46.38.168/relations",
    "https://www.virustotal.com/gui/ip-address/212.83.46.137/relations",
    "https://www.virustotal.com/gui/ip-address/213.109.192.93/relations",
    "https://www.virustotal.com/gui/ip-address/213.183.55.52/relations",
    "https://www.virustotal.com/gui/ip-address/3.239.29.103/relations",
    "https://www.virustotal.com/gui/ip-address/3.33.130.190/relations",
    "https://www.virustotal.com/gui/ip-address/34.216.117.25/relations",
    "https://www.virustotal.com/gui/ip-address/36.50.40.202/relations",
    "https://www.virustotal.com/gui/ip-address/39.104.50.12/relations",
    "https://www.virustotal.com/gui/ip-address/45.137.159.236/relations",
    "https://www.virustotal.com/gui/ip-address/45.138.172.23/relations",
    "https://www.virustotal.com/gui/ip-address/45.153.240.66/relations",
    "https://www.virustotal.com/gui/ip-address/46.17.175.230/relations",
    "https://www.virustotal.com/gui/ip-address/46.183.187.190/relations",
    "https://www.virustotal.com/gui/ip-address/46.30.189.18/relations",
    "https://www.virustotal.com/gui/ip-address/46.30.191.184/relations",
    "https://www.virustotal.com/gui/ip-address/47.236.119.146/relations",
    "https://www.virustotal.com/gui/ip-address/47.236.12.192/relations",
    "https://www.virustotal.com/gui/ip-address/47.236.243.41/relations",
    "https://www.virustotal.com/gui/ip-address/47.236.248.66/relations",
    "https://www.virustotal.com/gui/ip-address/47.250.57.207/relations",
    "https://www.virustotal.com/gui/ip-address/47.251.51.195/relations",
    "https://www.virustotal.com/gui/ip-address/47.252.52.225/relations",
    "https://www.virustotal.com/gui/ip-address/47.74.10.112/relations",
    "https://www.virustotal.com/gui/ip-address/47.74.85.109/relations",
    "https://www.virustotal.com/gui/ip-address/47.88.26.202/relations",
    "https://www.virustotal.com/gui/ip-address/47.90.210.26/relations",
    "https://www.virustotal.com/gui/ip-address/5.180.114.198/relations",
    "https://www.virustotal.com/gui/ip-address/5.181.20.102/relations",
    "https://www.virustotal.com/gui/ip-address/5.230.249.5/relations",
    "https://www.virustotal.com/gui/ip-address/5.230.35.199/relations",
    "https://www.virustotal.com/gui/ip-address/5.230.37.44/relations",
    "https://www.virustotal.com/gui/ip-address/5.230.54.3/relations",
    "https://www.virustotal.com/gui/ip-address/5.230.67.73/relations",
    "https://www.virustotal.com/gui/ip-address/5.230.69.153/relations",
    "https://www.virustotal.com/gui/ip-address/5.230.71.95/relations",
    "https://www.virustotal.com/gui/ip-address/5.230.72.15/relations",
    "https://www.virustotal.com/gui/ip-address/5.230.72.98/relations",
    "https://www.virustotal.com/gui/ip-address/5.230.73.106/relations",
    "https://www.virustotal.com/gui/ip-address/5.230.73.198/relations",
    "https://www.virustotal.com/gui/ip-address/5.230.73.238/relations1",
    "https://www.virustotal.com/gui/ip-address/5.230.74.58/relations",
    "https://www.virustotal.com/gui/ip-address/5.230.74.80/relations",
    "https://www.virustotal.com/gui/ip-address/5.230.78.184/relations",
    "https://www.virustotal.com/gui/ip-address/5.230.78.76/relations",
    "https://www.virustotal.com/gui/ip-address/5.255.100.151/relations",
    "https://www.virustotal.com/gui/ip-address/5.255.104.124/relations",
    "https://www.virustotal.com/gui/ip-address/5.255.105.243/relations",
    "https://www.virustotal.com/gui/ip-address/5.255.106.249/relations",
    "https://www.virustotal.com/gui/ip-address/5.255.112.244/relations",
    "https://www.virustotal.com/gui/ip-address/5.255.113.149/relations",
    "https://www.virustotal.com/gui/ip-address/5.255.116.103/relations",
    "https://www.virustotal.com/gui/ip-address/5.255.117.75/relations",
    "https://www.virustotal.com/gui/ip-address/5.255.120.103/relations",
    "https://www.virustotal.com/gui/ip-address/5.255.121.168/relations",
    "https://www.virustotal.com/gui/ip-address/5.255.121.188/relations",
    "https://www.virustotal.com/gui/ip-address/5.255.124.203/relations",
    "https://www.virustotal.com/gui/ip-address/5.255.126.233/relations",
    "https://www.virustotal.com/gui/ip-address/5.255.99.223/relations",
    "https://www.virustotal.com/gui/ip-address/5.255.99.99/relations",
    "https://www.virustotal.com/gui/ip-address/51.195.146.204/relations",
    "https://www.virustotal.com/gui/ip-address/51.89.9.145/relations",
    "https://www.virustotal.com/gui/ip-address/62.113.255.80/relations",
    "https://www.virustotal.com/gui/ip-address/62.72.22.91/relations",
    "https://www.virustotal.com/gui/ip-address/65.108.198.252/relations",
    "https://www.virustotal.com/gui/ip-address/69.61.36.170/relations",
    "https://www.virustotal.com/gui/ip-address/76.223.105.230/relations",
    "https://www.virustotal.com/gui/ip-address/77.83.196.59/relations",
    "https://www.virustotal.com/gui/ip-address/77.95.113.16/relations",
    "https://www.virustotal.com/gui/ip-address/79.141.165.199/relations",
    "https://www.virustotal.com/gui/ip-address/79.141.174.176/relations",
    "https://www.virustotal.com/gui/ip-address/79.141.174.208/relations",
    "https://www.virustotal.com/gui/ip-address/8.208.11.212/relations",
    "https://www.virustotal.com/gui/ip-address/8.208.90.73/relations",
    "https://www.virustotal.com/gui/ip-address/8.208.92.59/relations",
    "https://www.virustotal.com/gui/ip-address/8.209.221.234/relations",
    "https://www.virustotal.com/gui/ip-address/8.211.192.22/relations",
    "https://www.virustotal.com/gui/ip-address/8.218.5.63/relations",
    "https://www.virustotal.com/gui/ip-address/8.222.232.191/relations",
    "https://www.virustotal.com/gui/ip-address/8.222.250.160/relations",
    "https://www.virustotal.com/gui/ip-address/80.251.18.108/relations",
    "https://www.virustotal.com/gui/ip-address/81.171.7.136/relations",
    "https://www.virustotal.com/gui/ip-address/81.171.7.139/relations",
    "https://www.virustotal.com/gui/ip-address/82.180.175.87/relations",
    "https://www.virustotal.com/gui/ip-address/83.171.236.49/relations",
    "https://www.virustotal.com/gui/ip-address/83.243.121.239/relations",
    "https://www.virustotal.com/gui/ip-address/84.32.84.32/relations",
    "https://www.virustotal.com/gui/ip-address/84.32.84.33/relations",
    "https://www.virustotal.com/gui/ip-address/85.113.70.48/relations",
    "https://www.virustotal.com/gui/ip-address/85.239.55.124/relations",
    "https://www.virustotal.com/gui/ip-address/88.119.161.40/relations",
    "https://www.virustotal.com/gui/ip-address/89.116.133.247/relations",
    "https://www.virustotal.com/gui/ip-address/89.116.192.242/relations",
    "https://www.virustotal.com/gui/ip-address/89.150.40.43/relations",
    "https://www.virustotal.com/gui/ip-address/89.46.234.85/relations",
    "https://www.virustotal.com/gui/ip-address/89.46.65.19/relations",
    "https://www.virustotal.com/gui/ip-address/91.193.18.108/relations",
    "https://www.virustotal.com/gui/ip-address/91.195.240.12/relations",
    "https://www.virustotal.com/gui/ip-address/91.223.208.175/relations",
    "https://www.virustotal.com/gui/ip-address/91.92.252.90/relations",
    "https://www.virustotal.com/gui/ip-address/92.113.21.70/relations",
    "https://www.virustotal.com/gui/ip-address/92.118.190.165/relations",
    "https://www.virustotal.com/gui/ip-address/93.127.192.14/relations",
    "https://www.virustotal.com/gui/ip-address/93.183.74.8/relations",
    "https://www.virustotal.com/gui/ip-address/93.190.143.108/relations",
    "https://www.virustotal.com/gui/ip-address/94.156.65.165/relations",
    "https://www.virustotal.com/gui/ip-address/94.158.245.67/relations",
    "https://www.virustotal.com/gui/ip-address/98.142.254.52/relations",
    "https://www.virustotal.com/gui/ip-address/98.142.254.83/relations",
    "https://www.virustotal.com/gui/ip-address/98.142.254.94/relations",
    "https://www.welivesecurity.com/en/eset-research/love-actually-fake-dating-app-used-lure-targeted-spyware-campaign-pakistan/",
    "https://www.zscaler.com/blogs/security-research/warhawk-new-backdoor-arsenal-sidewinder-apt-group-0 (# WarHawk)",
    "https://x.com/AndreGironda/status/1981785066515968447",
    "https://x.com/Cyberteam008/status/1904701843927863409",
    "https://x.com/Cyberteam008/status/1925009704918393295",
    "https://x.com/Cyberteam008/status/1938086890411893240",
    "https://x.com/Cyberteam008/status/1967811673924022458",
    "https://x.com/Cyberteam008/status/2048596656141340906",
    "https://x.com/DmitriyMelikov/status/1869829399023104432",
    "https://x.com/FatzQatz/status/2034236872076231108",
    "https://x.com/Glacius_/status/1919444379971821617",
    "https://x.com/GroupIB_TI/status/1927692817599545555",
    "https://x.com/JAMESWT_MHT/status/1869724537115541616",
    "https://x.com/Joseliyo_Jstnk/status/1804112721408835817",
    "https://x.com/Malwar3Ninja/status/1890393003207843897",
    "https://x.com/RedDrip7/status/1813049510601630031",
    "https://x.com/RedDrip7/status/1986014463494160775",
    "https://x.com/RedDrip7/status/2013145924730863672",
    "https://x.com/RedDrip7/status/2013146014660571412",
    "https://x.com/RedDrip7/status/2032290347527913562",
    "https://x.com/SecAI_AI/status/1884616742082932870",
    "https://x.com/SecAI_AI/status/1890047778539061342",
    "https://x.com/ShadowChasing1/status/1902203302315749870",
    "https://x.com/SinghSoodeep/status/2035992239235903862",
    "https://x.com/SinghSoodeep/status/2043571382601289736",
    "https://x.com/StrikeReadyLabs/status/1811134839598326198",
    "https://x.com/StrikeReadyLabs/status/1818267844972306610",
    "https://x.com/StrikeReadyLabs/status/1820454673603768564",
    "https://x.com/StrikeReadyLabs/status/1821133707077370041",
    "https://x.com/StrikeReadyLabs/status/1826250092669751401",
    "https://x.com/StrikeReadyLabs/status/1830774400397779262",
    "https://x.com/StrikeReadyLabs/status/1831386292728598949",
    "https://x.com/StrikeReadyLabs/status/1833558192024142056",
    "https://x.com/StrikeReadyLabs/status/1836356550274826416",
    "https://x.com/StrikeReadyLabs/status/1849797282499039404",
    "https://x.com/StrikeReadyLabs/status/1856724048903836018",
    "https://x.com/StrikeReadyLabs/status/1857456905167237288",
    "https://x.com/StrikeReadyLabs/status/1864282578561221054",
    "https://x.com/StrikeReadyLabs/status/1871572110134726720",
    "https://x.com/StrikeReadyLabs/status/1876284392319963587",
    "https://x.com/StrikeReadyLabs/status/1876353156252340233",
    "https://x.com/TLP_R3D/status/1926147062552223856",
    "https://x.com/Thisism23567356/status/2047237888799092781",
    "https://x.com/ThreatBookLabs/status/1871570023665275210",
    "https://x.com/ThreatBookLabs/status/1872288256370585931",
    "https://x.com/ThreatBookLabs/status/1902740067703202129",
    "https://x.com/ThreatBookLabs/status/1947112060321714517",
    "https://x.com/ThreatBookLabs/status/1952157611350241612",
    "https://x.com/ThreatBookLabs/status/1957623577643217181",
    "https://x.com/__0XYC__/status/1893503792827527388",
    "https://x.com/__0XYC__/status/1896843819838251335",
    "https://x.com/__0XYC__/status/1907321547326661055",
    "https://x.com/__0XYC__/status/1909926129340965172",
    "https://x.com/__0XYC__/status/1917099175331959296",
    "https://x.com/__0XYC__/status/1955863170712530987",
    "https://x.com/__0XYC__/status/1960328082746753424",
    "https://x.com/__0XYC__/status/1972166420403572852",
    "https://x.com/__0XYC__/status/1996536016123892101",
    "https://x.com/__0XYC__/status/2014705989681840232",
    "https://x.com/__0XYC__/status/2019617829784547463",
    "https://x.com/__0XYC__/status/2021430578197995793",
    "https://x.com/__0XYC__/status/2022530597097271436",
    "https://x.com/__0XYC__/status/2026971764769665277",
    "https://x.com/__0XYC__/status/2039538772090753351",
    "https://x.com/__0XYC__/status/2042075173915127858",
    "https://x.com/__0XYC__/status/2054792675887382660",
    "https://x.com/__0XYC__/status/2054793748106657829",
    "https://x.com/__0XYC__/status/2072904128695800308",
    "https://x.com/_priyaa_1/status/2007013981622530418",
    "https://x.com/banthisguy9349/status/1867529811750694984",
    "https://x.com/banthisguy9349/status/1867536997528875196",
    "https://x.com/banthisguy9349/status/1875901285783962024",
    "https://x.com/banthisguy9349/status/1875904770697003459",
    "https://x.com/banthisguy9349/status/1875930695388037559",
    "https://x.com/banthisguy9349/status/1875934113292861656",
    "https://x.com/blackorbird/status/1859161598469836806",
    "https://x.com/blackorbird/status/1871576281571274847",
    "https://x.com/blackorbird/status/1897618982384873643",
    "https://x.com/blackorbird/status/1902694151847850310",
    "https://x.com/blackorbird/status/1966082587098755312",
    "https://x.com/blackorbird/status/2084940847863509476",
    "https://x.com/ginkgo_g/status/1801540845797315055",
    "https://x.com/ginkgo_g/status/1867518951930179775",
    "https://x.com/ginkgo_g/status/1877604805612548507",
    "https://x.com/joe4security/status/2085384961570349091",
    "https://x.com/k3yp0d/status/1821523835214065877",
    "https://x.com/k3yp0d/status/1821526304635650555",
    "https://x.com/k3yp0d/status/1856401803379876074",
    "https://x.com/k3yp0d/status/1871927642984968619",
    "https://x.com/mal_analysis136/status/1822672814924611748",
    "https://x.com/mal_analysis136/status/1822916700762984543",
    "https://x.com/mal_analysis136/status/1878823552188883024",
    "https://x.com/mal_analysis136/status/1879225400666313177",
    "https://x.com/mal_analysis136/status/1889041601709977866",
    "https://x.com/mal_analysis136/status/1890729450792268024",
    "https://x.com/mal_analysis136/status/1897314313720983686",
    "https://x.com/mal_analysis136/status/1903400504925028535",
    "https://x.com/mal_analysis136/status/1903410777085948009",
    "https://x.com/malwrhunterteam/status/1846308333432852902",
    "https://x.com/malwrhunterteam/status/1928777698526044415",
    "https://x.com/malwrhunterteam/status/2008471305432003044",
    "https://x.com/malwrhunterteam/status/2013212998198796594",
    "https://x.com/malwrhunterteam/status/2054831494347063755",
    "https://x.com/phatomcandle/status/2077737009569808478",
    "https://x.com/salmanvsf/status/1844636033109066079",
    "https://x.com/salmanvsf/status/1901922280508469555",
    "https://x.com/salmanvsf/status/1985549302727590124",
    "https://x.com/skocherhan/status/1981180565739974685",
    "https://x.com/skocherhan/status/2027484078132379889",
    "https://x.com/spontiroli/status/1912850014520463442",
    "https://x.com/suyog41/status/1814216605414351325",
    "https://x.com/suyog41/status/1822904355777138829",
    "https://x.com/suyog41/status/1824001819149799434",
    "https://x.com/suyog41/status/1839593288455606483",
    "https://x.com/suyog41/status/1844614969158984039",
    "https://x.com/suyog41/status/1844615527106322754",
    "https://x.com/suyog41/status/1846521863347789927",
    "https://x.com/suyog41/status/1848679667399807266",
    "https://x.com/suyog41/status/1849679847137870328",
    "https://x.com/suyog41/status/1858462344856101197",
    "https://x.com/suyog41/status/1859132957870694480",
    "https://x.com/suyog41/status/1876157867423879302",
    "https://x.com/suyog41/status/1880182370902634893",
    "https://x.com/suyog41/status/1884178221127852096",
    "https://x.com/suyog41/status/1887133284276244512",
    "https://x.com/suyog41/status/1887812529151443394",
    "https://x.com/suyog41/status/1888906530118062394",
    "https://x.com/suyog41/status/1891372873496834115",
    "https://x.com/suyog41/status/1895090090650784157",
    "https://x.com/suyog41/status/1895440300421881953",
    "https://x.com/suyog41/status/1901879336480989522",
    "https://x.com/suyog41/status/1902321493520064582",
    "https://x.com/suyog41/status/1909121702707048705",
    "https://x.com/suyog41/status/1914565910607880350",
    "https://x.com/suyog41/status/1914624962876596333",
    "https://x.com/suyog41/status/1919279981105992119",
    "https://x.com/suyog41/status/1920014750643007950",
    "https://x.com/suyog41/status/1920723276243894501",
    "https://x.com/suyog41/status/1922211946847228187",
    "https://x.com/suyog41/status/1922225245680721992",
    "https://x.com/suyog41/status/1922258775567712490",
    "https://x.com/suyog41/status/1925828628517921245",
    "https://x.com/suyog41/status/1927704786981224607",
    "https://x.com/suyog41/status/1934520152726413764",
    "https://x.com/suyog41/status/1942892749822566737",
    "https://x.com/suyog41/status/1947177091893805561",
    "https://x.com/suyog41/status/1958766748804817302",
    "https://x.com/suyog41/status/2001622867822415897",
    "https://x.com/suyog41/status/2023736857771827313",
    "https://x.com/suyog41/status/2075572390315311333",
    "https://x.com/uslss_etr/status/1795534272725713221",
    "https://x.com/volrant136/status/1916037219770634729",
    "https://x.com/volrant136/status/1916593879983571354",
    "https://x.com/volrant136/status/1919123011107451280",
    "https://x.com/volrant136/status/1922300186526638477",
    "https://x.com/volrant136/status/1922332480503181486",
    "https://x.com/volrant136/status/1923061758643597787",
    "https://x.com/volrant136/status/1923403903262986410",
    "https://x.com/volrant136/status/1925229593897709961",
    "https://x.com/volrant136/status/1925581298782941625",
    "https://x.com/volrant136/status/1926301843916734747",
    "https://x.com/volrant136/status/1926559917101494717",
    "https://x.com/volrant136/status/1926564282252120128",
    "https://x.com/volrant136/status/1927753865471918171",
    "https://x.com/volrant136/status/1928856220292571240",
    "https://x.com/volrant136/status/1928905494892003331",
    "https://x.com/volrant136/status/1936332922849566845",
    "https://x.com/volrant136/status/1936722517433213141",
    "https://x.com/volrant136/status/1937176053765853314",
    "https://x.com/volrant136/status/1937546185109029284",
    "https://x.com/volrant136/status/1938595504843051137",
    "https://x.com/volrant136/status/1938601633123868683",
    "https://x.com/volrant136/status/1938848055022833806",
    "https://x.com/volrant136/status/1938850528672313834",
    "https://x.com/volrant136/status/1939225148021784776",
    "https://x.com/volrant136/status/1939737733024415965",
    "https://x.com/volrant136/status/1939739683023421890",
    "https://x.com/volrant136/status/1939744960170885468",
    "https://x.com/volrant136/status/1940461337936646467",
    "https://x.com/volrant136/status/1941881061492785292",
    "https://x.com/volrant136/status/1942261847438090310",
    "https://x.com/volrant136/status/1942665553652637966",
    "https://x.com/volrant136/status/1943411794501931421",
    "https://x.com/volrant136/status/1943411876236230991",
    "https://x.com/volrant136/status/1943411984407343140",
    "https://x.com/volrant136/status/1945535021890040150",
    "https://x.com/volrant136/status/1947733875385421848",
    "https://x.com/volrant136/status/1947740571042201898",
    "https://x.com/volrant136/status/1949199453102985695",
    "https://x.com/volrant136/status/1949543032547582120",
    "https://x.com/volrant136/status/1949549269410545920",
    "https://x.com/volrant136/status/1949867469012685147",
    "https://x.com/volrant136/status/1949896689864540232",
    "https://x.com/volrant136/status/1949896889966505997",
    "https://x.com/volrant136/status/1950950797736329381",
    "https://x.com/volrant136/status/1950951163748118935",
    "https://x.com/volrant136/status/1951339364585447465",
    "https://x.com/volrant136/status/1951339826235711650",
    "https://x.com/volrant136/status/1952014499172495781",
    "https://x.com/volrant136/status/1952014981278355879",
    "https://x.com/volrant136/status/1954575077359698237",
    "https://x.com/volrant136/status/1954576749125304709",
    "https://x.com/volrant136/status/1955663006303699041",
    "https://x.com/volrant136/status/1956738787243139245",
    "https://x.com/volrant136/status/1959269610600968526",
    "https://x.com/volrant136/status/1959693263897813084",
    "https://x.com/volrant136/status/1959704085298663626",
    "https://x.com/volrant136/status/1962212071275368628",
    "https://x.com/volrant136/status/1964037554736398445",
    "https://x.com/volrant136/status/1966935607483265167",
    "https://x.com/volrant136/status/1972184931284799492",
    "https://x.com/volrant136/status/1975244229287846383",
    "https://x.com/volrant136/status/1976333787400409330",
    "https://x.com/volrant136/status/1981058315137536410",
    "https://x.com/volrant136/status/1981378466273775690",
    "https://x.com/volrant136/status/1981382785651921399",
    "https://x.com/volrant136/status/1987156569117892733",
    "https://x.com/volrant136/status/1988688742949978559",
    "https://x.com/volrant136/status/1989955653058875805",
    "https://x.com/volrant136/status/1989957481687388457",
    "https://x.com/volrant136/status/1989958731027943578",
    "https://x.com/volrant136/status/1993209945299599830",
    "https://x.com/volrant136/status/1996677391704289400",
    "https://x.com/volrant136/status/2000684285901332534",
    "https://x.com/volrant136/status/2001677935397474324",
    "https://x.com/volrant136/status/2001706314045727114",
    "https://x.com/volrant136/status/2002000970570690709",
    "https://x.com/volrant136/status/2002046264809296061",
    "https://x.com/volrant136/status/2002771041505149206",
    "https://x.com/volrant136/status/2003498589851668860",
    "https://x.com/volrant136/status/2005680099560153314",
    "https://x.com/volrant136/status/2007867704154476691",
    "https://x.com/volrant136/status/2008605197745193332",
    "https://x.com/volrant136/status/2011859288625725724",
    "https://x.com/volrant136/status/2011865662021660819",
    "https://x.com/volrant136/status/2011866917179703642",
    "https://x.com/volrant136/status/2017258736906297545",
    "https://x.com/volrant136/status/2017261324980687351",
    "https://x.com/volrant136/status/2020180803012161568",
    "https://x.com/volrant136/status/2020360851639922927",
    "https://x.com/volrant136/status/2021636487281045747",
    "https://x.com/volrant136/status/2022616294122508555",
    "https://x.com/volrant136/status/2022993609352741257",
    "https://x.com/volrant136/status/2023422149449699599",
    "https://x.com/volrant136/status/2024478284982210852",
    "https://x.com/volrant136/status/2028050650110554502",
    "https://x.com/volrant136/status/2032133065666089160",
    "https://x.com/volrant136/status/2032833539201540166",
    "https://x.com/volrant136/status/2033226839788060973",
    "https://x.com/volrant136/status/2033574016154226898",
    "https://x.com/volrant136/status/2034639901853970679",
    "https://x.com/volrant136/status/2035385952529522976",
    "https://x.com/volrant136/status/2035748336410759648",
    "https://x.com/volrant136/status/2039761718969315508",
    "https://x.com/volrant136/status/2040459381930877404",
    "https://x.com/volrant136/status/2046241063380390343",
    "https://x.com/volrant136/status/2046603826296234102",
    "https://x.com/volrant136/status/2048054426078724126",
    "https://x.com/volrant136/status/2048431910871875851",
    "https://x.com/volrant136/status/2055309731229507629",
    "https://x.com/volrant136/status/2056077509901574493",
    "https://x.com/volrant136/status/2056744757330665683",
    "https://x.com/volrant136/status/2056766835962323257",
    "https://x.com/volrant136/status/2064713040029991309",
    "https://x.com/volrant136/status/2066232019890426173",
    "https://x.com/volrant136/status/2068637244039258552",
    "https://x.com/volrant136/status/2073059201346408940",
    "https://x.com/volrant136/status/2073667741438103962",
    "https://x.com/volrant136/status/2073668614679650761",
    "https://x.com/volrant136/status/2076012175685287991",
    "https://x.com/volrant136/status/2080669471878819889",
    "https://x.com/volrant136/status/2081805669175370115",
    "https://x.com/volrant136/status/2083246886262313189",
    "https://x.com/volrant136/status/2085410874051981755",
    "https://x.com/wa1Ile/status/1816718243123593410",
    "https://x.com/wa1Ile/status/1879794476480426196",
    "https://x.com/wa1Ile/status/1893896154825294224",
    "https://x.com/wa1Ile/status/1953339615714386101",
    "https://x.com/wa1Ile/status/1999042315726295358",
    "https://x.com/wa1Ile/status/2031612431856971936"
  ],
  "related": [
    {
      "evidence": [
        {
          "detail": "4 shared indicators",
          "kind": "infrastructure",
          "weight": 4.0
        },
        {
          "detail": "2 reports cite both",
          "kind": "reporting",
          "weight": 2.0
        }
      ],
      "slug": "G0134"
    },
    {
      "evidence": [
        {
          "detail": "8 reports cite both",
          "kind": "reporting",
          "weight": 8.0
        }
      ],
      "slug": "G1002"
    },
    {
      "evidence": [
        {
          "detail": "6 reports cite both",
          "kind": "reporting",
          "weight": 6.0
        }
      ],
      "slug": "G0040"
    },
    {
      "evidence": [
        {
          "detail": "2 reports cite both",
          "kind": "reporting",
          "weight": 2.0
        }
      ],
      "slug": "G0032"
    },
    {
      "evidence": [
        {
          "detail": "2 reports cite both",
          "kind": "reporting",
          "weight": 2.0
        }
      ],
      "slug": "G0095"
    },
    {
      "evidence": [
        {
          "detail": "2 reports cite both",
          "kind": "reporting",
          "weight": 2.0
        }
      ],
      "slug": "G1001"
    },
    {
      "evidence": [
        {
          "detail": "1 report cite both",
          "kind": "reporting",
          "weight": 1.0
        }
      ],
      "slug": "G0094"
    },
    {
      "evidence": [
        {
          "detail": "1 report cite both",
          "kind": "reporting",
          "weight": 1.0
        }
      ],
      "slug": "MODIFIEDELEPHANT"
    }
  ],
  "slug": "G0121",
  "timeline": [
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-08-07",
      "indicators": {
        "domain": [
          "defense-housing-authority.vagued.live",
          "msofficeupdate.vagued.live",
          "msofficeupdator.vagued.live",
          "uy.vagued.live",
          "vagued.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/joe4security/status/2085384961570349091",
        "https://www.joesandbox.com/joereverser/analysis/2e03ffcc-7c06-455e-bbfd-a5b7188fa521/download?type=reports&report=html",
        "https://www.virustotal.com/gui/file/3b9432019a80a62fe6760a65f2677783bd60383b60206a5db7237a1b050647a2/detection",
        "https://www.virustotal.com/gui/file/6b85e9c7dd33416a096e377303d82ac49c8c3044f969ff72560409a3f1151cfb/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-08-07",
      "indicators": {
        "domain": [
          "infomofa.workers.dev",
          "mail-navy-lk.up.railway.app",
          "misty-pond-6b85.infomofa.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2085410874051981755"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-08-05",
      "indicators": {
        "domain": [
          "apps-sco-gov-pk.workers.dev",
          "gov-pk.workers.dev",
          "itsupport.apps-sco-gov-pk.workers.dev",
          "webmail-pnra.gov-pk.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/blackorbird/status/2084940847863509476",
        "https://mp.weixin.qq.com/s/PALBLusD4umh_52gy2wVAg"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-08-01",
      "indicators": {
        "domain": [
          "www-nea-gov-cn.fetchdrives.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/phatomcandle/status/2077737009569808478",
        "https://x.com/volrant136/status/2083246886262313189",
        "https://www.virustotal.com/gui/file/1202845815bc416bdfd8be09f500b5833e63ba5e06aeb5fafba093edf0f7e1b9/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-07-28",
      "indicators": {
        "domain": [
          "pmdc.gov.pk-hq.cc"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/1923061758643597787"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 12
      },
      "first_seen": "2026-07-27",
      "indicators": {
        "domain": [
          "pkmpunjabcode.com",
          "spfc-punjab-gov-pk.online",
          "spfc-punjab-govpk.xyz",
          "spfc-punjab-pk.cc",
          "spfc-punjabgov-pk.co",
          "spfc-punjabgov-pk.com",
          "spfc.pk",
          "spfcpkm.online",
          "spfcpungov.site",
          "spfcpunjab-gov-pk.com",
          "spfcpunjabgov.com",
          "spfcpunjabsgovs.pk"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2081805669175370115"
      ],
      "total": 12
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-07-24",
      "indicators": {
        "domain": [
          "mail-fisheries-gov-bd.netlify.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2080669471878819889"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-07-23",
      "indicators": {
        "domain": [
          "9t.fetchdrives.info",
          "fetchdrives.info",
          "mofa-gov-bd.fetchdrives.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/phatomcandle/status/2077737009569808478",
        "https://x.com/volrant136/status/2083246886262313189",
        "https://www.virustotal.com/gui/file/1202845815bc416bdfd8be09f500b5833e63ba5e06aeb5fafba093edf0f7e1b9/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-07-18",
      "indicators": {
        "domain": [
          "visa-nadra-gov-pk.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/skocherhan/status/2027484078132379889"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 9
      },
      "first_seen": "2026-07-11",
      "indicators": {
        "domain": [
          "bdnavy.download-msoffice.com",
          "cabinet-division-gov-pk.download-msoffice.com",
          "ceh.download-msoffice.com",
          "docx2a2e3e78e76bcc759905da3f1532a4b8c2word.download-msoffice.com",
          "download-msoffice.com",
          "mm.download-msoffice.com",
          "portmin.download-msoffice.com",
          "training.docx2a2e3e78e76bcc759905da3f1532a4b8c2word.download-msoffice.com",
          "word.download-msoffice.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/suyog41/status/2075572390315311333",
        "https://www.virustotal.com/gui/file/372226c831de35186e1c96ec28c9ca8ceb02d69c9fe718e21d35b2e921ccf1de/detection",
        "https://www.virustotal.com/gui/file/5ef25d162827195f2fbdc80fd5c6d119ff41dd16f980692a8c4308465d88c554/detection"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-07-11",
      "indicators": {
        "domain": [
          "mail-bcc-gov-bd.vercel.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2076012175685287991"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-07-05",
      "indicators": {
        "domain": [
          "ep-mocha.vercel.app",
          "epyi-zimbat-five.vercel.app",
          "uptownhigh.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2073667741438103962",
        "https://x.com/volrant136/status/2073668614679650761"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-07-04",
      "indicators": {
        "domain": [
          "wmail-zim-gov-rj-se-sp-br-63330a.netlify.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2073059201346408940"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-07-03",
      "indicators": {
        "domain": [
          "tight-lake-webuploader.malik-jaani786.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2028050650110554502",
        "https://x.com/__0XYC__/status/2072904128695800308"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-06-21",
      "indicators": {
        "domain": [
          "mail-bfsa-gov-bd.netlify.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2068637244039258552"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-06-15",
      "indicators": {
        "domain": [
          "min-pk.com",
          "mofa-gov-np.min-pk.com",
          "qa.min-pk.com",
          "qh.min-pk.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2066232019890426173",
        "https://www.virustotal.com/gui/file/f5a7890fd09909711cd9aed1614f8f2687639c61f4ea26efb57100431a688f05/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 10
      },
      "first_seen": "2026-06-10",
      "indicators": {
        "domain": [
          "2672ewr5403894534fgdgfd5907e44fdfgdfg67088gdfgfd90e2cbd8b6.pages.dev",
          "9af72fg4jg75hg8jg9dfghhfgdh5666k41706769d32bf1f766cdec1d1.pages.dev",
          "9af72fg4jg75hg8jg9dfghhfgdh5666k41706769d32bf1f766cdec1d11.pages.dev",
          "dnsvay8faydj3f79dje9djr02j101c4atg3c3acdd2a06ca2fb183cf995.pages.dev",
          "mail-defence-lk-webmail-imp-view-php-actiob-ri5it-kgfi5kg9.pages.dev",
          "mail-navy-lk-4326er48fdu49fgu49fgj549fj349fdj3490fdjk390df.pages.dev",
          "mail-navy-lk-login.pages.dev",
          "sdf-sdgyhsdfg-sdfglksdjh-sdglkjsdglhks-gsdflsdfhhsdfgjklls.pages.dev",
          "sdfsdf-tfghfghf546rty6ytuuyjgutyjghj-rtfytr54fghf-fghfg-fg.pages.dev",
          "sdgf9af72f31706769d32bf1ff66cdec1d1gkj5jg95jg5k0hkg95kg0tk.pages.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2064713040029991309"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-06-10",
      "indicators": {
        "domain": [
          "pk-cc.com",
          "pk-qrs.online",
          "visa.nadra.gov.pk-cc.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/skocherhan/status/2027484078132379889"
      ],
      "total": 3
    },
    {
      "counts": {
        "ipv4": 2
      },
      "first_seen": "2026-05-21",
      "indicators": {
        "ipv4": [
          "5.252.178.27:443",
          "5.252.178.27:9889"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.linkedin.com/posts/smica83_sidewinder-rattlesnake-macedonia-share-7463160755161526273-N2hU",
        "https://www.virustotal.com/gui/file/04016d3ac1b30375de773a8fd63a4d7f60aa36ab5679b1714e2d98ac88979505/detection",
        "https://www.virustotal.com/gui/file/3b294866be0b9d298121df7fbb2709ceb3dba700526aba68f07871e8005b7891/detection",
        "https://www.virustotal.com/gui/file/e9f44c4e4239b676c8c9afd05edf7cdbb0b1fd95e1be67e021bb40702d045d72/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2026-05-19",
      "indicators": {
        "domain": [
          "interior-ministry.com",
          "mofa-gov-bd.interior-ministry.com",
          "moha-gov-np.interior-ministry.com",
          "ol.interior-ministry.com",
          "pubad-gov-lk.interior-ministry.com",
          "www-ndma-gov-pk.interior-ministry.com",
          "www-sbp-org-pk.interior-ministry.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2056744757330665683",
        "https://www.virustotal.com/gui/ip-address/83.243.121.239/relations"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-05-19",
      "indicators": {
        "domain": [
          "interiorgovpk.life"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/1938848055022833806",
        "https://x.com/volrant136/status/2056766835962323257"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-05-17",
      "indicators": {
        "domain": [
          "interior-gov-pk.direct880.net",
          "moha-gov-np.direct880.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2056077509901574493",
        "https://www.virustotal.com/gui/file/3003f4084df2f5ef9cdd896abc099f0a3b84dafd05c8d405beb3b276d6348d5b/detection",
        "https://www.virustotal.com/gui/file/a03677e263bad0c2ea6ae319c1b0b925b1f3a2f851ed24141d74a65abaf7e70c/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-05-15",
      "indicators": {
        "domain": [
          "dumping-open-burning-of-hazardous-waste.zeabur.app",
          "iran-war-or-deal.zeabur.app",
          "mail-ideaspakistan-gov-pk.zeabur.app",
          "minutes-of-meeting.zeabur.app",
          "zimbramail-nyatel-com.up.railway.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2055309731229507629"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 6,
        "url_path": 1
      },
      "first_seen": "2026-05-14",
      "indicators": {
        "domain": [
          "cloudforme.top",
          "docs.files-windows.top",
          "files-windows.top",
          "ntc-firewall.safeurl-content.online",
          "pakistan-server-auth0.cloudforme.top",
          "safeurl-content.online"
        ],
        "url_path": [
          "/opx/mailflair/r/EZ6n6FMhSh"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/__0XYC__/status/2054792675887382660",
        "https://x.com/__0XYC__/status/2054793748106657829",
        "https://www.virustotal.com/gui/file/b9a5a187f850885bf7e9de5c1f957469bb16a65d51b08e2da79202e13e069010/detection"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-05-14",
      "indicators": {
        "domain": [
          "2r.nrtcpk-net.com",
          "circular.nrtcpk-net.com",
          "erty.nrtcpk-net.com",
          "nrtcpk-net.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/malwrhunterteam/status/2054831494347063755",
        "https://www.virustotal.com/gui/file/34074546f23b48d31d368b2b1c0c3f475dbc15689853a91d113038eb1cd8d8bb/detection",
        "https://www.virustotal.com/gui/file/9ae756a44c87dde511f11b521c7643b80b330c87f6cf78db5410278c1dc61996/detection",
        "https://www.virustotal.com/gui/file/d163ef058710925ef5ea2be66df52d837880d1ec18e6575395cab2cd441404a0/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-05-02",
      "indicators": {
        "domain": [
          "ee-visa.com",
          "nadra-gov.ee-visa.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/skocherhan/status/2027484078132379889"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2026-04-28",
      "indicators": {
        "domain": [
          "direct880.net",
          "geneva-mofa-gov-bd.direct880.net",
          "mofa-go-np.direct880.net",
          "mofa-gov-np.direct880.net",
          "pakun-org.direct880.net",
          "wg.direct880.net",
          "www-fbr-gov-pk.direct880.net",
          "www-securitycouncilreport-org.direct880.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/Cyberteam008/status/2048596656141340906",
        "https://www.virustotal.com/gui/file/e032080c5afeb99bd8bd87e3f68d2b655162a90a78d1207ec12bc0e81563a077/detection",
        "https://www.virustotal.com/gui/file/159c47db6c9a162c47167ff4d9ebb892e44acf946c95aaad0ec49935627844fc/detection"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-04-26",
      "indicators": {
        "domain": [
          "zimbra-nyatel-production.up.railway.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2048431910871875851"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-04-25",
      "indicators": {
        "domain": [
          "webapp-getdocumentodwnload-pacapp.malik-jaani786.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2048054426078724126"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 1
      },
      "first_seen": "2026-04-23",
      "indicators": {
        "domain": [
          "driveattachment-mofa.com"
        ],
        "ipv4": [
          "38.60.235.109:9876"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/Thisism23567356/status/2047237888799092781",
        "https://www.virustotal.com/gui/file/ae3348414926ec22db313ccd61b0d78c819325b3c6f364903d88da5404a05ac4/detection",
        "https://www.virustotal.com/gui/file/d375ad74e3f3994f919a68f97d082f796a8dc426083423141d40d5f095cede09/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 42
      },
      "first_seen": "2026-04-21",
      "indicators": {
        "domain": [
          "cabinet.gov.bd.pk-mailgov.com",
          "cbsl.lk.pk-mailgov.com",
          "commerce.gov.pk.pk-mailgov.com",
          "control.pk-mailgov.com",
          "cpj.org.pk-mailgov.com",
          "dmerpccc.gov.pk.gmail.com.pk-mailgov.com",
          "estabiishment.gov.pk-mailgov.com",
          "fbr.gov.pk-mailgov.com",
          "fpsc.gov.pk-mailgov.com",
          "gmail.com.pk-mailgov.com",
          "gov.pk-mailgov.com",
          "gunaso.pk-mailgov.com",
          "hotmail.pk-mailgov.com",
          "info.pk-mailgov.com",
          "info2.pk-mailgov.com",
          "interior.gov.pk-mailgov.com",
          "mha.gov.bd.pk-mailgov.com",
          "mishal.com.pk-mailgov.com",
          "mo.treasury.gov.lk.pk-mailgov.com",
          "mod.gov.bd.pk-mailgov.com",
          "mof.gov.np.pk-mailgov.com",
          "mofa.gov.bd.pk-mailgov.com",
          "moha.gov.bd.pk-mailgov.com",
          "moha.gov.np.pk-mailgov.com",
          "moib.gov.pk-mailgov.com",
          "ndma.gov.pk-mailgov.com",
          "org.pk-mailgov.com",
          "osacadmin.pk-mailgov.com",
          "pakun.org.pk-mailgov.com",
          "pk-mailgov.com",
          "pk.gmail.com.pk-mailgov.com",
          "pk.pk-mailgov.com",
          "pubad.gov.lk.pk-mailgov.com",
          "reliefweb.int.pk-mailgov.com",
          "securitycouncilreport.org.pk-mailgov.com",
          "sltnet.lk.pk-mailgov.com",
          "state.gov.pk-mailgov.com",
          "treasury.gov.lk.pk-mailgov.com",
          "un.org.pk-mailgov.com",
          "webdisk.pk-mailgov.com",
          "webmail.pk-mailgov.com",
          "whm.pk-mailgov.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2046603826296234102"
      ],
      "total": 42
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2026-04-20",
      "indicators": {
        "domain": [
          "apostille-mofa-gov-pk-verify-attestation.cerapostille.com",
          "apostille-mofa-gov-pk-verify-attestation.encodertechs.com",
          "apostillemofag0v-pk.storeaone.com",
          "appostile-mofa-pk.storeaone.com",
          "appostille-mofa-gov-pk-attestation.storeaone.com",
          "appostille-mofa-gov.storeaone.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/89.116.133.247/relations"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-04-20",
      "indicators": {
        "domain": [
          "preview-mail-from-mofa-gov-pk-user-com-center.malik-jaani786.workers.dev",
          "zimramail-nayatel.girlfriendparty42.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://intel.breakglass.tech/post/sidewinder-z2fa-lts-moincox-bangladesh-navy-pakistan-mofa-opsec-burn"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-04-20",
      "indicators": {
        "domain": [
          "twilight-violet-55a5.malik-jaani786.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2046241063380390343"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-04-16",
      "indicators": {
        "domain": [
          "mail-svr.co",
          "mofa-gov-bd.mail-svr.co",
          "www-unocha-org.mail-svr.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/__0XYC__/status/2042075173915127858",
        "https://x.com/SinghSoodeep/status/2043571382601289736",
        "https://www.virustotal.com/gui/file/492a46f495a17a0c5d7e59cf362f3f6f57f01c3be39f912e37ec51298fa73d6a/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-04-06",
      "indicators": {
        "domain": [
          "contract-agreement-with-staff.zeabur.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2040459381930877404"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-04-04",
      "indicators": {
        "domain": [
          "blog.fbmastery.com",
          "fbmastery.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/skocherhan/status/2027484078132379889"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-04-03",
      "indicators": {
        "domain": [
          "zimbramail-nayatel-com.zeabur.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2039761718969315508"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-04-02",
      "indicators": {
        "domain": [
          "estabiishment.gov.ministry-gov.org",
          "gov.ministry-gov.org",
          "ministry-gov.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/__0XYC__/status/2039538772090753351"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-03-31",
      "indicators": {
        "domain": [
          "evisa-nadra-govpak.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/skocherhan/status/2027484078132379889"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-03-30",
      "indicators": {
        "domain": [
          "gov.pk-cam.online",
          "gov.pk.onev.online",
          "gov.qrpk.info",
          "pk-cam.online",
          "visa.nadra.gov.pk-cam.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/skocherhan/status/2027484078132379889"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-03-24",
      "indicators": {
        "domain": [
