{
  "aliases": [
    "Dark Basin"
  ],
  "attack_id": null,
  "attack_name": null,
  "attack_url": null,
  "counts": {
    "domain": 462
  },
  "first_seen": {
    "domain": {
      "2mblk.com": "2020-06-10",
      "4mblk.com": "2023-11-15",
      "ablyazovangels.com": "2023-11-15",
      "ablyazovcog.com": "2023-11-15",
      "ablyazovcrimestory.com": "2023-11-15",
      "ablyazovcrimesyndicate.com": "2023-11-15",
      "ablyazovcriminalgang.com": "2023-11-15",
      "ablyazovcriminals.com": "2023-11-15",
      "ablyazovgang.com": "2023-11-15",
      "ablyazovmafia.com": "2023-11-15",
      "ablyazovorganisedcrime.com": "2023-11-15",
      "affiliatedomainservice.com": "2023-11-15",
      "affliatedomainservice.com": "2020-06-10",
      "allaboutiot.website": "2020-06-10",
      "anitmationworldnews.com": "2020-06-10",
      "anothershortnr.com": "2020-06-10",
      "aplsrvrer.com": "2020-06-10",
      "assuredreturnplan.com": "2020-06-10",
      "auditionregistrationonline.com": "2020-06-10",
      "backwaterreservoir.com": "2020-06-10",
      "basemailservice.com": "2020-06-10",
      "baseserveremailbg.com": "2020-06-10",
      "basichostingrussia.com": "2020-06-10",
      "basichostnetservice.com": "2020-06-10",
      "basicmyoffshore.com": "2020-06-10",
      "basicruoffshore.com": "2020-06-10",
      "basicservicehk.com": "2020-06-10",
      "basicservicelux.com": "2020-06-10",
      "basicservicemy.com": "2020-06-10",
      "basicservicerus.com": "2020-06-10",
      "basicservicesg.com": "2020-06-10",
      "basicsgoffshore.com": "2020-06-10",
      "bellsouthnetwork.com": "2020-06-10",
      "belowmargins.com": "2020-06-10",
      "bitserverhk.com": "2020-06-10",
      "bitserverlux.com": "2020-06-10",
      "blogforpranks.com": "2020-06-10",
      "blogserverlx.com": "2020-06-10",
      "browserdirectservice.com": "2020-06-10",
      "browserextensions.info": "2020-06-10",
      "browserredirect.com": "2020-06-10",
      "bsrvrer.com": "2020-06-10",
      "budgtoffmy.com": "2023-11-15",
      "budgtoffru.com": "2023-11-15",
      "buzzoffbul.com": "2020-06-10",
      "buzzoffhk.com": "2020-06-10",
      "buzzoffmy.com": "2020-06-10",
      "buzzoffru.com": "2020-06-10",
      "buzzoffsg.com": "2020-06-10",
      "capitalinvestmentsllp.com": "2020-06-10",
      "cathostingservice.com": "2020-06-10",
      "chatserverrussia.com": "2020-06-10",
      "checkmailserverhk.com": "2020-06-10",
      "chromeperfection.com": "2020-06-10",
      "com-ar-en-us.com": "2020-06-10",
      "com-authmail.com": "2020-06-10",
      "com-biz.website": "2023-11-15",
      "com-com-us.com": "2023-11-15",
      "com-com.website": "2023-11-15",
      "com-en-us.co.uk": "2023-11-15",
      "com-er-en-us.com": "2020-06-10",
      "com-hl-en-us.com": "2023-11-15",
      "com-io-en-us.com": "2020-06-10",
      "com-mail-us.com": "2023-11-15",
      "com-mail.net": "2023-11-15",
      "com-nh-en-us.com": "2020-06-10",
      "com-oa-en-us.com": "2020-06-10",
      "com-us-en-us.com": "2023-11-15",
      "com-website33.biz": "2020-06-10",
      "com-website33.com": "2020-06-10",
      "com-website33.info": "2020-06-10",
      "com-website33.net": "2020-06-10",
      "com-website33.org": "2020-06-10",
