{
  "aliases": [
    "apt-c-01",
    "poison ivy"
  ],
  "attack_id": null,
  "attack_name": null,
  "attack_url": null,
  "counts": {
    "domain": 183,
    "ipv4": 4,
    "url": 2
  },
  "first_seen": {
    "domain": {
      "126mailserver.serveftp.com": "2019-07-13",
      "143-244-183-240.cprapid.com": "2025-02-05",
      "360urlscan.com": "2023-03-31",
      "64-176-165-42.cprapid.com": "2025-02-05",
      "6c99b2c4cf5a.expolebanon.com": "2025-02-05",
      "access.webplurk.com": "2019-07-13",
      "accounts126.com": "2023-04-28",
      "afte856422126.com": "2025-02-05",
      "aliago.dyndns.dk": "2019-07-13",
      "annie165.zyns.com": "2019-07-13",
      "app.newfacebk.com": "2019-02-27",
      "as1688.webhop.org": "2019-07-13",
      "atrew56877.com": "2025-02-05",
      "avdsart.com": "2025-02-05",
      "babana.wikaba.com": "2019-07-13",
      "backaaa.beijingdasihei.com": "2019-07-13",
      "bearingonly.rebatesrule.net": "2019-07-13",
      "bribieislandhistory.com": "2025-02-05",
      "bt0116.servebbs.net": "2019-07-13",
      "buendnis-fuer-kinder.com": "2025-02-05",
      "caac-cn.com": "2024-11-29",
      "caac-cn.org": "2024-11-29",
      "canberk.gecekodu.com": "2019-07-13",
      "ceepitbj.servepics.com": "2019-07-13",
      "censor.site": "2023-01-13",
      "center-gai.com": "2025-02-05",
      "certifications.services": "2023-01-13",
      "chamber.icu": "2025-02-05",
      "check.blogdns.com": "2019-07-13",
      "china.serveblog.net": "2019-07-13",
      "chinamil.lflink.com": "2019-07-13",
      "chinmori.com": "2025-02-05",
      "cloudattaches-126.com": "2023-04-12",
      "clouddevice.site": "2023-01-13",
      "clouddrive.space": "2023-01-13",
      "cluster.safe360.dns05.com": "2019-07-13",
      "cnsa163.com": "2025-02-05",
      "cnwww.m-music.net": "2019-07-13",
      "co-journal163.com": "2025-02-05",
      "co-journalyeah.net": "2025-02-05",
      "comehigh.mefound.com": "2019-07-13",
      "contracter.org": "2025-02-05",
      "daotongintelligence163.com": "2025-02-05",
      "datamasterw.com": "2025-02-05",
      "difusora890.com": "2025-02-05",
      "dockerswarm2.cic-webpro.com": "2025-02-05",
      "download163ease.com": "2023-04-27",
      "eadfg56877.com": "2025-02-05",
      "eco163.com": "2025-02-05",
      "eleusina.com": "2025-02-05",
      "emailser163.serveusers.com": "2019-07-13",
      "esrebrenica.com": "2025-02-05",
      "fevupdate.ocry.com": "2019-07-13",
      "fff.dynamic-dns.net": "2019-07-13",
      "fored126.com": "2025-02-05",
      "gaewaa.upgrinfo.com": "2019-07-13",
      "geiwoaaa.qpoe.com": "2019-07-13",
      "givemea.ygto.com": "2019-07-13",
      "givemeaaa.upgrinfo.com": "2019-07-13",
      "gjfgw163.com": "2025-02-05",
      "goldlion.mefound.com": "2019-07-13",
      "gottardo-fs.com": "2025-02-05",
      "gscmovies.com": "2025-02-05",
      "gugupd.008.net": "2019-07-13",
      "guliu2008.9966.org": "2019-07-13",
      "gxbxzszl163.com": "2025-02-05",
      "gzkfj20240923.com": "2025-02-05",
      "h2024163.com": "2025-02-05",
      "hcqtji.com": "2025-02-05",
      "hopemilltheatre.com": "2025-02-05",
      "hostmaster.thicongcayxanh.com.vn": "2025-02-05",
      "howtochoosealawschool.com": "2025-02-05",
      "hunter.luminousstore.cloud": "2025-02-05",
      "huntercomunity.pterodactyl.web.id": "2025-02-05",
      "hy-zhqopin.mynumber.org": "2019-07-13",
      "hyssjc.securitytactics.com": "2019-07-13",
      "im1.dewabiz.com": "2025-02-05",
      "influxdb.kanoak.com": "2020-08-13",
      "intent.cyou": "2025-02-05",