          "dp.islamic-finder.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/AndreGironda/status/1981785066515968447",
        "https://cybersecuritynews.com/sidewinder-hacking-group-uses-clickonce-based-infection-chain/",
        "https://www.virustotal.com/gui/file/99ed9f44a02a3549d60c58233f793622319ed4d08d2c1c8d6fd17fcb06afa8c0/detection",
        "https://www.virustotal.com/gui/file/93ebcdc6bee559d9c61f484dd521c917517a5114bbfa3ed7d374547a6d0e08e8/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2026-03-23",
      "indicators": {
        "domain": [
          "cabinet-gov-bd.donwloaad-file.com",
          "df.donwloaad-file.com",
          "donwloaad-file.com",
          "fbr-gov-pk.donwloaad-file.com",
          "pubad-gov-lk.donwloaad-file.com",
          "www-fbr-gov-pk.donwloaad-file.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/SinghSoodeep/status/2035992239235903862",
        "https://www.virustotal.com/gui/file/4d11d087acbf9573e3f850a99f5bb67357ed2215de0e96a63c4c151f0714e4f9/detection"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-03-22",
      "indicators": {
        "domain": [
          "fbr-g0v.pk",
          "ndmagovpk.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2035748336410759648"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-03-21",
      "indicators": {
        "domain": [
          "cabinet-gov-pk.mora-govpk.co",
          "mora-govpk.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2035385952529522976"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-03-19",
      "indicators": {
        "domain": [
          "pk-ev.online",
          "pk-o.xyz",
          "visa.nadra.gov.pk-o.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/skocherhan/status/2027484078132379889"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-03-19",
      "indicators": {
        "domain": [
          "bold-bonus-1d3b.malik-jaani786.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2034639901853970679"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-03-19",
      "indicators": {
        "domain": [
          "malik-jaani786.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2028050650110554502",
        "https://x.com/__0XYC__/status/2072904128695800308",
        "https://x.com/volrant136/status/2034639901853970679"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 15
      },
      "first_seen": "2026-03-18",
      "indicators": {
        "domain": [
          "ambpoint.vip",
          "blueoceancode.com",
          "guosapp.vip",
          "guotoujgvip.vip",
          "gygaxf.com",
          "hkunionpoy.vip",
          "jobfreeeco.it.com",
          "line-wqeyoiua.top",
          "mitgiied.vip",
          "wps-hakjgyu.top",
          "wps-yoiuzuiof.top",
          "xdappxz.vip",
          "xdlxweb.vip",
          "yayoi.it.com",
          "zhenpinxuanji.vip"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/FatzQatz/status/2034236872076231108"
      ],
      "total": 15
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-03-17",
      "indicators": {
        "domain": [
          "qrpk.info",
          "visa.nadra.gov-pk.info",
          "visa.nadra.gov.qrpk.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/skocherhan/status/2027484078132379889"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-03-16",
      "indicators": {
        "domain": [
          "girlfriendparty42.workers.dev",
          "royal-field-9144.girlfriendparty42.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2033574016154226898"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-03-15",
      "indicators": {
        "domain": [
          "freshg-dgprocur2028200-ou4zqmub.leapcell.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2033226839788060973"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-03-15",
      "indicators": {
        "domain": [
          "onev.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/skocherhan/status/2027484078132379889"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-03-14",
      "indicators": {
        "domain": [
          "dekl-dgprocur2028200-ljakefli.leapcell.dev",
          "mail-hit-gov.leapcell.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2032833539201540166"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-03-13",
      "indicators": {
        "domain": [
          "bahria-edu.workers.dev",
          "cc-cvbs-sco.workers.dev",
          "cms.bahria-edu.workers.dev",
          "support.cc-cvbs-sco.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/RedDrip7/status/2032290347527913562",
        "https://www.virustotal.com/gui/file/67c341e187ddfcd5a4a7df8743ae82e72db1e5c3747d5c4e185d99f54182f093/detection",
        "https://www.virustotal.com/gui/file/e5474cad56d35160c83378e6719f7c2331333581ab78a0428d0c425a3049e50f/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-03-13",
      "indicators": {
        "domain": [
          "com-e-visa.online",
          "visa.nadra.gov.pk.com-e-visa.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/skocherhan/status/2027484078132379889"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-03-12",
      "indicators": {
        "domain": [
          "zimbramail-nayatel.leapcell.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2032133065666089160"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 11
      },
      "first_seen": "2026-03-11",
      "indicators": {
        "domain": [
          "ankara-mofa-gov-bd.fia-g0v.net",
          "cabinet-gov-bd.fia-g0v.net",
          "fia-g0v.net",
          "mofa-gov-np.fia-g0v.net",
          "mofa-gov-pk.fia-g0v.net",
          "moha-portal-gov-bd.fia-g0v.net",
          "pubad-gov-ik.fia-g0v.net",
          "pubad-gov-lk.fia-g0v.net",
          "www-cbsl-gov-lk.fia-g0v.net",
          "www-commerce-gov-pk.fia-g0v.net",
          "www-establishment-gov-pk.fia-g0v.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/wa1Ile/status/2031612431856971936",
        "https://www.virustotal.com/gui/file/dcca21d91e3f261f998d7caa78660ac86b8b16c3785eef87788b502e84d98a8b/detection"
      ],
      "total": 11
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-03-09",
      "indicators": {
        "domain": [
          "visa.nadra-gov.click",
          "visa.nadra.gov.pk-ev.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/skocherhan/status/2027484078132379889"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-03-02",
      "indicators": {
        "domain": [
          "bangladesh-islamic-baank.workers.dev",
          "info.bangladesh-islamic-baank.workers.dev",
          "ov-pk.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://arcticwolf.com/resources/blog/sloppylemming-deploys-burrowshell-and-rust-based-rat-to-target-pakistan-and-bangladesh/"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-03-01",
      "indicators": {
        "domain": [
          "download-secure-app-from-icloud.malik-jaani786.workers.dev",
          "hit-view-message-preview.malik-jaani786.workers.dev",
          "modp-view-full-message.malik-jaani786.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2028050650110554502",
        "https://x.com/__0XYC__/status/2072904128695800308"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 22
      },
      "first_seen": "2026-02-28",
      "indicators": {
        "domain": [
          "gov-pak.com",
          "gove.pw",
          "gvo-pk.cc",
          "lubeleaf.com",
          "nadra-gov.online",
          "nadra-gov.pt",
          "nadra.gove.pw",
          "nadra.gvo-pk.cc",
          "pakvisa.online",
          "shafaftech.com",
          "visa-nadra-gov-pk.desynt.com",
          "visa-nadra-gov-pk.lubeleaf.com",
          "visa-nadra-gov-pk.pages.dev",
          "visa-nadra-gov-pk.shafaftech.com",
          "visa-nadra-gov-pk.xo.je",
          "visa.nadra-gov.online",
          "visa.nadra-gov.pt",
          "visa.nadra.gov-pak.com",
          "visa.nadra.gov.pk.pakvisa.online",
          "visa.nadra.gov.pk.rdpip.com",
          "visa.nadra.gove.pw",
          "visa.nadra.gvo-pk.cc"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/skocherhan/status/2027484078132379889"
      ],
      "total": 22
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-02-26",
      "indicators": {
        "domain": [
          "adobe.updatepdf.workers.dev",
          "updatepdf.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/__0XYC__/status/2026971764769665277",
        "https://www.virustotal.com/gui/file/795ea82a7aa424f6d54d975a44d1c69a622217dbf8ebbd67becb64559bd3a909/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-02-19",
      "indicators": {
        "domain": [
          "mail-navy-lk-43897fyi78945tr78945uio89045iuort89045prt054k.pages.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2024478284982210852"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-02-17",
      "indicators": {
        "domain": [
          "cdn-pkcert-gov-pk.pages.dev",
          "nrtc-com-pk.pages.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/suyog41/status/2023736857771827313",
        "https://www.virustotal.com/gui/file/f0ee184cdc7ba2a87a669462942f11ebb8d98e10d887e5a668668b5fd822bdda/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-02-17",
      "indicators": {
        "domain": [
          "pkcert-gov-pk.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/172.67.166.115/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-02-16",
      "indicators": {
        "domain": [
          "234rewr44dfs34sdf43454353fd4ffg345rr4.netlify.app",
          "435fdgfd-fgh675gh56jh-65jhg65ghjytu65.netlify.app",
          "9af72fg4jg75hg8jg94kg94k9fk390gk4170674tr69bf1f766cdec1d11.pages.dev",
          "mail-pmo-gov-lk3u3i495ui3jkdf9d549fgkj45fg94jdfg904j439g.pages.dev",
          "slservices-lk.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2023422149449699599"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-02-16",
      "indicators": {
        "domain": [
          "navy-pk-dils-maint213-ifwcnxl4.leapcell.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2022993609352741257"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-02-14",
      "indicators": {
        "domain": [
          "download-doc.com",
          "mail-pk.com",
          "mails-pk.net",
          "pc-gov-pk.download-doc.com",
          "www-cbsl-gov-lk.download-doc.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/__0XYC__/status/2022530597097271436",
        "https://x.com/volrant136/status/2022616294122508555"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-02-12",
      "indicators": {
        "domain": [
          "mail-ntc-net-pk-zimbra-dils-maint213-2q1ntcqz.leapcell.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2021636487281045747"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 11
      },
      "first_seen": "2026-02-11",
      "indicators": {
        "domain": [
          "www-ccdi-gov-cn.hkbmwzone.com",
          "www-chinaneast-gov-cn.videoem.com",
          "www-creditjx-gov-cn.aaaqb.com",
          "www-enfotss-gov-ao.pages.dev",
          "www-hernandarias-gov-py.pages.dev",
          "www-shshjs-gov-cn.videoem.com",
          "www-tic-gov-tl.outlookowa.com",
          "www-tic-gov-tl.selectpaw.com",
          "www-tjlsj-gov-cn.syyjc.net",
          "www-toki-gov-tr.sa.com",
          "www-ymbq-gov-cn.drron.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2021636487281045747"
      ],
      "total": 11
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-02-11",
      "indicators": {
        "domain": [
          "establishment.mails-pk.com",
          "filenesthub.org",
          "mails-pk.com",
          "pubad-gov-lk.filenesthub.org",
          "www-finance-gov-pk.filenesthub.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/__0XYC__/status/2021430578197995793"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 11
      },
      "first_seen": "2026-02-08",
      "indicators": {
        "domain": [
          "bgmea-com-bd.loadpath.net",
          "depo-gov-pk.loadpath.net",
          "g20-org-za.loadpath.net",
          "kashmirawareness.loadpath.net",
          "loadpath.net",
          "mof-gov-bd.loadpath.net",
          "mof-portal-gov-bd.loadpath.net",
          "mowr-gov-pk.loadpath.net",
          "pubad-gov-lk.loadpath.net",
          "www-finance-gov-pk.loadpath.net",
          "www-kashmirawareness-org.loadpath.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2020360851639922927"
      ],
      "total": 11
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-02-08",
      "indicators": {
        "domain": [
          "www-finance-gov-pk.fetchdrive.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/wa1Ile/status/1999042315726295358",
        "https://x.com/suyog41/status/2001622867822415897",
        "https://www.virustotal.com/gui/file/30be03d9709a15d677b7692855993f1ef3708d568c27c293cc2f02295ce99c4b/detection",
        "https://www.virustotal.com/gui/file/7d8109940eb9b9c5f00f6ff8b4db21585c1a2723766a359eef39e6926e0807ea/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1,
        "url_path": 1
      },
      "first_seen": "2026-02-07",
      "indicators": {
        "domain": [
          "mail-bcc-gov-bd-condepakuregoda4533-fxr7ofbc.leapcell.dev"
        ],
        "url_path": [
          "/?ausbduabxyasgdbaskbbx="
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2020180803012161568"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 59
      },
      "first_seen": "2026-02-06",
      "indicators": {
        "domain": [
          "bd.mail-pk.org",
          "bgmea.com.bd.mail-pk.org",
          "cabinet.gov.mail-pk.org",
          "caninetdivision.mail-pk.org",
          "cbsl.lk.mail-pk.org",
          "com.bd.mail-pk.org",
          "com.mail-pk.org",
          "commerce.gov.pk.mail-pk.org",
          "communications.gov.mail-pk.org",
          "dirco.gov.za.mail-pk.org",
          "finance.gov.bd.mail-pk.org",
          "finance.gov.pk.mail-pk.org",
          "gmail.com.mail-pk.org",
          "gov.bd.mail-pk.org",
          "gov.lk.mail-pk.org",
          "gov.mail-pk.org",
          "gov.np.mail-pk.org",
          "gov.pk.mail-pk.org",
          "gov.za.mail-pk.org",
          "grabfiles.net",
          "lk.mail-pk.org",
          "mail-pk.org",
          "mha.gov.bd.mail-pk.org",
          "mo.treasury.gov.lk.mail-pk.org",
          "mod.gov.bd.mail-pk.org",
          "mof.gov.np.mail-pk.org",
          "mofa-gov-bd.grabfiles.net",
          "mofa.gov.bd.mail-pk.org",
          "mofa.gov.mail-pk.org",
          "mofa.gov.np.mail-pk.org",
          "mofa.mail-pk.org",
          "moha.gov.bd.mail-pk.org",
          "moha.gov.np.mail-pk.org",
          "mowr.gov.pk.mail-pk.org",
          "na.gov.mail-pk.org",
          "nepal.gov.np.mail-pk.org",
          "nepra-org-pk.grabfiles.net",
          "nepra.org.pk.mail-pk.org",
          "np.mail-pk.org",
          "org.pk.mail-pk.org",
          "paknavy.gov.pk.mail-pk.org",
          "pc.gov.pk.mail-pk.org",
          "pimec.gov.mail-pk.org",
          "pimec.gov.pk.mail-pk.org",
          "pk.mail-pk.org",
          "pmmd.treasury.gov.lk.mail-pk.org",
          "portmin.gov.lk.mail-pk.org",
          "ppra.org.pk.mail-pk.org",
          "pta.mail-pk.org",
          "pubad-gov-lk.grabfiles.net",
          "pubad.gov.lk.mail-pk.org",
          "sltnet.lk.mail-pk.org",
          "swo-gov-pk.grabfiles.net",
          "swo.gov.pk.mail-pk.org",
          "treasury.gov.lk.mail-pk.org",
          "wapda.gov.mail-pk.org",
          "www-cbsl-gov-lk.grabfiles.net",
          "www-finance-gov-pk.grabfiles.net",
          "za.mail-pk.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/__0XYC__/status/2019617829784547463"
      ],
      "total": 59
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-02-03",
      "indicators": {
        "domain": [
          "mopa-gov-bd.snagdrive.org",
          "toepsai.tech",
          "vpsaren.site"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/AndreGironda/status/1981785066515968447",
        "https://cybersecuritynews.com/sidewinder-hacking-group-uses-clickonce-based-infection-chain/",
        "https://www.virustotal.com/gui/file/99ed9f44a02a3549d60c58233f793622319ed4d08d2c1c8d6fd17fcb06afa8c0/detection",
        "https://www.virustotal.com/gui/file/93ebcdc6bee559d9c61f484dd521c917517a5114bbfa3ed7d374547a6d0e08e8/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-31",
      "indicators": {
        "domain": [
          "hit-deop-hasan7169004254-f24834bv.leapcell.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2017261324980687351"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-31",
      "indicators": {
        "domain": [
          "zimbra10-internationalrelation40-beep5751-brqupv53.leapcell.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2017258736906297545"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-31",
      "indicators": {
        "domain": [
          "org.hitpak.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/__0XYC__/status/1972166420403572852",
        "https://x.com/volrant136/status/1972184931284799492",
        "https://www.welivesecurity.com/en/eset-research/love-actually-fake-dating-app-used-lure-targeted-spyware-campaign-pakistan/",
        "https://www.virustotal.com/gui/file/5e1cfa57771084629c2b08757f38d67f0ad28faa412090f1c6ef3fa0fd893bb3/detection",
        "https://www.virustotal.com/gui/file/e4aa98c1beee901871fd8a78b37b21ef886e507e65fc6499e3df3769081cd1cb/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-23",
      "indicators": {
        "domain": [
          "zimbra10-nml3wp-max8143-fn1rsf7l.leapcell.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/__0XYC__/status/2014705989681840232"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1,
        "url_path": 1
      },
      "first_seen": "2026-01-20",
      "indicators": {
        "domain": [
          "s3-ap-northeast-1-amazonaws-com.pages.dev"
        ],
        "url_path": [
          "/krypt0kickoswk1wokic.html"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/malwrhunterteam/status/2013212998198796594",
        "https://www.virustotal.com/gui/file/590879c567c6d95b18b34e46e9830ba7b807279d76d83abc066f013d4b6f693e/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-01-19",
      "indicators": {
        "domain": [
          "api.desco-gov-bd.workers.dev",
          "desco-gov-bd.workers.dev",
          "fancy-voice-b182.goldibrowhoami.workers.dev",
          "ftp.desco-gov-bd.workers.dev",
          "goldibrowhoami.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/RedDrip7/status/2013145924730863672",
        "https://www.virustotal.com/gui/file/1946315d645d9a8c5114759b350ec4f85dba5f9ee4a63d74437d7a068bff7752/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-01-19",
      "indicators": {
        "domain": [
          "ahsaanullaahkhan.workers.dev",
          "api.ahsaanullaahkhan.workers.dev",
          "netof66867.workers.dev",
          "test.netof66867.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/RedDrip7/status/2013146014660571412",
        "https://www.virustotal.com/gui/file/13c1a063409ad73e068604e4a5a605915d96d3c8e87e466bb49c6f41033d5909/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-16",
      "indicators": {
        "domain": [
          "training-course-on-improving-safety.up.railway.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2011866917179703642"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-16",
      "indicators": {
        "domain": [
          "dfkl-mdalifhossen595864-bqa6juqe.leapcell.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2011865662021660819"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-16",
      "indicators": {
        "domain": [
          "zimbra10-nml3wp-max8143-3ipio7e5.leapcell.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2011859288625725724"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1,
        "url_path": 1
      },
      "first_seen": "2026-01-07",
      "indicators": {
        "domain": [
          "s3-eu-central-1amazonaws-com-2n4.pages.dev"
        ],
        "url_path": [
          "/x9238vnhajerh.html"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/malwrhunterteam/status/2008471305432003044",
        "https://www.virustotal.com/gui/file/421f7bdc183b51435cf834c6a2841491e2a9d2246826bb56424d7c42c1632e25/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-06",
      "indicators": {
        "domain": [
          "site4-map-com.zeabur.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2008605197745193332"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-04",
      "indicators": {
        "domain": [
          "zimbra-com.up.railway.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2007867704154476691"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 233
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "0range.site",
          "126mail-cn.com",
          "16bz5.pmreco.xyz",
          "1846m.pmreco.xyz",
          "3nxyc.pmreco.xyz",
          "423743f1-53d2-41bf-9dba-e1e0b7c8f460.pmreco.xyz",
          "4yj7f.pmreco.xyz",
          "5vs9r.pmreco.xyz",
          "6dbb77fd-6d9d-415e-b414-3d1051cd33f4.dytt888.net",
          "96c54.pmreco.xyz",
          "982m31.pmreco.xyz",
          "a.fetchdrive.info",
          "aapletv.org",
          "admin.grabfiles.org",
          "admin.onesom.biz",
          "agent.onesom.biz",
          "alhabib.live",
          "amazingbonis.com",
          "api.grabfiles.org",
          "api.onesom.biz",
          "app.dytt888.net",
          "app.grabfiles.org",
          "app.onesom.biz",
          "arceno.xyz",
          "arcteno.live",
          "army-bdgov.com",
          "army-lk.org",
          "aromne.info",
          "assets.fetchdrive.info",
          "autoconfig.bdgov.info",
          "autodiscover.seoshz.live",
          "b1x.mov",
          "b5hyr.pmreco.xyz",
          "baerow.live",
          "bd.filenest.live",
          "beaxor.xyz",
          "berec.live",
          "bizor.live",
          "blog.grabfiles.org",
          "blty.at",
          "bnepon.xyz",
          "bodec.site",
          "botim.cc",
          "c6udy.pmreco.xyz",
          "cabinet-gov-pk.dytt888.net",
          "cbsl-gov-lk.snagdrive.com",
          "cc2mm.pmreco.xyz",
          "clopem.info",
          "cms.grabfiles.org",
          "com.news-bd.com",
          "cpanel.news-bd.com",
          "cpcalendars.bdgov.info",
          "critical-patch-update.com",
          "dashboard.onesom.biz",
          "dc-4c46fcf37468.news-bd.com",
          "defence-bd.net",
          "demcon.live",
          "demo.fetchdrive.info",
          "demo.grabfiles.org",
          "dev.fetchdrive.info",
          "dev.grabfiles.org",
          "dev.onesom.biz",
          "download-store.tech",
          "dsocem.site",
          "dytt888.net",
          "elaopsu.live",
          "exosel.info",
          "fbrgov.com",
          "fdb74.pmreco.xyz",
          "feew6.pmreco.xyz",
          "fetchdrive.info",
          "filenest.live",
          "flomen.xyz",
          "frzpwdev.grabfiles.org",
          "gitlab.seoshz.live",
          "gmapp.info",
          "go709p.dytt888.net",
          "goslin.info",
          "gov-office.org",
          "govbd-div.com",
          "grabfiles.org",
          "greatslols.com",
          "halcor.site",
          "hetlic.tech",
          "hinoms.com",
          "hlones.xyz",
          "holemn.xyz",
          "hostmaster.news-bd.com",
          "hpqumyre.grabfiles.org",
          "hrka1.pmreco.xyz",
          "huneme.live",
          "iclod.org",
          "igqlc.pmreco.xyz",
          "igyg8z.sepweo.info",
          "install-e.store",
          "ipv6.seoshz.live",
          "iseonea.live",
          "islamic-finder.org",
          "j2zfz.pmreco.xyz",
          "jestec.info",
          "jomeno.site",
          "jomens.live",
          "kenose.live",
          "ketin.live",
          "ketle.site",
          "khaleejtimes.cc",
          "kicov.site",
          "kintecc.com",
          "kmz.fetchdrive.info",
          "koepasc.live",
          "koitic.org",
          "lalosop.biz",
          "laspzo.site",
          "lescrip.live",
          "linkeden.net",
          "loadpath.info",
          "loasem.live",
          "loasen.xyz",
          "lonime.xyz",
          "m1n.mov",
          "macop.site",
          "magento.seoshz.live",
          "mail-163cn.com",
          "mail.bdgov.info",
          "mail.news-bd.com",
          "mailserver.seoshz.live",
          "marine-pak.org",
          "me7q1.pmreco.xyz",
          "mfa-govtt-az.com",
          "mfa-govtt-mm.com",
          "milbdarmy.live",
          "mocat-gov-bd.filenest.live",
          "mod-gov-bd.filenest.live",
          "mod-gov-bd.snagdrive.com",
          "modeso.info",
          "mofa-gov-bd.filenest.live",
          "mofa-gov-bd.snagdrive.com",
          "mofa-gov-np.dytt888.net",
          "mofa-lk.org",
          "moha-gov-bd.filenest.live",
          "moha-gov-bd.snagdrive.com",
          "moha-gov-np.filenest.live",
          "moha-gov-np.snagdrive.com",
          "mos-gov-bd.snagdrive.com",
          "ms.dufichiers.fr",
          "n2pro.pmreco.xyz",
          "ndma-govpk.info",
          "nemln.pmreco.xyz",
          "news-bd.com",
          "news-bd.com.news-bd.com",
          "news-lk.com",
          "nocet.info",
          "nrdi-govt.com",
          "nrtc-supporl2.com",
          "ns1.army-lk.org",
          "ns1.news-bd.com",
          "ns1.news-bd.com.news-bd.com",
          "ns2.army-lk.org",
          "ns2.news-bd.com",
          "nslow.pmreco.xyz",
          "o1ghs.pmreco.xyz",
          "oalems.com",
          "office-addonsmis.com",
          "office.seoshz.live",
          "onesom.biz",
          "ootbp.pmreco.xyz",
          "opesc.info",
          "orrwv.pmreco.xyz",
          "panel.onesom.biz",
          "pasoale.info",
          "pectec.live",
          "pin-up.amazingbonis.com",
          "pinup.greatslols.com",
          "pmo-gov-pk.filenest.live",
          "pmo-gov-pk.loadpath.info",
          "pmo-gov-pk.snagdrive.com",
          "pmreco.xyz",
          "postfix.hondeman.net",
          "pp4gk.pmreco.xyz",
          "primary.news-bd.com",
          "pubad-gov-lk.filenest.live",
          "qakt3.pmreco.xyz",
          "rk7l0o.onesom.biz",
          "rmdjkuceitapp.grabfiles.org",
          "roensa.xyz",
          "rustore.fetchdrive.info",
          "rustore.pmreco.xyz",
          "saarc-sec-org.snagdrive.com",
          "sbd1u.pmreco.xyz",
          "seoshz.live",
          "sepweo.info",
          "sercha.info",
          "shoemo.xyz",
          "smtp.dytt888.net",
          "snagdrive.com",
          "snagdrive.org",
          "sopeor.com",
          "sri-lanka-it.com",
          "sri-lanka.it.com",
          "stage.onesom.biz",
          "staging.grabfiles.org",
          "staging.onesom.biz",
          "tactin.info",
          "telcec.site",
          "test.fetchdrive.info",
          "test.onesom.biz",
          "update1.store",
          "upones.site",
          "user.onesom.biz",
          "uw9i.pmreco.xyz",
          "v1d.mov",
          "valac.biz",
          "vateno.info",
          "velopen.info",
          "webdisk.bdgov.info",
          "webdisk.news-bd.com",
          "webmail.bdgov.info",
          "webmail.news-bd.com",
          "wl8aq8.nocet.info",
          "wqkwqcwvcn.filenest.live",
          "www-cbsl-gov-lk.filenest.live",
          "www-cbsl-gov-lk.loadpath.info",
          "www-cbsl-gov-lk.snagdrive.com",
          "www-parliament-lk.snagdrive.com",
          "www-pmo-gov-pk.dytt888.net",
          "www-treasury-gov-lk.filenest.live",
          "www-treasury-gov-lk.snagdrive.com",
          "y9zz2.pmreco.xyz",
          "yerac.live",
          "yhue2.pmreco.xyz",
          "zlaeso.xyz",
          "zruod.pmreco.xyz",
          "zyu43.pmreco.xyz"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/AndreGironda/status/1981785066515968447",
        "https://cybersecuritynews.com/sidewinder-hacking-group-uses-clickonce-based-infection-chain/",
        "https://www.virustotal.com/gui/file/99ed9f44a02a3549d60c58233f793622319ed4d08d2c1c8d6fd17fcb06afa8c0/detection",
        "https://www.virustotal.com/gui/file/93ebcdc6bee559d9c61f484dd521c917517a5114bbfa3ed7d374547a6d0e08e8/detection"
      ],
      "total": 233
    },
    {
      "counts": {
        "domain": 68
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "autoconfig.pk-mail.org",
          "autodiscover.pk-mail.org",
          "balochistanpolice.gov.pk-mail.org",
          "bcc.gov.bd.pk-mail.org",
          "bd.pk-mail.org",
          "caapakistan.pk-mail.org",
          "cabinet.gov.pk-mail.org",
          "cbsl.lk.pk-mail.org",
          "com.pk-mail.org",
          "cpanel.pk-mail.org",
          "cpcalendars.pk-mail.org",
          "cpcontacts.pk-mail.org",
          "dma.treasury.gov.lk.pk-mail.org",
          "elestech.com.pk-mail.org",
          "erd.gov.lk.pk-mail.org",
          "febgif.pk-mail.org",
          "ffc.gov.pk-mail.org",
          "finance.gov.pk-mail.org",
          "ftp.pk-mail.org",
          "gmail.com.pk-mail.org",
          "gov.bd.pk-mail.org",
          "gov.lk.pk-mail.org",
          "gov.np.pk-mail.org",
          "gov.pk-mail.org",
          "gov.pk.pk-mail.org",
          "greenpaktourism.pk-mail.org",
          "kppolice.gov.pk-mail.org",
          "kuknalim.com.pk-mail.org",
          "lk.pk-mail.org",
          "mail.pk-mail.org",
          "mha.gov.bd.pk-mail.org",
          "mindef.gov.pk-mail.org",
          "mo.treasury.gov.lk.pk-mail.org",
          "mocat.gov.bd.pk-mail.org",
          "mod.gov.bd.pk-mail.org",
          "mod.gov.np.pk-mail.org",
          "modp.gov.pk-mail.org",
          "moef.gov.bd.pk-mail.org",
          "mof.gov.np.pk-mail.org",
          "mofa.gov.bd.pk-mail.org",
          "mofa.gov.pk-mail.org",
          "mofaga.gov.np.pk-mail.org",
          "moha.gov.np.pk-mail.org",
          "mohpw.gov.bd.pk-mail.org",
          "moitt.gov.pk.pk-mail.org",
          "mos.gov.bd.pk-mail.org",
          "nih.pk-mail.org",
          "np.pk-mail.org",
          "paa.gov.pk-mail.org",
          "parliament.lk.pk-mail.org",
          "pc.gov.pk-mail.org",
          "pd.gov.bd.pk-mail.org",
          "pemra.gov.pk-mail.org",
          "pk-mail.org",
          "pk.pk-mail.org",
          "pkpolice.gov.pk-mail.org",
          "pmo.gov.pk-mail.org",
          "pnra.pk-mail.org",
          "ptd.gov.bd.pk-mail.org",
          "pubad.gov.lk.pk-mail.org",
          "punjab.gov.pk-mail.org",
          "punjabpolice.gov.pk-mail.org",
          "sindhpolice.gov.pk-mail.org",
          "sngpl.com.pk-mail.org",
          "treasury.gov.lk.pk-mail.org",
          "webdisk.pk-mail.org",
          "webmail.pk-mail.org",
          "whm.pk-mail.org"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.trellix.com/blogs/research/sidewinders-shifting-sands-click-once-for-espionage/"
      ],
      "total": 68
    },
    {
      "counts": {
        "domain": 59,
        "url_path": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "claimmofnewbudgetsgp-ars.zeabur.app",
          "claimmofnewbudgetsgp-ck.zeabur.app",
          "claimmofnewbudgetsgp-fm.zeabur.app",
          "claimmofnewbudgetsgp-jz.zeabur.app",
          "claimmofnewbudgetsgp-pd.zeabur.app",
          "claimmofnewbudgetsgp-rk.zeabur.app",
          "claimmofnewbudgetsgp-vn.zeabur.app",
          "claimmofnewbuedgetsg-ars.zeabur.app",
          "claimmofnewbuedgetsg-ck.zeabur.app",
          "claimmofnewbuedgetsg-fm.zeabur.app",
          "claimmofnewbuedgetsg-jz.zeabur.app",
          "claimmofnewbuedgetsg-pd.zeabur.app",
          "claimmofnewbuedgetsg-rk.zeabur.app",
          "claimmofnewbuedgetsg-vn.zeabur.app",
          "claimmofnewbuedgetsgp-ars.zeabur.app",
          "claimmofnewbuedgetsgp-ck.zeabur.app",
          "claimmofnewbuedgetsgp-fm.zeabur.app",
          "claimmofnewbuedgetsgp-jz.zeabur.app",
          "claimmofnewbuedgetsgp-pd.zeabur.app",
          "claimmofnewbuedgetsgp-rk.zeabur.app",
          "claimmofnewbuedgetsgp-vn.zeabur.app",
          "claimmofnewbuedgetssg-ck.zeabur.app",
          "claimmofnewbuedgetssg-jz.zeabur.app",
          "claimmofnewbuedgetssg-pd.zeabur.app",
          "claimmofnewbuedgetssg-rk.zeabur.app",
          "claimmofnewbuedgetssg-vn.zeabur.app",
          "mail-ntc-net-pk.zeabur.app",
          "mof-newbudget25-ck.zeabur.app",
          "mof-newbudget25-fm.zeabur.app",
          "mof-newbudget25-jz.zeabur.app",
          "mof-newbudget25-pdx.zeabur.app",
          "mof-newbudget25-rk.zeabur.app",
          "mof-newbudget25-vn.zeabur.app",
          "mof-newbuedget2025-jz.zeabur.app",
          "mof-newbuedget25-ars.zeabur.app",
          "mof-newbuedget25-jz.zeabur.app",
          "mof-newbuedget25-rk.zeabur.app",
          "mofbudget-ars.zeabur.app",
          "mofbudget-ck.zeabur.app",
          "mofbudget-fld.zeabur.app",
          "mofbudget-fm.zeabur.app",
          "mofbudget-jz.zeabur.app",
          "mofbudget-pd.zeabur.app",
          "mofbudget-vn.zeabur.app",
          "mofbudget.zeabur.app",
          "mofnewbuedgetsgp-jz.zeabur.app",
          "mofnewbuedgetsgp-pd.zeabur.app",
          "mofnewbuedgetssg-ck.zeabur.app",
          "mofnewbuedgetssg-jz.zeabur.app",
          "mofnewbuedgetssg-pd.zeabur.app",
          "mofnewbuedgetssg-rk.zeabur.app",
          "mofnewbuedgetssgp-ck.zeabur.app",
          "mofnewbuedgetssgp-jz.zeabur.app",
          "mofnewbuedgetssgp-pd.zeabur.app",
          "mofsgpbudget-ars.zeabur.app",
          "mofsgpbudget-ck.zeabur.app",
          "mofsgpbudget-jz.zeabur.app",
          "new-mof-budgetsgp-ars.zeabur.app",
          "webmail-mofa-gov-pk.zeabur.app"
        ],
        "url_path": [
          "/?lfdkjgiroetuiroyhgfhnbjkfsdfiowerierehjre",
          "/load/?lfdkjgiroetuiroyhgfhnbjkfsdfiowerierehjre"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1981058315137536410",
        "https://x.com/skocherhan/status/1981180565739974685"
      ],
      "total": 61
    },
    {
      "counts": {
        "domain": 54
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "0ultook.live",
          "acenent.site",
          "aliyumm.pro",
          "appcrew.info",
          "ateows.info",
          "baatube.com",
          "bdnews.info",
          "buzsep.info",
          "cespkom.info",
          "ciamat.info",
          "csd-pk.online",
          "d0ownload.com",
          "doc-downlod.com",
          "downnload.net",
          "ecility.xyz",
          "encetion.live",
          "ereribe.tech",
          "estsaln.site",
          "ex1.mov",
          "fx1.live",
          "inporta.org",
          "install-manager.com",
          "kaleido.moe",
          "krontab.info",
          "krotab.info",
          "letcrip.xyz",
          "limkdin.com",
          "luckjav.com",
          "mainet.info",
          "maroos.live",
          "moragovt.net",
          "navy-support.org",
          "nolotion.info",
          "nrtc-support.com",
          "ntc-net.com",
          "ntc-pak.org",
          "ostcone.site",
          "p1x.live",
          "pareing.info",
          "pl1.mov",
          "pn0fficial.info",
          "porket.info",
          "reasoen.org",
          "recovar.org",
          "ritenoc.live",
          "senine.info",
          "superback.space",
          "tchgin.site",
          "tolera.live",
          "updotes.co",
          "vinver.live",
          "winger.live",
          "y1x.org",
          "zeanos.live"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/Cyberteam008/status/1904701843927863409",
        "https://en.fofa.info/result?qbase64=ZmlkPSJhRnJ1NVZDRW1PWWN2KzlIVUczU3J3PT0i (# 2025-03-26)"
      ],
      "total": 54
    },
    {
      "counts": {
        "domain": 37
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "autodiscover-paa-gov-pk-auth-logon-aspx.pages.dev",
          "dgdp-product-details-2025-turkey.netlify.app",
          "doc-ye9wbezc.b4a.run",
          "drive-dgdp-gov-bd-confidential-files.netlify.app",
          "drive-dgdp-gov-bd-files.netlify.app",
          "drive-nepal-gov-np-files.netlify.app",
          "drive-nepal-gov.com",
          "gooogle.files-cyber-net-pk.workers.dev",
          "govmm.org",
          "helpful-national-poilcy-nepla-gov-np.netlify.app",
          "maif-piac-aero.gov-pkgov.workers.dev",
          "mail-776f305796709f2d567e6868feaba274-gov-pk-investment.pages.dev",
          "mail-aviation-gov-pk-pdf.pages.dev",
          "mail-minfinance-gov-np.netlify.app",
          "mail-mod-gov-np-download-pdf.netlify.app",
          "mail-moha-gov-np-download.netlify.app",
          "mail-paa-gov-pk.pages.dev",
          "mail-suparco-gov-pk-owa-auth-logon-aspx.pages.dev",
          "mail.pof-gov-pk.workers.dev",
          "mailcbmgovmm.pages.dev",
          "maill-govtnepal-gov-np.netlify.app",
          "maill-nepalgv-gov-np.netlify.app",
          "mall-ministryoffinance-np.netlify.app",
          "na-gov-pk-meeting-pac.pages.dev",
          "ntc-06gd0upz.b4a.run",
          "owa-suparco-gov-pk-logon-aspx.pages.dev",
          "owa-suparco-gov-pk-owa-autho.pages.dev",
          "secure-ntc.net",
          "technologysupport.help",
          "uploads.ptcl-gov-pk.workers.dev",
          "verify.mod-defence-lk.workers.dev",
          "viewpdfonline-1wgtaeus.b4a.run",
          "webmail-hubpower-com-error.pages.dev",
          "webmail.cybar-net-pk.workers.dev",
          "workermdxxx.naychilin-pk.workers.dev",
          "www-foreignaffairs-nepal-com.netlify.app",
          "www-nepalgovernment-genz-agendapdf.netlify.app"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://hunt.io/blog/operation-southnet-sidewinder-south-asia-maritime-phishing"
      ],
      "total": 37
    },
    {
      "counts": {
        "domain": 26
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "dgdp-gov-pk-technical-specification.pages.dev",
          "dgdp-gov-pk-technical-specification1.pages.dev",
          "fab-gov-pk-account.pages.dev",
          "lcbkp-gov-pk-sedang-berbunga.pages.dev",
          "mail-kpt-gov-pk-2fa-registration.pages.dev",
          "mail-kpt-gov-pk-browserautheintacation.pages.dev",
          "mail-kpt-gov-pk-error.pages.dev",
          "mail-kpt-gov-pk-estblishment-it-park.pages.dev",
          "mail-kpt-gov-pk-joint-coordination-meeting.pages.dev",
          "mail-kpt-gov-pk-meeting-sub-committee.pages.dev",
          "mail-kpt-gov-pk-mod-revised-scheduled.pages.dev",
          "mail-kpt-gov-pk-provision-of-data-for-greater-karachi.pages.dev",
          "mail-kpt-gov-pk-provision-of-karachi-port-vision.pages.dev",
          "mail-kpt-gov-pk-securityupdates-jun2025olertnessegingvsdvs.pages.dev",
          "mail-kpt-gov-pk-training-course-public-finance.pages.dev",
          "mail-kpt-gov-pk-viruspurification-securitypachesjun-2025df.pages.dev",
          "mail-kpt-gov-pk-visit-to-malaysia-final.pages.dev",
          "mofa-gov-pk-692e658f-19ac-8320-a0ee-b52b2198b13c-visit.pages.dev",
          "mofa-gov-pk-692e658f-19ac-8320-a0ee-b52b2198b13c.pages.dev",
          "mofa-gov-pk-press-release-training-course-public-finance.pages.dev",
          "moitt-gov-pk-presentation-visit-pm.pages.dev",
          "nha-gov-pk-mohd-dam-hydropower-project.pages.dev",
          "nitb-gov-pk-vpn-for-secure-webmail-access.pages.dev",
          "pmad-gov-pk-2fa-registration.pages.dev",
          "suparco-gov-pk-6866387a-44d0-8009-a76e-6948da2c3278.pages.dev",
          "webmail-gov-pk-action-plan-cpec-inbox-download.pages.dev"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/2002000970570690709"
      ],
      "total": 26
    },
    {
      "counts": {
        "domain": 25,
        "url": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "cgwic-sessionexpired-challenge.pages.dev",
          "cgwic-sessionexpired-challenges.pages.dev",
          "dacastexpo.com",
          "expo.com.cn.mail-files-open-preview.com",
          "expo.infinityfreeapp.com",
          "expo.test-links.com",
          "file-preview-session-expired.pages.dev",
          "gleaming-praline-dcd579.netlify.app",
          "i737461746963o6578706fo646576z.oszar.com",
          "jingjang-duduva.000webhostapp.com",
          "l0gin-cetc1-files-0pen-expired.netlify.app",
          "mail-files-open-preview.com",
          "mail.biitt.cn",
          "meeting-rigistration-defence-attache.netlify.app",
          "meeting-rigistration-embassy.netlify.app",
          "plaaf-a1irshow-registrati0n-2024.netlify.app",
          "plaaf-zhuhaiairshow-registration-2024.netlify.app",
          "pr-21356.expo.dev",
          "preview-attachments-f1les-0pen-pdf.netlify.app",
          "session-expired-file-download-cetcimail.pages.dev",
          "tamhuudung.com",
          "timoney.getexpo.com",
          "we-are-under-gain.000webhostapp.com",
          "wpda-mom-meeting-invitation-letter.netlify.app",
          "zhuhai-a1rsh0w-reg1strat1i0n-2o24.netlify.app"
        ],
        "url": [
          "http://112.13.121.89"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1959269610600968526"
      ],
      "total": 26
    },
    {
      "counts": {
        "domain": 26
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "advancedhealth.medicallab.site",
          "armslicense.interiorgovt.com",
          "chughtai.medicallab.site",
          "cons.mofa.gov.pk.cons1.mfa-ir.cn",
          "dlimssindh.gov-pk.site",
          "fir.islamabadpolice.gov-pk.site",
          "gov-pk.site",
          "interiorgovt.com",
          "interiorministrypk.com",
          "khanlab.medicallab.site",
          "kpkarmslicense.site",
          "license.interiorministrypk.com",
          "licenseinterior.gov-pk.site",
          "madhouse.cloud",
          "mail.dlimspunjabgovpk.com",
          "mail.gov-pk.site",
          "medicallab.site",
          "mfa-ir.cn",
          "ministryofinteriorlicense.gov-pk.site",
          "ministryofinteriorpermit.gov-pk.site",
          "nadra.gov-pk.site",
          "nims.nadra.gov-pk.com",
          "pakvisanadra.gov-pk.site",
          "permitinterior.gov-pk.site",
          "punjabpolice.gov-pk.site",
          "vmi1789770.contaboserver.net"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/Cyberteam008/status/1938086890411893240"
      ],
      "total": 26
    },
    {
      "counts": {
        "domain": 26
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "6441056b613c32a9.dwnlld.info",
          "7ef1996f-c463-4540-936a-70d0fd477f98.live-co.org",
          "a5936441-e402-41e3-b02b-75af112074b5.org-co.net",
          "advisary.army-govbd.info",
          "bscic-gov-bd.dwnlld.info",
          "dirsports.milqq.info",
          "dwnlld.infomfa-gov-lk.dwnlld.info",
          "esxipubad-gov-lk.org-co.net",
          "hisidewindersidewinder.pimec-paknavy.updates-installer.store",
          "lolsidewindersidewinder.nic-svc.net",
          "mail.ntc.net.pk.onlinestatus.live",
          "mail.ntc.net.pk.vpdf.online",
          "mail.paf.gov.pk.onlinestatus.live",
          "mod-gov-bd.org-liv.net",
          "mof-gov-bd.nic-svc.net",
          "mof-gov-np.dwnlld.info",
          "mofa-gov-np.live-co.org",
          "mofa-gov-np.net-src.info",
          "moitt-gov-pk.dwnlld.info",
          "probashi-gov-bd.mail-govt.org",
          "probashi-gov-bd.net-src.info",
          "wnic-svc.net",
          "www-cbsl-gov-lk.dwnlld.infomfa-gov-lk.dwnlld.info",
          "www-erd-gov-lk.dwnlld.info",
          "www-treasury-gov-lk.org-liv.net",
          "xcfhg.dwnlld.info"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.acronis.com/en-us/cyber-protection-center/posts/from-banks-to-battalions-sidewinders-attacks-on-south-asias-public-sector/"
      ],
      "total": 26
    },
    {
      "counts": {
        "domain": 22
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "109.176.30.212.sslip.io",
          "172.86.92.150.sslip.io",
          "antarticarevolution.sbs",
          "assumptiontable.click",
          "firsatburdaavm.com",
          "greenstream.top",
          "happyhours.sbs",
          "huangjianglee.top",
          "mail.voyage-prive.com.ru",
          "mohrss.help",
          "pandalyticsresearch.sbs",
          "paypal.es-profils.me",
          "routinework.sbs",
          "sellersprofile.sbs",
          "system-services-manual.life",
          "systemhealthservices.top",
          "systemupdateanalysis.blog",
          "systemupgradationservices.net",
          "technicaladivsory.click",
          "technicaladvisory.sbs",
          "voyage-prive.com.ru",
          "zamannindaindirimlerimm.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://twitter.com/suyog41/status/1768558626929860749",