      "comservicelogin.com": "2023-11-15",
      "corn-en-gb.com": "2020-06-10",
      "corn-en-us.com": "2020-06-10",
      "corn-fr-fr.com": "2020-06-10",
      "corn-lang-eng.com": "2020-06-10",
      "corn-loginservicesverified.com": "2020-06-10",
      "corn-msrvrgr.com": "2020-06-10",
      "corn-servicelogin.com": "2020-06-10",
      "corn-ukr.com": "2020-06-10",
      "csrvrer.com": "2020-06-10",
      "cyberanalyticals.com": "2023-11-15",
      "cyberserverusa.com": "2020-06-10",
      "deferrer.website": "2023-11-15",
      "demoprojectsuk.com": "2020-06-10",
      "dnsserverprv.com": "2020-06-10",
      "domainblacklistcheck.com": "2020-06-10",
      "domainemailhostings.com": "2020-06-10",
      "domainexpertswebuk.com": "2023-11-15",
      "domainforhostuk.com": "2020-06-10",
      "domainformailinguk.com": "2020-06-10",
      "domainhostnetworkuk.com": "2020-06-10",
      "domainhostnetworkusa.com": "2020-06-10",
      "domainhostworkeu.com": "2020-06-10",
      "domainlocalhostingeu.com": "2020-06-10",
      "domainlocalhostinghk.com": "2020-06-10",
      "domainlocalhostinguk.com": "2020-06-10",
      "domainmanager33.com": "2020-06-10",
      "domainmanager33.site": "2020-06-10",
      "domainmanager33.website": "2020-06-10",
      "domainserver322.com": "2020-06-10",
      "domainserver399.com": "2020-06-10",
      "domainserveractive.com": "2020-06-10",
      "domainsforfreehosting.com": "2020-06-10",
      "domainsforsupport.com": "2020-06-10",
      "domainsfortechhelp.com": "2020-06-10",
      "domainsserver4f.com": "2023-11-15",
      "dotnerserversg.com": "2020-06-10",
      "dotnetserverhk.com": "2020-06-10",
      "dsrvrer.com": "2020-06-10",
      "ecom-servicelogin.com": "2020-06-10",
      "economyfeeds.com": "2020-06-10",
      "economyservicesil.com": "2020-06-10",
      "ecoserveraus.com": "2020-06-10",
      "emailauthservice.com": "2020-06-10",
      "emailbaseserverhl.com": "2020-06-10",
      "emaildeliverysuccess.com": "2020-06-10",
      "emailhostholland.com": "2020-06-10",
      "emailhostsecurehk.com": "2020-06-10",
      "emailmappingservice.com": "2020-06-10",
      "emailsecurenode.com": "2020-06-10",
      "emailserver399.com": "2020-06-10",
      "emailserver4859.com": "2020-06-10",
      "emailserver499.com": "2020-06-10",
      "emailserverhk48.com": "2020-06-10",
      "emailserverholland.com": "2020-06-10",
      "emailservername299.com": "2020-06-10",
      "emailseverrus23.com": "2020-06-10",
      "emailvalidateservice.com": "2020-06-10",
      "esrvrer.com": "2020-06-10",
      "euanticorruption.com": "2023-11-15",
      "exchangeserver2345.com": "2020-06-10",
      "exchangeserverformailing.com": "2020-06-10",
      "extranetserviceonline.com": "2020-06-10",
      "fastserverasia.com": "2020-06-10",
      "fastservereurope.com": "2020-06-10",
      "fastserveruk.com": "2020-06-10",
      "fastserverusa.com": "2020-06-10",
      "forumtechtopic.com": "2020-06-10",
      "frwrdrurl.com": "2020-06-10",
      "frwrdrwr.com": "2020-06-10",
      "getemailopens.com": "2020-06-10",
      "getreadytorunhalfmarathon.com": "2020-06-10",
      "getsetgoforhealth.com": "2020-06-10",
      "goomail.ml": "2023-11-15",