      "janheweliusz.com": "2025-02-05",
      "jason.zyns.com": "2019-07-13",
      "javainfo.upgrinfo.com": "2019-07-13",
      "jerry.jkub.com": "2019-07-13",
      "k2024163.com": "2025-02-05",
      "kav2011.mooo.com": "2019-07-13",
      "kouwel.zapto.org": "2019-07-13",
      "krogoo.net": "2025-02-05",
      "l12254686126.com": "2025-02-05",
      "l12457784126.com": "2025-02-05",
      "l2024163.com": "2025-02-05",
      "l58785163.com": "2025-02-05",
      "l588188126.com": "2025-02-05",
      "l5886797126.com": "2025-02-05",
      "l63service.serveuser.com": "2019-07-13",
      "l8630639126.com": "2025-02-05",
      "laizaow.mefound.com": "2019-07-13",
      "ll63.net": "2025-02-05",
      "localhosts.ddns.us": "2019-07-13",
      "locarmi.com": "2025-02-05",
      "lorenlegarda.com": "2025-02-05",
      "m2024163.com": "2025-02-05",
      "mail.eco163.com": "2025-02-05",
      "mail.ll63.net": "2025-02-05",
      "mail.sends.sendsmtp.com": "2019-07-13",
      "mail163.mypop3.net": "2019-07-13",
      "mailsends.sendsmtp.com": "2019-07-13",
      "mediatvset.no-ip.org": "2019-07-13",
      "mg333.co": "2025-02-05",
      "microsoftword.serveuser.com": "2019-07-13",
      "moneyaaa.beijingdasihei.com": "2019-07-13",
      "monitoring.kanoak.com": "2020-08-13",
      "motices.ourhobby.com": "2019-07-13",
      "mp3.dnset.com": "2019-07-13",
      "museeairespace.com": "2025-02-05",
      "myaccount.emailsevr.net": "2019-07-13",
      "nefeliishot.com": "2025-02-05",
      "netlink.vizvaz.com": "2019-07-13",
      "newonelier.com": "2025-02-05",
      "nissantuners.com": "2025-02-05",
      "node.huntercomunity.pterodactyl.web.id": "2025-02-05",
      "nottinghamplayhouse.com": "2025-02-05",
      "o88252526126.com": "2025-02-05",
      "office.go.dyndns.org": "2019-07-13",
      "officepatch.dnset.com": "2019-07-13",
      "officeupdate.mynetav.com": "2020-08-13",
      "oneliotimes.com": "2025-02-05",
      "operater.solaris.nu": "2019-07-13",
      "pouhui.diskstation.org": "2019-07-13",
      "pps.longmusic.com": "2019-07-13",
      "private-site163.com": "2025-02-05",
      "ps1688.webhop.org": "2019-07-13",
      "psagwadar.com": "2025-02-05",
      "redebrasilatual.com": "2025-02-05",
      "regomiba.com": "2025-02-05",
      "rising.linkpc.net": "2019-07-13",
      "safe360.dns05.com": "2019-07-13",
      "sandy.ourhobby.com": "2019-07-13",
      "sater512368.com": "2025-02-05",
      "saymoil.com": "2025-02-05",
      "service.justdied.com": "2019-07-13",
      "shandong163.com": "2025-02-05",
      "shannon-fishery-board.com": "2025-02-05",
      "ship5688789.com": "2025-02-05",
      "shiper5688163.com": "2025-02-05",
      "shop-dustongel.com": "2025-02-05",
      "soagov.sytes.net": "2019-07-13",
      "soagov.zapto.org": "2019-07-13",
      "soasoa.sytes.net": "2019-07-13",
      "solovlxx.com": "2025-02-05",
      "ssy.ikwb.com": "2019-07-13",
      "ssy.mynumber.org": "2019-07-13",
      "stamfordshakespeare.com": "2025-02-05",
      "superset.greeninvietnam.org.vn": "2025-02-05",
      "svcsrset.ezua.com": "2019-07-13",
      "tanygraig.com": "2025-02-05",
      "teacat.https443.org": "2019-07-13",
      "technicel.vip": "2025-02-05",
      "technology.cyou": "2025-02-05",
      "telegrafonline.com": "2025-02-05",
      "the-real-mscleo.com": "2025-02-05",
      "thecatlab.space": "2025-02-05",
      "thisisstfc.com": "2025-02-05",
      "tong.wikaba.com": "2019-07-13",
      "tsumada.com": "2025-02-05",
      "tyeeconsulting.com": "2025-02-05",
      "update.newfacebk.com": "2019-02-27",