        "https://twitter.com/k3yp0d/status/1789806184175685805",
        "https://www.virustotal.com/gui/ip-address/146.70.157.120/detection",
        "https://www.virustotal.com/gui/ip-address/146.70.80.58/detection",
        "https://www.virustotal.com/gui/file/92145633823ed4a4c56915ab81f6bc0582fd27700d8515400edd0a153d39829f/detection",
        "https://www.virustotal.com/gui/file/736315462b91943de9df6210db3bb52564982dd6c758d06ea79e3a404548569b/detection",
        "https://www.virustotal.com/gui/file/6e4a4d25c2e8f5bacc7e0f1c8b538b8ad61571266f271cfdfc14725b3be02613/detection",
        "https://www.virustotal.com/gui/file/316e01b962bf844c3483fce26ff3b2d188338034b1dbd41f15767b06c6e56041/detection",
        "https://www.virustotal.com/gui/file/2f5f44863048243c1bbec6e16b1c0902f8c61d61fdb8277f5c514b2f04ce8993/detection",
        "https://www.virustotal.com/gui/file/2027a5acbfea586f2d814fb57a97dcfce6c9d85c2a18a0df40811006d74aa7e3/detection",
        "https://www.virustotal.com/gui/file/3e35834b72b475952ae60ea8479ebe3638e204df414a838dfe143081f6729d8e/detection"
      ],
      "total": 22
    },
    {
      "counts": {
        "domain": 22
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "aliyum.email",
          "crontec.site",
          "d0wnlaod.com",
          "debcon.live",
          "defencearmy.pro",
          "depo-govpk.com",
          "dgtk.depo-govpk.com",
          "dirctt888.com",
          "directt88.com",
          "documentviewer.info",
          "dowmloade.org",
          "downl0ad.org",
          "file-dwnld.org",
          "mevron.tech",
          "mod-kh.info",
          "modpak-info.services",
          "modpak.info",
          "ms-office.pro",
          "pncert.info",
          "veorey.live",
          "zeltech.live",
          "ziptec.info"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://securelist.com/sidewinder-apt-updates-its-toolset-and-targets-nuclear-sector/115847/"
      ],
      "total": 22
    },
    {
      "counts": {
        "domain": 18
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "bd.mofa-govbd.com",
          "erd.gov.lk.mofa-govbd.com",
          "ftp.mofa-govbd.com",
          "gov.bd.mofa-govbd.com",
          "gov.lk.mofa-govbd.com",
          "lk.mofa-govbd.com",
          "mail.mofa-govbd.com",
          "mhapsd.gov.bd.mofa-govbd.com",
          "mod.mofa-govbd.com",
          "mofa-gov-bd.com",
          "mofa-govbd.com",
          "mofa-govbd.org",
          "mofa.gov.bd.mofa-govbd.com",
          "mofagovbd.com",
          "nvloi.mofagovbd.com",
          "tod.treasury.gov.lk.mofa-govbd.com",
          "treasury.gov.lk.mofa-govbd.com",
          "yahoo.com.mofa-govbd.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1939225148021784776"
      ],
      "total": 18
    },
    {
      "counts": {
        "domain": 18
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "armslicensekpk.gov-pk.com",
          "consmofa-gov-pk.com",
          "dlimspunjab.gov-pk.com",
          "dlimssindh.gov-pk.com",
          "fbr.gov-pk.com",
          "gov-pk.com",
          "licenseinterior.gov-pk.com",
          "mail.gov-pk.com",
          "ministryofinteriorlicense.gov-pk.com",
          "ministryofinteriorpermit.gov-pk.com",
          "nadra.gov-pk.com",
          "pakvisanadra.gov-pk.com",
          "permitinterior.gov-pk.com",
          "permitsinteriors-gov-pk.com",
          "ptpkp.gov-pk.com",
          "punjabpolice.gov-pk.com",
          "scandalsofallovertheworld.gov-pk.com",
          "spfc-punjab-gov-pk.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1927753865471918171"
      ],
      "total": 18
    },
    {
      "counts": {
        "domain": 16
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "allpakarmlicences.com",
          "allpakarmslicence.com",
          "allpakarmslisense.site",
          "armlicensepk.site",
          "bookutrips.com",
          "govpk.site",
          "licenceinteriorministrypk.com",
          "licenseinterior.govpk.site",
          "mail.allpakarmslicence.com",
          "mail.licenceinteriorministrypk.com",
          "mail.pakarmslicense.com.pk",
          "ministryofinteriorlicense.govpk.site",
          "pakarmslicense.com.pk",
          "pakarmslisense.com",
          "pakistanarmslicense.com",
          "vehicleverificationsystem.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1941881061492785292",
        "https://app.validin.com/detail?find=b39c305a502803d29b370488c7e55f2879d57358&type=hash&ref_id=6a40730d8aa#tab=host_pairs (# 2025-07-07)"
      ],
      "total": 16
    },
    {
      "counts": {
        "domain": 8,
        "ipv4": 4,
        "url": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "acfinang.shop",
          "anefank.mom",
          "asfinnagg.shop",
          "asfrimag.mom",
          "asfrimamg.mom",
          "eairr.mom",
          "eneralbqark.shop",
          "ier-modile.shop"
        ],
        "ipv4": [
          "185.159.128.117:443",
          "31.15.17.230:443",
          "31.58.137.246:443",
          "46.8.226.5:443"
        ],
        "url": [
          "http://185.159.128.117",
          "http://31.15.17.230",
          "http://31.58.137.246",
          "http://46.8.226.5"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/TLP_R3D/status/1926147062552223856",
        "https://x.com/volrant136/status/1926301843916734747"
      ],
      "total": 16
    },
    {
      "counts": {
        "domain": 15
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "24170-40494.bacloud.info",
          "andc.govaf.org",
          "dns.andc.govaf.org",
          "e-nothi.ddns.net",
          "edgeupdate.redirectme.net",
          "govaf.org",
          "mail-bccgov.gotdns.ch",
          "mail-bccnetdd.ddns.net",
          "mail.andc.govaf.org",
          "mail.mobta.govaf.org",
          "mail.moi.govaf.org",
          "mobta.govaf.org",
          "moi.govaf.org",
          "winhost.redirectme.net",
          "winupdate.redirectme.net"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/wa1Ile/status/1953339615714386101",
        "https://www.virustotal.com/gui/ip-address/88.119.161.40/relations",
        "https://www.netskope.com/blog/a-look-at-the-nim-based-campaign-using-microsoft-word-docs-to-impersonate-the-nepali-government"
      ],
      "total": 15
    },
    {
      "counts": {
        "domain": 15
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "101c4a583c3acdd2a06ca2fb183cf995fgd55fghf67dhf7dhf7dhnfks7.pages.dev",
          "arf26th-hducim-kdu-ac-lk-index-html.pages.dev",
          "click-here-to-keep-same-password.netlify.app",
          "fcgzbgcvzsgrjbnndsfdsdfffcffgzsfwferfvd4hfgtyghjtghjrhgts.pages.dev",
          "mail-airforce-lk1b8470bce36a0e858a410b4169b23e1c.pages.dev",
          "mail-army-sl-dte-of-welfare-session-out.pages.dev",
          "mail-kdu-lk-inbox-interanl-memo.pages.dev",
          "mail-preview-trainingcollabration-bangladesh-srilanka.pages.dev",
          "mail-prevlew-jointworkshop-training-srilanka-bangladesh.pages.dev",
          "nsvay8faydj3f79dje9djr02j101c4a583c3acdd2a06ca2fb183cf995.pages.dev",
          "p2m3o4j3j101c4a583c3acdd2a06ca2fb183cf995mrfi34ur9rj40fm49.pages.dev",
          "saffsdf-fgjhhgj-fhfgjrt65df-tfgy54hgf.netlify.app",
          "sdfgsdfsdhfgdfgdsgfsdjfdjsghfsdgfjkdsfdsbfbsdfjksdkjfdsfks.pages.dev",
          "sdfsdgfsd-sdfjdgsjff-sdfg44gdfgjf-dfghkjfdhkj-dfgklhfghklf.pages.dev",
          "www-airforcelk-preview-com.netlify.app"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1955663006303699041"
      ],
      "total": 15
    },
    {
      "counts": {
        "domain": 15
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "dgdp-account-file-data-doc-procuremen.netlify.app",
          "dgdp.cloud.secured.file.updatemind52.com",
          "dgfi.gov.bd",
          "drive-rokectsaans-com-tr-account-file.netlify.app",
          "drive-roketsans-com-tr-account-files.netlify.app",
          "gov.bd.account.file.updatemind52.com",
          "idef-2025-conf-data-file-tr-account-d.netlify.app",
          "idef2025-com-tr-files-drive-account.netlify.app",
          "mail-aselsans-com-tr-account-files-da.netlify.app",
          "mail-bof-gov-file-account-conf-files.netlify.app",
          "mail-dgfi-gov-bd-accounts-file-data-d.netlify.app",
          "mail.gov.bd.account.file.updatemind52.com",
          "mailbox-inbox-bd.com",
          "police.gov.bd.updatemind52.com",
          "webmail.police.gov.bd.updatemind52.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://hunt.io/blog/apt-sidewinder-netlify-government-phishing"
      ],
      "total": 15
    },
    {
      "counts": {
        "domain": 13
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "bd.mofa-govtpk.net",
          "bgb.gov.bd.mofa-govtpk.net",
          "cabinet.gov.bd.mofa-govtpk.net",
          "cbsl.lk.mofa-govtpk.net",
          "gov.bd.mofa-govtpk.net",
          "gov.lk.mofa-govtpk.net",
          "lk.mofa-govtpk.net",
          "mod.gov.bd.mofa-govtpk.net",
          "mofa-govtpk.net",
          "mofa.gov.bd.mofa-govtpk.net",
          "mopa.gov.bd.mofa-govtpk.net",
          "presidentsoffice.lk.mofa-govtpk.net",
          "pubad.gov.lk.mofa-govtpk.net"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1943411876236230991"
      ],
      "total": 13
    },
    {
      "counts": {
        "domain": 13
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "g0vt.pk",
          "gov.pk-hhq.cc",
          "gov.pk-hq.cc",
          "gov.pk-hq.us",
          "gov.pk-hqr.co",
          "gov.pk-hqr.online",
          "gov.pk-ht.pk",
          "pk-hhq.cc",
          "pk-hq.cc",
          "pk-hq.us",
          "pk-hqr.co",
          "pk-hqr.online",
          "pk-ht.pk"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1923061758643597787"
      ],
      "total": 13
    },
    {
      "counts": {
        "domain": 13
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "combined-training-and-administrative.netlify.app",
          "coordination-cas-visit.netlify.app",
          "drive-baf-mil-bd-share-file.netlify.app",
          "goc-visit-program-details-pdf.netlify.app",
          "mail-afd-gov-bd-account-error-issues.netlify.app",
          "mail-baf-mil-bd-fils-cas-visit-to-chi.netlify.app",
          "mail.baf.mil.bd.pdf.quickhelpsolve.com",
          "mail.bcc.gov.bd.pdf.quickhelpsolve.com",
          "mail.drive.gov.bd.files.updatemind52.com",
          "newmail-army-mil-bd-owa-apth-mail-dat.netlify.app",
          "quickhelpsolve.com",
          "sdkfjsh23-sdfgdklhg4-efglhdfg4-dfgjkl.netlify.app",
          "updatemind52.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://strikeready.com/blog/apt-android-phishing-microsoft/",
        "https://research.checkpoint.com/2024/foxit-pdf-flawed-design-exploitation/",
        "http://malasada.tech/open-directory-search-leads-to-aged-apt-c-35-findings/",
        "https://app.validin.com/detail?type=hash&find=9d38a97bccfc3cffbb72786a0c02ce140e6ef25b#tab=host_pairs (# 2025-08-19)"
      ],
      "total": 13
    },
    {
      "counts": {
        "domain": 11,
        "url_path": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "bcc.gov.bd.ramdaanvibe.info",
          "bcc.gov.bd.upworkoffice.online",
          "bccgov-bd-production.up.railway.app",
          "bd.ramdaanvibe.info",
          "bd.upworkoffice.online",
          "email.bcc.gov.bd.ramdaanvibe.info",
          "gov.bd.ramdaanvibe.info",
          "gov.bd.upworkoffice.online",
          "mail.bcc.gov.bd.upworkoffice.online",
          "ramdaanvibe.info",
          "upworkoffice.online"
        ],
        "url_path": [
          "/?ioewroiewrioweroiriwwoei="
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1987156569117892733"
      ],
      "total": 12
    },
    {
      "counts": {
        "domain": 12
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "email.moitt.gov.pk.viewdoc.online",
          "email.ntc.gov.pk.viewdoc.online",
          "email.paf.gov.pk.viewdoc.online",
          "email.pof.gov.pk.viewdoc.online",
          "email.sco.gov.pk.viewdoc.online",
          "gov.pk.viewdoc.online",
          "moitt.gov.pk.viewdoc.online",
          "ntc.gov.pk.viewdoc.online",
          "paf.gov.pk.viewdoc.online",
          "pof.gov.pk.viewdoc.online",
          "sco.gov.pk.viewdoc.online",
          "viewdoc.online"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/__0XYC__/status/1893503792827527388",
        "https://www.virustotal.com/gui/ip-address/202.142.177.150/detection"
      ],
      "total": 12
    },
    {
      "counts": {
        "domain": 10
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "aku-edu-pk.org",
          "alphapolice.org",
          "kptgov.org",
          "news-pk-media.news",
          "punjab-bankpk.org",
          "punjab-pk.org",
          "punjabpolice-pk.org",
          "samaa-tv.com",
          "turkavic.org",
          "vmi2186317.contaboserver.net"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1940461337936646467"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 10
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "cloud.coremailcloud.com",
          "coremailcloud.com",
          "demsflygerxamy.com",
          "mail.demsflygerxamy.com",
          "mail.oilplus1td.com",
          "mailcloucl.com",
          "oilplus1td.com",
          "qq.mailcloucl.com",
          "server.oilplus1td.com",
          "vistavue.shop"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/ThreatBookLabs/status/1952157611350241612",
        "https://app.validin.com/detail?type=dom&find=mailcloucl.com#tab=host_pairs"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 7,
        "url_path": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "2aeb306b-4c5f-4cc6-a7a2-6fcd96612b9d.us-east-1.cloud.genez.io",
          "5673696e-bcf9-4a34-848d-2e6875b0561e.us-east-1.cloud.genez.io",
          "7b1271c3-0158-4f94-b54e-d51a4be1cfc4.us-east-1.cloud.genez.io",
          "85476ee3-a4b9-4815-bd1d-68653205e378.us-east-1.cloud.genez.io",
          "mail-ntc-net-pk-pdf.up.railway.app",
          "mail-ntc-net-pk.up.railway.app",
          "webservermail-g2689far.b4a.run"
        ],
        "url_path": [
          "/?jcvjeijnasdncadasdbfdfurhtnbfgbsydbx=",
          "/login/?jcvjeijnasdncadasdbfdfurhtnbfgbsydbx="
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1964037554736398445"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 9
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "a6dff163-e0b9-49c9-87e4-357f761f3c3b.us-east-1.cloud.genez.io",
          "gmail-1-production-3004.up.railway.app",
          "gmails-downloadnew-production.up.railway.app",
          "gmals-downloadpdfs-gdrive.up.railway.app",
          "gpk-production.up.railway.app",
          "mail-doc-download-pdf.up.railway.app",
          "minutes-interministryproduction.up.railway.app",
          "ngmail-downloadsnew-pdf.up.railway.app",
          "sg21-production.up.railway.app"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1956738787243139245"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "gov.np.officemuwork.online",
          "gov.pk.officemuwork.online",
          "mail.mofa.gov.pk.officemuwork.online",
          "mail.npc.gov.np.officemuwork.online",
          "mofa.gov.pk.officemuwork.online",
          "np.officemuwork.online",
          "npc.gov.np.officemuwork.online",
          "pk.officemuwork.online"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1989958731027943578"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "drive-afd-gov-bd-account-file.netlify.app",
          "drive-army-mil-bd-account-data-file.netlify.app",
          "drive-bcc-registraion-cloud-storage.netlify.app",
          "drive-newmail-arm-mil-bd-account-data.netlify.app",
          "embassy-of-italy-visit-to-cxb.netlify.app",
          "mail-account-data.github.io",
          "mail-bof-gov-bd-cas-visit.netlify.app",
          "newmail-army-mil-bd-pso-meeting-file.netlify.app"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1954575077359698237"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "cabinet-gov-bd.dwnlld.info",
          "dwnlld.info",
          "fa-gov-lk.dwnlld.info",
          "infomfa-gov-lk.dwnlld.info",
          "mfa-gov-lk.dwnlld.info",
          "mofa-gov-bd.dwnlld.info",
          "prison-gov-bd.dwnlld.info",
          "www-cbsl-gov-lk.dwnlld.info"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/suyog41/status/1895090090650784157",
        "https://x.com/suyog41/status/1895440300421881953",
        "https://www.virustotal.com/gui/file/a61335c10cf98064761806af6451b3cddd66641ccb35a6d8b915a02d6279f46a/detection",
        "https://www.virustotal.com/gui/file/74111c9b0ed748fc6bfc025d13a2ed08663b988cb69c044f1c6f153f9020294c/detection"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "gov.lk.mofa-govlk.org",
          "lk.mofa-govlk.org",
          "mfa.gov.lk.mofa-govlk.org",
          "mod.mofa-govlk.org",
          "mofa-govlk.org",
          "presidentsoffice.mofa-govlk.org",
          "pubad.mofa-govlk.org",
          "sob.mofa-govlk.org"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/198.54.120.24/relations"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "gov.pk-mail.co",
          "pkcert-arbeitssicherheit.de",
          "pkcert.com",
          "pkcert.gov.pk-mail.co",
          "pkcert.live",
          "pkcert.net",
          "pkcert.org"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1919123011107451280"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "downld.org",
          "mod-gov-bd.downld.org",
          "mofa-gov-bd.downld.org",
          "mofa-gov-np.downld.org",
          "pubad-gov-lk.downld.org",
          "www-erd-gov-lk.downld.org",
          "www-treasury-gov-lk.downld.org"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/suyog41/status/1934520152726413764",
        "https://www.virustotal.com/gui/file/2aec3dcec0274b498bd5e6996a7ff835980953485f5a96f105bfa8f4eceda98a/detection",
        "https://www.virustotal.com/gui/file/cfc62931fafc8e73986d80743215e6d3a4c345c387c2654c3a42968906811f4d/detection",
        "https://www.virustotal.com/gui/file/a5f3bffd4adbbc344d1b81c7673d6b037713da07baa4b0a0838780436d182946/detection",
        "https://www.virustotal.com/gui/file/9a2ccd6340020c3f4b5ebbdba16b260fd2869e37c43a7a01fcfa17f2d4438f25/detection"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "downloads.masarh.live",
          "lk.aliyumm.pro",
          "mail163cn.info",
          "masarh.live",
          "policy.mail163cn.info",
          "sco.mail163cn.info",
          "sudden.nepalarmy-milnp.info"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/blackorbird/status/1966082587098755312",
        "https://x.com/RedDrip7/status/1986014463494160775",
        "https://mp.weixin.qq.com/s/wxRSVugKHy7x1SmANQOrAA",
        "https://www.virustotal.com/gui/file/67ae5f3db5f907c2bcc9f932c5379ec17aba4d2e4bca4cf63160ee182e18ae19/detection"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "islamabadpk.site",
          "kptkp.online",
          "moma.islamabadpk.site",
          "moma.kptkp.online",
          "pkcert.news",
          "pkcert.report",
          "slpa.news"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/__0XYC__/status/1907321547326661055",
        "https://x.com/__0XYC__/status/1917099175331959296",
        "https://app.validin.com/detail?find=209.74.80.196&type=ip4&ref_id=aed6130bdda#tab=host_pairs",
        "https://www.virustotal.com/gui/file/2ab8d52677ebc2517c79979246e69ed9bd88b2c40170b3061cd49007c1f6fef4/detection",
        "https://www.virustotal.com/gui/file/a928c417df15814ebee6434742bfec78cf35fcdc61c871a2f07ce4d7a2a13e3d/detection"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "cabinet-gov-pk.fetchdrive.org",
          "commerce-gov-pk.fetchdrive.org",
          "fetchdrive.org",
          "mofa-gov-bd.fetchdrive.org",
          "portmin-gov-lk.fetchdrive.org",
          "www-communications-gov-pk.fetchdrive.org"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/wa1Ile/status/1999042315726295358",
        "https://x.com/suyog41/status/2001622867822415897",
        "https://www.virustotal.com/gui/file/30be03d9709a15d677b7692855993f1ef3708d568c27c293cc2f02295ce99c4b/detection",
        "https://www.virustotal.com/gui/file/7d8109940eb9b9c5f00f6ff8b4db21585c1a2723766a359eef39e6926e0807ea/detection"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 5,
        "url_path": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "bd.officemuwork.online",
          "mail.navy.mil.bd.officemuwork.online",
          "mil.bd.officemuwork.online",
          "navy.mil.bd.officemuwork.online",
          "officemuwork.online"
        ],
        "url_path": [
          "/swpGMooD"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1989957481687388457"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "agenda-talking-point-for-army.up.railway.app",
          "d515dc5c-16cd-4443-8f83-0ab5cb549050.us-east-1.cloud.genez.io",
          "dbarny-fdtref.up.railway.app",
          "mail-arny-nil-db.up.railway.app",
          "mail-download-army-mii-bd.up.railway.app",
          "newmailarmyy-53ufzg0t.b4a.run"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1954576749125304709"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "dwnlld.com",
          "mod-gov-bd.dwnlld.com",
          "mofa-gov-np.dwnlld.com",
          "mofa-gov-pk.dwnlld.com",
          "mopa-gov-bd.dwnlld.com",
          "www-cbsl-gov-lk.dwnlld.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/suyog41/status/1920014750643007950",
        "https://www.virustotal.com/gui/ip-address/193.42.39.217/relations",
        "https://www.virustotal.com/gui/file/558de2a01fbd76be171561c3c82fd6a8e2d4c913444850af99d44a4cfb41b680/detection",
        "https://www.virustotal.com/gui/file/725ded50e7f517addd12f029aeaf9a23f2b9ce6239b98820c8a12ea5cb79dbfa/detection",
        "https://www.virustotal.com/gui/file/b6b98197133a19a20ef64d6206e4b0e98d8d9db00d66a643577f5d55e00ea58d/detection"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "advisory.army-govbd.info",
          "amended.army-govbd.info",
          "army-govbd.info",
          "emv1.army-govbd.info",
          "geninstr.army-govbd.info",
          "mail.army-govbd.info"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/suyog41/status/1919279981105992119",
        "https://www.virustotal.com/gui/ip-address/109.70.236.126/relations",
        "https://www.virustotal.com/gui/file/57b9744b30903c7741e9966882815e1467be1115cbd6798ad4bfb3d334d3523d/detection"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "analytic.mfa-qov.com",
          "mfa-qov.com",
          "pimec-paknavy.updates-installer.store",
          "rnail.mfa-qov.com",
          "superset.mfa-qov.com",
          "updates-installer.store"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/suyog41/status/1914565910607880350",
        "https://app.validin.com/detail?find=2.58.15.89&type=ip4&ref_id=227c9fab6be#tab=resolutions",
        "https://www.virustotal.com/gui/file/63f5445527c47e17b71e87eef4dd7a86883607a22830bcee5b1fabc5d03bab38/detection"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "cabinet-gov-bd.org-liv.net",
          "cirt-gov-bd.org-liv.net",
          "mail-mofa-gov.org-liv.net",
          "mofa-gov-np.org-liv.net",
          "org-liv.net",
          "pubad-gov-lk.org-liv.net"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/ThreatBookLabs/status/1902740067703202129",
        "https://x.com/suyog41/status/1914624962876596333",
        "https://www.virustotal.com/gui/ip-address/2.58.14.27/relations",
        "https://www.virustotal.com/gui/file/f464ad5c6aba13b42aa903bda0add7c074d45388da379747c83f2c3756c9b658/detection"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "advisory.info-bdgov.com",
          "feedback.info-bdgov.com",
          "info-bdgov.com",
          "input.info-bdgov.com",
          "nomination.info-bdgov.com",
          "note.info-bdgov.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/GroupIB_TI/status/1927692817599545555",
        "https://x.com/suyog41/status/1947177091893805561",
        "https://www.virustotal.com/gui/ip-address/5.230.249.5/relations",
        "https://www.virustotal.com/gui/file/34e1f529b6ea80483b92ce9604a1028db9133581869690376f9ddfb47cfb6fd9/detection",
        "https://www.virustotal.com/gui/file/d92961b536f1f8229208b2cd8c099dfaae67219ea6b55cd58e7c90daa4d8fc52/detection"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "consmofagov.com",
          "dlimpunjabgov.com",
          "dlimsindhgov.com",
          "dlimsitp-gov.com",
          "hec-gov.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1947740571042201898"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "cons.gov-pk.pk",
          "consmofa.gov-pk.pk",
          "gov-pk.pk",
          "mail.gov-pk.pk",
          "school.gov-pk.pk"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1922300186526638477"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 4,
        "ipv4": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "blue-term-c168.gov-pkgov.workers.dev",
          "boundschain.workers.dev",
          "restless-brook-f09b.boundschain.workers.dev",
          "themegaprovider.ddns.net"
        ],
        "ipv4": [
          "47.236.177.123:9090"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/malwrhunterteam/status/1928777698526044415",
        "https://x.com/volrant136/status/1928856220292571240",
        "https://x.com/volrant136/status/1928905494892003331"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "app.modcloudspace.com",
          "mail.modcloudspace.com",
          "modcloudspace.com",
          "moddirectoratecloud.com",
          "myanmar-org-mail.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/__0XYC__/status/1955863170712530987",
        "https://app.validin.com/detail?type=hash&find=f7ea7521e47f6071c33f72316691557f#tab=host_pairs (# 2025-08-19)"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "adobe.pdf-downlod.com",
          "download-doc.net",
          "pdf-downlod.com",
          "pubad-gov-lk.download-doc.net",
          "www-cbsl-gov-lk.download-doc.net"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/Cyberteam008/status/1967811673924022458"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "101c4a583c3acdd2dfgn54990fgmkl5i90ghml569ig06ca2fb183cf995.pages.dev",
          "101c4a5fdjfjkf8fg90fksd9dfslsd0fk83c3acdd2a06ca2fb183cf995.pages.dev",
          "d101c4a583c3acdd2a06ca2fb183cf99d6fm7fjdf8djf9lfjf4mfi89.pages.dev",
          "dnsvay8faydj3f79dje9djr02j101c4a583c3acdd2a06ca2fb183cf995.pages.dev"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1959693263897813084"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "bd-govt.com",
          "bd-govt.info",
          "bdgovt.com",
          "brebd-govt-bd.online"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1943411984407343140"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "cons.mofagovpk.co",
          "mofa-govpk.co",
          "mofagovpk-hq.co",
          "mofagovpk.co"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1939739683023421890"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "api.pkgov.xyz",
          "pkgov.xyz",
          "sco.pkgov.xyz",
          "wapda.pkgov.xyz"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1937176053765853314"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "file-dwnld.net",
          "interior-gov-pk.file-dwnld.net",
          "mofa-gov-bd.file-dwnld.net",
          "pmo-gov-pk.file-dwnld.net"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/suyog41/status/1922225245680721992",
        "https://www.virustotal.com/gui/ip-address/5.230.37.44/relations",
        "https://www.virustotal.com/gui/file/162a1efb479cc29e8f007168386ff4d6e441c46827e00751c56ff5e389a30d37/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "customs-gov-lk.net-co.info",
          "net-co.info",
          "postmaster.net-co.info",
          "www-customs-gov-lk.net-co.info"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/suyog41/status/1909121702707048705",
        "https://www.virustotal.com/gui/file/69eee36642f274c724fadcfdf1f103ae0fd9b5f4bad7ac6a33b3c627d6114426/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "cabinet-gov-bd.nic-svc.net",
          "nic-svc.net",
          "www-erd-gov-lk.nic-svc.net",
          "www-treasury-gov-lk.nic-svc.net"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/salmanvsf/status/1901922280508469555",
        "https://x.com/suyog41/status/1902321493520064582",
        "https://www.virustotal.com/gui/file/9b76d98c2641512c66e8f2f99b2d0bda86ec1a4809420b74feadfb8f4f7dbf48/detection",
        "https://www.virustotal.com/gui/file/5b5a1833d4daaf05699a009316a4d866851130b258f424f066b867a534ba944d/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "mail126.live",
          "pncert.pro",
          "roncez.tech",
          "sercoten.info"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/mal_analysis136/status/1903410777085948009",
        "https://en.fofa.info/result?qbase64=amFybT0iMjFkMTlkMDAwMjFkMjFkMjFjMjFkMTlkMjFkMjFkZGRjNzVlYThiYjA1MzEzNGU3NDc4ZTAwNGQwM2ZmNjUiICYmIGhlYWRlcj0iSFRUUC8xLjEgNDA0IE5vdCBGb3VuZCIgJiYgaGVhZGVyPSJDb25uZWN0aW9uOiBjbG9zZSIgJiYgaGVhZGVyPSJDb250ZW50LVR5cGU6IHRleHQvaHRtbCIgJiYgaGVhZGVyPSJTZXJ2ZXI6IG5naW54IiAmJiBhc249IjU5NzExIg%3D%3D&page=1&page_size=10 (# 2025-03-22)"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "circulars.ntcpk.co",
          "ntcpk.co",
          "paletec.live",
          "sinantion.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/mal_analysis136/status/1903400504925028535",
        "https://www.virustotal.com/gui/ip-address/5.255.120.103/relations",
        "https://en.fofa.info/result?qbase64=amFybT0iMmFkMmFkMDAwMmFkMmFkMjJjNDJkNDJkMDAwMDAwOGE1OTQxYzEzZjY3ZTBjMGEyYzhhMzZiZmVlZjY5MjAiICYmIGJhbm5lcj0iSFRUUC8xLjEgNDA0IE5vdCBGb3VuZCIgJiYgYmFubmVyPSJTZXJ2ZXI6IG5naW54IiAmJiBiYW5uZXI9IkNvbnRlbnQtVHlwZTogdGV4dC9odG1sIiAmJiBiYW5uZXI9IkNvbm5lY3Rpb246IGtlZXAtYWxpdmUiICYmIGFzbj0iNjA0MDQiICYmIHNlcnZlcj09Im5naW54Ig%3D%3D (# 2025-03-22)"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "adobeglobal.com",
          "cadetcollege.adobeglobal.com",
          "latestupdate.adobeglobal.com",
          "livestreaming.adobeglobal.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/ShadowChasing1/status/1902203302315749870",
        "https://x.com/suyog41/status/1901879336480989522",
        "https://www.virustotal.com/gui/file/1815d9aa261c60dde4abe3d8beea19496a9295775d8824087744276fb18a23e0/detection",
        "https://www.virustotal.com/gui/file/341a21538b90c87b40e150967519a695f2c339befde232e2f3cd85caf6885803/behavior"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 2,
        "ipv4": 1,
        "url": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "gwadar-port.zapto.org",
          "social-welfare.ddns.net"
        ],
        "ipv4": [
          "89.46.65.19:443"
        ],
        "url": [
          "http://89.46.65.19"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/89.46.65.19/relations",
        "https://www.virustotal.com/gui/file/01c29e84ad1a5fc1f2d16a93fee1c6386aecef1a99153eccaddbca54549befd3/detection",
        "https://www.virustotal.com/gui/file/3068db7b9b198a82971a353cec4dd775257dd35358745bd471c6784acb05297e/detection",
        "https://www.virustotal.com/gui/file/cd8f065206ead30ae634397d9f9ceb715d7f8b378a23924227850c92b013ec41/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "gbpay.gov.pk",
          "gbpay.pmrugb.gov.pk",
          "pmrugb.gov.pk",
          "test.gbpay.gov.pk"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/62.72.22.91/relations",
        "https://www.virustotal.com/gui/ip-address/92.113.21.70/relations"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 2,
        "url_path": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "navy-mil-bd-download.up.railway.app",
          "page-view-mail.zeabur.app"
        ],
        "url_path": [
          "/?hebjwhihsdbwbsdbwudiok"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/2003498589851668860"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2,
        "url_path": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "drive-mha-gov-bd-files-acctn-doct.netlify.app",
          "pdfofficialdocument.com"
        ],
        "url_path": [
          "/cvbnhmj7.php"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1993209945299599830"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "17067699af72f31706fgjkf5kg9j4990gk950.netlify.app",
          "appt-sdf49fk0apt9dk9sdls9fl-dkgf9dld9.netlify.app",
          "cgd64-gkgiot9lg0-ghbasbousa-01156egog.netlify.app"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1981382785651921399"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1,
        "url_path": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "downloadfileddssdrrg.zeabur.app"
        ],
        "url_path": [
          "/?dhsfiourewjdfjgkfdgkldfjiorejfdjgfdgjkdfjgreioo=",
          "/login/?dhsfiourewjdfjgkfdgkldfjiorejfdjgfdgjkdfjgreioo="
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1981378466273775690"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "8ad94e36.cdn-caa-sco.pages.dev",
          "cdn-caa-sco.pages.dev",
          "eede6f46.cdn-caa-sco.pages.dev"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1966935607483265167",
        "https://www.virustotal.com/gui/file/04e378b653cb975609ab637eef36bf92d26867dcd79fb90c5f7e1993019eff91/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "interiorministrygov.site",
          "interiorsgovpk.site",
          "ministryofinterior.shop"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1938850528672313834"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "cons-mofa-gov-pk.rf.gd",
          "cons-mofa-govt.pk",
          "consmofagovhqipk.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1937546185109029284"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "inkora.org",
          "mail.power-govpk.org",
          "power-govpk.org"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1936332922849566845",
        "https://www.virustotal.com/gui/ip-address/185.233.166.156/relations",
        "https://app.validin.com/detail?find=3004e97990e49dc01e5377263f9cd5a75f1d0c7c3bf16cc596be5c84c510c96e&type=hash&ref_id=6f07ea3f6ef#tab=host_pairs"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "army-lk.info",
          "feedback.army-lk.info",
          "invitation.army-lk.info"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/suyog41/status/1942892749822566737",
        "https://www.virustotal.com/gui/file/c0b4d57dd0a8fe415b35ee452818a6ffe695c75d559bd92324771d9f663ebe14/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "advisory.ndma-govpk.co",
          "confidential.ndma-govpk.co",
          "ndma-govpk.co"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/suyog41/status/1927704786981224607",
        "https://www.virustotal.com/gui/ip-address/46.30.189.18/relations",
        "https://www.virustotal.com/gui/file/dec609e4b53e1b9b5fd9ec72f2c012324b25e9eb0539b0d454e89c4bd2e3bd5c/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "mod-gov-bd.net-src.org",
          "net-src.org",
          "pmo-gov-pk.net-src.org"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/suyog41/status/1925828628517921245",
        "https://www.virustotal.com/gui/file/b7a703096c719d8c70f7ce8f586ed83d50975982c83c5bf48e6faff626c6bdee/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "cybersecurity.nepalarmy-milnp.info",
          "dtecyber.nepalarmy-milnp.info",
          "nepalarmy-milnp.info"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/suyog41/status/1922211946847228187",
        "https://x.com/suyog41/status/1922258775567712490",
        "https://www.virustotal.com/gui/file/56ce6048c13a0742f2a00bd75135784a3135c089518d6786242424e5fcb52161/detection",
        "https://www.virustotal.com/gui/file/01afb99be9f3077b9ebd80f0e67e99a5a0162ba1fa4f7e9285154c78389c206c/detection",
        "https://www.virustotal.com/gui/file/fdb90737709a989f8d8f1df4d02e9eae2eb6299dc1a9ee55c62ed2eeb6f54cda/detection",
        "https://www.virustotal.com/gui/file/974e7115f257c4c47a8c12c468f29888cbc31a37504a033dd34aa5190c3381ca/detection",
        "https://www.virustotal.com/gui/file/08b273a27150fdb1a84f922ffcf55da614b29c149d1c96873aced3f9547e6365/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "army-lk.com",
          "dsf.army-lk.com",
          "dteofmediapsyops.army-lk.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/suyog41/status/1920723276243894501",
        "https://www.virustotal.com/gui/file/85afc5d78392be685ae84f4391aa4e7ea11bb44eb92a3d94a0329a963abf8932/detection",
        "https://www.virustotal.com/gui/file/8e37838066f5e02e01aa5bf7cfc12f74ed18473d017f00441f57e22e64497c88/detection",
        "https://www.virustotal.com/gui/file/29f36deedf252bcc1f51882c8f071c9aa128ba7f8acd8dd21d4e2800eb440905/detection",
        "https://www.virustotal.com/gui/file/1f7873ffa104f80e306b60d00854849b905beaaccb99ab4505146553f4c7e847/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "afdtrg.nrdi-gov.com",
          "nrdi-gov.com",
          "slpa-lk.nrdi-gov.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/blackorbird/status/1902694151847850310",
        "https://www.virustotal.com/gui/ip-address/5.255.100.151/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "fwd-transaction-slip-52923640.gov1-lk.com",
          "gov1-lk.com",
          "new-year-message-from-the-chief-of-the-army-staff.gov1-lk.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/_priyaa_1/status/2007013981622530418",
        "https://www.virustotal.com/gui/file/b72cd42fae7ff3aae6735891bd41e5a4e84f8bb662de46d07c2548d81ee73a1e/detection",
        "https://www.virustotal.com/gui/file/f412f7fdc979e31904b6577ff70741ceaa70eeb5c53b773646d58a3685babfa3/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "dl.vlc-services.cfd",
          "nadracloudx.pages.dev",
          "vlc-services.cfd"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/__0XYC__/status/1996536016123892101",
        "https://tria.ge/251204-m88xqavkd1/behavioral2"
      ],
      "total": 3
    },
    {
      "counts": {
        "ipv4": 1,
        "url_path": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "ipv4": [
          "167.86.94.42:18745"
        ],
        "url_path": [
          "/api/root_3977413298779/hello",
          "/api/root_3977413298779/upload"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/ThreatBookLabs/status/1947112060321714517",
        "https://www.virustotal.com/gui/file/4f008754902cfc8380f6fc4d9b8d93ac095d9cf3273b544c0aa1cf3d803ea623/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "compnetworkservices.ddns.net",
          "maildefence.myftp.org",
          "office365-server.ddns.net"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/2.58.15.42/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "dafillio.com",
          "playservicess.com",
          "playsevices.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://strikeready.com/blog/sidewinder-apt-leverages-nepal-protests-to-push-mobile-malware/",
        "https://app.validin.com/detail?find=Nepal%20Emergency%20Helpline&type=raw&ref_id=8e81c44632d#tab=host_pairs (# 2025-09-18)",
        "https://www.virustotal.com/gui/file/679743ceb283331b973728921406125179f56737f0b4b667f983a7303d36af78/detection",
        "https://www.virustotal.com/gui/file/f2b22a17835034a17d4133cf46bd1339c793b5591822f11179bcbe88b04183c8/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "pbm-gov-pk.ignitebiz.de",
          "pqa-gov-pk.workers.dev",
          "pta-gov-pk.workers.dev"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://app.validin.com/lookalikes?limit=1000&lookback=90&depth=0&find=pmo-gov-pk (# 2025-06-11)"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "punjabgovpolice.org",
          "punjabpolicegovernmentofpakistan.org",
          "punjabpolicepakistan.org"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://app.validin.com/detail?find=69c8a3baf76640c8385adcc2b8ef3174ead8a1fc&type=hash&ref_id=99333d38ae6#tab=host_pairs (# 2025-09-05)"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "jtops.milqq.info",
          "milqq.info"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/wa1Ile/status/1893896154825294224",
        "https://www.virustotal.com/gui/file/1527cf10f00c798262b3347c00af8028fee3bc88a450bc2df7766b1118c62cd5/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1,
        "url_path": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "webmaii-bcc-gov-bd-newfiles.up.railway.app"
        ],
        "url_path": [
          "/?evfdbskjfbksjlfkjsengknsjbgwg34vf"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/2002771041505149206"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "dgdp-drive-file-sharing-pdf-files-doc.netlify.app",
          "invitation-mofa-nepli-gov-np-file.netlify.app"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/2001706314045727114"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "drive-acct-offl-pdf.com",
          "drive-armed-force-day-cas-msg.netlify.app"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/2001677935397474324"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "mail-sco-gov-pk.netlify.app",
          "usermail-output-panel.000webhostapp.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/2000684285901332534"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "mms.phone-update.click",
          "phone-update.click"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1996677391704289400",
        "https://www.virustotal.com/gui/file/21cb07f97127a5427603d9d9540c68e0fce7e1d4863216d86799a84f32074d05/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1,
        "url_path": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "exmail-qq-drive.com"
        ],
        "url_path": [
          "/cetcc/crud.php"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1950951163748118935"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "all-files.mail-sessionexpired.com",
          "mail-sessionexpired.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1949896889966505997"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "www-navl-com-lk.pages.dev",
          "www-officialregistration-accounts.netlify.app"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1949199453102985695"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "afdinfo786.bdgov.info",
          "bdgov.info"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1945535021890040150",
        "https://www.virustotal.com/gui/ip-address/46.30.191.184/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "mfagov.info",
          "mfagov.net"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1926564282252120128"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "ducane.info",
          "l1kdine.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1923403903262986410"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "goov.pk",
          "visa-nadra-gov-pk.pk"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1922332480503181486",
        "https://www.virustotal.com/gui/ip-address/93.190.143.108/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "beoe.govtpk.co",
          "govtpk.co"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1916593879983571354"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "army-bd.com",
          "nomination.army-bd.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/suyog41/status/1958766748804817302",
        "https://www.virustotal.com/gui/file/4efcee12fc15253ffbfc6c85076e0d675a2210a081a23e59f9b0364fb4279c04/detection",
        "https://www.virustotal.com/gui/file/29afca6e2c38105952012a51e5b40b789bc5fb9bc7c73e33c399df4b2d58999b/detection",
        "https://www.virustotal.com/gui/file/7cac51f6941028cf7e77722484e2ced8eb43511f1b1b8d99f6e17703534103de/detection",
        "https://www.virustotal.com/gui/file/7dc75ac10f838a418f18bf69d867dc77bc36a3342165737d1b9bce9582a8d8b4/detection",
        "https://www.virustotal.com/gui/file/2e48dc76c7cd8cc59db6114359fc6b7cdcc2f883becb7f91c3d59ba42e2f7cb7/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "info-lanka.org",
          "modltr.info-lanka.org"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/spontiroli/status/1912850014520463442",
        "https://www.virustotal.com/gui/file/7363887b6b0fe7cece3c21ad18515835922379c7d78c47cea745940a1061a6c4/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "defence-np.net",
          "internal-advisory-azerbaijan-russia-diplomatic-crisis.defence-np.net"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/salmanvsf/status/1985549302727590124",