      "hardcoretechnologiesllp.com": "2020-06-10",
      "hathwaynetwork.com": "2020-06-10",
      "hbh-europe-ripoff-report.com": "2023-11-15",
      "hiretechservicehg.com": "2020-06-10",
      "hkdrillonline.com": "2020-06-10",
      "hklinbas.com": "2020-06-10",
      "hollandtourandtravel.com": "2020-06-10",
      "homeforallorphans.com": "2020-06-10",
      "homeremedytipntricks.com": "2020-06-10",
      "homeserver87.com": "2020-06-10",
      "hongkongshippingcompany.com": "2020-06-10",
      "hostbasichk.com": "2020-06-10",
      "hostbasicholl.com": "2020-06-10",
      "hostbasicmy.com": "2020-06-10",
      "hostbasicru.com": "2020-06-10",
      "hostbasicsg.com": "2020-06-10",
      "hostemailsecureserver.com": "2020-06-10",
      "hostemailserver.com": "2020-06-10",
      "hostfeasta.com": "2020-06-10",
      "hostingserviceclean.com": "2020-06-10",
      "hostingserviceforall.com": "2020-06-10",
      "hostingservicesloyal.com": "2020-06-10",
      "hostingservicesukit.com": "2020-06-10",
      "hostmailsecure.com": "2020-06-10",
      "hostmailsecureserver.com": "2020-06-10",
      "hostsecuremail.com": "2020-06-10",
      "hostsecuremail544.com": "2020-06-10",
      "hostserverrus.com": "2020-06-10",
      "hostusewithtech.com": "2020-06-10",
      "imapserverholland.com": "2020-06-10",
      "imgsrvrer.com": "2020-06-10",
      "inrsrvrer.com": "2020-06-10",
      "internetmarketingservicehg.com": "2020-06-10",
      "interserver439.com": "2020-06-10",
      "intrsrvrer.com": "2020-06-10",
      "isrvrer.com": "2020-06-10",
      "javaservermy.com": "2020-06-10",
      "knowledgebaseonlineuk.com": "2020-06-10",
      "linkfollowservice.com": "2020-06-10",
      "linkforwrder.com": "2020-06-10",
      "linkshortnr.com": "2020-06-10",
      "linkshrtnr22.com": "2020-06-10",
      "linksrtnr.com": "2020-06-10",
      "linuxbasichk.com": "2020-06-10",
      "linuxbasichk1.com": "2020-06-10",
      "linuxbasicmy.com": "2020-06-10",
      "linuxbasicru.com": "2020-06-10",
      "linuxbasicru1.com": "2020-06-10",
      "linuxbasicru3.com": "2023-11-15",
      "linuxbasicsg.com": "2020-06-10",
      "linuxbasicsg1.com": "2020-06-10",
      "linuxhostingplatformuk.com": "2020-06-10",
      "linuxserverfast.com": "2020-06-10",
      "lnkshrtnr.com": "2020-06-10",
      "localhostinguk.com": "2020-06-10",
      "localserversa.com": "2020-06-10",
      "loginauths-service.com": "2020-06-10",
      "logincontrolserver.com": "2020-06-10",
      "loginservercheck.com": "2020-06-10",
      "loginservicebasic.com": "2020-06-10",
      "loginservicehelp.com": "2020-06-10",
      "loginservicesmailsonlinesaccounts.com": "2020-06-10",
      "loginserviceunified.com": "2020-06-10",
      "logserver39.com": "2020-06-10",
      "look-com.org": "2023-11-15",
      "luxlinbas.com": "2020-06-10",
      "mail-com.org": "2023-11-15",
      "mail-logger.com": "2020-06-10",
      "mail-msrgr.info": "2020-06-10",
      "mailannounceservice.com": "2020-06-10",
      "mailapiservice.com": "2020-06-10",
      "mailauthenticatorservice.com": "2020-06-10",
      "mailauthorizationservice.com": "2020-06-10",
      "mailauthservice.com": "2020-06-10",
      "mailauthservice399.com": "2020-06-10",