      "updateinfo.servegame.org": "2019-07-13",
      "updates.lflink.com": "2019-07-13",
      "usa08.serveftp.net": "2019-07-13",
      "uswebmail163.sendsmtp.com": "2019-07-13",
      "vernonmuseum.com": "2025-02-05",
      "waterfall.mynumber.org": "2019-07-13",
      "webplurk.com": "2021-04-08",
      "webupdate.dnsrd.com": "2019-07-13",
      "winsoftware.onedumb.com": "2020-08-13",
      "winsysupdate.dynamic-dns.net": "2019-07-13",
      "wmiaprp.ezua.com": "2019-07-13",
      "worldradihistory.com": "2025-02-05",
      "ww2gravestoneer.com": "2025-02-05",
      "wwwdo.tyur.acmetoy.com": "2019-07-13",
      "xinhua.redirectme.net": "2019-07-13",
      "zilarmala.com": "2025-02-05",
      "zxcv201789.dynssl.com": "2019-07-13"
    },
    "ipv4": {
      "128.199.134.3:443": "2024-11-29",
      "158.247.208.174:443": "2024-11-29",
      "202.182.108.174:80": "2020-08-13",
      "207.148.126.90:80": "2020-08-13"
    },
    "url": {
      "http://128.199.134.3": "2024-11-29",
      "http://158.247.208.174": "2024-11-29"
    }
  },
  "first_seen_precision": {
    "domain": {},
    "ipv4": {},
    "url": {}
  },
  "first_seen_range": {
    "earliest": "2019-02-27",
    "latest": "2025-02-05"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "126mailserver.serveftp.com",
      "143-244-183-240.cprapid.com",
      "360urlscan.com",
      "64-176-165-42.cprapid.com",
      "6c99b2c4cf5a.expolebanon.com",
      "access.webplurk.com",
      "accounts126.com",
      "afte856422126.com",
      "aliago.dyndns.dk",
      "annie165.zyns.com",
      "app.newfacebk.com",
      "as1688.webhop.org",
      "atrew56877.com",
      "avdsart.com",
      "babana.wikaba.com",
      "backaaa.beijingdasihei.com",
      "bearingonly.rebatesrule.net",
      "bribieislandhistory.com",
      "bt0116.servebbs.net",
      "buendnis-fuer-kinder.com",
      "caac-cn.com",
      "caac-cn.org",
      "canberk.gecekodu.com",
      "ceepitbj.servepics.com",
      "censor.site",
      "center-gai.com",
      "certifications.services",
      "chamber.icu",
      "check.blogdns.com",
      "china.serveblog.net",
      "chinamil.lflink.com",
      "chinmori.com",
      "cloudattaches-126.com",
      "clouddevice.site",
      "clouddrive.space",
      "cluster.safe360.dns05.com",
      "cnsa163.com",
      "cnwww.m-music.net",
      "co-journal163.com",
      "co-journalyeah.net",
      "comehigh.mefound.com",
      "contracter.org",
      "daotongintelligence163.com",
      "datamasterw.com",
      "difusora890.com",
      "dockerswarm2.cic-webpro.com",
      "download163ease.com",
      "eadfg56877.com",
      "eco163.com",
      "eleusina.com",
      "emailser163.serveusers.com",
      "esrebrenica.com",
      "fevupdate.ocry.com",
      "fff.dynamic-dns.net",
      "fored126.com",
      "gaewaa.upgrinfo.com",
      "geiwoaaa.qpoe.com",
      "givemea.ygto.com",
      "givemeaaa.upgrinfo.com",
      "gjfgw163.com",
      "goldlion.mefound.com",
      "gottardo-fs.com",
      "gscmovies.com",
      "gugupd.008.net",
      "guliu2008.9966.org",
      "gxbxzszl163.com",
      "gzkfj20240923.com",
      "h2024163.com",
      "hcqtji.com",
      "hopemilltheatre.com",
      "hostmaster.thicongcayxanh.com.vn",
      "howtochoosealawschool.com",
      "hunter.luminousstore.cloud",
      "huntercomunity.pterodactyl.web.id",
      "hy-zhqopin.mynumber.org",
      "hyssjc.securitytactics.com",
      "im1.dewabiz.com",
      "influxdb.kanoak.com",
      "intent.cyou",
      "janheweliusz.com",
      "jason.zyns.com",