        "https://www.virustotal.com/gui/file/f69708c769f3d34fc0798257b472cc48770208b6862ea3e6540d12b9f23f9cdf/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "bismi.pro",
          "vpdf.online"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/mal_analysis136/status/1897314313720983686"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "d0wnlaod.org",
          "modp-gov-pk.d0wnlaod.org"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/blackorbird/status/1897618982384873643",
        "https://www.virustotal.com/gui/ip-address/185.235.138.29/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "buildthenations.info",
          "hitpak.org"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/__0XYC__/status/1972166420403572852",
        "https://x.com/volrant136/status/1972184931284799492",
        "https://www.welivesecurity.com/en/eset-research/love-actually-fake-dating-app-used-lure-targeted-spyware-campaign-pakistan/",
        "https://www.virustotal.com/gui/file/5e1cfa57771084629c2b08757f38d67f0ad28faa412090f1c6ef3fa0fd893bb3/detection",
        "https://www.virustotal.com/gui/file/e4aa98c1beee901871fd8a78b37b21ef886e507e65fc6499e3df3769081cd1cb/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "it-pakistan-gov-pk.workers.dev",
          "support.it-pakistan-gov-pk.workers.dev"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/__0XYC__/status/1909926129340965172"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "mail.ntc.net.pk.bismi.pro",
          "ntc.net.pk.bismi.pro"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/__0XYC__/status/1896843819838251335"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "mod-gov-bd.dwnlld.info",
          "pc-gov-pk.downnload.net"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/Glacius_/status/1919444379971821617",
        "https://www.virustotal.com/gui/file/1955c6914097477d5141f720c9e8fa44b4fe189e854da298d85090cbc338b35a/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "cabinet-gov-pk.net-co.live",
          "net-co.live"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/85.239.55.124/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "file-downlod.org",
          "songlong88.net"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/80.251.18.108/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "centralized-email-system-np.com",
          "inboxofficial-bd.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/36.50.40.202/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "mofa-qov.com",
          "rnail.mofa-qov.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/2.58.15.76/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "mfa-gov-al.com",
          "mfa-gov-cy.online"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/domain/mfa-gov-al.com/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "wqqwysd-qwbeaxsb.zeabur.app"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/2005680099560153314"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "psdgbgb-cell.github.io"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/2002046264809296061"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "mail-bcc-gov-bd-7j5la.bunny.run"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1989955653058875805"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "mailsserver-lk.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1988688742949978559"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "email-sco-gov-pk.zeabur.app"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1976333787400409330"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "mail-moitt-gov-pk-meeting-sun-committee.pages.dev"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1975244229287846383"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "101c4a583c3acdd2afd06ca2fb183cf995sdfsdh54jkdfgh54893489h5.pages.dev"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1962212071275368628"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "mailscodomain-hubenkks.b4a.run"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1959704085298663626"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "mailbox3-inbox1-bd.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1952014981278355879"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "mail-baf-mil-bd-account-data-files-document.pages.dev"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1952014499172495781"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "pnra-gov-view.000webhostapp.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1951339826235711650"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "mail-modp-gov-pk-view.netlify.app"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1951339364585447465"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "axigen-web-expired-paknavy-files.netlify.app"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1950950797736329381"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "encrypted-files-paknavy-0pen.netlify.app"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1949896689864540232"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "mail-mod-gov-bd-account-conf-files.netlify.app"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1949867469012685147"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "www-srilankanavy-cabinet-decision.netlify.app"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1949549269410545920"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "mail-mod-gov-np-account-file-data.netlify.app"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1949543032547582120"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "dlimskpk-gov.com.pk"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1947733875385421848"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "ptpkp-govt.site"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1943411794501931421"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "nastp-govpk.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1942665553652637966"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "psw-gov-pk.net"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1942261847438090310"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "safecityctd.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1939744960170885468"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "islamabadpolice.org"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1939737733024415965"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "interiorgovpk.site"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1938848055022833806",
        "https://x.com/volrant136/status/2056766835962323257"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "punjabsafecities.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1938601633123868683"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "punjabgovpk.org"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1938595504843051137"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "interior-gov-pk.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1936722517433213141"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "paknavy.info"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1926559917101494717"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "mod-gov-bd.info"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1925581298782941625",
        "https://www.virustotal.com/gui/ip-address/47.236.12.192/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "cons-mofa-gov-pk-hqr-1777839.online"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1925229593897709961"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "botcel.info"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/volrant136/status/1916037219770634729",
        "https://www.virustotal.com/gui/ip-address/2.58.15.183/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "www-presidentsoffice-gov-lk.dwnlld.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/suyog41/status/1920014750643007950",
        "https://www.virustotal.com/gui/ip-address/193.42.39.217/relations",
        "https://www.virustotal.com/gui/file/558de2a01fbd76be171561c3c82fd6a8e2d4c913444850af99d44a4cfb41b680/detection",
        "https://www.virustotal.com/gui/file/725ded50e7f517addd12f029aeaf9a23f2b9ce6239b98820c8a12ea5cb79dbfa/detection",
        "https://www.virustotal.com/gui/file/b6b98197133a19a20ef64d6206e4b0e98d8d9db00d66a643577f5d55e00ea58d/detection",
        "https://www.acronis.com/en-us/cyber-protection-center/posts/from-banks-to-battalions-sidewinders-attacks-on-south-asias-public-sector/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "posta-nhq43i6x.b4a.run"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/__0XYC__/status/1960328082746753424",
        "https://x.com/volrant136/status/1964037554736398445"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "ipv4": [
          "149.102.131.122:41521"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/ThreatBookLabs/status/1957623577643217181",
        "https://www.virustotal.com/gui/file/2185e15486256a3bf16176f54e765a76fd9b96cb3800920402a137bdc698e7da/detection",
        "https://www.virustotal.com/gui/file/5dca94edf42e5578edccf63a51790e68ec46fa0fb6377c884b056339cfb58dac/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "ndma-govpak.org"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/34.216.117.25/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "mfa-gov-cy.info"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.virustotal.com/gui/ip-address/139.84.131.91/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "donwloaded.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://twitter.com/Glacius_/status/1727968223088214182",
        "https://x.com/Cyberteam008/status/1925009704918393295",
        "https://www.virustotal.com/gui/ip-address/5.230.54.3/relations",
        "https://www.virustotal.com/gui/file/170ccf1225154fa0cd92a14219f0b912479cc4095203646c38a31bb78baafe9f/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "govmm.me"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://app.validin.com/detail?type=hash&find=5bdf6ee243a03479ed1b1f05c2cee35a#tab=host_pairs (# 2025-10-12)"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "punjabpolicegovpk.org"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://app.validin.com/detail?find=5.181.159.226&type=ip4&ref_id=99333d38ae6#tab=resolutions"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2025-02-17",
      "indicators": {
        "domain": [
          "data-sob-gov-bd.live-co.org",
          "live-co.org",
          "mod-gov-bd.live-co.org",
          "mofa-gov-bd.live-co.org",
          "pubad-gov-lk.live-co.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/suyog41/status/1891372873496834115",
        "https://www.virustotal.com/gui/file/96d429d67a2663ef2cf3f45ccd0619adf0cd030f7fe70f072af1ce1d67ec52a3/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2025-02-15",
      "indicators": {
        "domain": [
          "api.nbppakistan.com",
          "collector.nbppakistan.com",
          "github.nbppakistan.com",
          "nbppakistan.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/mal_analysis136/status/1890729450792268024"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 45
      },
      "first_seen": "2025-02-14",
      "indicators": {
        "domain": [
          "baf.mil.bd.hilsa.online",
          "bd.hilsa.online",
          "email.moitt.gov.pk.hilsa.online",
          "emails.moitt.gov.pk.hilsa.online",
          "getnew.file.update.up2dts.online",
          "gov.pk.hilsa.online",
          "hillview.net.pk.hilsa.online",
          "hilsa.online",
          "mail-mod-gov-bd-account-data-file.netlify.app",
          "mail.baf.mil.bd.hilsa.online",
          "mail.bgb.gov.bd.up2dts.online",
          "mail.hillview.net.pk.hilsa.online",
          "mail.hilsa.online",
          "mail.mofa.gov.pk.up2dts.online",
          "mail.mofas.gov.pk.updatemaster.info",
          "mail.navy.lk.updatemaster.info",
          "mail.navy.mil.bd.up2dts.online",
          "mail.npc.gov.np.up2dts.online",
          "mail.ntc.gov.pk.hilsa.online",
          "mail.paf.gov.pk.hilsa.online",
          "mail.punjab.gov.pk.hilsa.online",
          "mail.sco.gov.pk.hilsa.online",
          "mails.baf.mil.bd.updatemaster.info",
          "mails.bcc.gov.bd.updatemaster.info",
          "mails.mofa.gov.np.updatemaster.info",
          "mails.mofa.gov.pk.updatemaster.info",
          "mails.navy.mil.bd.updatemaster.info",
          "mails.nepal.gov.np.updatemaster.info",
          "mails.ntc.net.pk.hilsa.online",
          "mails.paf.gov.pk.hilsa.online",
          "mails.pmo.gov.pk.hilsa.online",
          "mil.bd.hilsa.online",
          "mofa.gov.np.updatemaster.info",
          "moitt.gov.pk.hilsa.online",
          "net.pk.hilsa.online",
          "ntc.gov.pk.hilsa.online",
          "ntc.net.pk.hilsa.online",
          "paf.gov.pk.hilsa.online",
          "pk.hilsa.online",
          "pmo.gov.pk.hilsa.online",
          "punjab.gov.pk.hilsa.online",
          "sco.gov.pk.hilsa.online",
          "up2dts.online",
          "updatemaster.info",
          "view.full.pdf.file.up2dts.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/SecAI_AI/status/1890047778539061342",
        "https://app.validin.com/detail?find=38.60.198.71&type=ip4&ref_id=612fb65def6#tab=resolutions"
      ],
      "total": 45
    },
    {
      "counts": {
        "domain": 20
      },
      "first_seen": "2025-02-14",
      "indicators": {
        "domain": [
          "cb-govt.com",
          "ik-gost.ru",
          "pakgovt.online",
          "pakgovt.site",
          "pk-go.net",
          "pk-gods.com",
          "pk-post.top",
          "pk-soft.online",
          "pkgovk.info",
          "pm-gov.cloud",
          "ptgovt.top",
          "ptt-govt.blog",
          "ptt-govt.ink",
          "ptt-govt.lat",
          "pttgovt.bond",
          "pygovt.com",
          "uk-gov.cyou",
          "uk-gov.icu",
          "uk-gov.qpon",
          "uk-gova.today"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/volrant136/status/2021636487281045747"
      ],
      "total": 20
    },
    {
      "counts": {
        "domain": 20
      },
      "first_seen": "2025-02-14",
      "indicators": {
        "domain": [
          "dopm.gov.np.totheeverest.com",
          "gov.bd.account.login.sessions.webmailarmy.com",
          "gov.np.farwestkhabar.com",
          "gov.np.namlo.com.np",
          "gov.np.totheeverest.com",
          "gov.np.unsilk.com",
          "gov.np.webproxy.to",
          "ims.sudurpashchim.gov.np.farwestkhabar.com",
          "mail-navy-mil-bd-modern-email-inbox-messages.webmailarmy.com",
          "mail.bgb.gov.bd.account.modern.sessions.webmailarmy.com",
          "mail.cao.gov.bd.account.login.sessions.webmailarmy.com",
          "mail.mod.gov.bd.account.login.sessions.webmailarmy.com",
          "mhealth.dopm.gov.np.totheeverest.com",
          "ov.bd.account.modern.sessions.webmailarmy.com",
          "psdph.dopm.gov.np.totheeverest.com",
          "see.gov.np.unsilk.com",
          "snnp.gov.np.namlo.com.np",
          "vaccine.moha.gov.np.webproxy.to",
          "vaccine.mohp.gov.np.webproxy.to",
          "webmailarmy.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/Malwar3Ninja/status/1890393003207843897",
        "https://www.virustotal.com/gui/file/866f2112ee7e2553b0db0e931dd14f18515020ebc5985d91f6c96f1fce24a56c/detection"
      ],
      "total": 20
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2025-02-10",
      "indicators": {
        "domain": [
          "dirctt88.info",
          "micret.live",
          "mteron.info",
          "recred.live",
          "warecon.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/mal_analysis136/status/1889041601709977866"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2025-02-10",
      "indicators": {
        "domain": [
          "net-src.info",
          "pubad-gov-lk.net-src.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/suyog41/status/1888906530118062394",
        "https://www.virustotal.com/gui/file/22527dd1a62dc46dd4edd23a681657cf4c3477e9f90fb1ef63ef657608b9838c/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2025-02-07",
      "indicators": {
        "domain": [
          "org-co.net",
          "pubad-gov-lk.org-co.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/suyog41/status/1887812529151443394",
        "https://www.virustotal.com/gui/file/47d77499968244911d0179fb858578de00dbb98079e33f5ed5d229d03eb04d67/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 33
      },
      "first_seen": "2025-02-05",
      "indicators": {
        "domain": [
          "app-sec01.online",
          "docum.store",
          "email.mofa.gov.pk.docum.store",
          "email.navy.gov.bd.docum.store",
          "email.nvy.milbd.onlinestatus.live",
          "emails.mofa.gov.pk.docum.store",
          "files-ci.com",
          "gooogle.live",
          "kra20.fun",
          "mail.baf.mil.bd.docum.store",
          "mail.baf.mil.bd.onlinestatus.live",
          "mail.bcc.gov.bd.onlinestatus.live",
          "mail.fwo.com.pk.onlinestatus.live",
          "mail.mofa.gov.pk.docum.store",
          "mail.mofa.gov.pk.onlinestatus.live",
          "mail.navy.mil.bd.docum.store",
          "mail.navy.mil.bd.onlinestatus.live",
          "mail.nepla.gov.np.onlinestatus.live",
          "mail.pof.gov.pk.onlinestatus.live",
          "mail.ssf.gov.bd.onlinestatus.live",
          "mail1.mofa.gov.pk.docum.store",
          "mail1.navy.mil.bd.docum.store",
          "msonlineoffice.com",
          "noreplyuser.site",
          "onlinestatus.live",
          "opensign-delta3e.com",
          "reecesayer.com",
          "security-it1.com",
          "sqrt.ovh",
          "surveydocs.online",
          "synoslabs-test.com",
          "webmail.fwo.com.pk.docum.store",
          "xn--micosoftonline-iwc.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/SecAI_AI/status/1884616742082932870",
        "https://www.virustotal.com/gui/ip-address/51.89.9.145/relations"
      ],
      "total": 33
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2025-02-05",
      "indicators": {
        "domain": [
          "gso2.mail163.info",
          "mail163.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/suyog41/status/1887133284276244512",
        "https://www.virustotal.com/gui/file/15cf5271c7b9b8ad22c4c96bc8674d9835e8d419fc1a6077f3b59fbd7e59d112/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2025-01-28",
      "indicators": {
        "domain": [
          "dytt888.org",
          "presidentsoffice-gov-lk.dytt888.org",
          "www-mopa-gov-bd.dytt888.org",
          "www-presidentsoffice-gov-lk.dytt888.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/suyog41/status/1884178221127852096",
        "https://www.virustotal.com/gui/ip-address/5.255.126.233/relations",
        "https://www.virustotal.com/gui/file/54c4641f709e51622531dc3d04fd2f4a3bad2a42dca287e2777c04d59cbca789/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2025-01-17",
      "indicators": {
        "domain": [
          "interior-gov-pk.mail-govt.org",
          "mail-govt.org",
          "www-cabinetoffice-gov-lk.mail-govt.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/suyog41/status/1880182370902634893",
        "https://www.virustotal.com/gui/ip-address/5.255.117.75/relations",
        "https://www.virustotal.com/gui/file/d3fb61c0211bd379bf80f15cf072fdbc1187fe95546fdfcfcbdf8918004f05e2/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 10
      },
      "first_seen": "2025-01-16",
      "indicators": {
        "domain": [
          "commerce.govpk.me",
          "depo.govpk.me",
          "ead.govpk.me",
          "fia.govpk.me",
          "govpk.me",
          "ib.govpk.me",
          "mofa.govpk.me",
          "moitt.govpk.me",
          "mpnr.govpk.me",
          "pc.govpk.me"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/wa1Ile/status/1879794476480426196",
        "https://www.virustotal.com/gui/ip-address/45.137.159.236/relations"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2025-01-14",
      "indicators": {
        "domain": [
          "govpk.email",
          "govvv.pk",
          "ib.govvv.pk",
          "mindef.govvv.pk",
          "mofa.govpk.email",
          "mofa.govvv.pk",
          "paknavy.govpk.email",
          "paknavy.govvv.pk"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/mal_analysis136/status/1879225400666313177",
        "https://www.virustotal.com/gui/ip-address/89.116.192.242/relations"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2025-01-13",
      "indicators": {
        "domain": [
          "mystore.prepforce.site",
          "prepforce.site"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/mal_analysis136/status/1878823552188883024",
        "https://www.virustotal.com/gui/ip-address/195.201.179.80/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2025-01-10",
      "indicators": {
        "domain": [
          "modpak.live",
          "paknavy.modpak.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/ginkgo_g/status/1877604805612548507",
        "https://www.virustotal.com/gui/file/f29de289f33c8c9e4a53d25443e6d949b0028b31accf9abb4a8bab4a9dcbba42/detection",
        "https://www.virustotal.com/gui/file/896ddb35cde29b51ec5cf0da0197605d5fd754c1f9f45e97d40cd287fb5a2d25/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 50
      },
      "first_seen": "2025-01-06",
      "indicators": {
        "domain": [
          "81-cn.ddns.net",
          "81-cn.info",
          "az-updates.store",
          "bangladeshbaank-gov-bd.workers.dev",
          "boc-cn.81-cn.info",
          "boc.cn.81-cn.info",
          "cas.sysu.edu.cn.81-cn.info",
          "cfau.edu.cn.81-cn.info",
          "cloud.moe.gov.cn.81-cn.info",
          "cmclient-downloader.serveirc.com",
          "corporate-social-activity-updates.ciecc.com.cn.81-cn.info",
          "crec-bangladesh.ddns.net",
          "fileserver.81-cn.info",
          "gateway.ceair.com.81-cn.info",
          "globaltimes-cn.org",
          "hit.gov.pk.81-cn.info",
          "hust.edu.cn.81-cn.info",
          "internal-portal.ceair.com.81-cn.info",
          "mail-cscec.ddns.net",
          "mail-mofa.ddns.net",
          "mail-nssc.sytes.net",
          "mail-nudt.sytes.net",
          "mail.a.globaltimes-cn.org",
          "mail.cfau.edu.cn.81-cn.info",
          "mail.cmec.com.globaltimes-cn.org",
          "mail.hit.gov.pk.81-cn.info",
          "mail.hust.edu.cn.81-cn.info",
          "mail.mail.cmec.com.globaltimes-cn.org",
          "mail.mail.spacechina.com.81-cn.info",
          "mail.mfa.gov.cn.81-cn.info",
          "mail.mfaa.gov.cn.globaltimes-cn.org",
          "mail.mofa.gov.pk.globaltimes-cn.org",
          "mail.nju.edu.cn.81-cn.info",
          "mail.nudt.edu.cn.81-cn.info",
          "mail.smmu.edu.cn.81-cn.info",
          "mail.tsinghua.edu.cn.81-cn.info",
          "mfa.gov.cn.81-cn.info",
          "mfaa.gov.cn.globaltimes-cn.org",
          "moe.gov.cn.81-cn.info",
          "mofa.gov.pk.globaltimes-cn.org",
          "news-gov-cn.info",
          "nju.edu.cn.81-cn.info",
          "nudt.edu.cn.81-cn.info",
          "smmu.edu.cn.81-cn.info",
          "spacechina.com.81-cn.info",
          "tsinghua.edu.cn.81-cn.info",
          "uat-updates.gateway.ceair.com.81-cn.info",
          "updates.moe.gov.cn.81-cn.info",
          "vrms.bangladeshbaank-gov-bd.workers.dev",
          "wandering-pond-e7f4.foxiproxi.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1876284392319963587",
        "https://x.com/StrikeReadyLabs/status/1876353156252340233",
        "https://raw.githubusercontent.com/StrikeReady-Inc/samples/refs/heads/main/2025-01-06%205000%20BDT/urls.txt",
        "https://www.virustotal.com/gui/file/136dd864f5772a6567aff34fcbe6f0665b7cc04b2d486004c370f410bee259b1/detection",
        "https://www.virustotal.com/gui/file/eebf4a5104d75f8f6536e592d4c7945d56f8431059f2cab980756d9b9e96f0fc/detection"
      ],
      "total": 50
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2025-01-06",
      "indicators": {
        "domain": [
          "downnload.org",
          "ibas-finance-gov-bd.downnload.org",
          "mof-portal-gov-bd.downnload.org",
          "mofa-gov-bd.downnload.org",
          "mofa-gov-np.downnload.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/suyog41/status/1876157867423879302",
        "https://www.virustotal.com/gui/ip-address/178.209.51.231/relations",
        "https://www.virustotal.com/gui/file/5f0d9a8f26a8ead63c0d2063abdef157138eb59def34c361cdc3a42b0ed2c17d/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 10
      },
      "first_seen": "2025-01-05",
      "indicators": {
        "domain": [
          "cmm.int-secure.org",
          "cnmm.int-secure.org",
          "fia-gob.net",
          "int-secure.org",
          "mofa-gov-np.fia-gob.net",
          "officedrive.live",
          "pmd.paknavy-gov.com",
          "president-gov-ik.donwloaded.net",
          "sarabanmithnavvtni-mil.com",
          "sl-navy.officedrive.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/banthisguy9349/status/1875901285783962024"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2025-01-05",
      "indicators": {
        "domain": [
          "download-files-0pen-err0r-l0gin.netlify.app",
          "downloadfiles-mail.pages.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/banthisguy9349/status/1875930695388037559"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2025-01-05",
      "indicators": {
        "domain": [
          "notifications-khmod.d0cumentview.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/suyog41/status/1858462344856101197",
        "https://x.com/banthisguy9349/status/1875904770697003459",
        "https://www.virustotal.com/gui/ip-address/89.46.234.85/relations",
        "https://www.virustotal.com/gui/file/40159fcfe9793a8a13111131e31f10eb1652343f6b9d172e2cadc821bc5f28fd/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2025-01-05",
      "indicators": {
        "domain": [
          "nia-china-inviation-package-zip.netlify.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/banthisguy9349/status/1875934113292861656"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-12-27",
      "indicators": {
        "domain": [
          "38273409.mail-defence-lk-loging-horde.pages.dev",
          "mail-defence-lk-loging-horde.pages.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/ThreatBookLabs/status/1872288256370585931"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-12-26",
      "indicators": {
        "domain": [
          "cloudpmo.top",
          "ofc.cloudpmo.top"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/k3yp0d/status/1871927642984968619",
        "https://www.virustotal.com/gui/file/01c6bc7bc8b4367205b698b99ad57df27387aa855a3245bdf5fa727e73925d06/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2024-12-24",
      "indicators": {
        "domain": [
          "draft-paper-advertisementfdg.netlify.app",
          "mail-defence-lk-session-out.pages.dev",
          "mailserver-lk.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/ThreatBookLabs/status/1871570023665275210",
        "https://x.com/StrikeReadyLabs/status/1871572110134726720",
        "https://x.com/blackorbird/status/1871576281571274847",
        "https://www.virustotal.com/gui/file/c27843c64f1e9bfbaabe5a98f384ef9d3eb2c32f97efe109690de16dd52d44e8/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 9
      },
      "first_seen": "2024-12-19",
      "indicators": {
        "domain": [
          "btrc-gov-bd.mail-govt.com",
          "cag-org-bd.mail-govt.com",
          "mail-govt.com",
          "mod-portal-gov-bd.mail-govt.com",
          "mofa-portal-gov-bd.mail-govt.com",
          "molwa-gov-bd.mail-govt.com",
          "mopa-gov-bd.mail-govt.com",
          "www-mof-gov-np.mail-govt.com",
          "www-prc-mhapsd-gov-bd.mail-govt.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/DmitriyMelikov/status/1869829399023104432",
        "https://www.virustotal.com/gui/file/ba6ca4391a9fb405dd780fd5fb1a8acea22435f1707b2422e2bec6d74dbecc41/detection"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 2,
        "url": 2
      },
      "first_seen": "2024-12-19",
      "indicators": {
        "domain": [
          "bangla.b-cdn.net"
        ],
        "ipv4": [
          "47.76.135.130:443",
          "47.84.196.148:443"
        ],
        "url": [
          "http://47.76.135.130",
          "http://47.84.196.148"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/JAMESWT_MHT/status/1869724537115541616",
        "https://www.virustotal.com/gui/file/44f7c5e8855fc2c9a0026183759f99635d7b89eee46dc904d5618123ed217435/detection",
        "https://www.virustotal.com/gui/file/6750a7e6eb02eecab234f42a6cc6a88c1510d557336d53a85c02ad43776d8cb9/detection",
        "https://www.virustotal.com/gui/file/623767715bd1a33c41e2de8ab3af341e629105132c3434f454cf249f98adbfd7/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 8,
        "url": 1
      },
      "first_seen": "2024-12-13",
      "indicators": {
        "domain": [
          "efes-mindef-qov-pk.dowmload.org",
          "google.gov-pok.net",
          "kenaikan.portdedjibouti.live",
          "mofa-gov-np.dirctt88.co",
          "mofa-gov-pk.download.info",
          "salary-cuxxing.session-out.com",
          "suezcanal.portdedjibouti.live",
          "www-opmcm-gov-np.direct888.net"
        ],
        "url": [
          "http://213.183.55.52"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/banthisguy9349/status/1867529811750694984",
        "https://pastebin.com/raw/eEBba59X"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-12-13",
      "indicators": {
        "domain": [
          "defence-lk.military-bd.org",
          "military-bd.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/ginkgo_g/status/1867518951930179775",
        "https://www.virustotal.com/gui/file/8ae6cf2d0932782784084ff0e792a85146d5073115556e8d05a225e635ec96fa/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-12-13",
      "indicators": {
        "domain": [
          "ww25.mail-dmp-navy-pk.dytt88.org",
          "ww25.ministryofforeignaffairs-mofa-gov-pk.dytt88.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/t3ft3lb/status/1656554005491859456",
        "https://x.com/banthisguy9349/status/1867536997528875196",
        "https://www.virustotal.com/gui/ip-address/5.230.73.198/relations",
        "https://www.virustotal.com/gui/file/a703c6772e8bcf7cd0aef05ecbee4c7f7f39371d45b42bf1030df2be5261717c/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-12-04",
      "indicators": {
        "domain": [
          "dntnavymil.mofw.pro",
          "mofw.pro"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1864282578561221054",
        "https://www.virustotal.com/gui/file/a1b5ca71501c5215b2a7ed637308060e10914e436dcda11c219448e3540ef200/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-11-20",
      "indicators": {
        "domain": [
          "paknavy.rf.gd"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/blackorbird/status/1859161598469836806",
        "https://blogs.blackberry.com/en/2024/11/suspected-nation-state-adversary-targets-pakistan-navy-in-cyber-espionage-campaign",
        "https://www.virustotal.com/gui/collection/f6f862c588961ae94c5c23d92331b85e5023ed7064c00d1299f73d47aadf699d/iocs",
        "https://www.virustotal.com/gui/file/fc39ec35d767a2c0a178ca9874be8aaf87033f8b834ee8dcb57d3904516e4335/detection",
        "https://www.virustotal.com/gui/file/a0a18e76d8af39b9b198d9ea7c67dc372fa3cdb2286ac405fa8e76154af34fff/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-11-20",
      "indicators": {
        "domain": [
          "www-airport-lk.mail-gov.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1857456905167237288",
        "https://x.com/suyog41/status/1859132957870694480",
        "https://www.virustotal.com/gui/file/5fd3f901163aad60fae9afc8c969bba7ff233c7eba242ce85f17b920f9b70140/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-11-18",
      "indicators": {
        "domain": [
          "advisories-sgcustoms.d0cumentview.info",
          "d0cumentview.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/suyog41/status/1858462344856101197",
        "https://x.com/banthisguy9349/status/1875904770697003459",
        "https://www.virustotal.com/gui/ip-address/89.46.234.85/relations",
        "https://www.virustotal.com/gui/file/40159fcfe9793a8a13111131e31f10eb1652343f6b9d172e2cadc821bc5f28fd/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2024-11-15",
      "indicators": {
        "domain": [
          "cloudmails.live",
          "ecloudsmails.com",
          "mail-gov.org",
          "opertingsmail.us"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1857456905167237288",
        "https://x.com/suyog41/status/1859132957870694480",
        "https://www.virustotal.com/gui/file/5fd3f901163aad60fae9afc8c969bba7ff233c7eba242ce85f17b920f9b70140/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-11-13",
      "indicators": {
        "domain": [
          "paknavy.org.pk"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/k3yp0d/status/1856401803379876074",
        "https://x.com/StrikeReadyLabs/status/1856724048903836018",
        "https://urlscan.io/result/82d6480b-898a-4ea5-9105-557c4096a79c",
        "https://www.virustotal.com/gui/file/ce4428b9b4455cfc051f195fcab0bfee775a7ef5aa3432a7d807c798444c250d/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2024-11-12",
      "indicators": {
        "domain": [
          "bmac-g0v-cn-aman-exercise-1etter.netlify.app",
          "bmac-org-cn-exercise-observer-invites.netlify.app",
          "bmac-pla-exercise-aman-2024-letter.netlify.app",
          "china-immigration-department-letter.netlify.app",
          "chinese-pla-a1rforce-0fficil-drive.netlify.app",
          "ministryofdefencechinadrive.pages.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/k3yp0d/status/1856401803379876074",
        "https://x.com/StrikeReadyLabs/status/1856724048903836018",
        "https://urlscan.io/result/82d6480b-898a-4ea5-9105-557c4096a79c",
        "https://www.virustotal.com/gui/file/ce4428b9b4455cfc051f195fcab0bfee775a7ef5aa3432a7d807c798444c250d/detection"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 43
      },
      "first_seen": "2024-10-25",
      "indicators": {
        "domain": [
          "acc.pk-govt.net",
          "apgml.pk-govt.net",
          "bard.gov.bd.pk-govt.net",
          "caab.gov.bd.pk-govt.net",
          "cabinet.gov.bd.pk-govt.net",
          "cabinet.pk-govt.net",
          "cga.gov.bd.pk-govt.net",
          "ecs.pk-govt.net",
          "email.pk-govt.net",
          "establishment.gov.pk-govt.net",
          "fbr-gov.net",
          "finance.gov.pk-govt.net",
          "fisheries.gov.bd.pk-govt.net",
          "gov-cn.co",
          "gov-org.com",
          "govt-cn.co",
          "govt-cn.org",
          "icd.punjab.gov.pk-govt.net",
          "minland.pk-govt.net",
          "mochta.pk-govt.net",
          "mod-govbd.com",
          "mod.gov.bd.pk-govt.net",
          "mod.gov.pk-govt.net",
          "modp.gov.pk-govt.net",
          "mof.pk-govt.net",
          "mofa-govlk.net",
          "mofa.gov.bd.pk-govt.net",
          "mofa.gov.np.pk-govt.net",
          "mofa.gov.pk-govt.net",
          "mofa.pk-govt.net",
          "moha.gov.np.pk-govt.net",
          "mopa.gov.bd.pk-govt.net",
          "mopa.pk-govt.net",
          "nepalpolice-govnp.com",
          "nespak.com.pk-govt.net",
          "ofac-gov.net",
          "pk-govt.net",
          "pnra.pk-govt.net",
          "prisons.punjab.pk-govt.net",
          "punjab.gov.pk-govt.net",
          "punjabpolice.gov.pk-govt.net",
          "sgad.punjab.gov.pk-govt.net",
          "tcp.gov.pk-govt.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1849797282499039404"
      ],
      "total": 43
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2024-10-25",
      "indicators": {
        "domain": [
          "dytt88.co",
          "mfa-go-ke.dytt88.co",
          "moitt-gov-pk.dytt88.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/suyog41/status/1849679847137870328",
        "https://www.virustotal.com/gui/ip-address/5.255.116.103/relations",
        "https://www.virustotal.com/gui/file/56bf8948160e563b835cb3b656d0f3848625433b66cb3f89ba07f04f4e8e78cf/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-10-22",
      "indicators": {
        "domain": [
          "sgad-punjab-gov-pk.dirctt888.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/suyog41/status/1848679667399807266",
        "https://www.virustotal.com/gui/file/865f5b3b1ee94d89ad9a9840f49a17d477cddfc3742c5ef78d77a6027ad1caa5/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-10-22",
      "indicators": {
        "domain": [
          "dirctt888.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/84.32.84.32/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-10-16",
      "indicators": {
        "domain": [
          "auth.desktopserver.top",
          "cloud.desktopserver.top"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/suyog41/status/1839593288455606483",
        "https://x.com/malwrhunterteam/status/1846308333432852902",
        "https://www.virustotal.com/gui/file/21c0756d52ca7947a83529e2cc7d3341f4626b8da05c256f5ec09034d147c6ba/detection",
        "https://www.virustotal.com/gui/file/f51361da0c24c1ae422ebe8fb12aa1ff9ec49c71d1d699c9cff68f2ee93fcdfa/detection",
        "https://www.virustotal.com/gui/file/3958bd2062a15c764427a2cc886743df1b1ac56633e1ae43f190e43db836ddb3/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-10-16",
      "indicators": {
        "domain": [
          "mofa-gov-np.dirctt888.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/suyog41/status/1846521863347789927",
        "https://www.virustotal.com/gui/file/fa95fadc73e5617305a6b71f77e9d255d14402650075107f2272f131d3cf7b00/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 54
      },
      "first_seen": "2024-10-15",
      "indicators": {
        "domain": [
          "63inc.com",
          "aliyum.tech",
          "asyn.info",
          "cnsa-gov.org",
          "colot.info",
          "condet.org",
          "conft.live",
          "decoty.tech",
          "dinfed.co",
          "dirctt88.net",
          "direct88.co",
          "donwload-file.com",
          "downloadabledocx.com",
          "dynamic.nactagovpk.org",
          "e1ix.mov",
          "e1x.tech",
          "grouit.tech",
          "gtrec.info",
          "healththebest.com",
          "kernet.info",
          "kretic.info",
          "mfas.pro",
          "mitlec.site",
          "mmcert-org-mm.donwloaded.com",
          "mod-gov-bd.direct888.net",
          "mofagovs.org",
          "moittpk.net",
          "mshealthcheck.live",
          "nactagovpk.org",
          "navy-mil.co",
          "nextgen.paknavy-govpk.net",
          "nopler.live",
          "ntcpak.org",
          "numzy.net",
          "nventic.info",
          "pafgovt.com",
          "pdfrdr-update.com",
          "pdfrdr-update.info",
          "pmd-office.org",
          "portdedjibouti.shipping-policy.info",
          "portdjibouti.pmd-office.org",
          "premier.moittpk.org",
          "ptcl-net.com",
          "scrabt.tech",
          "shipping-policy.info",
          "sjfu-edu.co",
          "support-update.info",
          "tazze.co",
          "tex-ideas.info",
          "tumet.info",
          "u1x.co",
          "ujsen.net",
          "updtesession.online",
          "widge.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/sidewinder-apt/114089/",
        "https://www.virustotal.com/gui/ip-address/79.141.174.176/relations"
      ],
      "total": 54
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2024-10-11",
      "indicators": {
        "domain": [
          "command.ms-office.app",
          "holiday.ms-office.app",
          "ms-office.app",
          "update.ms-office.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/suyog41/status/1844615527106322754",
        "https://x.com/salmanvsf/status/1844636033109066079",
        "https://www.virustotal.com/gui/file/bafd23bf68bcb56f7927d10627c7e361127e8d42acdb7206752182ecadb611bc/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2024-10-11",
      "indicators": {
        "domain": [
          "dirctt888.info",
          "kafka.dirctt888.info",
          "paknavy-gov-pk.dirctt888.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/suyog41/status/1844614969158984039",
        "https://www.virustotal.com/gui/ip-address/167.88.164.63/relations",
        "https://www.virustotal.com/gui/file/8782aa3b2f8b28b67101532937ab95a47e0d246513c8496c2f6a29cd44d02cf1/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-09-27",
      "indicators": {
        "domain": [
          "desktopserver.top",
          "drive.desktopserver.top"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/suyog41/status/1839593288455606483",
        "https://x.com/malwrhunterteam/status/1846308333432852902",
        "https://www.virustotal.com/gui/file/21c0756d52ca7947a83529e2cc7d3341f4626b8da05c256f5ec09034d147c6ba/detection",
        "https://www.virustotal.com/gui/file/f51361da0c24c1ae422ebe8fb12aa1ff9ec49c71d1d699c9cff68f2ee93fcdfa/detection",
        "https://www.virustotal.com/gui/file/3958bd2062a15c764427a2cc886743df1b1ac56633e1ae43f190e43db836ddb3/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 58
      },
      "first_seen": "2024-09-26",
      "indicators": {
        "domain": [
          "168-gov.info",
          "acrobat.paknavy-pk.org",
          "aljazeerak.online",
          "apl-com.icu",
          "apl-org.online",
          "aurora.dawn-904.workers.dev",
          "blabla.apl-com.icu",
          "browser.apl-org.online",
          "classifieds.workers.dev",
          "confidential.zapto.org",
          "crec-bd.site",
          "dawn.apl-org.online",
          "dawnnews.workers.dev",
          "docs.apl-com.icu",
          "epaper.dawn-323.workers.dev",
          "filebox-1-y7125191.deta.app",
          "fonts.apl-org.online",
          "gov-pkgov.workers.dev",
          "hascolgov.info",
          "helpdesk-lab.site",
          "herald-b2a.workers.dev",
          "hesco.hascolgov.info",
          "hit-pk.org",
          "humariweb.info",
          "hurr.zapto.org",
          "images-11d.workers.dev",
          "itsupport-gov.com",
          "locaal.navybd-gov.info",
          "localhost.apl-com.icu",
          "locall.hascolgov.info",
          "login.apl-org.online",
          "mail-islamabadpolice-gov-pk.ntc-telecommunication-safecity.workers.dev",
          "mail-na-gov-pk.na-gov-pk.workers.dev",
          "mail.apl-com.icu",
          "mail.pakistangov.com",
          "mofapak.info",
          "mozilla.apl-org.online",
          "na-gov-pk.workers.dev",
          "new.apl-org.online",
          "ntc-telecommunication-safecity.workers.dev",
          "obituary.workers.dev",
          "oil.hascolgov.info",
          "openkm.paknavy-pk.org",
          "owa-spamcheck.apl-org.online",
          "pakistangov.com",
          "paknavy-pk.org",
          "pitb.gov-pkgov.workers.dev",
          "pitb.zapto.org",
          "quran-books.store",
          "redzone.apl-org.online",
          "redzone2.apl-org.online",
          "sco.zapto.org",
          "sharepoint-punjab.sharepoint-e13.workers.dev",
          "storage-e13.sharepoint-e13.workers.dev",
          "update.apl-org.online",
          "updpcn.online",
          "zero-berlin-covenant.apl-org.online",
          "zoom.osutuga7.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1836356550274826416",
        "https://www.virustotal.com/gui/ip-address/212.46.38.168/relations"
      ],
      "total": 58
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2024-09-18",
      "indicators": {
        "domain": [
          "customs.document-viewer.info",
          "document-viewer.info",
          "office.document-viewer.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1836356550274826416",
        "https://www.virustotal.com/gui/ip-address/212.46.38.168/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-09-10",
      "indicators": {
        "domain": [
          "cloud.dellicon.top",
          "dellicon.top"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1833558192024142056",
        "https://www.virustotal.com/gui/file/5ba6e6deae5da0adf35e78319e9c528343a21f09863b879b3976351896578229/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-09-04",