      "mailchimpservice.com": "2020-06-10",
      "mailcollectorservice.com": "2020-06-10",
      "mailcommunicationservice.com": "2020-06-10",
      "mailcommute.com": "2020-06-10",
      "maildeliveryagent.com": "2020-06-10",
      "mailer-domain.com": "2020-06-10",
      "mailerdomain56.com": "2020-06-10",
      "mailgatorservice.com": "2020-06-10",
      "mailhostingsecurenet.com": "2020-06-10",
      "mailingserver938.com": "2020-06-10",
      "maillinkservice.com": "2020-06-10",
      "mailmarknotes.com": "2020-06-10",
      "mailmarkservice.com": "2020-06-10",
      "mailpostsecure.com": "2020-06-10",
      "mailpostsecureservice.com": "2020-06-10",
      "mailrockservice.com": "2023-11-15",
      "mailsecurehost.com": "2020-06-10",
      "mailsecureservers.com": "2020-06-10",
      "mailserver39.com": "2020-06-10",
      "mailserver89.com": "2023-11-15",
      "mailserver89.net": "2020-06-10",
      "mailserver89.org": "2020-06-10",
      "mailserverdirect3994.com": "2020-06-10",
      "mailserverenterprise.com": "2020-06-10",
      "mailservereurope.com": "2020-06-10",
      "mailserveroutlook.com": "2020-06-10",
      "mailserverru2099.com": "2020-06-10",
      "mailservershare.com": "2020-06-10",
      "mailserveruk.com": "2020-06-10",
      "mailserveruk89.com": "2020-06-10",
      "mailserveruk89.net": "2020-06-10",
      "mailserveruk89.org": "2020-06-10",
      "mailserviceloginonline.com": "2020-06-10",
      "mailtickr.com": "2020-06-10",
      "mailtransferserver.com": "2020-06-10",
      "maxlaboratories.com": "2020-06-10",
      "mblk1.com": "2020-06-10",
      "mgrsr.com": "2020-06-10",
      "minrsrvr.com": "2020-06-10",
      "mnrsrvrer.com": "2020-06-10",
      "mrgrhr.com": "2020-06-10",
      "msgrdrg.com": "2023-11-15",
      "msrdr.com": "2018-08-30",
      "msrfrgr.com": "2020-06-10",
      "msrvrgeh.com": "2020-06-10",
      "msrvrgh.com": "2020-06-10",
      "msrwr.com": "2018-08-30",
      "mvrsrvrer.com": "2020-06-10",
      "myfacetik.cf": "2023-11-15",
      "mylinbas.com": "2020-06-10",
      "mywebredirect.info": "2020-06-10",
      "nameserver3476.com": "2020-06-10",
      "nameserverredirect.com": "2023-11-15",
      "netcomserviceonline.com": "2023-11-15",
      "netgeoserversg.com": "2020-06-10",
      "netmapservice.com": "2020-06-10",
      "netsecureemailservice.com": "2020-06-10",
      "netsecurehostingmy.com": "2020-06-10",
      "netsecuremailhosting.com": "2020-06-10",
      "netsecureserver399.com": "2020-06-10",
      "netserviceru.com": "2020-06-10",
      "networkshareserver.com": "2020-06-10",
      "newserver39.com": "2020-06-10",
      "nigeriaoilleaks.com": "2023-11-15",
      "nodeserver50.com": "2020-06-10",
      "nrgrsrvrer.com": "2020-06-10",
      "offshorecompanyllp.com": "2020-06-10",
      "offshoretoursntravels.com": "2020-06-10",
      "ondemand.pushthisurl.com": "2023-11-15",
      "onlineloginportal.com": "2020-06-10",
      "onlineloginportalhk.com": "2020-06-10",
      "onlineloginportalmy.com": "2020-06-10",
      "onlineloginportalsg.com": "2020-06-10",
      "onlineloginserviceeu.com": "2020-06-10",
      "onlineloginserviceuk.com": "2020-06-10",
      "onlineloginserviceusa.com": "2020-06-10",