      "javainfo.upgrinfo.com",
      "jerry.jkub.com",
      "k2024163.com",
      "kav2011.mooo.com",
      "kouwel.zapto.org",
      "krogoo.net",
      "l12254686126.com",
      "l12457784126.com",
      "l2024163.com",
      "l58785163.com",
      "l588188126.com",
      "l5886797126.com",
      "l63service.serveuser.com",
      "l8630639126.com",
      "laizaow.mefound.com",
      "ll63.net",
      "localhosts.ddns.us",
      "locarmi.com",
      "lorenlegarda.com",
      "m2024163.com",
      "mail.eco163.com",
      "mail.ll63.net",
      "mail.sends.sendsmtp.com",
      "mail163.mypop3.net",
      "mailsends.sendsmtp.com",
      "mediatvset.no-ip.org",
      "mg333.co",
      "microsoftword.serveuser.com",
      "moneyaaa.beijingdasihei.com",
      "monitoring.kanoak.com",
      "motices.ourhobby.com",
      "mp3.dnset.com",
      "museeairespace.com",
      "myaccount.emailsevr.net",
      "nefeliishot.com",
      "netlink.vizvaz.com",
      "newonelier.com",
      "nissantuners.com",
      "node.huntercomunity.pterodactyl.web.id",
      "nottinghamplayhouse.com",
      "o88252526126.com",
      "office.go.dyndns.org",
      "officepatch.dnset.com",
      "officeupdate.mynetav.com",
      "oneliotimes.com",
      "operater.solaris.nu",
      "pouhui.diskstation.org",
      "pps.longmusic.com",
      "private-site163.com",
      "ps1688.webhop.org",
      "psagwadar.com",
      "redebrasilatual.com",
      "regomiba.com",
      "rising.linkpc.net",
      "safe360.dns05.com",
      "sandy.ourhobby.com",
      "sater512368.com",
      "saymoil.com",
      "service.justdied.com",
      "shandong163.com",
      "shannon-fishery-board.com",
      "ship5688789.com",
      "shiper5688163.com",
      "shop-dustongel.com",
      "soagov.sytes.net",
      "soagov.zapto.org",
      "soasoa.sytes.net",
      "solovlxx.com",
      "ssy.ikwb.com",
      "ssy.mynumber.org",
      "stamfordshakespeare.com",
      "superset.greeninvietnam.org.vn",
      "svcsrset.ezua.com",
      "tanygraig.com",
      "teacat.https443.org",
      "technicel.vip",
      "technology.cyou",
      "telegrafonline.com",
      "the-real-mscleo.com",
      "thecatlab.space",
      "thisisstfc.com",
      "tong.wikaba.com",
      "tsumada.com",
      "tyeeconsulting.com",
      "update.newfacebk.com",
      "updateinfo.servegame.org",
      "updates.lflink.com",
      "usa08.serveftp.net",
      "uswebmail163.sendsmtp.com",
      "vernonmuseum.com",
      "waterfall.mynumber.org",
      "webplurk.com",
      "webupdate.dnsrd.com",
      "winsoftware.onedumb.com",
      "winsysupdate.dynamic-dns.net",
      "wmiaprp.ezua.com",
      "worldradihistory.com",
      "ww2gravestoneer.com",
      "wwwdo.tyur.acmetoy.com",
      "xinhua.redirectme.net",
      "zilarmala.com",
      "zxcv201789.dynssl.com"
    ],
    "ipv4": [
      "128.199.134.3:443",
      "158.247.208.174:443",
      "202.182.108.174:80",
      "207.148.126.90:80"
    ],
    "url": [
      "http://128.199.134.3",
      "http://158.247.208.174"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "GREENSPOT"
  ],
  "references": [
    "https://hunt.io/blog/greenspot-apt-targets-163com-fake-downloads-spoofing",
    "https://mp.weixin.qq.com/s/6wVfE9SE3wVuazxVppe3tA",
    "https://threatbook.io/domain/download163ease.com",
    "https://ti.360.net/uploads/2018/09/20/6f8ad451646c9eda1f75c5d31f39f668.pdf (Chinese)",
    "https://twitter.com/RedDrip7/status/1118009381679878144",
    "https://twitter.com/ThreatBookLabs/status/1613735997363359745",