      "indicators": {
        "domain": [
          "pkinfo.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1831386292728598949",
        "https://www.virustotal.com/gui/file/c2bc69085df7036bdef980932a2383b34a9fb76a92d85b9f377beca060053c17/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-09-03",
      "indicators": {
        "domain": [
          "document-viewer.live",
          "stae-org-mz.document-viewer.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1830774400397779262",
        "https://www.virustotal.com/gui/ip-address/194.68.44.55/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-08-21",
      "indicators": {
        "domain": [
          "pafmodernwebclient-srirj3dq.b4a.run"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1826250092669751401",
        "https://www.virustotal.com/gui/file/e3802e7f09f499537271f80af7ca81ee1e6d8559164e644665cf50d0a43bccdc/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-08-15",
      "indicators": {
        "domain": [
          "cyber.pmd-offc.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/mal_analysis136/status/1822916700762984543",
        "https://x.com/suyog41/status/1824001819149799434",
        "https://www.virustotal.com/gui/ip-address/5.255.121.168/relations",
        "https://www.virustotal.com/gui/ip-address/5.255.99.223/relations",
        "https://www.virustotal.com/gui/file/bdbbb8fc621a1717e0dd373c143279db794a72a5bbd846ede92df412043623f7/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2024-08-12",
      "indicators": {
        "domain": [
          "office.pmd-office.info",
          "pmd-office.info",
          "pmd-office.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/mal_analysis136/status/1822916700762984543",
        "https://x.com/suyog41/status/1824001819149799434",
        "https://www.virustotal.com/gui/ip-address/5.255.121.168/relations",
        "https://www.virustotal.com/gui/ip-address/5.255.99.223/relations",
        "https://www.virustotal.com/gui/file/bdbbb8fc621a1717e0dd373c143279db794a72a5bbd846ede92df412043623f7/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-08-12",
      "indicators": {
        "domain": [
          "moittadvisory.pmd-offc.info",
          "pmd-offc.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/suyog41/status/1822904355777138829",
        "https://www.virustotal.com/gui/ip-address/213.183.55.52/relations",
        "https://www.virustotal.com/gui/file/a84b3dd5f7d29d8d257fdef0ede512ae09e6cd5be7681b9466a5c60f6f877c2b/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2024-08-11",
      "indicators": {
        "domain": [
          "dowmload.co",
          "fmprc-gov-cn.dowmload.co",
          "mod-gov-bd.dowmload.co",
          "mofa-gov-bd.dowmload.co",
          "mofa-gov-pk.dowmload.co",
          "punjabpolice-gov-pk.dowmload.co",
          "www-army-mil-bd.dowmload.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/mal_analysis136/status/1822672814924611748",
        "https://www.virustotal.com/gui/ip-address/5.255.121.188/relations"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-08-11",
      "indicators": {
        "domain": [
          "dlimspunjabgovpk.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/Cyberteam008/status/1938086890411893240"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-08-08",
      "indicators": {
        "domain": [
          "my.refnameit.life",
          "refnameit.life"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/k3yp0d/status/1821526304635650555",
        "https://www.virustotal.com/gui/file/b81c49fe252f763e43d2be298298ecc5d986c59e047efff6ecb928126e17f881/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-08-08",
      "indicators": {
        "domain": [
          "ministryofficedownloadcloudserver.screenpont.xyz",
          "screenpont.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/k3yp0d/status/1821523835214065877",
        "https://www.virustotal.com/gui/file/ffb1e4d9253ed97cc381826993a8812ac6c53f7a7d01793e282fc148102bdab3/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-08-07",
      "indicators": {
        "domain": [
          "dowmload.info",
          "mofa-gov-pk.dowmload.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1821133707077370041",
        "https://www.virustotal.com/gui/file/fec66a9aabf379d150ad51926b318f9c03edbe8f7e655193c036db6c0ba9a6b6/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-08-07",
      "indicators": {
        "domain": [
          "cons.mofa-gov-pk.site",
          "mofa-gov-pk.site"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/195.35.10.141/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-08-07",
      "indicators": {
        "domain": [
          "mofa-g0v-pk.workers.dev",
          "sharepakistan.mofa-g0v-pk.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/domain/mofa-g0v-pk.workers.dev/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2024-08-05",
      "indicators": {
        "domain": [
          "mofserviceserver.top",
          "ofc.mofserviceserver.top",
          "pmofficepakistancloudserver.shiftroof.top",
          "shiftroof.top"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1820454673603768564"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 27
      },
      "first_seen": "2024-08-01",
      "indicators": {
        "domain": [
          "army.mil.bd.pk-govt.com",
          "beoe.gov.pk-govt.com",
          "cabinet.gov.bd.pk-govt.com",
          "cabinet.gov.pk-govt.com",
          "ead.gov.pk-govt.com",
          "fia.gov.pk-govt.com",
          "fia.gov.pk.pk-govt.com",
          "finance.gov.pk-govt.com",
          "mod.gov.ba.pk-govt.com",
          "mod.gov.bd.pk-govt.com",
          "mofa.gov.bd.pk-govt.com",
          "mofa.gov.np.pk-govt.com",
          "mofa.gov.pk-govt.com",
          "mofa.gov.pk.pk-govt.com",
          "nepalembassyusa.org.pk-govt.com",
          "nepembassy.org.uk.pk-govt.com",
          "paknavy.gov.pk-govt.com",
          "paknavy.gov.pk.pk-govt.com",
          "pasb.mod.gov.pk-govt.com",
          "pk-govt.com",
          "pmo.gov.bd.pk-govt.com",
          "pmo.gov.pk.pk-govt.com",
          "police.gov.bd.pk-govt.com",
          "prisons.punjab.gov.pk-govt.com",
          "prisons.punjab.pk-govt.com",
          "punjabpolice.gov.pk-govt.com",
          "sparrso.gov.bd.pk-govt.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/93.127.192.14/relations"
      ],
      "total": 27
    },
    {
      "counts": {
        "domain": 9
      },
      "first_seen": "2024-08-01",
      "indicators": {
        "domain": [
          "army.mil.bd.mofa-govlk.com",
          "geo.org.pk",
          "geopk.org",
          "gmail.com.mofa-govlk.com",
          "mod.gov.bd.mofa-govlk.com",
          "mofa-govlk.com",
          "mofa.gov.bd.mofa-govlk.com",
          "pmo.gov.bd.mofa-govlk.com",
          "sparrso.gov.bd.mofa-govlk.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/193.29.57.101/relations"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-07-30",
      "indicators": {
        "domain": [
          "management.xuzeest.buzz",
          "xuzeest.buzz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1818267844972306610",
        "https://www.virustotal.com/gui/file/6842aee028eaa07af8e8eba41bef019aee72fe245ca86be39efd2df883b2402c/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2024-07-26",
      "indicators": {
        "domain": [
          "leave.portdedjibouti.live",
          "notice.portdedjibouti.live",
          "portdedjibouti.live",
          "wwww.notice.portdedjibouti.live",
          "wwww.portdedjibouti.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/wa1Ile/status/1816718243123593410",
        "https://www.virustotal.com/gui/ip-address/5.255.112.244/relations",
        "https://www.virustotal.com/gui/file/b8294a2038c3e79a06ad1f35c1083edaa6591b393f8bba681384a103734c27e9/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-07-19",
      "indicators": {
        "domain": [
          "mora.pdfadobe.com",
          "pdfadobe.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/suyog41/status/1814216605414351325",
        "https://www.virustotal.com/gui/ip-address/5.255.113.149/relations",
        "https://www.virustotal.com/gui/file/c4627139cab65aed8b7639006fa4848516f5681dca4ddf483fd27aa2e9f645c2/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-07-19",
      "indicators": {
        "domain": [
          "heatwave.paknavy.store",
          "paknavy.store"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/suyog41/status/1814216605414351325",
        "https://www.virustotal.com/gui/file/005188f4c96d1f996e260d4cd1f6cb51de8c02654520673506976004203328cc/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-07-16",
      "indicators": {
        "domain": [
          "mofa-filetransfer.servehttp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/RedDrip7/status/1813049510601630031",
        "https://www.virustotal.com/gui/file/15081f25bd44b8591d2895c33db7c238b6d52ffb5fbeb235b62d52e681c99249/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-07-11",
      "indicators": {
        "domain": [
          "dgps-govtpk.com",
          "reports.dgps-govtpk.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1811134839598326198",
        "https://www.virustotal.com/gui/ip-address/5.230.35.199/relations",
        "https://www.virustotal.com/gui/file/9572312a12605c6a6ea6447af6fc063f4196aeba523ed38ce2c5ff51c33d4831/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 4,
        "url_path": 1
      },
      "first_seen": "2024-07-05",
      "indicators": {
        "domain": [
          "investigation04.session-out.com",
          "policy.session-out.com",
          "salary-cutting.session-out.com",
          "session-out.com"
        ],
        "url_path": [
          "/fbd901_harassment/"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/89.150.40.43/relations",
        "https://www.virustotal.com/gui/file/512a83f1a6c404cb0ba679c7a2f3aa782bb5e17840d31a034de233f7500a6cb9/detection",
        "https://www.virustotal.com/gui/file/b72ac58d599e6e1080251b1ac45a521b33c08d7d129828a4e82a7095e9f93e53/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-06-21",
      "indicators": {
        "domain": [
          "mailarmylk.mods.email"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/ginkgo_g/status/1801540845797315055",
        "https://x.com/Joseliyo_Jstnk/status/1804112721408835817",
        "https://www.virustotal.com/gui/ip-address/91.223.208.175/relations",
        "https://www.virustotal.com/gui/file/c87e8d369a9718304e253ebe24da5267bf3a39f0b456c4191029b6be4bc04a42/detection",
        "https://www.virustotal.com/gui/file/57d761453bbc6ba9ace467f4491d7a19b9c7e097f81d9772efbcd2f43ada4dce/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2024-06-14",
      "indicators": {
        "domain": [
          "mailnepalarmymil.mods.email",
          "mods.email",
          "premier.mods.email"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/ginkgo_g/status/1801540845797315055",
        "https://x.com/Joseliyo_Jstnk/status/1804112721408835817",
        "https://www.virustotal.com/gui/ip-address/91.223.208.175/relations",
        "https://www.virustotal.com/gui/file/c87e8d369a9718304e253ebe24da5267bf3a39f0b456c4191029b6be4bc04a42/detection",
        "https://www.virustotal.com/gui/file/57d761453bbc6ba9ace467f4491d7a19b9c7e097f81d9772efbcd2f43ada4dce/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-06-07",
      "indicators": {
        "domain": [
          "mofa-gov-pk.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/76.223.105.230/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2024-05-28",
      "indicators": {
        "domain": [
          "dirctt88.co",
          "mfa-gov-lk.dirctt88.co",
          "moto.dirctt88.co",
          "office.dirctt88.co",
          "sp-nepalembassy-gov-np.dirctt88.co",
          "sparrso-gov-bd.dirctt88.co",
          "www-army-mil-bd.dirctt88.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/uslss_etr/status/1795534272725713221",
        "https://www.virustotal.com/gui/ip-address/46.183.187.190/relations",
        "https://www.virustotal.com/gui/file/ceb93ee3093dbf1a49918ede81055018d9c0f0945a97f904a16951010cfbce61/detection"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 28
      },
      "first_seen": "2024-05-23",
      "indicators": {
        "domain": [
          "amazonas-gov.co",
          "cabinet-download-server.top",
          "cnsa-gov.com",
          "ctd.govt-pk.com",
          "documents-server-pk.top",
          "ecp.govt-pk.com",
          "embajadadenepal.es.govt-pk.com",
          "ep-gov-pk.christmas",
          "ep-gov-pk.icu",
          "gov-govpk.info",
          "goverment-pk-update.top",
          "justice-gov.info",
          "mail-govpk.com",
          "mod-gov-pk.live",
          "mohre-gov.info",
          "moma-gov-pk.org",
          "my-gov-confirm.org",
          "nadra-govpk.com",
          "ncsc-gov.com",
          "newmofa.org",
          "nitb-update-services.top",
          "pakistan-mofa.cloud",
          "paknavy-govpk.com",
          "pmo.documents-server-pk.top",
          "pta-govpk.com",
          "s3-network-pakistan.online",
          "services-pk-users.top",
          "update-govpk.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.embeeresearch.io/advanced-guide-to-infrastructure-analysis-tracking-apt-sidewinder-domains/"
      ],
      "total": 28
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-05-13",
      "indicators": {
        "domain": [
          "packageupdates.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/suyog41/status/1768558626929860749",
        "https://twitter.com/k3yp0d/status/1789806184175685805",
        "https://www.virustotal.com/gui/ip-address/146.70.157.120/detection",
        "https://www.virustotal.com/gui/ip-address/146.70.80.58/detection",
        "https://www.virustotal.com/gui/file/92145633823ed4a4c56915ab81f6bc0582fd27700d8515400edd0a153d39829f/detection",
        "https://www.virustotal.com/gui/file/736315462b91943de9df6210db3bb52564982dd6c758d06ea79e3a404548569b/detection",
        "https://www.virustotal.com/gui/file/6e4a4d25c2e8f5bacc7e0f1c8b538b8ad61571266f271cfdfc14725b3be02613/detection",
        "https://www.virustotal.com/gui/file/316e01b962bf844c3483fce26ff3b2d188338034b1dbd41f15767b06c6e56041/detection",
        "https://www.virustotal.com/gui/file/2f5f44863048243c1bbec6e16b1c0902f8c61d61fdb8277f5c514b2f04ce8993/detection",
        "https://www.virustotal.com/gui/file/2027a5acbfea586f2d814fb57a97dcfce6c9d85c2a18a0df40811006d74aa7e3/detection",
        "https://www.virustotal.com/gui/file/3e35834b72b475952ae60ea8479ebe3638e204df414a838dfe143081f6729d8e/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 15,
        "ipv4": 12
      },
      "first_seen": "2024-05-09",
      "indicators": {
        "domain": [
          "aliyum.org",
          "amarsonarbangla123.dgps-govpk.co",
          "api.crypto-wise.co",
          "appclub.live",
          "bangladeshnavy.dgps-govpk.co",
          "crypto-wise.co",
          "dgps-govpk.co",
          "emv1.crypto-wise.co",
          "jupyt.tech",
          "mailotloc.aliyum.org",
          "mailotlook.aliyum.org",
          "mta-sts.crypto-wise.co",
          "ntcpak.live",
          "office.ntcpak.live",
          "tsinghua-edu.tech"
        ],
        "ipv4": [
          "193.200.16.230:443",
          "5.230.40.141:443",
          "5.230.42.202:443",
          "5.230.43.203:443",
          "5.230.52.133:443",
          "5.230.54.162:443",
          "5.230.54.63:443",
          "5.230.55.29:443",
          "5.230.70.181:443",
          "5.230.71.148:443",
          "5.230.74.96:443",
          "5.230.77.142:443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Cyberteam008/status/1788436206528680124",
        "https://pastebin.com/vPLMDA1U"
      ],
      "total": 27
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-05-09",
      "indicators": {
        "domain": [
          "dgps-govpk.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/98.142.254.94/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-05-09",
      "indicators": {
        "domain": [
          "dgps-govpk.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/98.142.254.83/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-05-09",
      "indicators": {
        "domain": [
          "libqstur.tech"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/5.230.73.238/relations1"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 21
      },
      "first_seen": "2024-05-08",
      "indicators": {
        "domain": [
          "amigos.govt-pk.com",
          "bd.govt-pk.com",
          "dfd-punjab.govt-pk.com",
          "dfd.punjab.govt-pk.com",
          "gov.pk.govt-pk.com",
          "govt-pk.com",
          "ics.govt-pk.com",
          "ics1.govt-pk.com",
          "investinnepal.gov.np.govt-pk.com",
          "lgcd.punjab.gov.pk.govt-pk.com",
          "medicalbillers.govt-pk.com",
          "mindef.gov.pk.govt-pk.com",
          "mod.gov.bd.govt-pk.com",
          "mod.gov.np.govt-pk.com",
          "mofa.gov.bd.govt-pk.com",
          "mofa.gov.np.govt-pk.com",
          "np.govt-pk.com",
          "oidc.idp.elogin.att.govt-pk.com",
          "prisons.punjab.govt-pk.com",
          "pubad.gov.lk.govt-pk.com",
          "sparrso.gov.bd.govt-pk.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/alex_lanstein/status/1788200111966658963",
        "https://pastebin.com/5tvyLKZM"
      ],
      "total": 21
    },
    {
      "counts": {
        "domain": 15
      },
      "first_seen": "2024-05-08",
      "indicators": {
        "domain": [
          "bd.govt-net.com",
          "com.govt-net.com",
          "fia-govt-net.com.govt-net.com",
          "fia.govt-net.com",
          "gov.bd.govt-net.com",
          "gov.lk.govt-net.com",
          "gov.np.govt-net.com",
          "govt-net.com",
          "lk.govt-net.com",
          "mfa.gov.lk.govt-net.com",
          "mofa.gov.bd.govt-net.com",
          "mofa.gov.lk.govt-net.com",
          "mofa.gov.np.govt-net.com",
          "np.govt-net.com",
          "ptdi.govt-net.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ValidinLLC/status/1788210860017553882"
      ],
      "total": 15
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-05-08",
      "indicators": {
        "domain": [
          "mail.mofa-govtpk.com",
          "mofa-govtpk.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/mal_analysis136/status/1788219355446075756",
        "https://www.virustotal.com/gui/ip-address/84.32.84.33/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-05-08",
      "indicators": {
        "domain": [
          "dowmload.org",
          "efes-mindef-gov-pk.dowmload.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/alex_lanstein/status/1788203426020499698",
        "https://www.virustotal.com/gui/file/006e5fe0c01712391c54319a9d1579d7208f3cfa9f49fe56a14d93f0d0e8928b/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-04-30",
      "indicators": {
        "domain": [
          "docs.mofa-services-server.top",
          "mofa-services-server.top"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/doc_guard/status/1785422860741202184",
        "https://www.virustotal.com/gui/file/8a6e381ab6f1d2ab74e3ee232680d5991c9f751241a6a0c3f0d9082d2cf61a05/detection",
        "https://app.docguard.io/23f3a046884bf94ec706f98000a9efbda48455b4dd86f0665409937b1fb811cb/112148fa-67fb-4646-8dcd-9007ddf87e00/0/results/dashboard"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2024-04-29",
      "indicators": {
        "domain": [
          "gwadarport.gov.jzbnco.com",
          "gwadarport.gov.packetfilters.org",
          "gwadarport.gov.pk.migkua.com",
          "gwadarport.gov.pk.rankglobe.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/8.218.5.63/relations"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-04-29",
      "indicators": {
        "domain": [
          "commerce-gov-in.iima.remotexs.in"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/alex_lanstein/status/1775623052941799483",
        "https://blog.strikeready.com/blog/rattling-the-cage-of-a-sidewinder/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2024-04-12",
      "indicators": {
        "domain": [
          "com.pakchinavest.info",
          "gwadarport.ddns.net",
          "investgov.info",
          "mail.investgov.info",
          "pakchinainvest.com.pakchinavest.info",
          "pakchinavest.info",
          "webmail.pakchinainvest.com.pakchinavest.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/8.218.5.63/relations"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-04-12",
      "indicators": {
        "domain": [
          "mofa-gov-qa.srvssl.cf",
          "srvssl.cf"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/185.82.22.193/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 34
      },
      "first_seen": "2024-04-04",
      "indicators": {
        "domain": [
          "bd.gov-co.org",
          "com.gov-co.org",
          "defence.lk.gov-co.org",
          "e-mopf.gov.mm.gov-co.org",
          "finance.gov.mv.gov-co.org",
          "for.gov-co.org",
          "foreign.gov.mv.gov-co.org",
          "gov-co.org",
          "gov.bd.gov-co.org",
          "gov.mm.gov-co.org",
          "gov.np.gov-co.org",
          "health.gov.lk.gov-co.org",
          "health.gov.mv.gov-co.org",
          "immigration.gov.np.gov-co.org",
          "lk.gov-co.org",
          "mfa.gov.lk.gov-co.org",
          "mil.np.gov-co.org",
          "mod.gov.np.gov-co.org",
          "mofa.bd.gov-co.org",
          "mofa.gov.bd.gov-co.org",
          "mofa.gov.np.gov-co.org",
          "mv.gov-co.org",
          "myanmar.gov-co.org",
          "navy.lk.gov-co.org",
          "nepal.gov.np.gov-co.org",
          "nhsrc.pk.gov-co.org",
          "np.gov-co.org",
          "nugmyanmar.org.gov-co.org",
          "org.gov-co.org",
          "plandiv.gov.bd.gov-co.org",
          "po.gov.mv.gov-co.org",
          "presidentoffice.lk.gov-co.org",
          "pubsec.gov.lk.gov-co.org",
          "punjab-ministry-pk.com.gov-co.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/185.245.180.44/relations"
      ],
      "total": 34
    },
    {
      "counts": {
        "domain": 9
      },
      "first_seen": "2024-04-04",
      "indicators": {
        "domain": [
          "1.modp-pk.org",
          "gov.pk.1.modp-pk.org",
          "gov.pk.modp-pk.org",
          "mail.mofa.gov.pk.modp-pk.org",
          "modp-pk.org",
          "mofa.gov.pk.1.modp-pk.org",
          "mofa.gov.pk.modp-pk.org",
          "pk.1.modp-pk.org",
          "pk.modp-pk.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/47.74.10.112/relations"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2024-04-04",
      "indicators": {
        "domain": [
          "bd.govt-org.net",
          "gov.bd.govt-org.net",
          "gov.lk.govt-org.net",
          "govt-org.net",
          "lk.govt-org.net",
          "mod.gov.bd.govt-org.net",
          "mofa.gov.lk.govt-org.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/185.245.180.3/relations"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2024-04-04",
      "indicators": {
        "domain": [
          "cons.mofa.gov.pk-hq.qrrl.net",
          "gov.pk-hq.qrrl.net",
          "mofa.gov.pk-hq.qrrl.net",
          "pk-hq.qrrl.net",
          "qrrl.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/77.95.113.16/relations"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2024-04-04",
      "indicators": {
        "domain": [
          "2let.org",
          "cons.mofa.gov.pk.2let.org",
          "gov.pk.2let.org",
          "mofa.gov.pk.2let.org",
          "pk.2let.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/109.70.148.47/relations"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2024-04-04",
      "indicators": {
        "domain": [
          "gov.lk.govt-org.com",
          "govt-org.com",
          "lk.govt-org.com",
          "mfa.gov.lk.govt-org.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/84.32.84.32/relations"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2024-04-04",
      "indicators": {
        "domain": [
          "emaiil.co",
          "gov.pk.emaiil.co",
          "mod.gov.pk.emaiil.co",
          "pk.emaiil.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/104.219.248.111/relations"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2024-04-04",
      "indicators": {
        "domain": [
          "gov.pk-hqr-online.co",
          "mofa.gov.pk-hqr-online.co",
          "pk-hqr-online.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/3.33.130.190/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2024-04-04",
      "indicators": {
        "domain": [
          "mail.mofa-gov-qa.gq",
          "mofa-gov-qa.gq",
          "webmail.mofa-gov-qa.gq"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/185.82.22.193/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2024-04-04",
      "indicators": {
        "domain": [
          "ai.mofagov.online",
          "mofagov.online",
          "server.mofagov.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/134.209.86.200/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-04-04",
      "indicators": {
        "domain": [
          "mofa-gov-bd-mailll.rf.gd",
          "mofa-gov-pk-download.rf.gd"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/185.27.134.55/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-04-04",
      "indicators": {
        "domain": [
          "mofa-gov-pk-foreignministry-documents.timeoflahore.com",
          "timeoflahore.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/185.212.70.84/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-04-04",
      "indicators": {
        "domain": [
          "mail.mofa-gov-qa.ml",
          "mofa-gov-qa.ml"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/128.199.145.180/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-04-04",
      "indicators": {
        "domain": [
          "mofagovpk.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/208.109.19.101/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-04-04",
      "indicators": {
        "domain": [
          "mofa-gov-pk.rf.gd"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/185.27.134.33/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-04-04",
      "indicators": {
        "domain": [
          "mofa-gov-mail-view-pk.rf.gd"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/185.27.134.222/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-04-04",
      "indicators": {
        "domain": [
          "mofa-gov-msg-view.rf.gd"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/185.27.134.151/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-04-04",
      "indicators": {
        "domain": [
          "mofa-gov-pk.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/185.151.30.193/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-04-04",
      "indicators": {
        "domain": [
          "mofa-gov-pk.pages.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/172.66.47.59/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 33
      },
      "first_seen": "2024-04-03",
      "indicators": {
        "domain": [
          "afmat.tech",
          "aliyumm.tech",
          "almightyallah.live",
          "ausibedu.org",
          "boket.tech",
          "btud.live",
          "commerce-gov-pk.directt888.com",
          "comptes.tech",
          "dafpak.org",
          "defenec.net",
          "detru.info",
          "directt888.com",
          "download-file.net",
          "dynat.tech",
          "gebre.tech",
          "mailrta.mfagov.org",
          "mfa-govt.net",
          "mfacom.org",
          "mofa-gov-pk.directt888.com",
          "moittpk.org",
          "msacn.ntcpk.net",
          "newoutlook.live",
          "ntcpk.info",
          "ntcpk.net",
          "numpy.info",
          "paknavy-gov.org",
          "pnscpk.com",
          "sarabanmithnavy.tni-mil.com",
          "sezti.org",
          "tni-mil.com",
          "tni-mil.org",
          "tnial-mil.net",
          "training.detru.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/alex_lanstein/status/1775623052941799483",
        "https://blog.strikeready.com/blog/rattling-the-cage-of-a-sidewinder/"
      ],
      "total": 33
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-04-03",
      "indicators": {
        "domain": [
          "mfa-gov.cc"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/91.195.240.12/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2024-04-01",
      "indicators": {
        "domain": [
          "mail.moe-gov-ae.info",
          "mail.mofa-gov-ae.info",
          "mail.mofagov-sa.info",
          "moe-gov-ae.info",
          "mofa-gov-ae.info",
          "mofagov-sa.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/93.183.74.8/relations"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2024-04-01",
      "indicators": {
        "domain": [
          "cabint-division-pk.fia-gov.com",
          "ctd2.police.fia-gov.com",
          "police.fia-gov.com",
          "sindh.police.fia-gov.com",
          "vpn.fia-gov.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ginkgo_g/status/1774639942628761827",
        "https://www.virustotal.com/gui/file/0fa00d4f4f8e8449883aef7f0459a0fb754d57d55af2b41f5e445f867000fa70/detection",
        "https://www.virustotal.com/gui/file/85d5c21050bd72c4ee02060d0be234ac35babc785567dca5bfc1d299150576b7/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2024-04-01",
      "indicators": {
        "domain": [
          "mail-sco-gov-pk.mil-bd.workers.dev",
          "mailbaf.mil-bd.workers.dev",
          "mil-bd.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/172.67.143.200/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "ipv4": 3
      },
      "first_seen": "2024-04-01",
      "indicators": {
        "ipv4": [
          "64.46.102.122:8443",
          "64.46.102.26:443",
          "64.46.102.63:8443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Cyberteam008/status/1774703213390057829"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-04-01",
      "indicators": {
        "domain": [
          "mai1-sco-gov-pk-sdf.rf.gd"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/185.27.134.221/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-04-01",
      "indicators": {
        "domain": [
          "ptcl-gov.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/185.174.135.4/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-04-01",
      "indicators": {
        "domain": [
          "ptcl-govp.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.group-ib.com/blog/hunting-sidewinder/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2024-03-29",
      "indicators": {
        "domain": [
          "mail.punjabgov.org",
          "punjabgov.org",
          "submitsurvey.info",
          "surveyofpakistan.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Cyberteam008/status/1773587888279630292",
        "https://www.virustotal.com/gui/ip-address/103.151.111.61/relations",
        "https://www.virustotal.com/gui/ip-address/142.202.191.187/relations",
        "https://www.virustotal.com/gui/ip-address/91.92.252.90/relations",
        "https://www.virustotal.com/gui/ip-address/94.156.65.165/relations"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-03-29",
      "indicators": {
        "domain": [
          "paknavy.cloud",
          "paknavy.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/46.17.175.230/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-03-29",
      "indicators": {
        "domain": [
          "mail-np.net",
          "paknavy-gov-pk.mail-np.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/198.54.116.197/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-03-29",
      "indicators": {
        "domain": [
          "moitt.paknavy-govpk.info",
          "paknavy-govpk.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/alex_lanstein/status/1773817732426863037",
        "https://www.virustotal.com/gui/file/7dca552bc38f54716c80eb2c4f1f35cf6e5b12a78a5cec8bf335453c1b433cfd/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-03-29",
      "indicators": {
        "domain": [
          "paknavy.tech"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/84.32.84.32/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-03-29",
      "indicators": {
        "domain": [
          "paknavy-govpk.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/79.141.165.199/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-03-29",
      "indicators": {
        "domain": [
          "paknavy-govpk.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/109.106.251.65/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-03-29",
      "indicators": {
        "domain": [
          "mofagovpk.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/domain/mofagovpk.info/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-03-28",
      "indicators": {
        "domain": [
          "mailcn.163inc.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ginkgo_g/status/1768477798191263970",
        "https://twitter.com/suyog41/status/1773224136095023435",
        "https://www.virustotal.com/gui/file/31b558d79c20b2d18f404096532156e2a25dff5626589a0b27404f359dc9e8db/detection",
        "https://www.virustotal.com/gui/file/0b917833380d87990413d318ecd7ed08710d07aedc1d39b749256530c32f2ca9/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1,
        "url_path": 2
      },
      "first_seen": "2024-03-15",
      "indicators": {
        "domain": [
          "syncscheduler.com"
        ],
        "url_path": [
          "/r3diRecT/redirector/",
          "/r3diRecT/redirector/proxy.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/suyog41/status/1768558626929860749",
        "https://twitter.com/k3yp0d/status/1789806184175685805",
        "https://www.virustotal.com/gui/ip-address/146.70.157.120/detection",
        "https://www.virustotal.com/gui/ip-address/146.70.80.58/detection",
        "https://www.virustotal.com/gui/file/92145633823ed4a4c56915ab81f6bc0582fd27700d8515400edd0a153d39829f/detection",
        "https://www.virustotal.com/gui/file/736315462b91943de9df6210db3bb52564982dd6c758d06ea79e3a404548569b/detection",
        "https://www.virustotal.com/gui/file/6e4a4d25c2e8f5bacc7e0f1c8b538b8ad61571266f271cfdfc14725b3be02613/detection",
        "https://www.virustotal.com/gui/file/316e01b962bf844c3483fce26ff3b2d188338034b1dbd41f15767b06c6e56041/detection",
        "https://www.virustotal.com/gui/file/2f5f44863048243c1bbec6e16b1c0902f8c61d61fdb8277f5c514b2f04ce8993/detection",
        "https://www.virustotal.com/gui/file/2027a5acbfea586f2d814fb57a97dcfce6c9d85c2a18a0df40811006d74aa7e3/detection",
        "https://www.virustotal.com/gui/file/3e35834b72b475952ae60ea8479ebe3638e204df414a838dfe143081f6729d8e/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-03-15",
      "indicators": {
        "domain": [
          "163inc.org",
          "mailafdgovbd.163inc.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ginkgo_g/status/1768477798191263970",
        "https://twitter.com/suyog41/status/1773224136095023435",
        "https://www.virustotal.com/gui/file/31b558d79c20b2d18f404096532156e2a25dff5626589a0b27404f359dc9e8db/detection",
        "https://www.virustotal.com/gui/file/0b917833380d87990413d318ecd7ed08710d07aedc1d39b749256530c32f2ca9/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-03-08",
      "indicators": {
        "domain": [
          "moemaldives.pmd-office.com",
          "pmd-office.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/RedDrip7/status/1765935716964675683",
        "https://www.virustotal.com/gui/file/ae22f9da201032d007a0b3f54c3a53ea7a41292bba6e9855d48dd21b55c048ae/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-03-07",
      "indicators": {
        "domain": [
          "mailmofagovmm.mofa.email",
          "mofa.email"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Joseliyo_Jstnk/status/1765727342263988567",
        "https://www.virustotal.com/gui/file/acbfbf6fd00fa347a52657e5ca0f5cc6cbcf197a04e2d3fd5dc9235926b319d7/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-03-06",
      "indicators": {
        "domain": [
          "finance-gov-pk.rf.gd"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Joseliyo_Jstnk/status/1765304025358954689",
        "https://www.virustotal.com/gui/file/4d8ef13543182fdc5cd5bb270878bcac80b77ac7c3e566c0934450e35141ece0/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 14
      },
      "first_seen": "2024-03-04",
      "indicators": {
        "domain": [
          "cpanel-nha-gov-pk.pakistan-gov-pk.workers.dev",
          "mail-asian-parliament-org.pakistan-gov-pk.workers.dev",
          "mail-depo-gov-pk.government-pak.workers.dev",
          "mail-hit-gov-pk.government-pak.workers.dev",
          "mail-hitgovpk.government-pak.workers.dev",
          "mail-kpt-gov-pk.pak-gov-pk.workers.dev",
          "mail-mofa-gov-pk.pakistan-gov-pk.workers.dev",
          "mail-nba-gov-pk.pakistan-gov-pk.workers.dev",
          "mail-pof-gov-pk.government-pak.workers.dev",
          "mail-ppra-org-pk.pakistan-gov-pk.workers.dev",
          "mail-sco-gov-pk.government-pak.workers.dev",
          "nha-gov-pk.pakistan-gov-pk.workers.dev",
          "webmail-wapda-gov-pk.pakistan-gov-pk.workers.dev",
          "worker-plain-wind-01a9.pakistan-gov-pk.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/172.67.137.37/relations",
        "https://www.virustotal.com/gui/ip-address/172.67.184.202/relations",
        "https://www.virustotal.com/gui/ip-address/172.67.215.149/relations"
      ],
      "total": 14
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-03-04",
      "indicators": {
        "domain": [
          "mail-punjab-gov-pk.ntc-telecomcorporation.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/nahamike01/status/1747167370190458924"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-02-29",
      "indicators": {
        "domain": [
          "webmail-pacorgpk.myvnc.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/47.236.119.146/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2024-02-28",
      "indicators": {
        "domain": [
          "govnp.live",
          "mailmofa.govnp.live",
          "mofa.govnp.live",
          "opmcm.govnp.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/82.180.175.87/relations"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2024-02-28",
      "indicators": {
        "domain": [
          "govtpak.workers.dev",
          "mail-depo-gov-pk.govtpak.workers.dev",
          "mail-hitgovpk.govtpak.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/172.67.135.224/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-02-28",
      "indicators": {
        "domain": [
          "mailmofa.newmofa.com",
          "newmofa.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1762874221493879011",
        "https://www.virustotal.com/gui/file/df2be2327ed0062cba45a3f85378d0d386500ffcae20ed155ca106854d706325/detection",
        "https://www.virustotal.com/gui/file/525b00fc379589a73ebd6471e440220c886b969332360e17fb44d5175b3d945e/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2024-02-27",
      "indicators": {
        "domain": [
          "126-com.live",
          "mailarmylk.126-com.live",
          "spark.126-com.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/malwrhunterteam/status/1762199010062766152",
        "https://www.virustotal.com/gui/ip-address/91.193.18.108/relations",
        "https://www.virustotal.com/gui/file/13dafd14c85aee3ed60ec25284ba39d6ecdd7ddf4b484d2048efc05960da51e2/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-02-26",
      "indicators": {
        "domain": [
          "mof-govn.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/185.166.188.146/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2024-02-25",
      "indicators": {
        "domain": [
          "cons-mofagovpk.servehttp.com",
          "mail-armybd.servehttp.com",
          "mailtest-mofa.servehttp.com",
          "rewards-ptclnetpk.servehttp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/__0XYC__/status/1664581189766610944",
        "https://twitter.com/uslss_etr/status/1664705054069215252",
        "https://www.virustotal.com/gui/ip-address/8.208.90.73/relations"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 10
      },
      "first_seen": "2024-02-23",
      "indicators": {
        "domain": [
          "ideas2024-pakistan.myvnc.com",
          "ideaspakistan-govpk.myvnc.com",
          "iportal-ntdcgovpk.myvnc.com",
          "mail-armylk.myvnc.com",
          "mail-armylk.servehalflife.com",
          "mail-hitgovpk.myvnc.com",
          "mail-hitgovpk.servehttp.com",
          "meter-ntdccompk.myvnc.com",
          "meter-ntdccompk.servehttp.com",
          "pertest-ntdccompk.ddnsking.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/47.250.57.207/relations"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2024-02-23",
      "indicators": {
        "domain": [
          "203-124351878443.hopto.org",
          "mail-bafmilbd.myvnc.com",
          "mail-depogovpk.myvnc.com",
          "mailhit-govpk.hopto.org",
          "mailpsab-modgovpk.hopto.org",
          "mailsco-govpk.hopto.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/47.236.119.146/relations"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2024-02-23",
      "indicators": {
        "domain": [
          "g0v-pk.net",
          "mail.dgdp.gov.pk.pujfjue003hmdhfh99ppjdflsdqwlkls.g0v-pk.net",
          "mail.paf.gov.pk.pujfjue003hmdhfh99ppjdflsdqwlkls.g0v-pk.net",
          "mail.sco.gov.pk.pujfjue003hmdhfh99ppjdflsdqwlkls.g0v-pk.net",
          "pujfjue003hmdhfh99ppjdflsdqwlkls.g0v-pk.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/domain/g0v-pk.net/relations"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2024-02-23",
      "indicators": {
        "domain": [
          "crypton0019.workers.dev",
          "mail-sco-gov-pk.crypton0019.workers.dev",
          "worker-crimson-bread-052d.crypton0019.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/172.67.194.69/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-02-23",
      "indicators": {
        "domain": [
          "mail-hitgovpk.servegame.com",
          "mailsco-govpk.myvnc.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/8.208.11.212/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-02-23",
      "indicators": {
        "domain": [
          "mail-pofgovpk.3utilities.com",
          "mail-pofgovpk.sytes.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/47.236.248.66/relations",
        "https://www.virustotal.com/gui/ip-address/47.88.26.202/relations",
        "https://www.virustotal.com/gui/ip-address/8.211.192.22/relations",
        "https://www.virustotal.com/gui/ip-address/8.222.232.191/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-02-23",
      "indicators": {
        "domain": [
          "ethanhunthero125.workers.dev",
          "mail-pc-gov-pk-login.ethanhunthero125.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/172.67.133.19/relations",
        "https://www.virustotal.com/gui/ip-address/172.67.194.69/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2024-02-21",
      "indicators": {
        "domain": [
          "government-pak.workers.dev",
          "mail-mod-gov-pk.pakistan-gov-pk.workers.dev",
          "mail-modp-gov-pk.government-pak.workers.dev",
          "mail-modp-gov-pk.pak-gov-pk.workers.dev",
          "pak-gov-pk.workers.dev",
          "pakistan-gov-pk.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/172.67.137.37/relations",
        "https://www.virustotal.com/gui/ip-address/172.67.184.202/relations",
        "https://www.virustotal.com/gui/ip-address/172.67.215.149/relations"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-02-20",
      "indicators": {
        "domain": [
          "kr-i-sas-orv-e-l-a.workers.dev",
          "mail-gwadarport-gov-pk.kr-i-sas-orv-e-l-a.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/104.21.29.219/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2024-02-19",
      "indicators": {
        "domain": [
          "gwadarport-gov-pk.gwadarportt.workers.dev",
          "gwadarportt.workers.dev",
          "mail-invest-gov-pk.gwadarportt.workers.dev",
          "mail-nespak-com-pk.gwadarportt.workers.dev",