      "onlinemusicstoreuk.com": "2020-06-10",
      "onlinenetworkinghelp.com": "2023-11-15",
      "openserverholland.com": "2020-06-10",
      "optionalblogging.com": "2020-06-10",
      "optionalblogginges.com": "2020-06-10",
      "optionalbloggingeu.com": "2020-06-10",
      "optionalblogginguk.com": "2020-06-10",
      "optionaldesigners.com": "2020-06-10",
      "optionsothego.com": "2020-06-10",
      "pageredirectservice.com": "2020-06-10",
      "pageserver299.com": "2020-06-10",
      "pageserver77.com": "2020-06-10",
      "pageserverru.com": "2020-06-10",
      "personaldoaminru.com": "2020-06-10",
      "personaldoaminsg.com": "2020-06-10",
      "phpwebserver34.best": "2020-06-10",
      "phpwebserver34.site": "2020-06-10",
      "phpwebserver34.tech": "2020-06-10",
      "phpwebserver34.xyz": "2020-06-10",
      "planyourexoticvacation.com": "2020-06-10",
      "portfoliofasinating.com": "2020-06-10",
      "post-manager.com": "2023-11-15",
      "postmarkapiservice.com": "2020-06-10",
      "postserverem.com": "2020-06-10",
      "postserviceemaildomain.com": "2020-06-10",
      "ppleid.org": "2023-11-15",
      "productdemoservice.com": "2020-06-10",
      "promotespritialbelief.com": "2020-06-10",
      "prwebsiteuk.com": "2020-06-10",
      "racksackserveruk.com": "2020-06-10",
      "rackserver39.com": "2020-06-10",
      "readmytipsntricks.com": "2020-06-10",
      "redirectonline.xyz": "2020-06-10",
      "redirectserviceonline.com": "2020-06-10",
      "registrationonlineeurope.com": "2020-06-10",
      "rockerhostings.com": "2020-06-10",
      "rulinuxbasic.com": "2020-06-10",
      "ruslinbas.com": "2020-06-10",
      "russialinuxbasic.com": "2020-06-10",
      "saferedirect.pw": "2023-11-15",
      "santanaservice.com": "2020-06-10",
      "sapserver39j.com": "2020-06-10",
      "sapserverhg.com": "2020-06-10",
      "sapserverhike.com": "2020-06-10",
      "sapserverhipe.com": "2020-06-10",
      "searchsimple.info": "2020-06-10",
      "searchsimple.net": "2020-06-10",
      "secureemailserver65.com": "2020-06-10",
      "securemailhost46.com": "2020-06-10",
      "secureserver9898.com": "2020-06-10",
      "secureserverasia.com": "2020-06-10",
      "secureservereurope.com": "2020-06-10",
      "selectedmaxstores.com": "2020-06-10",
      "selectedservicemy.com": "2020-06-10",
      "selectedserviceru.com": "2020-06-10",
      "selectedservicesg.com": "2020-06-10",
      "selectiveservicemax.com": "2020-06-10",
      "selectyourgroom.com": "2020-06-10",
      "serverasiasap.com": "2020-06-10",
      "serverdemoservice.com": "2020-06-10",
      "serverforhelphk.com": "2020-06-10",
      "serverforhelplux.com": "2023-11-15",
      "serverforhelpmy.com": "2023-11-15",
      "serverforhelpru.com": "2020-06-10",
      "serverforhelpsg.com": "2020-06-10",
      "serverforhiretech.com": "2020-06-10",
      "serverforhome.com": "2020-06-10",
      "serverformailings.com": "2020-06-10",
      "serverfornetworks.com": "2020-06-10",
      "serverforshort.com": "2020-06-10",
      "serverfortechhelp.com": "2020-06-10",
      "serverfortechies.com": "2020-06-10",
      "serverforzapper.com": "2020-06-10",
      "servergateway33.com": "2020-06-10",