    "https://twitter.com/ThreatBookLabs/status/1641631696742391808",
    "https://twitter.com/ThreatBookLabs/status/1645986803592347648",
    "https://twitter.com/ThreatBookLabs/status/1651978128439517185",
    "https://twitter.com/blackorbird/status/1293732897405378560",
    "https://www.virustotal.com/gui/domain/webplurk.com/relations",
    "https://www.virustotal.com/gui/file/534522b87f1158f28587f82b4df590546a004f17a648cfcff2bdcc5fc2cc3355/detection",
    "https://www.virustotal.com/gui/file/921ceb666fcfeee6cb031b334f6552bbf9e0364e51bb3972c2ff02a0779a5693/detection",
    "https://www.virustotal.com/gui/file/b101035ae8b25263cf7101fbc63df71682cf0963d59b28e28da6e83b35003452/detection",
    "https://www.virustotal.com/gui/file/d3591c2f1692fd1dd582f7fb377b74d1c8e82b2256d4b8c6cc9f9bc5b2fc39c3/detection",
    "https://x.com/blackorbird/status/1862442853445902387"
  ],
  "related": [
    {
      "evidence": [
        {
          "detail": "2 shared indicators",
          "kind": "infrastructure",
          "weight": 2.0
        }
      ],
      "slug": "PKPLUG"
    }
  ],
  "slug": "GREENSPOT",
  "timeline": [
    {
      "counts": {
        "domain": 90
      },
      "first_seen": "2025-02-05",
      "indicators": {
        "domain": [
          "143-244-183-240.cprapid.com",
          "64-176-165-42.cprapid.com",
          "6c99b2c4cf5a.expolebanon.com",
          "afte856422126.com",
          "atrew56877.com",
          "avdsart.com",
          "bribieislandhistory.com",
          "buendnis-fuer-kinder.com",
          "center-gai.com",
          "chamber.icu",
          "chinmori.com",
          "cnsa163.com",
          "co-journal163.com",
          "co-journalyeah.net",
          "contracter.org",
          "daotongintelligence163.com",
          "datamasterw.com",
          "difusora890.com",
          "dockerswarm2.cic-webpro.com",
          "eadfg56877.com",
          "eco163.com",
          "eleusina.com",
          "esrebrenica.com",
          "fored126.com",
          "gjfgw163.com",
          "gottardo-fs.com",
          "gscmovies.com",
          "gxbxzszl163.com",
          "gzkfj20240923.com",
          "h2024163.com",
          "hcqtji.com",
          "hopemilltheatre.com",
          "hostmaster.thicongcayxanh.com.vn",
          "howtochoosealawschool.com",
          "hunter.luminousstore.cloud",
          "huntercomunity.pterodactyl.web.id",
          "im1.dewabiz.com",
          "intent.cyou",
          "janheweliusz.com",
          "k2024163.com",
          "krogoo.net",
          "l12254686126.com",
          "l12457784126.com",
          "l2024163.com",
          "l58785163.com",
          "l588188126.com",
          "l5886797126.com",
          "l8630639126.com",
          "ll63.net",
          "locarmi.com",
          "lorenlegarda.com",
          "m2024163.com",
          "mail.eco163.com",
          "mail.ll63.net",
          "mg333.co",
          "museeairespace.com",
          "nefeliishot.com",
          "newonelier.com",
          "nissantuners.com",
          "node.huntercomunity.pterodactyl.web.id",
          "nottinghamplayhouse.com",
          "o88252526126.com",
          "oneliotimes.com",
          "private-site163.com",
          "psagwadar.com",
          "redebrasilatual.com",
          "regomiba.com",
          "sater512368.com",
          "saymoil.com",
          "shandong163.com",
          "shannon-fishery-board.com",
          "ship5688789.com",
          "shiper5688163.com",
          "shop-dustongel.com",
          "solovlxx.com",
          "stamfordshakespeare.com",