          "webmail-gda-gov-pk.gwadarportt.workers.dev",
          "worker-orange-unit-abfb.gwadarportt.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/172.67.192.82/relations"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2024-02-18",
      "indicators": {
        "domain": [
          "elccorp-net.ntc-telecomcorporation.workers.dev",
          "mail-ecp-gov-pk.ntc-telecomcorporation.workers.dev",
          "mail-gwadarport-gov-pk.ntc-telecomcorporation.workers.dev",
          "mail-sco-gov-pk.ntc-telecomcorporation.workers.dev",
          "news.ntc-telecomcorporation.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/nahamike01/status/1747167370190458924"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2024-02-18",
      "indicators": {
        "domain": [
          "finance-govnp.servehalflife.com",
          "mail-ntcgovpk.servehttp.com",
          "mail-scogovpk.servehttp.com",
          "mof-govnp.servehttp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/147.139.145.19/relations"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-02-18",
      "indicators": {
        "domain": [
          "discounts-ptclnetpk.servehttp.com",
          "rewards-ptclnetpk.viewdns.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/47.236.248.66/relations",
        "https://www.virustotal.com/gui/ip-address/47.88.26.202/relations",
        "https://www.virustotal.com/gui/ip-address/8.211.192.22/relations",
        "https://www.virustotal.com/gui/ip-address/8.222.232.191/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-02-11",
      "indicators": {
        "domain": [
          "vibe-ptclnetpk.viewdns.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/147.139.140.175/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 16
      },
      "first_seen": "2024-02-10",
      "indicators": {
        "domain": [
          "advisory-cabinetgpk.servehttp.com",
          "circular-financegov.servehalflife.com",
          "eservice-ptclnetpk.servehttp.com",
          "finance-govpk.serveblog.net",
          "hrmis-financegovpk.serveftp.com",
          "mail-depogovpk.servehttp.com",
          "mail-modgovpk.servehttp.com",
          "mail-mofagovpk.ddns.net",
          "mail-mofagovpk.gotdns.ch",
          "mail-mofagovpk.myddns.me",
          "nanfung.servehttp.com",
          "newmail-armymilbd.servehttp.com",
          "offers-ptclnetpk.serveblog.net",
          "ogdcl.servehttp.com",
          "piac-compk.servehttp.com",
          "portal-ptclnetpk.servehttp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/47.236.243.41/relations",
        "https://www.virustotal.com/gui/ip-address/47.74.85.109/relations",
        "https://www.virustotal.com/gui/ip-address/8.209.221.234/relations"
      ],
      "total": 16
    },
    {
      "counts": {
        "domain": 13
      },
      "first_seen": "2024-02-10",
      "indicators": {
        "domain": [
          "awards-piacaero.servehalflife.com",
          "awards-piacaero.servehttp.com",
          "mail-bafmilbd.servequake.com",
          "mail-dgdpgovpk.servehalflife.com",
          "mail-mofapk.servehttp.com",
          "mail-scogovpk.servehalflife.com",
          "mailhitgovpk.servehalflife.com",
          "news-ptvcompk.servehttp.com",
          "offer-ptclnetpk.servehttp.com",
          "offers-ptclnetpk.serveftp.com",
          "offers-ptclnetpk.serveirc.com",
          "sharepakistan-mofa.viewdns.net",
          "support-ntc.servehttp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/47.236.248.66/relations",
        "https://www.virustotal.com/gui/ip-address/47.88.26.202/relations",
        "https://www.virustotal.com/gui/ip-address/8.211.192.22/relations",
        "https://www.virustotal.com/gui/ip-address/8.222.232.191/relations"
      ],
      "total": 13
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2024-02-10",
      "indicators": {
        "domain": [
          "cap-mofapk.servehttp.com",
          "finance-govpk.serveftp.com",
          "financegovpk.servehttp.com",
          "navy-govbd.servehttp.com",
          "sdmx-financegovpk.servehttp.com",
          "vibe-ptclnetpk.servehttp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/8.208.92.59/relations"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-02-10",
      "indicators": {
        "domain": [
          "cap-mofagovpk.servehttp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/47.236.243.41/relations",
        "https://www.virustotal.com/gui/ip-address/47.74.85.109/relations",
        "https://www.virustotal.com/gui/ip-address/8.209.221.234/relations",
        "https://www.virustotal.com/gui/ip-address/8.208.92.59/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 16
      },
      "first_seen": "2024-02-02",
      "indicators": {
        "domain": [
          "gov-pk.online",
          "mail-ead.gov-pk.online",
          "mail-mowr.gov-pk.online",
          "mail-ntc.gov-pk.online",
          "mail-pc.gov-pk.online",
          "mail-sco.gov-pk.online",
          "mofa.gov-pk.online",
          "ntc.gov-pk.online",
          "ntcmail.gov-pk.online",
          "paec.gov-pk.online",
          "pc.gov-pk.online",
          "pnra.gov-pk.online",
          "pta.gov-pk.online",
          "sco.gov-pk.online",
          "suparco.gov-pk.online",
          "tdap.gov-pk.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/domain/gov-pk.online/relations"
      ],
      "total": 16
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2024-02-02",
      "indicators": {
        "domain": [
          "mail-mofagovpk.servehttp.com",
          "ntc-govpk.servehalflife.com",
          "taxsys-fbrgovpk.servehttp.com",
          "vpn-ptclnetpk.servehalflife.com",
          "vpn-ptclnetpk.viewdns.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/47.90.210.26/relations"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2024-02-02",
      "indicators": {
        "domain": [
          "api.nr3c-govpk.com",
          "mailx.nr3c-govpk.com",
          "nr3c-govpk.com",
          "o.nr3c-govpk.com",
          "r.nr3c-govpk.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Joseliyo_Jstnk/status/1753385273587626057",
        "https://www.virustotal.com/gui/ip-address/81.171.7.136/relations",
        "https://www.virustotal.com/gui/ip-address/81.171.7.139/relations",
        "https://www.virustotal.com/gui/file/ae9ba351fdeb8f06173770682d0df4caef31774b3e0c8e25e2c998cd96e70fa8/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-02-02",
      "indicators": {
        "domain": [
          "fbrgov-pk.ddns.net",
          "fbrgov.ddns.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/51.195.146.204/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-02-02",
      "indicators": {
        "domain": [
          "diagov.ddns.net",
          "govaruba.duckdns.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/181.41.35.224/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-02-02",
      "indicators": {
        "domain": [
          "mofagovpk.cheematrd.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/65.108.198.252/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 11
      },
      "first_seen": "2024-01-30",
      "indicators": {
        "domain": [
          "backup.download-services.online",
          "blue.win-service-update.top",
          "download-services.online",
          "file.services-download.top",
          "files.pdf-download.live",
          "newfile.pdf-download.live",
          "pdf-download.live",
          "royalmigration.buzz",
          "services-download.top",
          "uk.royalmigration.buzz",
          "win-service-update.top"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/__0XYC__/status/1752238025269272906",
        "https://twitter.com/Cuser07/status/1752266296463667343",
        "https://www.virustotal.com/gui/file/4438df17d22e4df1b430788da31ae0c0f4826b0c9896d1fb7d225cff586f11ad/detection"
      ],
      "total": 11
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-01-30",
      "indicators": {
        "domain": [
          "mofa-gov-np.fia-gov.net",
          "nepalcert-org.fia-gov.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Cuser07/status/1738790090326061060",
        "https://twitter.com/Joseliyo_Jstnk/status/1740672426906927562",
        "https://www.virustotal.com/gui/ip-address/77.83.196.59/relations",
        "https://www.virustotal.com/gui/file/1a88ef58675971eb18eeb267b1be90594cd6c7ebddf1c67d66729fa3e68de323/detection",
        "https://www.virustotal.com/gui/file/a11fab6de2c5111833e9e4a6f69ce5dded17085a3d8ae21c7fcfa00d7e113c9b/detection",
        "https://www.virustotal.com/gui/file/b565bd60e9182746de76feeebe7f85902e22ee3a22d5d55a278be7340923806e/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-01-21",
      "indicators": {
        "domain": [
          "mail-modp-gov-pk.ntc-telecomcorporation.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/nahamike01/status/1747167370190458924"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 12
      },
      "first_seen": "2024-01-16",
      "indicators": {
        "domain": [
          "cpanel.govpk.live",
          "cpcalendars.govpk.live",
          "cpcontacts.govpk.live",
          "dirbspta.govpk.live",
          "ecp.govpk.live",
          "govpk.live",
          "mail.govpk.live",
          "mora.govpk.live",
          "ptcl.govpk.live",
          "verification.ptcl.govpk.live",
          "webdisk.govpk.live",
          "webmail.govpk.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/axon?find=*.govpk.live&type=dom"
      ],
      "total": 12
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2024-01-16",
      "indicators": {
        "domain": [
          "aop.gov-af.org",
          "arg.gov-af.org",
          "mail-nepalgovnp.zapto.org",
          "mail-nscgovaf.hopto.org",
          "techfriend.hopto.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.trendmicro.com/en_us/research/20/l/sidewinder-leverages-south-asian-territorial-issues-for-spear-ph.html",
        "https://www.virustotal.com/gui/ip-address/185.225.19.46/relations",
        "https://otx.alienvault.com/pulse/5fd10760f9afb730d37c4742"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2024-01-16",
      "indicators": {
        "domain": [
          "mail-depo-gov-pk.ntc-telecomcorporation.workers.dev",
          "mail-dgdp-gov-pk.ntc-telecomcorporation.workers.dev",
          "mail-hit-gov-pk.ntc-telecomcorporation.workers.dev",
          "mail-paf-gov-pk.ntc-telecomcorporation.workers.dev",
          "ntc-telecomcorporation.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/nahamike01/status/1747167370190458924"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2024-01-16",
      "indicators": {
        "domain": [
          "mail-mofa.myftp.org",
          "mail-mohs.myftp.org",
          "microsoftfp.hopto.org",
          "nitcgov-np.hopto.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/83.171.236.49/relations"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-01-15",
      "indicators": {
        "domain": [
          "alfalahtransct-bank.servehttp.com",
          "ogdclcloud-mysharep.servehalflife.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/k3yp0d/status/1727695607203078193",
        "https://app.validin.com/axon?find=47.74.90.0&type=ip",
        "https://app.validin.com/axon?find=47.74.90.10&type=ip"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 42
      },
      "first_seen": "2024-01-11",
      "indicators": {
        "domain": [
          "academy.lesporc.live",
          "agency.lesporc.live",
          "api.argus.trondheim.bama.zoopit.no",
          "cdn.awrah.live",
          "cdn.cpec.site",
          "cdn.dolper.top",
          "cdn.dr-doom.xyz",
          "cdn.gearfill.biz",
          "cdn.geoloc.top",
          "cdn.hread.live",
          "cdn.plors.tech",
          "cdn.preag.info",
          "cdn.preat.info",
          "cdn.prol.info",
          "cdn.verocal.info",
          "civil.leyra.tech",
          "csla.blesis.live",
          "density.meplor.xyz",
          "deputy.meplor.xyz",
          "direct888.org",
          "employ.fdrek.live",
          "energy.fdrek.live",
          "lax036.relay.arandomserver.com",
          "lesporc.live",
          "lnkly.net",
          "meplor.xyz",
          "mu-api.anyremote.cn",
          "mxhichina.info",
          "nextgen.fia-gov.net",
          "ns.seiffenn.nohost.me",
          "resolve.preat.info",
          "seiffenn.nohost.me",
          "tercom.site",
          "test.api.68wx.com",
          "test.api.g.luohu8.com",
          "test.api.hzy.68wx.com",
          "test.es.68wx.com",
          "toss.tercom.site",
          "trust-crypto.net",
          "wide.storeapp.site",
          "wind.ridlay.live",
          "xmpp-upload.seiffenn.nohost.me"
        ]
      },
      "precision": "exact",
      "references": [
        "https://medium.com/@fofabot/practical-fofa-asset-expansion-sidewinder-apt-389714a70061"
      ],
      "total": 42
    },
    {
      "counts": {
        "domain": 19
      },
      "first_seen": "2024-01-05",
      "indicators": {
        "domain": [
          "defence.lk.gov-org.net",
          "gov-org.net",
          "gov.lk.gov-org.net",
          "gov.mm.gov-org.net",
          "gov.mv.gov-org.net",
          "gov.np.gov-org.net",
          "immigration.gov.mv.gov-org.net",
          "lk.gov-org.net",
          "mfa.gov.lk.gov-org.net",
          "mm.gov-org.net",
          "mod.gov.np.gov-org.net",
          "mofa.gov.np.gov-org.net",
          "moha.gov.np.gov-org.net",
          "mohs.gov.mm.gov-org.net",
          "mv.gov-org.net",
          "navy.lk.gov-org.net",
          "np.gov-org.net",
          "po.gov.mv.gov-org.net",
          "presidentoffice.lk.gov-org.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Joseliyo_Jstnk/status/1743223664391160170",
        "https://www.virustotal.com/gui/ip-address/69.61.36.170/relations"
      ],
      "total": 19
    },
    {
      "counts": {
        "domain": 9
      },
      "first_seen": "2024-01-05",
      "indicators": {
        "domain": [
          "direct888.net",
          "mofa-gov-np.direct888.net",
          "mofa-gov-sa.direct888.net",
          "mopf-gov-mm.direct888.net",
          "navy-lk.direct888.net",
          "www-moha-gov-lk.direct888.net",
          "www-police-gov-bd.direct888.net",
          "wwww.direct888.net",
          "wwww.mofa-gov-sa.direct888.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Joseliyo_Jstnk/status/1743190819245326808",
        "https://www.virustotal.com/gui/ip-address/5.180.114.198/relations",
        "https://www.virustotal.com/gui/file/15ce7d3c879975ca81777cf58f47409283e34ec1fe8e966fde608bc7eda16646/detection",
        "https://www.virustotal.com/gui/file/9d02bf092fdcf44a51ae6e264ec3e3e57afbe79622c92a797e33fb62ed495cda/detection",
        "https://www.virustotal.com/gui/file/931aee9ba0e51804cb354a3a41830721e41a0fab6758aa19a43eaf1abe621b4d/detection",
        "https://www.virustotal.com/gui/file/613068422c214b944c7b2e3fb60412ed99d35c9e18d53d45b16965c5a36f734a/detection"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2024-01-05",
      "indicators": {
        "domain": [
          "donwloaded.net",
          "president-gov-lk.donwloaded.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Cuser07/status/1743214744910401794",
        "https://www.virustotal.com/gui/ip-address/2.58.15.71/relations",
        "https://www.virustotal.com/gui/file/89d4d85592bf0b5e8b55c2d62c9050bfa8c3017f9f497134dbacbb2a0f13a09e/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 4,
        "url": 1
      },
      "first_seen": "2023-12-30",
      "indicators": {
        "domain": [
          "edms-vpn.ddns.net",
          "mail-dor.hopto.org",
          "mpt-ap.servehttp.com",
          "telenor-mm.redirectme.net"
        ],
        "url": [
          "http://213.109.192.93"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/RedDrip7/status/1719897373185560890",
        "https://www.netskope.com/blog/a-look-at-the-nim-based-campaign-using-microsoft-word-docs-to-impersonate-the-nepali-government",
        "https://www.virustotal.com/gui/ip-address/213.109.192.93/relations",
        "https://www.virustotal.com/gui/ip-address/5.181.20.102/relations",
        "https://app.validin.com/axon?find=213.109.192.93&type=ip",
        "https://www.virustotal.com/gui/file/fd7a25223ffd731ad4f4a4083ef4a776e4c6f5b0a068b213859f780f1c44cd82/detection",
        "https://www.virustotal.com/gui/file/d7f8173c108696584f9c1e36d72a3bb0785609d8951acab355a2e112a64497a4/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2023-12-29",
      "indicators": {
        "domain": [
          "apps.fia-gov.net",
          "myanmar-gov-mm.fia-gov.net",
          "myoffice.fia-gov.net",
          "opmcm-gov-np.fia-gov.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Cuser07/status/1738790090326061060",
        "https://twitter.com/Joseliyo_Jstnk/status/1740672426906927562",
        "https://www.virustotal.com/gui/ip-address/77.83.196.59/relations",
        "https://www.virustotal.com/gui/file/1a88ef58675971eb18eeb267b1be90594cd6c7ebddf1c67d66729fa3e68de323/detection",
        "https://www.virustotal.com/gui/file/a11fab6de2c5111833e9e4a6f69ce5dded17085a3d8ae21c7fcfa00d7e113c9b/detection",
        "https://www.virustotal.com/gui/file/b565bd60e9182746de76feeebe7f85902e22ee3a22d5d55a278be7340923806e/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2023-12-25",
      "indicators": {
        "domain": [
          "cirt-gov-mm.fia-gov.net",
          "fia-gov.net",
          "mofa-gov-bd.fia-gov.net",
          "moitt-gov-pk.fia-gov.net",
          "police-circular-gov-bd.fia-gov.net",
          "police-gov-bd.fia-gov.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Cuser07/status/1738790090326061060",
        "https://twitter.com/Joseliyo_Jstnk/status/1740672426906927562",
        "https://www.virustotal.com/gui/ip-address/77.83.196.59/relations",
        "https://www.virustotal.com/gui/file/1a88ef58675971eb18eeb267b1be90594cd6c7ebddf1c67d66729fa3e68de323/detection",
        "https://www.virustotal.com/gui/file/a11fab6de2c5111833e9e4a6f69ce5dded17085a3d8ae21c7fcfa00d7e113c9b/detection",
        "https://www.virustotal.com/gui/file/b565bd60e9182746de76feeebe7f85902e22ee3a22d5d55a278be7340923806e/detection"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-12-18",
      "indicators": {
        "domain": [
          "mailmfa.mofa-gov.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Glacius_/status/1736687727721013448",
        "https://www.virustotal.com/gui/file/0e51c4f52b63e7ce231959168dbc4270b4fa451c58e3bd2081441e7d83915361/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-12-06",
      "indicators": {
        "domain": [
          "e-servicesptclnetpk.servehttp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/k3yp0d/status/1727695607203078193",
        "https://app.validin.com/axon?find=47.74.90.0&type=ip",
        "https://app.validin.com/axon?find=47.74.90.10&type=ip"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-11-24",
      "indicators": {
        "domain": [
          "mofa-gov-pk.donwloaded.com",
          "police-gov-bd.donwloaded.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Glacius_/status/1727968223088214182",
        "https://x.com/Cyberteam008/status/1925009704918393295",
        "https://www.virustotal.com/gui/ip-address/5.230.54.3/relations",
        "https://www.virustotal.com/gui/file/170ccf1225154fa0cd92a14219f0b912479cc4095203646c38a31bb78baafe9f/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 5,
        "ipv4": 1,
        "url": 1,
        "url_path": 1
      },
      "first_seen": "2023-11-23",
      "indicators": {
        "domain": [
          "awards-piaccompk.serveftp.com",
          "fbr-taxupdates.serveblog.net",
          "pakmail.cloud",
          "senate-pak.site",
          "yes2khalistan.online"
        ],
        "ipv4": [
          "8.222.250.160:443"
        ],
        "url": [
          "http://8.222.250.160"
        ],
        "url_path": [
          "/uPSnswhC"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/alex_lanstein/status/1727280460022300924",
        "https://twitter.com/BaoshengbinCumt/status/1727517020269527069",
        "https://twitter.com/k3yp0d/status/1727613488967614761",
        "https://twitter.com/k3yp0d/status/1727612826661896390",
        "https://www.virustotal.com/gui/ip-address/47.251.51.195/relations",
        "https://www.virustotal.com/gui/ip-address/47.252.52.225/relations",
        "https://www.virustotal.com/gui/ip-address/8.222.250.160/relations",
        "https://www.virustotal.com/gui/file/d28ee2ab42b30c24b2569d9042f182e0a64e8dba2653500046153256e4620505/detection",
        "https://www.virustotal.com/gui/file/47144b2a4fa036692dccc81f0414c5d7898da001075c3e3c9995665cf5603791/detection"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2023-11-23",
      "indicators": {
        "domain": [
          "cloud-ntdc.servehttp.com",
          "e-supportntc.servehttp.com",
          "financeptcl-govpk.servehttp.com",
          "flysmart-piac.servehttp.com",
          "services-ptclnetpk.servehttp.com",
          "wetransfer.servehttp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/k3yp0d/status/1727695607203078193",
        "https://app.validin.com/axon?find=47.74.90.0&type=ip",
        "https://app.validin.com/axon?find=47.74.90.10&type=ip"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 7,
        "url_path": 3
      },
      "first_seen": "2023-11-22",
      "indicators": {
        "domain": [
          "dns.govnp.org",
          "govnp.org",
          "mail.mofa.govnp.org",
          "mofa.govnp.org",
          "mx1.nepal.govnp.org",
          "nepal.govnp.org",
          "nitc.govnp.org"
        ],
        "url_path": [
          "/AFA/RWlVOGJCSUxEaVljT0dKaQ==.aspx",
          "/RWlVOGJCSUxEaVljT0dKaQ==.aspx",
          "/mail/AFA/RWlVOGJCSUxEaVljT0dKaQ==.aspx"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ginkgo_g/status/1727155248081555886",
        "https://www.virustotal.com/gui/file/b5c001cbcd72b919e9b05e3281cc4e4914fee0748b3d81954772975630233a6e/detection",
        "https://www.virustotal.com/gui/file/b60f71bfbdf86b8959cebc7585ec5a39e6cdd1c8efc80aa2bb8b051df4b8889b/detection",
        "https://www.virustotal.com/gui/file/9a3481ad198c0ed8e0e9945a35387631784125d42a2132b8428e7bf041c1d397/detection",
        "https://www.virustotal.com/gui/file/1246356d78d47ce73e22cc253c47f739c4f766ff1e7b473d5e658ba1f0fdd662/detection",
        "https://www.virustotal.com/gui/file/696f57d0987b2edefcadecd0eca524cca3be9ce64a54994be13eab7bc71b1a83/detection"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2023-11-09",
      "indicators": {
        "domain": [
          "mailmofagovmm.mfa-gov.net",
          "mfa-gov.net",
          "webmail.mfa-gov.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/TLP_R3D/status/1722667675468312942",
        "https://www.virustotal.com/gui/ip-address/212.83.46.137/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 11
      },
      "first_seen": "2023-11-08",
      "indicators": {
        "domain": [
          "asean-ajp.myftp.org",
          "cloud.nitc.gavnp.org",
          "dns.nepal.gavnp.org",
          "drsasa.hopto.org",
          "mail-mohs.servehttp.com",
          "mx1.nepal.gavnp.org",
          "mx2.nepal.gavnp.org",
          "mytel-mm.servehttp.com",
          "nitc.gavnp.org",
          "pdf-shanstate.redirectme.net",
          "pdf-shanstate.serveftp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://mp.weixin.qq.com/s/iWx2tGCLOR0JtDBnC3FOwQ (Chinese)"
      ],
      "total": 11
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-11-03",
      "indicators": {
        "domain": [
          "dof-govmm.sytes.net",
          "windows-update.hopto.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/RedDrip7/status/1719897373185560890",
        "https://www.netskope.com/blog/a-look-at-the-nim-based-campaign-using-microsoft-word-docs-to-impersonate-the-nepali-government",
        "https://www.virustotal.com/gui/ip-address/213.109.192.93/relations",
        "https://www.virustotal.com/gui/ip-address/5.181.20.102/relations",
        "https://app.validin.com/axon?find=213.109.192.93&type=ip",
        "https://www.virustotal.com/gui/file/fd7a25223ffd731ad4f4a4083ef4a776e4c6f5b0a068b213859f780f1c44cd82/detection",
        "https://www.virustotal.com/gui/file/d7f8173c108696584f9c1e36d72a3bb0785609d8951acab355a2e112a64497a4/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 5,
        "url_path": 4
      },
      "first_seen": "2023-11-02",
      "indicators": {
        "domain": [
          "dns-mofgovbt.ddns.net",
          "mail-mofgovbt.hopto.org",
          "microsoftupdte.redirectme.net",
          "myanmar-apn.serveftp.com",
          "updatemanager.ddns.net"
        ],
        "url_path": [
          "/R0FNd0lCb0RGbU1VTUdwcQ==.php",
          "/R1JNU1p4a1RGbU1VTUdwcQ==.php",
          "/update/R0FNd0lCb0RGbU1VTUdwcQ==.php",
          "/update/R1JNU1p4a1RGbU1VTUdwcQ==.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/RedDrip7/status/1719897373185560890",
        "https://www.netskope.com/blog/a-look-at-the-nim-based-campaign-using-microsoft-word-docs-to-impersonate-the-nepali-government",
        "https://www.virustotal.com/gui/ip-address/213.109.192.93/relations",
        "https://www.virustotal.com/gui/ip-address/5.181.20.102/relations",
        "https://app.validin.com/axon?find=213.109.192.93&type=ip",
        "https://www.virustotal.com/gui/file/fd7a25223ffd731ad4f4a4083ef4a776e4c6f5b0a068b213859f780f1c44cd82/detection",
        "https://www.virustotal.com/gui/file/d7f8173c108696584f9c1e36d72a3bb0785609d8951acab355a2e112a64497a4/detection"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2023-10-16",
      "indicators": {
        "domain": [
          "complaints-ntcgovpk.viewdns.net",
          "mail-mofagovpk.servehalflife.com",
          "mail-mofagovpk.serveirc.com",
          "mail-mofagovpk.viewdns.net",
          "mail-pmogovpk.servehttp.com",
          "ntdc-govpk.viewdns.net",
          "sharepakistanmofa.servehttp.com",
          "vibe-ptclnetpk.servehalflife.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/JVPv5sIM3eFmGyi/status/1697074761380278599",
        "https://www.virustotal.com/gui/ip-address/147.139.212.200/relations",
        "https://www.virustotal.com/gui/file/78cea4a9ee2cce19f961c2ddd4972ec479c196c8e9f9763a95561e0f18776883/detection"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-10-16",
      "indicators": {
        "domain": [
          "pak-army.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/TLP_R3D/status/1708843583778763109",
        "https://www.virustotal.com/gui/ip-address/193.42.36.66/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-10-16",
      "indicators": {
        "domain": [
          "cloud-ptclnetpk.servehttp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/JVPv5sIM3eFmGyi/status/1713750113167053187",
        "https://www.virustotal.com/gui/ip-address/8.222.250.160/relations",
        "https://www.virustotal.com/gui/file/d28ee2ab42b30c24b2569d9042f182e0a64e8dba2653500046153256e4620505/detection",
        "https://twitter.com/alex_lanstein/status/1727280460022300924",
        "https://twitter.com/BaoshengbinCumt/status/1727517020269527069",
        "https://twitter.com/k3yp0d/status/1727613488967614761",
        "https://twitter.com/k3yp0d/status/1727612826661896390",
        "https://www.virustotal.com/gui/ip-address/47.251.51.195/relations",
        "https://www.virustotal.com/gui/ip-address/47.252.52.225/relations",
        "https://www.virustotal.com/gui/file/47144b2a4fa036692dccc81f0414c5d7898da001075c3e3c9995665cf5603791/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 16
      },
      "first_seen": "2023-10-02",
      "indicators": {
        "domain": [
          "cpanel.govpk.info",
          "dev.govpk.info",
          "endofmission.govpk.info",
          "govpk.info",
          "intdtebangladesh.govpk.info",
          "invitation-letter.govpk.info",
          "mail.govpk.info",
          "mofa.govpk.info",
          "note1582023.govpk.info",
          "webdisk.govpk.info",
          "webmail.govpk.info",
          "ww1.govpk.info",
          "ww25.govpk.info",
          "ww38.govpk.info",
          "wwww.govpk.info",
          "wwww.invitation-letter.govpk.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/suyog41/status/1708827613727531181",
        "https://www.virustotal.com/gui/ip-address/193.142.58.149/relations",
        "https://www.virustotal.com/gui/file/e36e8244c06d88a5650783bfb3e0e85acd76b803a33018d48391f1ebcc849622/detection"
      ],
      "total": 16
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-09-26",
      "indicators": {
        "domain": [
          "emv1.mofa-gov.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/suyog41/status/1706194781112537213",
        "https://twitter.com/TLP_R3D/status/1706262046587682998",
        "https://www.virustotal.com/gui/ip-address/185.117.90.59/relations",
        "https://www.virustotal.com/gui/file/6e89d7eedc4088f1bcdf45171c41deb6c778e14141802c153496550f09b85fb7/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2023-09-25",
      "indicators": {
        "domain": [
          "mailciieorg.mofa-gov.org",
          "maile.mofa-gov.org",
          "mailmofa.mofa-gov.org",
          "mailyafd.mofa-gov.org",
          "mofa-gov.org",
          "pakarmy-govpk.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/suyog41/status/1706194781112537213",
        "https://twitter.com/TLP_R3D/status/1706262046587682998",
        "https://www.virustotal.com/gui/ip-address/185.117.90.59/relations",
        "https://www.virustotal.com/gui/file/6e89d7eedc4088f1bcdf45171c41deb6c778e14141802c153496550f09b85fb7/detection"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-09-05",
      "indicators": {
        "domain": [
          "slic.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1698883638937657412"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-08-31",
      "indicators": {
        "domain": [
          "gyre.site"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1697240572417974285"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-08-29",
      "indicators": {
        "domain": [
          "defpak.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1696504153500213519"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-08-24",
      "indicators": {
        "domain": [
          "cloudplatfromservice.one",
          "gclouddrives.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://mp.weixin.qq.com/s/ewGyvlmWUD45XTVsoxeVpg",
        "https://otx.alienvault.com/pulse/64a445050a5e0f1018b5bf6d"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-08-15",
      "indicators": {
        "domain": [
          "ntc-govpk.serveftp.com",
          "vpn-ptclnetpk.servehttp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/StopMalvertisin/status/1668668882108940288",
        "https://www.virustotal.com/gui/ip-address/13.213.47.21/relations",
        "https://www.virustotal.com/gui/file/8a431314696e82f994dd7fd32e6151232a9bbdc948c64cc6ee8a6e3dc67bb4f6/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-07-19",
      "indicators": {
        "domain": [
          "mailstinghua.sinacn.co",
          "mailtsinghua.sinacn.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Axel_F5/status/1597978238542057473",
        "https://www.virustotal.com/gui/file/f946663a780806693ea3fb034215bd6da25971eb07d28fe9c209594c90ec3225/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-07-19",
      "indicators": {
        "domain": [
          "libreofficeupdates.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Axel_F5/status/1681354510642429982",
        "https://www.virustotal.com/gui/file/61a839aaba4807e492922a3ba0000b98568669626638acf5e5ed0b597fdd5e40/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-07-19",
      "indicators": {
        "domain": [
          "plainboardssixty.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Axel_F5/status/1669794530592170001",
        "https://www.virustotal.com/gui/file/b41d54a9686b312f9e114f62e6bf11e21c8e97dda477d488ca19e2afa45efc9e/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-07-18",
      "indicators": {
        "domain": [
          "mailafdbd.mod-pkgov.org",
          "mod-pkgov.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1681132716534923267",
        "https://www.virustotal.com/gui/ip-address/85.113.70.48/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-07-17",
      "indicators": {
        "domain": [
          "tref.tech"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1680943216114253825"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-07-17",
      "indicators": {
        "domain": [
          "mofagov.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1680766347255611394"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-07-12",
      "indicators": {
        "domain": [
          "nbcot.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1679132754842390529"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-07-12",
      "indicators": {
        "domain": [
          "cylit.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1678934448186728448"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-07-10",
      "indicators": {
        "domain": [
          "mofa-gov.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1678384704679182336",
        "https://www.virustotal.com/gui/ip-address/5.230.74.80/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-07-07",
      "indicators": {
        "domain": [
          "pakistanarmy.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/__0XYC__/status/1676905915885187073",
        "https://www.virustotal.com/gui/file/3ef7b9a872dc1247edb0f3947d0db681ff14be81cb46be22ce4f896f2d2dc7f0/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-07-05",
      "indicators": {
        "domain": [
          "mailsiis.alit.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/t3ft3lb/status/1676511378117648386",
        "https://www.virustotal.com/gui/file/4e86f36820d5e96739fa6ed192d410eeca975c3a2ec48e13eb98d3486c9262b0/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-07-05",
      "indicators": {
        "domain": [
          "ptcl-gov.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/TLP_R3D/status/1676680838774136832",
        "https://www.virustotal.com/gui/ip-address/193.42.39.133/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-07-05",
      "indicators": {
        "domain": [
          "mofagov.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/TLP_R3D/status/1676537779574931457",
        "https://www.virustotal.com/gui/ip-address/98.142.254.52/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-07-03",
      "indicators": {
        "domain": [
          "fssp.tech"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1675852641874632705"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2023-06-25",
      "indicators": {
        "domain": [
          "bol-south.com",
          "ishd.directt88.org",
          "microsoft-365.directt88.org",
          "punjabpolice-gov-pk.fia-gov.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.group-ib.com/blog/hunting-sidewinder/"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-06-25",
      "indicators": {
        "domain": [
          "pk-co.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/TLP_R3D/status/1672174181935464448"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2023-06-13",
      "indicators": {
        "domain": [
          "csd-govpk.servehttp.com",
          "finance-govpk.servehttp.com",
          "ntc-govpk.servehttp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/StopMalvertisin/status/1668668882108940288",
        "https://www.virustotal.com/gui/ip-address/13.213.47.21/relations",
        "https://www.virustotal.com/gui/file/8a431314696e82f994dd7fd32e6151232a9bbdc948c64cc6ee8a6e3dc67bb4f6/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2023-06-11",
      "indicators": {
        "domain": [
          "emv1.pkgov-mail.com",
          "pkgov-mail.com",
          "service.pkgov-mail.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/146.70.161.36/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2023-06-11",
      "indicators": {
        "domain": [
          "cgate.ruve.live",
          "ruve.live",
          "volt.ruve.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1663729069811458048",
        "https://www.virustotal.com/gui/ip-address/5.230.78.76/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-06-11",
      "indicators": {
        "domain": [
          "pargue.tech"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1663400816907272192",
        "https://www.virustotal.com/gui/ip-address/5.255.124.203/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-06-11",
      "indicators": {
        "domain": [
          "data-protect.tech"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1661558607857717248"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 5,
        "url": 1
      },
      "first_seen": "2023-06-02",
      "indicators": {
        "domain": [
          "ebill-ptclnetpk.servehttp.com",
          "flysmart-piaccompk.servehttp.com",
          "nlc-govpk.servehttp.com",
          "offers-ptclnetpk.servehttp.com",
          "online-csdgovpk.servehttp.com"
        ],
        "url": [
          "http://149.129.237.253"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/__0XYC__/status/1664581189766610944",
        "https://twitter.com/uslss_etr/status/1664705054069215252",
        "https://www.virustotal.com/gui/ip-address/8.208.90.73/relations"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2023-05-23",
      "indicators": {
        "domain": [
          "drtgfhj.mofss.co",
          "emv1.mofss.co",
          "mofss.co",
          "service.mofss.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1660854037149884417",
        "https://www.virustotal.com/gui/ip-address/5.230.78.184/relations"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2023-05-18",
      "indicators": {
        "domain": [
          "emv1.ntc-net.co",
          "ntc-net.co",
          "service.ntc-net.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1659021576841601026",
        "https://www.virustotal.com/gui/ip-address/5.255.99.99/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 161
      },
      "first_seen": "2023-05-17",
      "indicators": {
        "domain": [
          "aa173.bank-ok.com",
          "active.roteh.site",
          "aeryple.xyz",
          "agarg.tech",
          "ailyun.live",
          "amuck.scoler.tech",
          "article-viewer.com",
          "assbutt.xyz",
          "ausib-edu.org",
          "avail.freay.tech",
          "axis.heplor.biz",
          "bank-ok.com",
          "basic.gruh.site",
          "basis.agarg.tech",
          "blesis.live",
          "bless.agarg.tech",
          "bluedoor.click",
          "brac.tech",
          "brave.agarg.tech",
          "breat.info",
          "cater.sphery.live",
          "cdn.torsey.xyz",
          "ceiling.kalpo.xyz",
          "cert.repta.live",
          "climb.kalpo.xyz",
          "cluster.jotse.info",
          "confluence.assbutt.xyz",
          "countpro.info",
          "cpec.site",
          "csdstore.app",
          "cssc-net.co",
          "cvix.cc",
          "dirctt88.org",
          "directt88.org",
          "dolper.top",
          "dr-doom.xyz",
          "dsmes.xyz",
          "e-tohfa.net",
          "elopter.top",
          "enclose.info",
          "endure.sphery.live",
          "estate.ovil.tech",
          "fdrek.live",
          "file-download.co",
          "focus.mectel.tech",
          "focus.semain.tech",
          "found.neger.site",
          "found.troks.site",
          "freay.tech",
          "freedom.olerpic.info",
          "ftp.true-islam.org",
          "fujit.info",
          "gearfill.biz",
          "geoloc.top",
          "georgion.info",
          "gitlab.enclose.info",
          "glorec.tech",
          "gretic.info",
          "groove.olipy.info",
          "gruve.site",
          "hakimiya.live",
          "handle.proey.tech",
          "helpdesk-gov.info",
          "heplor.biz",
          "hertic.tech",
          "hldren.info",
          "hostmaster.enclose.info",
          "hread.live",
          "hyat.tech",
          "inkly.net",
          "insert.roteh.site",
          "islamic-path.com",
          "jester.hyat.tech",
          "jotse.info",
          "kalpo.xyz",
          "kito.countpro.info",
          "krontec.info",
          "leron.info",
          "leyra.tech",
          "lines.aeryple.xyz",
          "livo.silvon.site",
          "lucas.hertic.tech",
          "mat.trelin.tech",
          "mectel.tech",
          "mfagov.org",
          "moon.tfrend.org",
          "mopiler.top",
          "msoft-updt.net",
          "neger.site",
          "nelcec.info",
          "normal.aeryple.xyz",
          "offshore.leron.info",
          "olerpic.info",
          "olipy.info",
          "oprad.top",
          "opt.freay.tech",
          "ortra.tech",
          "ovil.tech",
          "paf-govt.info",
          "pak-gov.info",
          "pak-govt.net",
          "pak-news.info",
          "pastlet.live",
          "plors.tech",
          "portal.breat.info",
          "preag.info",
          "preat.fujit.info",
          "preat.info",
          "privacy.olerpic.info",
          "private.hldren.info",
          "proey.tech",
          "prol.info",
          "ptcl-gov.org",
          "rack.nelcec.info",
          "reay.tech",
          "repta.live",
          "reth.cvix.cc",
          "reveal.troks.site",
          "ridlay.live",
          "roof.wsink.live",
          "rugby.wsink.live",
          "sbp-pk.org",
          "sdfsdg.enclose.info",
          "semain.tech",
          "service.true-islam.org",
          "shortney.org",
          "shrtny.co",
          "shrtny.live",
          "silk.freat.site",
          "silvon.site",
          "sindhpolice-govpk.org",
          "sk.krontec.info",
          "spec.trelin.tech",
          "sphery.live",
          "split.tyoin.biz",
          "square.oprad.top",
          "srv-app.co",
          "storeapp.site",
          "straight.hldren.info",
          "support-twitter.com",
          "tab.gruve.site",
          "telemart-pk.com",
          "tfrend.org",
          "tiinly.co",
          "tinurl.click",
          "torsey.xyz",
          "treat.fraty.info",
          "trelin.tech",
          "troks.site",
          "true-islam.org",
          "tyoin.biz",
          "utilize.elopter.top",
          "verocal.info",
          "view.proey.tech",
          "vtray.tech",
          "wsink.live",
          "yrak.info",
          "zed.shrtny.live",
          "zolosy.top",
          "zone.vtray.tech",
          "zretw.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.bridewell.com/insights/news/detail/the-distinctive-rattle-of-apt-sidewinder"
      ],
      "total": 161
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2023-05-17",
      "indicators": {
        "domain": [
          "efrgfh.pak-ntc.org",
          "emv1.pak-ntc.org",
          "service.pak-ntc.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1658669939010715653",
        "https://www.virustotal.com/gui/ip-address/192.36.27.97/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-05-16",
      "indicators": {
        "domain": [
          "govpk.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1658323281420881926"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-05-15",
      "indicators": {
        "domain": [
          "ntc-pk.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1657941419401805824"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 9
      },
      "first_seen": "2023-05-13",
      "indicators": {
        "domain": [
          "dgms.paknavy-gov.com",
          "forecast.comsats-net.com",
          "govpk.net",
          "mailnavybd.govpk.net",
          "mailnavymilbd.govpk.net",
          "paknavy-gov-pkp.downld.net",
          "paknavy-gov.com",
          "paknavy.jmicc.xyz",
          "paknavy.paknavy.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blogs.blackberry.com/en/2023/05/sidewinder-uses-server-side-polymorphism-to-target-pakistan"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-05-13",
      "indicators": {
        "domain": [