      "servergateway56.com": "2020-06-10",
      "serverhello54.com": "2020-06-10",
      "serverloadbalance.com": "2020-06-10",
      "servermailing34.com": "2020-06-10",
      "servermain43.com": "2020-06-10",
      "servermappingserviceonline.com": "2023-11-15",
      "serversap54.com": "2020-06-10",
      "serviceasneed.com": "2023-11-15",
      "serviceforneworder.com": "2020-06-10",
      "servicegoingfar.com": "2020-06-10",
      "sglinbas.com": "2020-06-10",
      "shadymario.com": "2023-11-15",
      "shipnyatchholland.com": "2020-06-10",
      "shoponlinefreesg.com": "2020-06-10",
      "shoponlinefreeuk.com": "2020-06-10",
      "short-ner.com": "2020-06-10",
      "shortenup.com": "2020-06-10",
      "shortenurlservices.com": "2020-06-10",
      "shortformurl.com": "2020-06-10",
      "shortformurl.xyz": "2020-06-10",
      "shortlinkcut.com": "2020-06-10",
      "shortnerserviceonline.com": "2020-06-10",
      "shortserver1.com": "2023-11-15",
      "shorturlservice.com": "2020-06-10",
      "shrinkandshareurl.com": "2020-06-10",
      "shrinkthisurl.com": "2020-06-10",
      "shrtnerlnk.com": "2020-06-10",
      "siteadmineurope.com": "2020-06-10",
      "siteadminhk.com": "2020-06-10",
      "sitebloginfo.com": "2020-06-10",
      "smtpserver389.com": "2020-06-10",
      "smtpserver466.com": "2020-06-10",
      "snaphosterservice.com": "2020-06-10",
      "softnetworksolutions.com": "2020-06-10",
      "softredirect.info": "2020-06-10",
      "srtnr.co": "2020-06-10",
      "srtnr.com": "2023-11-15",
      "srvrgruk.com": "2020-06-10",
      "standardofficeholland.com": "2020-06-10",
      "standardofficeil.com": "2020-06-10",
      "standardofficeuk.com": "2020-06-10",
      "strngbltru.com": "2020-06-10",
      "strongbolthostinghk.com": "2020-06-10",
      "strongwingtechnologies.com": "2020-06-10",
      "strurl.click": "2020-06-10",
      "supportserviceeu.com": "2020-06-10",
      "tineeurl.com": "2020-06-10",
      "tinyurlshortner.com": "2020-06-10",
      "tnyurlservice.com": "2020-06-10",
      "trackserviceonline.xyz": "2020-06-10",
      "transferdomainhk.com": "2020-06-10",
      "transferdomainlu.com": "2020-06-10",
      "transferdomainmy.com": "2020-06-10",
      "transferserver33.com": "2023-11-15",
      "tricktravelbooking.com": "2020-06-10",
      "trustedserviceonline.com": "2020-06-10",
      "trusteventservices.com": "2020-06-10",
      "ultimateresponseservice.com": "2020-06-10",
      "ultronnetworksolution.com": "2020-06-10",
      "un-told.net": "2020-06-10",
      "updatenameserver45.com": "2020-06-10",
      "upgradetravelservice.com": "2020-06-10",
      "usewithcareathome.com": "2020-06-10",
      "watchmanservice.com": "2023-11-15",
      "webdomainexperts.com": "2023-11-15",
      "webhostwebcare.com": "2023-11-15",
      "webmailmanageruk.com": "2023-11-15",
      "webmasterserver39.com": "2020-06-10",
      "webnetonlineservice.com": "2020-06-10",
      "webredirect.click": "2020-06-10",
      "webredirect39.com": "2020-06-10",
      "websecurehostings.com": "2020-06-10",
      "webserver39.com": "2020-06-10",
      "webserver39490.com": "2020-06-10",
      "webserver91.website": "2020-06-10",