          "superset.greeninvietnam.org.vn",
          "tanygraig.com",
          "technicel.vip",
          "technology.cyou",
          "telegrafonline.com",
          "the-real-mscleo.com",
          "thecatlab.space",
          "thisisstfc.com",
          "tsumada.com",
          "tyeeconsulting.com",
          "vernonmuseum.com",
          "worldradihistory.com",
          "ww2gravestoneer.com",
          "zilarmala.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://hunt.io/blog/greenspot-apt-targets-163com-fake-downloads-spoofing"
      ],
      "total": 90
    },
    {
      "counts": {
        "domain": 2,
        "ipv4": 2,
        "url": 2
      },
      "first_seen": "2024-11-29",
      "indicators": {
        "domain": [
          "caac-cn.com",
          "caac-cn.org"
        ],
        "ipv4": [
          "128.199.134.3:443",
          "158.247.208.174:443"
        ],
        "url": [
          "http://128.199.134.3",
          "http://158.247.208.174"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/blackorbird/status/1862442853445902387",
        "https://mp.weixin.qq.com/s/6wVfE9SE3wVuazxVppe3tA",
        "https://www.virustotal.com/gui/file/534522b87f1158f28587f82b4df590546a004f17a648cfcff2bdcc5fc2cc3355/detection",
        "https://www.virustotal.com/gui/file/d3591c2f1692fd1dd582f7fb377b74d1c8e82b2256d4b8c6cc9f9bc5b2fc39c3/detection"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-04-28",
      "indicators": {
        "domain": [
          "accounts126.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1651978128439517185"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-04-27",
      "indicators": {
        "domain": [
          "download163ease.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://threatbook.io/domain/download163ease.com"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-04-12",
      "indicators": {
        "domain": [
          "cloudattaches-126.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1645986803592347648"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-03-31",
      "indicators": {
        "domain": [
          "360urlscan.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1641631696742391808"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2023-01-13",
      "indicators": {
        "domain": [
          "censor.site",
          "certifications.services",
          "clouddevice.site",
          "clouddrive.space"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ThreatBookLabs/status/1613735997363359745"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-04-08",
      "indicators": {
        "domain": [
          "webplurk.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/RedDrip7/status/1118009381679878144",
        "https://www.virustotal.com/gui/domain/webplurk.com/relations",
        "https://www.virustotal.com/gui/file/b101035ae8b25263cf7101fbc63df71682cf0963d59b28e28da6e83b35003452/detection",
        "https://ti.360.net/uploads/2018/09/20/6f8ad451646c9eda1f75c5d31f39f668.pdf (Chinese)"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4,
        "ipv4": 2
      },
      "first_seen": "2020-08-13",
      "indicators": {
        "domain": [
          "influxdb.kanoak.com",
          "monitoring.kanoak.com",
          "officeupdate.mynetav.com",
          "winsoftware.onedumb.com"
        ],
        "ipv4": [
          "202.182.108.174:80",
          "207.148.126.90:80"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1293732897405378560",