          "daraz-pk.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1657207787397718018"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2023-05-11",
      "indicators": {
        "domain": [
          "dytt88.org",
          "mail-dmp-navy-pk.dytt88.org",
          "ministryofforeignaffairs-mofa-gov-pk.dytt88.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/t3ft3lb/status/1656554005491859456",
        "https://x.com/banthisguy9349/status/1867536997528875196",
        "https://www.virustotal.com/gui/ip-address/5.230.73.198/relations",
        "https://www.virustotal.com/gui/file/a703c6772e8bcf7cd0aef05ecbee4c7f7f39371d45b42bf1030df2be5261717c/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-05-11",
      "indicators": {
        "domain": [
          "aliit.org",
          "cxvdfg.aliit.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1656499255056687104",
        "https://www.virustotal.com/gui/ip-address/5.230.72.98/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-05-09",
      "indicators": {
        "domain": [
          "ntc-pk.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1655769610116038657",
        "https://threatbook.io/domain/ntc-pk.org"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-05-04",
      "indicators": {
        "domain": [
          "nadra-gov-pk.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/500mk500/status/1653860821020049410",
        "https://www.virustotal.com/gui/file/d236df798c56b2a32ff744f16d93c6a0412b4caaf2ea35b171a3953b19609074/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2023-05-02",
      "indicators": {
        "domain": [
          "alibababackupcloud.com",
          "portal.alibababackupcloud.com",
          "secure.alibababackupcloud.com",
          "vpn.alibababackupcloud.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/jaydinbas/status/1653361390491430915",
        "https://www.virustotal.com/gui/ip-address/39.104.50.12/relations",
        "https://www.virustotal.com/gui/file/88c10674bb6a53791bfe08497948699bf57ea9980a878a3a5fc1afb160d1d234/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-04-20",
      "indicators": {
        "domain": [
          "halterarks.co.uk"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/JVPv5sIM3eFmGyi/status/1648890379943706625"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 11
      },
      "first_seen": "2023-04-19",
      "indicators": {
        "domain": [
          "cabinet-division-pk.fia-gov.com",
          "dad.fia-gov.com",
          "desk.fia-gov.com",
          "fia-gov.com",
          "foooders.fia-gov.com",
          "ghckjxvo.fia-gov.com",
          "m.fia-gov.com",
          "plbulcbo.fia-gov.com",
          "test.fia-gov.com",
          "tmlbxveb.fia-gov.com",
          "wndro.fia-gov.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/__0XYC__/status/1648577567840952321",
        "https://www.virustotal.com/gui/ip-address/2.58.14.249/relations"
      ],
      "total": 11
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-04-10",
      "indicators": {
        "domain": [
          "mod-gov.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1645269421873840129"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-04-07",
      "indicators": {
        "domain": [
          "awrah.live",
          "blesico.site"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1644346009198395392"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-03-21",
      "indicators": {
        "domain": [
          "defpak.org",
          "paknavy.defpak.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/StopMalvertisin/status/1638194026162827265",
        "https://www.virustotal.com/gui/file/7dcf935a24039dff2d084f41ab8ca318b28c53c01f9de069f087b3be15457ba9/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 2
      },
      "first_seen": "2023-03-13",
      "indicators": {
        "url": [
          "cornerstonebeverly.org/js/files/ntfonts/",
          "cornerstonebeverly.org/js/files/ntfonts/avena"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/suyog41/status/1633822870601363457",
        "https://twitter.com/bofheaded/status/1634309581705715712",
        "https://twitter.com/fmc_nan/status/1634096201577660416",
        "https://www.virustotal.com/gui/file/9aed0c5a047959ef38ec0555ccb647688c67557a6f8f60f691ab0ec096833cce/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-03-10",
      "indicators": {
        "domain": [
          "connectiiest.com",
          "goinfinity.tech"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/bofheaded/status/1634290081627271168"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-03-10",
      "indicators": {
        "domain": [
          "cstc-spares-vip-163.dowmload.net",
          "dowmload.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/StopMalvertisin/status/1634084573620604934",
        "https://www.virustotal.com/gui/ip-address/5.255.106.249/relations",
        "https://www.virustotal.com/gui/file/8af93bed967925b3e5a70d0ad90eae1f13bc6e362ae3dac705e984f8697aaaad/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-03-10",
      "indicators": {
        "domain": [
          "bol-south.org",
          "mtss.bol-south.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/StopMalvertisin/status/1634084568608264192",
        "https://www.virustotal.com/gui/ip-address/79.141.174.208/relations",
        "https://www.virustotal.com/gui/file/a45258389a3c0d4615f3414472c390a0aabe77315663398ebdea270b59b82a5c/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2023-03-10",
      "indicators": {
        "url": [
          "cornerstonebeverly.org/js/files/docufentososo/doecumentosoneso/pantomime.hta"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/suyog41/status/1633822870601363457",
        "https://twitter.com/bofheaded/status/1634309581705715712",
        "https://twitter.com/fmc_nan/status/1634096201577660416",
        "https://www.virustotal.com/gui/file/9aed0c5a047959ef38ec0555ccb647688c67557a6f8f60f691ab0ec096833cce/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1,
        "url": 1
      },
      "first_seen": "2023-03-09",
      "indicators": {
        "ipv4": [
          "144.91.72.17:8080"
        ],
        "url": [
          "cornerstonebeverly.org/js/files/DRDO-K4-Missile-Clean-room"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/suyog41/status/1633822870601363457",
        "https://twitter.com/bofheaded/status/1634309581705715712",
        "https://twitter.com/fmc_nan/status/1634096201577660416",
        "https://www.virustotal.com/gui/file/9aed0c5a047959ef38ec0555ccb647688c67557a6f8f60f691ab0ec096833cce/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-03-01",
      "indicators": {
        "domain": [
          "hpuniversity.in"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/StopMalvertisin/status/1630934296113577984",
        "https://www.virustotal.com/gui/file/cdcc1e6e62df117cc40103c3b2821c10fd5f0372cf06e238663e634a05741764/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "url": 3,
        "url_path": 3
      },
      "first_seen": "2023-02-24",
      "indicators": {
        "url": [
          "kcps.edu.in/css/fonts/files/docs/graentsodocumentso/ganeshostwoso/",
          "kcps.edu.in/css/fonts/files/jquery/",
          "kcps.edu.in/css/fonts/files/ntsfonts/"
        ],
        "url_path": [
          "/ganeshostwoso/",
          "/graentsodocumentso/",
          "/graentsodocumentso/ganeshostwoso/"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/jaydinbas/status/1629149185806069761",
        "https://www.virustotal.com/gui/file/f81d1c47a666d4ec32e69b3e1312dda62c932298e32cc42d5c0c6543589d96be/detection",
        "https://www.virustotal.com/gui/file/3ed1dc92e8399f062e5e62e5483a87736e51ad4ce651f0628abf98d5e10aee27/detection"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-02-23",
      "indicators": {
        "domain": [
          "sinacn.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1628764544331059201",
        "https://twitter.com/Axel_F5/status/1597978238542057473",
        "https://www.virustotal.com/gui/file/f946663a780806693ea3fb034215bd6da25971eb07d28fe9c209594c90ec3225/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2023-02-17",
      "indicators": {
        "domain": [
          "gysdj.mod-gov.org",
          "iididbiy.mod-gov.org",
          "mod-gov.org",
          "service.mod-gov.org",
          "slpa.mod-gov.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/JVPv5sIM3eFmGyi/status/1626044765874814977",
        "https://www.virustotal.com/gui/ip-address/62.113.255.80/relations",
        "https://www.virustotal.com/gui/file/0ad752520774efca09add91df67ec72d2b1a8b503975569b077e43f40fc7a599/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 18,
        "url": 11,
        "url_path": 1
      },
      "first_seen": "2023-02-15",
      "indicators": {
        "domain": [
          "akamai.servehttp.com",
          "bankofceylon.sytes.net",
          "expolanka.serveftp.com",
          "gavaf.org",
          "gavnp.org",
          "lankabelltd.myftp.org",
          "mail-mohs.ddns.net",
          "mail.gavaf.org",
          "mail.nepal.gavnp.org",
          "nepal.gavnp.org",
          "nic-share.myftp.org",
          "nucleusvision.co",
          "outlook.gavaf.org",
          "sltelecom.servehttp.com",
          "sltmobitel.hopto.org",
          "srilankanairlines.redirectme.net",
          "webmail.gavaf.org",
          "windowupdate.myftp.org"
        ],
        "url": [
          "http://160.20.147.84",
          "http://185.163.47.226",
          "http://185.243.112.186",
          "http://185.248.101.231",
          "http://185.248.102.15",
          "http://194.32.76.244",
          "http://45.153.240.66",
          "http://45.92.156.114",
          "http://46.30.188.222",
          "http://5.2.79.135",
          "http://83.171.236.49"
        ],
        "url_path": [
          "/@/@/h31l0"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/GroupIB_TI/status/1625762101758140416"
      ],
      "total": 30
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2023-02-03",
      "indicators": {
        "domain": [
          "dsfgb.pmdu-gov.org",
          "elchxdnj.pmdu-gov.org",
          "ghj.pmdu-gov.org",
          "pmdu-gov.org",
          "qhacgeao.pmdu-gov.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1621434286816759808",
        "https://www.virustotal.com/gui/ip-address/5.255.105.243/relations"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2022-12-22",
      "indicators": {
        "domain": [
          "foodies.alit.info",
          "mail.alit.info",
          "maildefence.alit.info",
          "mailmofa.alit.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/fr0s7_/status/1605917826711048193",
        "https://www.virustotal.com/gui/file/a2faee1e5fe8717d6360458f1fd6d83902a2c9c6bb2e84f9ea5e4b67ffafbebd/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-12-21",
      "indicators": {
        "domain": [
          "csd.paf-govt.net",
          "paf-govt.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/t3ft3lb/status/1605501885531553797",
        "https://www.virustotal.com/gui/file/46cc2e14b7daeadc9f7e5be5cb2004f1370620c93ac97a31cd9a7d329211fd9e/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-12-06",
      "indicators": {
        "domain": [
          "downld.net",
          "paknavy-gov-pk.downld.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/malwareforme/status/1600150609616949248",
        "https://www.virustotal.com/gui/file/bc9d4eb09711f92e4e260efcf7e48906dca6bf239841e976972fd74dac412e2f/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-12-05",
      "indicators": {
        "domain": [
          "appsrv.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1599652629403299840"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2022-12-01",
      "indicators": {
        "domain": [
          "abc.bol-north.com",
          "bol-north.com",
          "cdsve.bol-north.com",
          "dgdfvdf.bol-north.com",
          "dger.bol-north.com",
          "dvdf.bol-north.com",
          "fyujv.bol-north.com",
          "pnwc.bol-north.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/RedDrip7/status/1598252489866121216",
        "https://www.virustotal.com/gui/ip-address/5.230.73.106/relations",
        "https://www.virustotal.com/gui/file/cd09bf437f46210521ad5c21891414f236e29aa6869906820c7c9dc2b565d8be/detection"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-11-29",
      "indicators": {
        "domain": [
          "graty.tech",
          "guide.graty.tech"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1597474158367379456"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2022-11-28",
      "indicators": {
        "domain": [
          "mailpakbj.mofs-gov.org",
          "mailv.mofs-gov.org",
          "mofs-gov.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1597099850075901957",
        "https://www.virustotal.com/gui/ip-address/158.255.211.188/relations",
        "https://www.virustotal.com/gui/file/023a9b64f4a97bebca72cbfa58553cf7ab3f6b80beba908447a441ef4870f284/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-11-15",
      "indicators": {
        "domain": [
          "fbr.net-pk.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1592393354138259457",
        "https://www.virustotal.com/gui/ip-address/192.36.41.43/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2022-11-14",
      "indicators": {
        "domain": [
          "google.play-store.co",
          "hostmaster.play-store.co",
          "play-store.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1592039315823276032"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-11-11",
      "indicators": {
        "domain": [
          "mailnepalarmy.mofagov.com",
          "mofagov.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/jaydinbas/status/1591096310870179840",
        "https://www.virustotal.com/gui/ip-address/5.230.74.58/relations",
        "https://www.virustotal.com/gui/file/ee2018f7b42ed56fb8b272c9662bf9ddd01f6058abd756019a857a33e54d8faf/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-10-31",
      "indicators": {
        "domain": [
          "rock.tonse.info",
          "tonse.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1586959212596563968"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 21
      },
      "first_seen": "2022-10-28",
      "indicators": {
        "domain": [
          "alit.info",
          "civix.site",
          "direct88.org",
          "fenctor.top",
          "file-server.co",
          "gov-netpk.net",
          "hblbank.co",
          "marksafe.org",
          "net-pk.org",
          "outlookk.co",
          "paf-govt.com",
          "paf-govt.org",
          "pak-navy.co",
          "paknavy.net",
          "paknavygov.org",
          "playstore.cloud",
          "reas.tech",
          "supportgovpk.co",
          "tinlly.co",
          "tinly.org",
          "vopler.tech"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Timele9527/status/1585824832842653696",
        "https://twitter.com/Timele9527/status/1585824983598538752"
      ],
      "total": 21
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-10-26",
      "indicators": {
        "domain": [
          "count.plokin.top",
          "plokin.top"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1585171289261891585"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 26,
        "ipv4": 1,
        "url": 2,
        "url_path": 1
      },
      "first_seen": "2022-10-22",
      "indicators": {
        "domain": [
          "1c1157fa.caa.update.customs-lk.org",
          "1d06bfb2.check.update.fia-gov.org",
          "1d06bfb2.local.update.fia-gov.org",
          "1d06bfb2.scan.update.fia-gov.org",
          "64115cb6.check.update.fia-gov.org",
          "753fa5b2.check.update.fia-gov.org",
          "a.bc.1d06bfb2.check.update.fia-gov.org",
          "a.bc.1d06bfb2.local.update.fia-gov.org",
          "a.bc.1d06bfb2.scan.update.fia-gov.org",
          "a.bc.64115cb6.check.update.fia-gov.org",
          "bc.1d06bfb2.local.update.fia-gov.org",
          "bc.1d06bfb2.scan.update.fia-gov.org",
          "bc.753fa5b2.check.update.fia-gov.org",
          "caa.update.customs-lk.org",
          "check.update.fia-gov.org",
          "customs-lk.org",
          "fia-gov.org",
          "generic.update.fia-gov.org",
          "lms.update.fia-gov.org",
          "local.update.fia-gov.org",
          "microsoft.update.fia-gov.org",
          "nadra-pk.org",
          "nadra.update.customs-lk.org",
          "scan.update.fia-gov.org",
          "update.customs-lk.org",
          "update.fia-gov.org"
        ],
        "ipv4": [
          "74.125.196.113:53"
        ],
        "url": [
          "http://146.190.235.137",
          "nepra.org.pk/css/32-Advisory-No-32.iso"
        ],
        "url_path": [
          "/wh/glass.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.zscaler.com/blogs/security-research/warhawk-new-backdoor-arsenal-sidewinder-apt-group-0 (# WarHawk)",
        "https://www.virustotal.com/gui/ip-address/3.239.29.103/relations",
        "https://www.virustotal.com/gui/file/58b3686e4255d32dbcf7dee9dac1d5be6d4692d086cde167da1e1a5e0e1b315a/detection",
        "https://www.virustotal.com/gui/file/624c6b56ee3865f4a5792ad1946a8e86b876440a5af3bac22ac1dee92f1b7372/detection",
        "https://www.virustotal.com/gui/file/7d3574c62df44b74337fc74ec7877792b4ffa1486a49bb19668433c3ca8836b5/detection",
        "https://www.virustotal.com/gui/file/f97d5d3e1c2ceb3e9d23ae5b5d4e7c9857155df5acf7f67fee995cb041c797dc/detection"
      ],
      "total": 30
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2022-10-20",
      "indicators": {
        "domain": [
          "awww.tsinghua.institute",
          "fdgnyt.tsinghua.institute",
          "mail.tsinghua.institute",
          "tsinghua.institute"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/t3ft3lb/status/1582838910857932802",
        "https://www.virustotal.com/gui/file/808058f4e1c47b91cacfc032f348a617961a463d19ee5389f472d29c65197438/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-10-20",
      "indicators": {
        "domain": [
          "finance.gov-net.co",
          "gov-net.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1583063616667799552",
        "https://www.virustotal.com/gui/file/b27968c0d0f55a06cbf424cacf62d0b22e64f021c72d51d4adb0c1771709fe70/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-10-20",
      "indicators": {
        "domain": [
          "bentec.tech",
          "front.bentec.tech"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1582922779707703297"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2022-10-14",
      "indicators": {
        "domain": [
          "comsats-mail.pk",
          "finance.gov.pk.ntc-gov.com",
          "ntc-gov.com",
          "paf-pk-gov.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/__0XYC__/status/1580083623717658624",
        "https://twitter.com/__0XYC__/status/1580796395052670976",
        "https://www.virustotal.com/gui/file/cd592c969a3a940e43888a1902ec9e4605ed28676d3945ab84d72175fbc87253/detection",
        "https://www.virustotal.com/gui/file/bbcca0dc10b700c01e557612f009c050ca618f227e0b8be3d4f471dd9d887a18/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2022-09-30",
      "indicators": {
        "domain": [
          "comsats-net.com",
          "lforvk.com",
          "moma.comsats-net.com",
          "promotionlist.comsats-net.com",
          "srilanka-navy.lforvk.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/RedDrip7/status/1575745702021705728",
        "https://www.virustotal.com/gui/file/e6a6066594160a053fe7d68d688b95920936d5880a37a2c91872fb2fc128adf6/detection",
        "https://www.virustotal.com/gui/file/5eec9df0c62b8a0d8c922d366e38ac91907d2a7f5cd13a717d7714015ae362c1/detection",
        "https://www.virustotal.com/gui/file/37eca58386fbf9c1e381f88776435565623e3d2d1e2b01218f7717b963449735/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-09-19",
      "indicators": {
        "domain": [
          "hare-ap.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1571639928483885056"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-09-15",
      "indicators": {
        "domain": [
          "mofadividion.ptcl-gov.com",
          "ptcl-gov.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/uslss_etr/status/1570487402694590464",
        "https://www.virustotal.com/gui/file/53cc8f46f10e4b3958834d75b15db3aa0d8c86a63b8bd3e6ac180c05ce27d748/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-09-14",
      "indicators": {
        "domain": [
          "d2klia4zfdp2mg.cloudfront.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/malwrhunterteam/status/1570061932706635781",
        "https://twitter.com/h2jazi/status/1570070185620512768",
        "https://www.virustotal.com/gui/file/719cbc3e08d90d557d464f1a27498626c1b76d6e8db302cb53cb3013a1c35dee/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-09-14",
      "indicators": {
        "domain": [
          "gov-pknet.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1569818563657224193"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2022-09-08",
      "indicators": {
        "domain": [
          "cssc.live",
          "mailarmy.cssc.live",
          "mailoutlook.cssc.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1567657961887252480",
        "https://www.virustotal.com/gui/ip-address/5.255.104.124/relations"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-09-02",
      "indicators": {
        "domain": [
          "api.watch-earn.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1534373342446202881",
        "https://mp.weixin.qq.com/s/8j_rHA7gdMxY1_X8alj8Zg (Chinese)",
        "https://www.virustotal.com/gui/file/d74900bf7418f3ad39a5ab27326ad6591f792d1dfdfe44deb89f1b319b7d83b4/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2022-08-25",
      "indicators": {
        "domain": [
          "dsfbgnh.office-drive.live",
          "office-drive.live",
          "sl-navy.office-drive.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/uslss_etr/status/1562641328055336960",
        "https://www.virustotal.com/gui/ip-address/103.149.46.237/relations",
        "https://www.virustotal.com/gui/file/efac11fcecbceb4e6273852207a3875ac1edd69158415c3a0bba704e58adeb2c/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-08-17",
      "indicators": {
        "domain": [
          "cdn.nelpec.top",
          "nelpec.top"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1559395659559899136",
        "https://www.virustotal.com/gui/ip-address/151.236.21.26/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-08-15",
      "indicators": {
        "domain": [
          "cdn.fritor.xyz",
          "fritor.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1559010528013729792"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-08-05",
      "indicators": {
        "domain": [
          "cdn.ubrig.live",
          "ubrig.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1553931751852244992",
        "https://www.virustotal.com/gui/ip-address/192.71.166.139/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-08-05",
      "indicators": {
        "domain": [
          "paf-media.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1555024895020769280"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2022-07-31",
      "indicators": {
        "domain": [
          "balcon.live",
          "cdn.greploc.live",
          "greploc.live",
          "tray.balcon.live",
          "treaty.balcon.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1528935733888970753",
        "https://www.virustotal.com/gui/ip-address/185.234.72.188/relations",
        "https://www.virustotal.com/gui/ip-address/45.138.172.23/relations"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-07-31",
      "indicators": {
        "domain": [
          "bluket.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1531519247293513728"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-07-29",
      "indicators": {
        "domain": [
          "cdn.ghaflah.top",
          "ghaflah.top"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1550064523964338176",
        "https://www.virustotal.com/gui/ip-address/5.230.72.15/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-07-29",
      "indicators": {
        "domain": [
          "mawazna.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1548924681008590853"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2022-07-22",
      "indicators": {
        "domain": [
          "awww.paf-gov.org",
          "finance.paf-gov.org",
          "paf-gov.org",
          "summer.paf-gov.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1550524741202726919",
        "https://www.virustotal.com/gui/file/a28a5417d707ecae61313bd5b7c53736d40afba2280cd7ae673963075ae37072/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2022-07-20",
      "indicators": {
        "domain": [
          "discount.kpt-gov.org",
          "kpt-gov.org",
          "ksew.kpt-gov.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1549762807624880128",
        "https://www.virustotal.com/gui/file/cd1a9ae4a3968643a6fb41b36b67838d952dac83ad63c63ce4ad3c672fac31b8/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 5,
        "url_path": 1
      },
      "first_seen": "2022-07-14",
      "indicators": {
        "domain": [
          "bgevin.live",
          "cdn.bgevin.live",
          "cdn.polvcrit.info",
          "eterplicity.live",
          "polvcrit.info"
        ],
        "url_path": [
          "/W6taHcwqKwhgzWGWr7ElpRAfWA7JcsXC0A2a4eFv/"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.checkpoint.com/2022/07/13/a-hit-is-made-suspected-india-based-sidewinder-apt-successfully-cyber-attacks-pakistan-military-focused-targets/",
        "https://otx.alienvault.com/pulse/62cffda72568807d4e9a9f2e",
        "https://www.virustotal.com/gui/ip-address/5.230.67.73/relations",
        "https://www.virustotal.com/gui/file/898513123f0f0342b1c47a4a65c88a60f895f90a9d0fa5fc5928c26dfab622b0/detection"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2022-07-08",
      "indicators": {
        "domain": [
          "br.mofa-pk.org",
          "mofa-pk.org",
          "mofa.g0v.cq.cn"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Malwar3Ninja/status/1545376308196147200"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-07-08",
      "indicators": {
        "domain": [
          "mail-mofa-gov-pk-satellite-proposal-for-pakistan-files-ops.netlify.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/BaoshengbinCumt/status/1545247231938244610"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2022-06-25",
      "indicators": {
        "domain": [
          "alit.live",
          "bdmil.alit.live",
          "mailh.alit.live",
          "mailmofa.alit.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/malwareforme/status/1540037682314629120",
        "https://www.virustotal.com/gui/ip-address/5.230.69.153/relations",
        "https://www.virustotal.com/gui/file/ee77e136f7df758c2ab9092529dc5c6b64b35bc9f4d2c16c65bcd05965ccd92a/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2022-06-14",
      "indicators": {
        "domain": [
          "jmicc.xyz",
          "navy-mil-bd.jmicc.xyz",
          "navy.jmicc.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1536707820799807489",
        "https://www.virustotal.com/gui/ip-address/5.230.71.95/relations",
        "https://www.virustotal.com/gui/file/4bad3e34a192a8f305e188538b4370ea835446cc6ba32fe046d9a5f2bc3df172/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-06-13",
      "indicators": {
        "domain": [
          "bahriafoundation.live",
          "pnwc.bahriafoundation.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1536330475656171520",
        "https://www.virustotal.com/gui/file/cf79ecafd3e1ae354fcf9cf33acdb06b6b64dc9a8128656a9d27ff94e154f9c4/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 17
      },
      "first_seen": "2022-06-08",
      "indicators": {
        "domain": [
          "afg-refugee.net",
          "brwse.co",
          "civix.live",
          "docusserve.cc",
          "docusserve.ltd",
          "doken.xyz",
          "fdn-mac.net",
          "filedownload.work",
          "gov-pk.net",
          "mofa-pk.co",
          "nationpk.org",
          "norter.xyz",
          "paf-mail.com",
          "pak-gov.net",
          "slap-games.club",
          "trik.live",
          "watch-earn.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1534373342446202881",
        "https://mp.weixin.qq.com/s/8j_rHA7gdMxY1_X8alj8Zg (Chinese)",
        "https://www.virustotal.com/gui/file/d74900bf7418f3ad39a5ab27326ad6591f792d1dfdfe44deb89f1b319b7d83b4/detection"
      ],
      "total": 17
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2022-06-03",
      "indicators": {
        "domain": [
          "almighty-allah.com",
          "api.almighty-allah.com",
          "api.supremeallah.world",
          "supremeallah.world"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/GroupIB_GIB/status/1532651046111023104",
        "https://www.virustotal.com/gui/file/e089dc65af44ff334304e52c29755c96460691d93cfd4e4ab75f75bc6078993e/detection",
        "https://www.virustotal.com/gui/file/42b828e187e4b7f1ca5d774553c8b85c1fed204a2a5a8c50fd4c7e9a491fb118/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2022-06-03",
      "indicators": {
        "domain": [
          "awww.srvapp.co",
          "discount.srvapp.co",
          "localhost.srvapp.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/GroupIB_GIB/status/1532651049776865280",
        "https://www.virustotal.com/gui/domain/srvapp.co/relations",
        "https://www.virustotal.com/gui/ip-address/185.225.19.142/relations",
        "https://www.virustotal.com/gui/file/c17cbe229e743df8993b96f2887393b2565ae355f3ba61d09c901e552e7ee4d1/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-06-03",
      "indicators": {
        "domain": [
          "register.srvapp.co",
          "srvapp.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/GroupIB_GIB/status/1532651049776865280",
        "https://www.virustotal.com/gui/domain/srvapp.co/relations",
        "https://www.virustotal.com/gui/ip-address/185.225.19.142/relations",
        "https://www.virustotal.com/gui/file/c17cbe229e743df8993b96f2887393b2565ae355f3ba61d09c901e552e7ee4d1/detection",
        "https://otx.alienvault.com/pulse/62a864daa688835ed774c449"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 72
      },
      "first_seen": "2022-06-02",
      "indicators": {
        "domain": [
          "api.vpn-secure.co",
          "askari.bitlyy.me",
          "askaribank.bitlyy.me",
          "bangladeshmarineacademylibrary.ppinewsagency.live",
          "bb.kdf-mail.com",
          "bbcnew.cn",
          "bitlyy.me",
          "china.bbcnew.cn",
          "cloud-apt.net",
          "covid.bbcnew.cn",
          "covid.pkrepublic.org",
          "covid19.mohp-gov.org",
          "cr20g.org",
          "csd-pk.co",
          "csd.bitlyy.me",
          "dasds.pak-gov.com",
          "dasdsadsa.pak-gov.com",
          "dawn.pakgov.org",
          "dha.pakgov.org",
          "docuserve.ltd",
          "dsasa.cr20g.org",
          "faujifoundation.bitlyy.me",
          "fdn-trace.net",
          "fdscv.tin-url.com",
          "fileserve.work",
          "gov.pakmarines",
          "hajjplanner.bitlyy.me",
          "hajjplanner.tin-url.com",
          "hbl.pakgov.org",
          "hpupdate.csd-pk.co",
          "islamabadclub.docuserve.ltd",
          "islamicfinder.bitlyy.me",
          "jp.pkrepublic.org",
          "karachishipyard.krlwin.org",
          "kdf-mail.com",
          "krlwin.org",
          "ltd.cdn-pak.net",
          "luckydraw.csd-pk.co",
          "mail.paf-gov.net",
          "mail.pak-gov.com",
          "meet.kdf-mail.com",
          "min.tin-url.com",
          "ministryofinterior.fileserve.work",
          "mofa-gov-pk.fdn-trace.net",
          "mohp-gov.org",
          "news.bitlyy.me",
          "news.dawnpk.org",
          "news.kdf-mail.com",
          "news.pakgov.org",
          "news.pkrepublic.org",
          "niims.pakgov.org",
          "paf.gov-mail.net",
          "pafroa.pak-gov.com",
          "pak-gov.com",
          "pk.kdf-mail.com",
          "pkflix.bitlyy.me",
          "pkflix.tin-url.com",
          "sbp.pakgov.org",
          "sec-vpn.bitlyy.me",
          "secp.pakgov.org",
          "secure.tin-url.com",
          "shoprex.bitlyy.me",
          "smstest.kdf-mail.com",
          "t.bitlyy.me",
          "telemart.bitlyy.me",
          "tin-url.com",
          "ubl.pakgov.org",
          "vim.kdf-mail.com",
          "vpn-secure.co",
          "vpn.tin-url.com",
          "wsed.pkrepublic.org",
          "xyz.kdf-mail.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.group-ib.com/sidewinder-antibot",
        "https://otx.alienvault.com/pulse/62987c8eafd38f2088986035"
      ],
      "total": 72
    },
    {
      "counts": {
        "domain": 14
      },
      "first_seen": "2022-06-02",
      "indicators": {
        "domain": [
          "covid.pakgov.net",
          "csd.pakgov.net",
          "finance.pakgov.net",
          "financial.pakgov.net",
          "flix.pakgov.net",
          "hajj.pakgov.net",
          "ji.pakgov.net",
          "nadra.pakgov.net",
          "ncoc.pakgov.net",
          "nhsrc.pakgov.net",
          "pt.pakgov.net",
          "vpn.pakgov.net",
          "wsde.pakgov.net",
          "ww2.pakgov.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/virqdroid/status/1532094635170238464",
        "https://twitter.com/ReBensk/status/1532245757322924032",
        "https://www.virustotal.com/gui/ip-address/2.56.245.21/relations",
        "https://blog.group-ib.com/sidewinder-antibot",
        "https://otx.alienvault.com/pulse/62987c8eafd38f2088986035"
      ],
      "total": 14
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2022-06-02",
      "indicators": {
        "domain": [
          "dawnpk.org",
          "paf-gov.net",
          "pakgov.org",
          "pkrepublic.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.group-ib.com/sidewinder-antibot",
        "https://otx.alienvault.com/pulse/62987c8eafd38f2088986035",
        "https://twitter.com/blackorbird/status/1534373342446202881",
        "https://mp.weixin.qq.com/s/8j_rHA7gdMxY1_X8alj8Zg (Chinese)",
        "https://www.virustotal.com/gui/file/d74900bf7418f3ad39a5ab27326ad6591f792d1dfdfe44deb89f1b319b7d83b4/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-06-02",
      "indicators": {
        "domain": [
          "pakgov.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/virqdroid/status/1532094635170238464",
        "https://twitter.com/ReBensk/status/1532245757322924032",
        "https://www.virustotal.com/gui/ip-address/2.56.245.21/relations",
        "https://blog.group-ib.com/sidewinder-antibot",
        "https://otx.alienvault.com/pulse/62987c8eafd38f2088986035",
        "https://twitter.com/blackorbird/status/1534373342446202881",
        "https://mp.weixin.qq.com/s/8j_rHA7gdMxY1_X8alj8Zg (Chinese)",
        "https://www.virustotal.com/gui/file/d74900bf7418f3ad39a5ab27326ad6591f792d1dfdfe44deb89f1b319b7d83b4/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-06-02",
      "indicators": {
        "domain": [
          "dvdbhjk.pakgov.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/virqdroid/status/1532094635170238464",
        "https://twitter.com/ReBensk/status/1532245757322924032",
        "https://www.virustotal.com/gui/ip-address/2.56.245.21/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2022-05-26",
      "indicators": {
        "domain": [
          "awww.interior-pk.org",
          "comsats.xyz",
          "interior-pk.org",
          "mofa-gov.interior-pk.org",
          "paknavy.comsats.xyz",
          "punjab.interior-pk.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/__0XYC__/status/1529707301979947009",
        "https://twitter.com/0xrb/status/1529709439808602113",
        "https://www.virustotal.com/gui/domain/interior-pk.org/relations",
        "https://www.virustotal.com/gui/file/6f4e89fce6a490d619cad9078079c6f6694b2798fc875288faa92b721f25d3cb/detection"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-05-23",
      "indicators": {
        "domain": [
          "finance.govpk-mail.net",
          "govpk-mail.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/__0XYC__/status/1528616671103131649",
        "https://www.virustotal.com/gui/ip-address/92.118.190.165/relations",
        "https://www.virustotal.com/gui/file/fedc3b7cdb07f7b6f5a6bc85720528057297282bfae7960b3d33001ab34a51d6/detection",
        "https://blog.group-ib.com/sidewinder-antibot",
        "https://otx.alienvault.com/pulse/62987c8eafd38f2088986035"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-05-23",
      "indicators": {
        "domain": [
          "csd.govpk-mail.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/__0XYC__/status/1528616671103131649",
        "https://www.virustotal.com/gui/ip-address/92.118.190.165/relations",
        "https://www.virustotal.com/gui/file/fedc3b7cdb07f7b6f5a6bc85720528057297282bfae7960b3d33001ab34a51d6/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 9
      },
      "first_seen": "2022-05-19",
      "indicators": {
        "domain": [
          "job.cssc.info",
          "mailcantonfair.cssc.info",
          "mailcitifs.cssc.info",
          "mailgu.cssc.info",
          "mailmofa.cssc.info",
          "mailturkmenembassy.cssc.info",
          "mofa.cssc.info",
          "rancher.cssc.info",
          "sdgsfg.cssc.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1526840629010894848",
        "https://mp.weixin.qq.com/s/qsGxZIiTsuI7o-_XmiHLHg",
        "https://otx.alienvault.com/pulse/6285048d921d21c8d9beaf1f",
        "https://www.virustotal.com/gui/domain/cssc.info/relations"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-05-19",
      "indicators": {
        "domain": [
          "cssc.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1526840629010894848",
        "https://mp.weixin.qq.com/s/qsGxZIiTsuI7o-_XmiHLHg",
        "https://otx.alienvault.com/pulse/6285048d921d21c8d9beaf1f",
        "https://www.virustotal.com/gui/domain/cssc.info/relations",
        "https://twitter.com/blackorbird/status/1534373342446202881",
        "https://mp.weixin.qq.com/s/8j_rHA7gdMxY1_X8alj8Zg (Chinese)",
        "https://www.virustotal.com/gui/file/d74900bf7418f3ad39a5ab27326ad6591f792d1dfdfe44deb89f1b319b7d83b4/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2022-05-06",
      "indicators": {
        "domain": [
          "awww.paknavy.live",
          "dxfgbdfh.paknavy.live",
          "pmsa.paknavy.live",
          "yfghvjb.paknavy.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/botlabsDev/status/1522500574956109825",
        "https://www.virustotal.com/gui/file/b3caa7ce9a8de209d5a63ab95485c1181f7fca03346330fe92ff3c0a0a9c1040/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-05-06",
      "indicators": {
        "domain": [
          "paknavy.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/botlabsDev/status/1522500574956109825",
        "https://www.virustotal.com/gui/file/b3caa7ce9a8de209d5a63ab95485c1181f7fca03346330fe92ff3c0a0a9c1040/detection",
        "https://twitter.com/blackorbird/status/1534373342446202881",
        "https://mp.weixin.qq.com/s/8j_rHA7gdMxY1_X8alj8Zg (Chinese)",
        "https://www.virustotal.com/gui/file/d74900bf7418f3ad39a5ab27326ad6591f792d1dfdfe44deb89f1b319b7d83b4/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2022-04-25",
      "indicators": {
        "domain": [
          "defrgthyj.ksewpk.com",
          "ksewpk.com",
          "mofabn.ksewpk.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1518594904393355264",
        "https://www.virustotal.com/gui/file/5dfe303f04e3432101b676fa0f230667eb6c9bc1715d5b4042f99d9522aa00fe/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-04-07",
      "indicators": {
        "domain": [
          "ksew.org",
          "srilankanavy.ksew.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1512011407838961664",
        "https://www.virustotal.com/gui/file/37baf7415c755688e1e89679130b5cfd713d662330734eb310089d1f2afd82b8/detection",
        "https://blog.group-ib.com/sidewinder-antibot",
        "https://otx.alienvault.com/pulse/62987c8eafd38f2088986035"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-03-17",
      "indicators": {
        "domain": [
          "awww.kpt-pk.net",
          "job.kpt-pk.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1504347312838959106",
        "https://research.checkpoint.com/2022/state-sponsored-attack-groups-capitalise-on-russia-ukraine-war-for-cyber-espionage/",
        "https://www.virustotal.com/gui/domain/kpt-pk.net/relations",
        "https://otx.alienvault.com/pulse/624c29baad734a210134b02c",
        "https://www.virustotal.com/gui/file/f765b0b6e4a34eb95c6f0ddf058bc88d5ef9ec2b11a5f3504d1673f4f69aceca/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-03-17",
      "indicators": {
        "domain": [
          "kpt-pk.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1504347312838959106",
        "https://research.checkpoint.com/2022/state-sponsored-attack-groups-capitalise-on-russia-ukraine-war-for-cyber-espionage/",
        "https://www.virustotal.com/gui/domain/kpt-pk.net/relations",
        "https://otx.alienvault.com/pulse/624c29baad734a210134b02c",
        "https://www.virustotal.com/gui/file/f765b0b6e4a34eb95c6f0ddf058bc88d5ef9ec2b11a5f3504d1673f4f69aceca/detection",
        "https://blog.group-ib.com/sidewinder-antibot",
        "https://otx.alienvault.com/pulse/62987c8eafd38f2088986035",
        "https://twitter.com/blackorbird/status/1534373342446202881",
        "https://mp.weixin.qq.com/s/8j_rHA7gdMxY1_X8alj8Zg (Chinese)",
        "https://www.virustotal.com/gui/file/d74900bf7418f3ad39a5ab27326ad6591f792d1dfdfe44deb89f1b319b7d83b4/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-03-17",
      "indicators": {
        "domain": [
          "maritimepakistan.kpt-pk.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1504347312838959106",
        "https://research.checkpoint.com/2022/state-sponsored-attack-groups-capitalise-on-russia-ukraine-war-for-cyber-espionage/",
        "https://www.virustotal.com/gui/domain/kpt-pk.net/relations",
        "https://otx.alienvault.com/pulse/624c29baad734a210134b02c",
        "https://www.virustotal.com/gui/file/f765b0b6e4a34eb95c6f0ddf058bc88d5ef9ec2b11a5f3504d1673f4f69aceca/detection",
        "https://blog.group-ib.com/sidewinder-antibot",
        "https://otx.alienvault.com/pulse/62987c8eafd38f2088986035"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 60
      },
      "first_seen": "2022-03-12",
      "indicators": {
        "domain": [
          "bok.pkgov.org",
          "bop.pkgov.org",
          "csd.pkgov.org",
          "cybernet.pkgov.org",
          "dawn.pkgov.org",
          "email.nespak.pkgov.org",
          "email.nitb.pkgov.org",
          "email.nlc.pkgov.org",
          "energy.pkgov.org",
          "fauji.pkgov.org",
          "lotussrv01.fauji.pkgov.org",
          "mail-corp.cybernet.pkgov.org",
          "mail.bok.pkgov.org",
          "mail.bop.pkgov.org",
          "mail.csd.pkgov.org",
          "mail.dawn.pkgov.org",
          "mail.mofa.pkgov.org",
          "mail.nrlpak.pkgov.org",
          "mail.ntc.pkgov.org",
          "mail.ntdc.pkgov.org",
          "mail.ogdcl.pkgov.org",
          "mail.pakoil.pkgov.org",
          "mail.pkgov.org",
          "mail.pmsa.pkgov.org",
          "mail.ptv.pkgov.org",
          "mail.radio.pkgov.org",
          "mail.sco.pkgov.org",
          "mofa.pkgov.org",
          "myth.pkgov.org",
          "nationalhelpdesk.pk",
          "nespak.pkgov.org",
          "nitb.pkgov.org",
          "nlc.pkgov.org",
          "np.pkgov.org",
          "nrlpak.pkgov.org",
          "ns1.pkgov.org",
          "ns2.pkgov.org",
          "ntc.pkgov.org",
          "ntdc.pkgov.org",
          "ogdcl.pkgov.org",
          "pakoil.pkgov.org",
          "parchqwebmail.parco.pkgov.org",
          "parco.pkgov.org",
          "pkgov.org",
          "pmo.nationalhelpdesk.pk",
          "pmsa.pkgov.org",
          "ptcl.pkgov.org",
          "ptv.pkgov.org",
          "radio.pkgov.org",
          "sco.pkgov.org",
          "sngpl.org.pk",
          "ssgc.pkgov.org",
          "sui.nationalhelpdesk.pk",
          "wapda.pkgov.org",