        "https://www.virustotal.com/gui/file/921ceb666fcfeee6cb031b334f6552bbf9e0364e51bb3972c2ff02a0779a5693/detection"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 76
      },
      "first_seen": "2019-07-13",
      "indicators": {
        "domain": [
          "126mailserver.serveftp.com",
          "access.webplurk.com",
          "aliago.dyndns.dk",
          "annie165.zyns.com",
          "as1688.webhop.org",
          "babana.wikaba.com",
          "backaaa.beijingdasihei.com",
          "bearingonly.rebatesrule.net",
          "bt0116.servebbs.net",
          "canberk.gecekodu.com",
          "ceepitbj.servepics.com",
          "check.blogdns.com",
          "china.serveblog.net",
          "chinamil.lflink.com",
          "cluster.safe360.dns05.com",
          "cnwww.m-music.net",
          "comehigh.mefound.com",
          "emailser163.serveusers.com",
          "fevupdate.ocry.com",
          "fff.dynamic-dns.net",
          "gaewaa.upgrinfo.com",
          "geiwoaaa.qpoe.com",
          "givemea.ygto.com",
          "givemeaaa.upgrinfo.com",
          "goldlion.mefound.com",
          "gugupd.008.net",
          "guliu2008.9966.org",
          "hy-zhqopin.mynumber.org",
          "hyssjc.securitytactics.com",
          "jason.zyns.com",
          "javainfo.upgrinfo.com",
          "jerry.jkub.com",
          "kav2011.mooo.com",
          "kouwel.zapto.org",
          "l63service.serveuser.com",
          "laizaow.mefound.com",
          "localhosts.ddns.us",
          "mail.sends.sendsmtp.com",
          "mail163.mypop3.net",
          "mailsends.sendsmtp.com",
          "mediatvset.no-ip.org",
          "microsoftword.serveuser.com",
          "moneyaaa.beijingdasihei.com",
          "motices.ourhobby.com",
          "mp3.dnset.com",
          "myaccount.emailsevr.net",
          "netlink.vizvaz.com",
          "office.go.dyndns.org",
          "officepatch.dnset.com",
          "operater.solaris.nu",
          "pouhui.diskstation.org",
          "pps.longmusic.com",
          "ps1688.webhop.org",
          "rising.linkpc.net",
          "safe360.dns05.com",
          "sandy.ourhobby.com",
          "service.justdied.com",
          "soagov.sytes.net",
          "soagov.zapto.org",
          "soasoa.sytes.net",
          "ssy.ikwb.com",
          "ssy.mynumber.org",
          "svcsrset.ezua.com",
          "teacat.https443.org",
          "tong.wikaba.com",
          "updateinfo.servegame.org",
          "updates.lflink.com",
          "usa08.serveftp.net",
          "uswebmail163.sendsmtp.com",
          "waterfall.mynumber.org",
          "webupdate.dnsrd.com",
          "winsysupdate.dynamic-dns.net",
          "wmiaprp.ezua.com",
          "wwwdo.tyur.acmetoy.com",
          "xinhua.redirectme.net",
          "zxcv201789.dynssl.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/RedDrip7/status/1118009381679878144",
        "https://www.virustotal.com/gui/domain/webplurk.com/relations",
        "https://www.virustotal.com/gui/file/b101035ae8b25263cf7101fbc63df71682cf0963d59b28e28da6e83b35003452/detection",
        "https://ti.360.net/uploads/2018/09/20/6f8ad451646c9eda1f75c5d31f39f668.pdf (Chinese)"
      ],
      "total": 76
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2019-02-27",
      "indicators": {
        "domain": [
          "app.newfacebk.com",
          "update.newfacebk.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1293732897405378560",
        "https://www.virustotal.com/gui/file/921ceb666fcfeee6cb031b334f6552bbf9e0364e51bb3972c2ff02a0779a5693/detection"
      ],
      "total": 2
    }
  ]
}