          "web.sngpl.org.pk",
          "webmail.cybernet.pkgov.org",
          "webmail.ssgc.pkgov.org",
          "webmail.wapda.pkgov.org",
          "whale.pkgov.org",
          "zmail.ptcl.pkgov.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/__0XYC__/status/1502593457201811459"
      ],
      "total": 60
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-02-22",
      "indicators": {
        "domain": [
          "crclab-bahria.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/uslss_etr/status/1496118824944697345",
        "https://www.virustotal.com/gui/file/94214e83441e3a6a5cde971f6abe0d4bf226fd0750a0ad26d2241c085de9b604/detection",
        "https://twitter.com/blackorbird/status/1534373342446202881",
        "https://mp.weixin.qq.com/s/8j_rHA7gdMxY1_X8alj8Zg (Chinese)",
        "https://www.virustotal.com/gui/file/d74900bf7418f3ad39a5ab27326ad6591f792d1dfdfe44deb89f1b319b7d83b4/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-02-22",
      "indicators": {
        "domain": [
          "dbms.crclab-bahria.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/uslss_etr/status/1496118824944697345",
        "https://www.virustotal.com/gui/file/94214e83441e3a6a5cde971f6abe0d4bf226fd0750a0ad26d2241c085de9b604/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2022-02-10",
      "indicators": {
        "domain": [
          "asianetnews.xyz",
          "awww.asianetnews.xyz",
          "mofa-gov-pk.asianetnews.xyz",
          "ofa-gov-pk.asianetnews.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/souiten/status/1491681294391992325",
        "https://www.virustotal.com/gui/file/44c720bc1adde78e11c202615260fb9e2e4301cf06edfefe06cde09a373a6c0e/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-02-10",
      "indicators": {
        "domain": [
          "bbcworld-news.net",
          "newsinbbc.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://assets.sentinelone.com/sentinellabs-apt/modified-elephant-apt"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 15
      },
      "first_seen": "2022-02-09",
      "indicators": {
        "domain": [
          "changeworld.hopto.org",
          "mail-argaf.myftp.org",
          "mail-meagovmv.hopto.org",
          "mail-modaf.hopto.org",
          "mail-modgav.hopto.org",
          "mail-mofa.hopto.org",
          "mail-mofagovpk.myftp.org",
          "mail-mopitgovnp.hopto.org",
          "mail-nepalpolgavnp.hopto.org",
          "mail-nepalpolice.hopto.org",
          "mail-opmcmgavnp.hopto.org",
          "microsoft-winupdate.servehttp.com",
          "teamchat.hopto.org",
          "webmail-accbt.hopto.org",
          "webmail-morrgovaf.hopto.org"
        ]
      },
      "precision": "exact",
      "references": [
        "http://blog.talosintelligence.com/2022/02/whats-with-shared-vba-code.html",
        "https://www.virustotal.com/gui/ip-address/45.153.240.66/relations"
      ],
      "total": 15
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-02-08",
      "indicators": {
        "domain": [
          "mod-pk.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1490984172797984770",
        "https://www.virustotal.com/gui/file/eeeb99f94029fd366dcde7da2a75a849833c5f5932d8f1412a89ca15b9e9ebb7/detection",
        "https://blog.group-ib.com/sidewinder-antibot",
        "https://otx.alienvault.com/pulse/62987c8eafd38f2088986035",
        "https://twitter.com/blackorbird/status/1534373342446202881",
        "https://mp.weixin.qq.com/s/8j_rHA7gdMxY1_X8alj8Zg (Chinese)",
        "https://www.virustotal.com/gui/file/d74900bf7418f3ad39a5ab27326ad6591f792d1dfdfe44deb89f1b319b7d83b4/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-02-08",
      "indicators": {
        "domain": [
          "dgmp-paknavy.mod-pk.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1490984172797984770",
        "https://www.virustotal.com/gui/file/eeeb99f94029fd366dcde7da2a75a849833c5f5932d8f1412a89ca15b9e9ebb7/detection",
        "https://blog.group-ib.com/sidewinder-antibot",
        "https://otx.alienvault.com/pulse/62987c8eafd38f2088986035"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2022-02-04",
      "indicators": {
        "domain": [
          "aeltron.xyz",
          "incometaxreturn.aeltron.xyz",
          "instructions.aeltron.xyz",
          "rgdtyt.aeltron.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/uslss_etr/status/1489274205917044736",
        "https://www.virustotal.com/gui/file/85ab1c3ee01c5456eb45bf13c69dda88fa014a1dc5e832bdaa3e801a29d84ccd/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2022-01-27",
      "indicators": {
        "domain": [
          "indianarmy.mailnic.info",
          "kavach.mailnic.info",
          "mod.mailnic.info",
          "passapp.mailnic.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/cyber__sloth/status/1485361081329631236"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-01-23",
      "indicators": {
        "domain": [
          "email-gov-in.digital",
          "mailnic.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/cyber__sloth/status/1485361081329631236"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-01-13",
      "indicators": {
        "domain": [
          "ministry-pk.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1481583143735808001",
        "https://www.virustotal.com/gui/file/cb933361cd6c26ca61c441a40da394a505086f572fd7e9bd425bf086adf50edc/detection",
        "https://twitter.com/blackorbird/status/1534373342446202881",
        "https://mp.weixin.qq.com/s/8j_rHA7gdMxY1_X8alj8Zg (Chinese)",
        "https://www.virustotal.com/gui/file/d74900bf7418f3ad39a5ab27326ad6591f792d1dfdfe44deb89f1b319b7d83b4/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-01-13",
      "indicators": {
        "domain": [
          "cabinet-gov-pk.ministry-pk.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1481583143735808001",
        "https://www.virustotal.com/gui/file/cb933361cd6c26ca61c441a40da394a505086f572fd7e9bd425bf086adf50edc/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-01-10",
      "indicators": {
        "domain": [
          "brep.cdn-edu.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/RedDrip7/status/1328639418110865409",
        "https://www.virustotal.com/gui/file/1cbec920afe2f978b8f84e0a4e6b757d400aeb96e8c0a221130060b196ece010/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2022-01-07",
      "indicators": {
        "domain": [
          "cn.cvix.live",
          "cosmic.cvix.live",
          "mailaplf.cvix.live",
          "mailmfagovnp.cvix.live",
          "mailmofagoug.cvix.live",
          "mailmofagovpk.cvix.live",
          "mailyahoocom.cvix.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/domain/cvix.live/relations"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-01-07",
      "indicators": {
        "domain": [
          "defencelk.cvix.live",
          "mailoutlookcom.cvix.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/domain/cvix.live/relations",
        "https://blog.group-ib.com/sidewinder-antibot",
        "https://otx.alienvault.com/pulse/62987c8eafd38f2088986035"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-01-07",
      "indicators": {
        "domain": [
          "moma-pk.org",
          "sppc.moma-pk.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/alex_lanstein/status/1479569375971713029",
        "https://pastebin.com/9HwieuS2",
        "https://blog.group-ib.com/sidewinder-antibot",
        "https://otx.alienvault.com/pulse/62987c8eafd38f2088986035"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-01-07",
      "indicators": {
        "domain": [
          "dfgrthy.moma-pk.org",
          "mofa.moma-pk.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/alex_lanstein/status/1479569375971713029",
        "https://pastebin.com/9HwieuS2"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-01-07",
      "indicators": {
        "domain": [
          "cvix.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/domain/cvix.live/relations",
        "https://blog.group-ib.com/sidewinder-antibot",
        "https://otx.alienvault.com/pulse/62987c8eafd38f2088986035",
        "https://twitter.com/blackorbird/status/1534373342446202881",
        "https://mp.weixin.qq.com/s/8j_rHA7gdMxY1_X8alj8Zg (Chinese)",
        "https://www.virustotal.com/gui/file/d74900bf7418f3ad39a5ab27326ad6591f792d1dfdfe44deb89f1b319b7d83b4/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2022-01-07",
      "indicators": {
        "ipv4": [
          "62.171.172.199:88"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/souiten/status/1474200802344386560",
        "https://www.virustotal.com/gui/file/ed4912f09e212479a319de1e95dd3e7d0e3574658be60782369c0e7a19ae0173/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-01-07",
      "indicators": {
        "domain": [
          "afcat.xyz"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1479502335328112645",
        "https://www.virustotal.com/gui/ip-address/144.126.141.41/relations",
        "https://www.virustotal.com/gui/file/d15f76acb846b237956a6373bd6646ef804419dd9a9fd3c9501acc241fcddff9/detection",
        "https://www.virustotal.com/gui/file/947b81c1ecdb34533f7bc9c41d6678fa525c17eae5b8f383e89c6c66db0743c1/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2022-01-06",
      "indicators": {
        "domain": [
          "dgpr.paknvay-pk.net",
          "mofa.paknvay-pk.net",
          "paknvay-pk.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/uslss_etr/status/1478784684452720646",
        "https://www.virustotal.com/gui/domain/paknvay-pk.net/relations",
        "https://www.virustotal.com/gui/ip-address/94.158.245.67/relations",
        "https://www.virustotal.com/gui/file/146e2c51cd7c904e0eeb641daa6ee956e80b48b198b9d2a9fd9b92b68399f9d1/detection",
        "https://www.virustotal.com/gui/file/e74be8bbad2fa8577b7383e6ad4dffd5d0cd44e75c0a7148a971c417d38d8ee7/detection",
        "https://blog.group-ib.com/sidewinder-antibot",
        "https://otx.alienvault.com/pulse/62987c8eafd38f2088986035"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-01-06",
      "indicators": {
        "domain": [
          "cdn-noc.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/domain/cdn-noc.net/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-01-06",
      "indicators": {
        "domain": [
          "careitservices.paknvay-pk.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/uslss_etr/status/1478784684452720646",
        "https://www.virustotal.com/gui/domain/paknvay-pk.net/relations",
        "https://www.virustotal.com/gui/ip-address/94.158.245.67/relations",
        "https://www.virustotal.com/gui/file/146e2c51cd7c904e0eeb641daa6ee956e80b48b198b9d2a9fd9b92b68399f9d1/detection",
        "https://www.virustotal.com/gui/file/e74be8bbad2fa8577b7383e6ad4dffd5d0cd44e75c0a7148a971c417d38d8ee7/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 3
      },
      "first_seen": "2022-01-05",
      "indicators": {
        "domain": [
          "digitalworldonline.net"
        ],
        "ipv4": [
          "164.68.108.153:4142",
          "164.68.108.153:5000",
          "164.68.108.153:8062"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/s1ckb017/status/1478750005594927109",
        "https://twitter.com/s1ckb017/status/1478750907827429380",
        "https://twitter.com/500mk500/status/1478758092611407876",
        "https://www.virustotal.com/gui/ip-address/164.68.108.153/relations",
        "https://www.virustotal.com/gui/file/88a174855020c69d7719779a09c9b1058ec6732aa0fb04343c1d82fe13ca2e6e/detection",
        "https://www.virustotal.com/gui/file/f4777f8751ed6818a693817513a5685f13a249803658d1f12190d7b1aa26079e/detection",
        "https://www.virustotal.com/gui/file/9abd42a9f2cc147db47d4bb9598870eab96a2094964e97a6cb231f58d4d4ada2/detection",
        "https://www.virustotal.com/gui/file/c401fc82d3ffdf118aac1bc247838fcd554b7faa3fd10aaa00ed83d80d00b87b/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-01-05",
      "indicators": {
        "domain": [
          "ms.teckblog.live",
          "teckblog.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1478496217789341698",
        "https://www.virustotal.com/gui/file/df0b09c9f359f2e086e5e6b78f6fc6f63c9be1c6023cc6ee1e698d6e0daba31b/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 9
      },
      "first_seen": "2021-12-26",
      "indicators": {
        "domain": [
          "afd.edu-cx.org",
          "asw-sns.link",
          "f.edu-cx.org",
          "fsfdsf.edu-cx.org",
          "go.edu-cx.org",
          "mofagovpk.edu-cx.org",
          "rkvisa200de.edu-cx.org",
          "rrkvisa200de.edu-cx.org",
          "yahoo.edu-cx.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1435546349856907268",
        "https://www.virustotal.com/gui/file/da08044373bc9bd54fd2ead9705446917e8f6e53d32f0885854e720e601cdbef/detection"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2021-12-26",
      "indicators": {
        "domain": [
          "bahariafoundation.live",
          "compress.bahariafoundation.live",
          "invitation.bahariafoundation.live",
          "mohgovsg.bahariafoundation.live",
          "pnwc.bahariafoundation.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1474901903418949636",
        "https://twitter.com/ShadowChasing1/status/1474901905474129922",
        "https://www.virustotal.com/gui/file/d3a0b7c5a1eafbf7d381b6ee064083496476163da5dfed53096fac36c2b30738/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2021-12-26",
      "indicators": {
        "domain": [
          "edu-cx.org",
          "paknavy.edu-cx.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1435546349856907268",
        "https://www.virustotal.com/gui/file/da08044373bc9bd54fd2ead9705446917e8f6e53d32f0885854e720e601cdbef/detection",
        "https://blog.group-ib.com/sidewinder-antibot",
        "https://otx.alienvault.com/pulse/62987c8eafd38f2088986035"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2021-12-26",
      "indicators": {
        "domain": [
          "nima.ppra.live",
          "ppra.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1433038639961804800",
        "https://www.virustotal.com/gui/file/8a1c9a28ba0c74bafd71705aa12128831d66bbae06536a81d680cd207e740a65/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-12-26",
      "indicators": {
        "domain": [
          "ppinewsagency.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1427258373532119044",
        "https://www.virustotal.com/gui/file/66ddbdfe9328d6a3f49abbb814252617fce0e05934ceeef9813e8bd30385fe50/detection",
        "https://blog.group-ib.com/sidewinder-antibot",
        "https://otx.alienvault.com/pulse/62987c8eafd38f2088986035"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-12-26",
      "indicators": {
        "domain": [
          "behr.ppinewsagency.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1427258373532119044",
        "https://www.virustotal.com/gui/file/66ddbdfe9328d6a3f49abbb814252617fce0e05934ceeef9813e8bd30385fe50/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 3
      },
      "first_seen": "2021-12-16",
      "indicators": {
        "ipv4": [
          "62.171.187.53:43",
          "62.171.187.53:44",
          "62.171.187.53:45"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/GGGGh0st/status/1471323446713864193",
        "https://www.virustotal.com/gui/file/1bf584616477e16b54d6be7ce4d69f7ea26ee7841ec9a17ed162f4d560ab125a/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "ipv4": 2,
        "url": 1
      },
      "first_seen": "2021-12-10",
      "indicators": {
        "ipv4": [
          "62.171.172.199:443",
          "62.171.172.199:81"
        ],
        "url": [
          "http://62.171.172.199"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1469399194435735553",
        "https://twitter.com/h2jazi/status/1469399196369313792",
        "https://www.virustotal.com/gui/file/2cf842ec2bac099d200c079375a4be7a4d0b3b5869dd739582b7df168e6c4fb6",
        "https://www.virustotal.com/gui/file/a7b52acc18ce7fd14b4a410019a1f0042a6743dcbe887e82d498130848ce195c/detection",
        "https://www.virustotal.com/gui/file/c02108f0b413ecdcb8fe48ff445cb75d45324bfd06734011409de57c7cfdeb73/detection",
        "https://www.virustotal.com/gui/file/4219de40e65c89ecba9bd392f744fa26b867cad82d1b994e1e9266482089d8f9/detection",
        "https://www.virustotal.com/gui/file/16467586cb1a11ce2e1ca81ae6fb490fbc8f5602245f883c14e940189dfd2b79/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "ipv4": 1,
        "url": 2
      },
      "first_seen": "2021-12-06",
      "indicators": {
        "ipv4": [
          "173.212.242.43:57149"
        ],
        "url": [
          "paryavaranindia.com/css/files/docs/Updated-Leave-Rules-Fourth-Edition/css",
          "paryavaranindia.com/css/files/hulfz/"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/souiten/status/1467674804211777536",
        "https://twitter.com/souiten/status/1467689489145339915",
        "https://twitter.com/souiten/status/1467693133001486337",
        "https://www.virustotal.com/gui/file/04206a2217be8d09e6dc6989d2a2b9aae8623f8fac962e5e07d9fa1a1577998b/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 10
      },
      "first_seen": "2021-12-03",
      "indicators": {
        "domain": [
          "afrepublic.xyz",
          "amsss.in",
          "appsstore.in",
          "eurekawatersolution.com",
          "maajankidevisevasansthan.org",
          "newsroom247.xyz",
          "republicofaf.xyz",
          "scout.fontsplugins.com",
          "scouttable.xyz",
          "securecheker.in"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.malwarebytes.com/threat-intelligence/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure/"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-12-03",
      "indicators": {
        "domain": [
          "webarchive-datacenter.herokuapp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1466686780531363840",
        "https://www.virustotal.com/gui/file/92dbd7f4399bce8b75e2c248af855df498bbed7e342c2d98ff6fcf15b611c50e"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2021-12-01",
      "indicators": {
        "domain": [
          "aitkenspencelogistics.mofa.live",
          "careitservices.mofa.live",
          "dsfvgbh.mofa.live",
          "mofa.live",
          "paknavy.mofa.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1466001768765018116",
        "https://www.virustotal.com/gui/file/38853bf262979313483310502d14a78db147586880d34571edf4d90e4bf05eb1"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-11-17",
      "indicators": {
        "domain": [
          "securedesk.one"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.malwarebytes.com/threat-intelligence/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2021-08-05",
      "indicators": {
        "domain": [
          "independenceday.pafwa.info",
          "pafwa.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.group-ib.com/sidewinder-antibot",
        "https://otx.alienvault.com/pulse/62987c8eafd38f2088986035"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 5,
        "ipv4": 3,
        "url": 2,
        "url_path": 2
      },
      "first_seen": "2021-08-03",
      "indicators": {
        "domain": [
          "cert.pk-gov.org",
          "dns1.pk-gov.org",
          "nccs.pk-gov.org",
          "ntc-pk.sytes.net",
          "quwa-paf.servehttp.com"
        ],
        "ipv4": [
          "141.136.0.91:443",
          "213.227.154.175:443",
          "91.193.18.248:443"
        ],
        "url": [
          "http://213.227.154.175",
          "http://78.142.29.118"
        ],
        "url_path": [
          "/F453457Pl_TMP347923592380/",
          "/pl200_TMP2831474WDF.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://mp.weixin.qq.com/s/dMFyLxsErYUZX7BQyBL9YQ (Chinese)"
      ],
      "total": 12
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2021-07-29",
      "indicators": {
        "domain": [
          "fbr.pak-web.com",
          "pak-web.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1420762840479109122",
        "https://twitter.com/ShadowChasing1/status/1420762846980308999",
        "https://www.virustotal.com/gui/file/468351924d611359fb181855331da98359bb1b926b5ce3ee8cd3330986d6e12c/detection",
        "https://www.virustotal.com/gui/file/84d5a31227eaa3be1134bb6f5a2f92c2621e738ee0c0c4f84758ae8d79d09526/detection",
        "https://blog.group-ib.com/sidewinder-antibot",
        "https://otx.alienvault.com/pulse/62987c8eafd38f2088986035"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2021-07-07",
      "indicators": {
        "domain": [
          "as.pakmarines.com",
          "dsadsa.pakmarines.com",
          "pakmarines.com",
          "pqa.gov.pakmarines.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1412695070659153925",
        "https://twitter.com/0xrb/status/1412727167151005703",
        "https://blog.group-ib.com/sidewinder-antibot",
        "https://otx.alienvault.com/pulse/62987c8eafd38f2088986035"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2021-07-07",
      "indicators": {
        "domain": [
          "gov.pakmarines.com",
          "jmicc-gov-pk.pakmarines.com",
          "pmaesa.pakmarines.com",
          "pnwc-gov-pk.pakmarines.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1412695070659153925",
        "https://twitter.com/0xrb/status/1412727167151005703"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-06-21",
      "indicators": {
        "domain": [
          "afghannewsnetwork.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.malwarebytes.com/threat-intelligence/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2021-06-11",
      "indicators": {
        "domain": [
          "cdn-in.net",
          "punjabpolice.gov.pk.standingoperatingprocedureforemergencythreat.cdn-in.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/BaoshengbinCumt/status/1403292104671916032"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-06-02",
      "indicators": {
        "domain": [
          "paknavy-gov-cvic.fbise.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1399969790471507968"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-05-28",
      "indicators": {
        "domain": [
          "cdn-gov.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1398171992554053632",
        "https://www.virustotal.com/gui/file/ff54e9228b7160f9272d67ad1423600d2cb7aa4d335412a28b11f63a517270fe/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2021-05-25",
      "indicators": {
        "domain": [
          "comsates.org",
          "crisismanagementunit.comsates.org",
          "mofa-gov-pk-wireless.comsates.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1397135889327804417"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2021-05-24",
      "indicators": {
        "domain": [
          "bahariafoundation.org",
          "pmaesa.bahariafoundation.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1396809305194590211",
        "https://www.virustotal.com/gui/file/caaf44f16dcbee93071887ab6844ed79975ccd20f9008deb93c13bfdb436e0b0/detection",
        "https://blog.group-ib.com/sidewinder-antibot",
        "https://otx.alienvault.com/pulse/62987c8eafd38f2088986035"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2021-05-11",
      "indicators": {
        "domain": [
          "img-google.paf-gov.com",
          "paf-gov.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1391976060472860675"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 27
      },
      "first_seen": "2021-04-28",
      "indicators": {
        "domain": [
          "autodiscover.mofagov-pk.online",
          "cpanel.mofagov-pk.online",
          "cpcalendars.mofagov-pk.online",
          "cpcontacts.mofagov-pk.online",
          "dgmi-share-folder-nepalarmy-mil-np-coas-sambodhan-pdf.netlify.app",
          "email-nepalarmy-mil-np-owa.netlify.app",
          "imail.aop.gov.af.egateway.nsc-gov.com",
          "mail-nepalarmy-mil-np-fsdafjsd.herokuapp.com",
          "mail-nepalarmy-mil-np-login-download.netlify.app",
          "mail-nepalarmy-mil-np-view.netlify.app",
          "mail-nepalpolice-gov-np-loginn.herokuapp.com",
          "mail-nscaf.hopto.org",
          "mail-ntmail-ntcnetnp.serveftp.comcnetnp.serveftp.com",
          "mail.mofagov-pk.online",
          "medeclinic.ae",
          "mod-cn.trans-del.net",
          "mofagov-pk.naatlibrary.com",
          "mofagov-pk.online",
          "naatlibrary.com",
          "nepalarmy.trans-del.net",
          "nsc-gov.com",
          "nsc-gov.net",
          "polyinc-global.trans-del.net",
          "trans-del.net",
          "webdisk.mofagov-pk.online",
          "webmail.mofagov-pk.online",
          "www-punjabpolice-gov-pk-sopforsecurityofforeignersandchinese.trans-aws.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/BaoshengbinCumt/status/1387233200871673856",
        "https://mp.weixin.qq.com/s/GWVz02_jGaUt_n9JxB1OwQ"
      ],
      "total": 27
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2021-04-21",
      "indicators": {
        "domain": [
          "afohs.mod-pak.co",
          "fbr.mod-pak.co",
          "mod-pak.co",
          "shaheenfoundation.mod-pak.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1384743822953877505"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2021-04-21",
      "indicators": {
        "domain": [
          "iugur.live",
          "mofa.iugur.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/BaoshengbinCumt/status/1384792855692988416",
        "https://www.virustotal.com/gui/ip-address/185.163.45.56/relations",
        "https://www.virustotal.com/gui/file/37a3855e05c63fdab773fdd39da021f2daf1961cc8137385db079960bdfa18c7/detection",
        "https://blog.group-ib.com/sidewinder-antibot",
        "https://otx.alienvault.com/pulse/62987c8eafd38f2088986035"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2021-04-21",
      "indicators": {
        "domain": [
          "bmac.iugur.live",
          "edu-mil.cn"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/BaoshengbinCumt/status/1384792855692988416",
        "https://www.virustotal.com/gui/ip-address/185.163.45.56/relations",
        "https://www.virustotal.com/gui/file/37a3855e05c63fdab773fdd39da021f2daf1961cc8137385db079960bdfa18c7/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-04-08",
      "indicators": {
        "domain": [
          "www-cdn.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/domain/www-cdn.net/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2021-03-11",
      "indicators": {
        "domain": [
          "afd-bdmil.cdn-pak.net",
          "fmprc.cdn-pak.net",
          "mofa.cdn-pak.net",
          "oimc.cdn-pak.net",
          "pakbj.cdn-pak.net",
          "poly.cdn-pak.net",
          "trgdte.cdn-pak.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/BaoshengbinCumt/status/1369916500014821377"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-03-11",
      "indicators": {
        "domain": [
          "ibn.cdn-pak.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/BaoshengbinCumt/status/1369916500014821377",
        "https://blog.group-ib.com/sidewinder-antibot",
        "https://otx.alienvault.com/pulse/62987c8eafd38f2088986035"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2021-03-05",
      "indicators": {
        "domain": [
          "cdn-pak.net",
          "mailmofagovpk.cdn-pak.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/DeadlyLynn/status/1367746507974270981",
        "https://www.virustotal.com/gui/file/bb58796f79a913a985eb41f0d12446e7ae8fe99fd3f0d432d77d8d82f202bf5f/detection",
        "https://blog.group-ib.com/sidewinder-antibot",
        "https://otx.alienvault.com/pulse/62987c8eafd38f2088986035"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-03-05",
      "indicators": {
        "domain": [
          "fqn-mil.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/DeadlyLynn/status/1367746507974270981",
        "https://www.virustotal.com/gui/file/bb58796f79a913a985eb41f0d12446e7ae8fe99fd3f0d432d77d8d82f202bf5f/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 12,
        "ipv4": 1
      },
      "first_seen": "2021-02-22",
      "indicators": {
        "domain": [
          "alsalaf.info",
          "attachments.gov-pk.info",
          "contact.gov-pak.org",
          "gov-pak.org",
          "gov-pk.info",
          "govt-pk.org",
          "nhsrcgovpk.servehttp.com",
          "onedrives.pk-gov.org",
          "pk-gov.org",
          "support-gov.myftp.org",
          "support.gov-pak.org",
          "support.govt-pk.org"
        ],
        "ipv4": [
          "151.236.11.147:57670"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1363683531067715584",
        "http://hackdig.com/02/hack-280699.htm",
        "https://app.any.run/tasks/b88e935c-b17a-4429-acdc-65156804ad1c/",
        "https://otx.alienvault.com/pulse/6033e84e6fb8fc369323e8e3/"
      ],
      "total": 13
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-02-20",
      "indicators": {
        "domain": [
          "cdn-secure.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/jfslowik/status/1362782587345727492"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2021-01-27",
      "indicators": {
        "domain": [
          "del-ivery.net",
          "trans-aws.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/BaoshengbinCumt/status/1354270351702691843"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2021-01-09",
      "indicators": {
        "domain": [
          "cdn-aws.net",
          "cdn-src.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/4b5e0ad20a8d143567cc424edf2010146e24a0b729de7ca0f66292141d363e57/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-01-06",
      "indicators": {
        "domain": [
          "paknavy-gov.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/domain/paknavy-gov.net/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-01-06",
      "indicators": {
        "domain": [
          "gov-cnn.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/domain/gov-cnn.net/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-01-06",
      "indicators": {
        "domain": [
          "gov-cn.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/domain/gov-cn.net/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2021-01-04",
      "indicators": {
        "domain": [
          "gov-af.net",
          "gov-crt.net",
          "gov-nadra.net",
          "gov-pbs.net",
          "gov-pmo.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/cyber__sloth/status/1346100925199478784"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-01-03",
      "indicators": {
        "domain": [
          "gov-mail.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1345559958796914694",
        "https://blog.group-ib.com/sidewinder-antibot",
        "https://otx.alienvault.com/pulse/62987c8eafd38f2088986035"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-12-25",
      "indicators": {
        "domain": [
          "cdn-re.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/BaoshengbinCumt/status/1342297125141454848",
        "https://www.virustotal.com/gui/file/c59c6c18f529c88cf352883b23af36f829b8ae1d17daa0762f028184cba7199b/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 19,
        "ipv4": 2
      },
      "first_seen": "2020-12-09",
      "indicators": {
        "domain": [
          "gov-af.org",
          "gov-np.org",
          "imail.aop.gov-af.org",
          "mail-apfgavnp.hopto.org",
          "mail-apfgovnp.ddns.net",
          "mail-kmgcom.ddns.net",
          "mail-mfagovcn.hopto.org",
          "mail-mofagovnp.hopto.org",
          "mail-mofagovnp.zapto.org",
          "mail-mofgovnp.hopto.org",
          "mail-ncporgnp.hopto.org",
          "mail-nepalarmymilnp.duckdns.org",
          "mail-nepalgovnp.duckdns.org",
          "mail-nepalpolicegov.hopto.org",
          "mail-nepalpolicegovnp.duckdns.org",
          "mail-nrborg.hopto.org",
          "mail-nscaf.myftp.org",
          "mail-ntcnetnp.serveftp.com",
          "mail.arg.gov-af.org"
        ],
        "ipv4": [
          "185.225.19.46:4589",
          "185.225.19.46:4875"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.trendmicro.com/en_us/research/20/l/sidewinder-leverages-south-asian-territorial-issues-for-spear-ph.html",
        "https://www.virustotal.com/gui/ip-address/185.225.19.46/relations",
        "https://otx.alienvault.com/pulse/5fd10760f9afb730d37c4742"
      ],
      "total": 21
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-11-24",
      "indicators": {
        "domain": [
          "ms-trace.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/mg2_tracy1/status/1331153718931177473",
        "https://www.virustotal.com/gui/file/7238f4e5edbe0e5a2242d8780fb58c47e7d32bf2c4f860c88c511c30675d0857/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-11-17",
      "indicators": {
        "domain": [
          "cdn-edu.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/RedDrip7/status/1328639418110865409",
        "https://www.virustotal.com/gui/file/1cbec920afe2f978b8f84e0a4e6b757d400aeb96e8c0a221130060b196ece010/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-11-05",
      "indicators": {
        "domain": [
          "gov-pok.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1324349418162720769",
        "https://twitter.com/ShadowChasing1/status/1324349684664528897",
        "https://www.virustotal.com/gui/domain/gov-pok.net/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-10-15",
      "indicators": {
        "domain": [
          "cdn-sop.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1316680709478604800",
        "https://twitter.com/mg2_tracy1/status/1316688407280586752",
        "https://www.virustotal.com/gui/file/280fb291d49f277067667838cdf30a940eaed9ed7712448158ea29e1ce6af86f/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2020-09-26",
      "indicators": {
        "domain": [
          "aws-pk.net",
          "cdn-aws-s2.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1308620752703299585"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-08-25",
      "indicators": {
        "domain": [
          "mil-pk.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/cyber__sloth/status/1298187291295461376",
        "https://www.virustotal.com/gui/ip-address/185.141.25.136/relations",
        "https://twitter.com/BaoshengbinCumt/status/1387233200871673856",
        "https://mp.weixin.qq.com/s/GWVz02_jGaUt_n9JxB1OwQ"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2020-08-24",
      "indicators": {
        "domain": [
          "asw-edu.net",
          "filesrvr.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1297902086747598852"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-08-21",
      "indicators": {
        "domain": [
          "fqn-cloud.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1296710024643796992",
        "https://www.virustotal.com/gui/file/a89189f1c7c101c8d9c2637e571c4f8546df3ea557a576090cde7b75009981a9/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1,
        "url": 1
      },
      "first_seen": "2020-08-11",
      "indicators": {
        "ipv4": [
          "202.58.104.100:81"
        ],
        "url": [
          "http://111.229.73.84"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/cyber__sloth/status/1293183011916193793",
        "https://twitter.com/cyber__sloth/status/1293187616897028098",
        "https://twitter.com/Arkbird_SOLG/status/1293221669134372865",
        "https://app.any.run/tasks/e3501b33-28a2-4b7c-bc79-d20891c4832e/"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2020-07-18",
      "indicators": {
        "domain": [
          "cdn-m1l.net",
          "tar-gz.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1284319235481538565"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-07-10",
      "indicators": {
        "domain": [
          "gov-mil.cn"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ccxsaber/status/1281413683013287936"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2020-06-03",
      "indicators": {
        "domain": [
          "chrom3.net",
          "r0dps.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1268214042637684738",
        "https://www.virustotal.com/gui/domain/chrom3.net/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-05-14",
      "indicators": {
        "domain": [
          "au-edu.km01s.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ccxsaber/status/1260775018306236416"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-05-14",
      "indicators": {
        "domain": [
          "kat0x.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Arkbird_SOLG/status/1260727623539404800"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-04-21",
      "indicators": {
        "domain": [
          "link-cdnl.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1252547080070914048"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2020-04-07",
      "indicators": {
        "domain": [
          "ap-ms.net",
          "d01fa.net",
          "fdn-en.net",
          "nrots.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Timele9527/status/1247325070520750080",
        "https://twitter.com/Timele9527/status/1247327952238284800",
        "https://twitter.com/Timele9527/status/1247376905956765697"
      ],
      "total": 4
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2020-01-16",
      "indicators": {
        "ipv4": [
          "110.10.176.193:4443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://mp.weixin.qq.com/s/L3dVwbkfTABtE4ZYtv5r4w",
        "https://otx.alienvault.com/pulse/5e206d8b77de0b2690b9946c"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-01-07",
      "indicators": {
        "domain": [
          "gov-pk.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://github.com/blackorbird/APT_REPORT/tree/master/sidewinder"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2020-01-06",
      "indicators": {
        "domain": [
          "aws-check.net",
          "deb-cn.net",
          "ms-db.net",
          "ms-ethics.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.trendmicro.com/trendlabs-security-intelligence/first-active-attack-exploiting-cve-2019-2215-found-on-google-play-linked-to-sidewinder-apt-group/",
        "https://otx.alienvault.com/pulse/5e133ac9f5eaf331885e74b4"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-12-31",
      "indicators": {
        "domain": [
          "fincruitconsulting.in"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Timele9527/status/1211852764688478216",
        "https://app.any.run/tasks/c8469e19-96a0-4f2f-9765-72acf72dee05/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-12-17",
      "indicators": {
        "domain": [
          "ap1-acl.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/RedDrip7/status/1206898954383740929"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2019-12-09",
      "indicators": {
        "ipv4": [
          "185.225.17.239:443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/0xCARNAGE/status/1203882560176218113",
        "https://app.any.run/tasks/3abfc241-3ab0-4016-acbb-040b44199d52/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-11-15",
      "indicators": {
        "domain": [
          "sd1-bin.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ccxsaber/status/1195281985335201794"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-11-15",
      "indicators": {
        "domain": [
          "reawk.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Timele9527/status/1195272502135549953",
        "https://www.virustotal.com/gui/domain/reawk.net/details"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-10-29",
      "indicators": {
        "domain": [
          "paknavy.gov.pk.ap1-port.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1189116884626493440"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-09-09",
      "indicators": {
        "domain": [
          "cdn-ps.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://mp.weixin.qq.com/s/pJ-rnzB7VMZ0feM2X0ZrHA"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-08-12",
      "indicators": {
        "domain": [
          "trans-can.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1160734383864610816"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 11
      },
      "first_seen": "2019-07-15",
      "indicators": {
        "domain": [
          "cdn-do.net",
          "cdn-edge.net",
          "cdn-list.net",
          "fb-dn.net",
          "google.com.d-dns.co",
          "msftupdate.srv-cdn.com",
          "nadra.gov.pk.d-dns.co",
          "pmo.cdn-load.net",
          "s12.cdn-apn.net",
          "s2.cdn-edge.net",
          "trans-pre.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Timele9527/status/1150597482310619136",
        "https://app.any.run/tasks/e15e1cd1-0c38-41b9-aa1e-a29562f17b3d/",
        "https://www.freebuf.com/articles/network/196788.html (Chinese)"
      ],
      "total": 11
    },
    {
      "counts": {
        "url": 2
      },
      "first_seen": "2019-07-08",
      "indicators": {
        "url": [
          "vidyasagaracademybrg.in/scripts/am/",
          "vidyasagaracademybrg.in/scripts/lnk/"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Timele9527/status/1147750939576586244"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2019-07-07",
      "indicators": {
        "url": [
          "http://167.86.116.39"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Timele9527/status/1147750939576586244"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 25
      },
      "first_seen": "2019-06-17",
      "indicators": {
        "domain": [
          "bd-gov.cdn-dl.cn",
          "bdgov-mopa.cdn-dl.cn",
          "biaa-org-bd.cdn-dl.cn",
          "biaa-org.cdn-dl.cn",
          "cdn-dl.cn",
          "gov-cn.cdn-dl.cn",
          "gov-pk.cdn-dl.cn",
          "hostmaster.cdn-dl.cn",
          "info-account.cdn-dl.cn",
          "ministry-gov.cdn-dl.cn",
          "ministry-interior-gov-pk.cdn-dl.cn",
          "mod-gov.cdn-dl.cn",
          "moe-gov.cdn-dl.cn",
          "moi-nadra.cdn-dl.cn",
          "mopa-bd.cdn-dl.cn",
          "mopa-bdgov.cdn-dl.cn",
          "mopa-govbd.cdn-dl.cn",
          "nadra-interior.cdn-dl.cn",
          "nadra-moi.cdn-dl.cn",
          "narda-moi.cdn-dl.cn",
          "neteease.cdn-dl.cn",
          "newmake.pw",
          "serve-dropbx-ap-east1.cdn-dl.cn",
          "suodeshui.cdn-dl.cn",
          "tiexue.cdn-dl.cn"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Sebdraven/status/1140597344720830471",
        "https://app.any.run/tasks/d7ce191d-c04f-4eff-a13c-02cbe746c256/",
        "https://www.virustotal.com/gui/domain/cdn-dl.cn/relations",
        "https://pastebin.com/rccqdjNB"
      ],
      "total": 25
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-03-22",
      "indicators": {
        "domain": [
          "nitb.pk-gov.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/malwrhunterteam/status/1109085127290900480"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2018-10-18",
      "indicators": {
        "domain": [
          "webserv-redir.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Sebdraven/status/1052864520522223616",
        "https://medium.com/@Sebdraven/apt-sidewinder-changes-theirs-ttps-to-install-their-backdoor-f92604a2739",
        "https://www.virustotal.com/#/ip-address/185.106.120.43",
        "https://twitter.com/Timele9527/status/1150597482310619136",
        "https://app.any.run/tasks/e15e1cd1-0c38-41b9-aa1e-a29562f17b3d/",
        "https://www.freebuf.com/articles/network/196788.html (Chinese)"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2018-10-18",
      "indicators": {
        "domain": [
          "heartissuehigh.win"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Sebdraven/status/1052864520522223616",
        "https://medium.com/@Sebdraven/apt-sidewinder-changes-theirs-ttps-to-install-their-backdoor-f92604a2739",
        "https://www.virustotal.com/#/ip-address/185.106.120.43"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2018-09-29",
      "indicators": {
        "domain": [
          "ap12.ms-update-server.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Timele9527/status/1150597482310619136",
        "https://app.any.run/tasks/e15e1cd1-0c38-41b9-aa1e-a29562f17b3d/",
        "https://www.freebuf.com/articles/network/196788.html (Chinese)"
      ],
      "total": 1
    }
  ]
}