      "webserverdomaineu.com": "2020-06-10",
      "webserverdomainhk.com": "2020-06-10",
      "webserverdomainuk.com": "2020-06-10",
      "webserverdomainusa.com": "2020-06-10",
      "webserverhollandservice.com": "2020-06-10",
      "webserveroginusa.com": "2020-06-10",
      "webserveronline9.com": "2020-06-10",
      "webserverredirect99.com": "2020-06-10",
      "websiteadminuk.com": "2023-11-15",
      "websitemanagerusa.com": "2023-11-15",
      "websociofiles.com": "2023-11-15",
      "xpertdomain.com": "2023-11-15",
      "xpertmaildomain.com": "2023-11-15",
      "youranotherserver.com": "2020-06-10",
      "zsrvrer.com": "2020-06-10"
    }
  },
  "first_seen_precision": {
    "domain": {}
  },
  "first_seen_range": {
    "earliest": "2018-08-30",
    "latest": "2023-11-15"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "2mblk.com",
      "4mblk.com",
      "ablyazovangels.com",
      "ablyazovcog.com",
      "ablyazovcrimestory.com",
      "ablyazovcrimesyndicate.com",
      "ablyazovcriminalgang.com",
      "ablyazovcriminals.com",
      "ablyazovgang.com",
      "ablyazovmafia.com",
      "ablyazovorganisedcrime.com",
      "affiliatedomainservice.com",
      "affliatedomainservice.com",
      "allaboutiot.website",
      "anitmationworldnews.com",
      "anothershortnr.com",
      "aplsrvrer.com",
      "assuredreturnplan.com",
      "auditionregistrationonline.com",
      "backwaterreservoir.com",
      "basemailservice.com",
      "baseserveremailbg.com",
      "basichostingrussia.com",
      "basichostnetservice.com",
      "basicmyoffshore.com",
      "basicruoffshore.com",
      "basicservicehk.com",
      "basicservicelux.com",
      "basicservicemy.com",
      "basicservicerus.com",
      "basicservicesg.com",
      "basicsgoffshore.com",
      "bellsouthnetwork.com",
      "belowmargins.com",
      "bitserverhk.com",
      "bitserverlux.com",
      "blogforpranks.com",
      "blogserverlx.com",
      "browserdirectservice.com",
      "browserextensions.info",
      "browserredirect.com",
      "bsrvrer.com",
      "budgtoffmy.com",
      "budgtoffru.com",
      "buzzoffbul.com",
      "buzzoffhk.com",
      "buzzoffmy.com",
      "buzzoffru.com",
      "buzzoffsg.com",
      "capitalinvestmentsllp.com",
      "cathostingservice.com",
      "chatserverrussia.com",
      "checkmailserverhk.com",
      "chromeperfection.com",
      "com-ar-en-us.com",
      "com-authmail.com",
      "com-biz.website",
      "com-com-us.com",
      "com-com.website",
      "com-en-us.co.uk",
      "com-er-en-us.com",
      "com-hl-en-us.com",
      "com-io-en-us.com",
      "com-mail-us.com",
      "com-mail.net",
      "com-nh-en-us.com",
      "com-oa-en-us.com",
      "com-us-en-us.com",
      "com-website33.biz",
      "com-website33.com",
      "com-website33.info",
      "com-website33.net",
      "com-website33.org",
      "comservicelogin.com",
      "corn-en-gb.com",
      "corn-en-us.com",
      "corn-fr-fr.com",
      "corn-lang-eng.com",
      "corn-loginservicesverified.com",
      "corn-msrvrgr.com",
      "corn-servicelogin.com",
      "corn-ukr.com",
      "csrvrer.com",
      "cyberanalyticals.com",
      "cyberserverusa.com",
      "deferrer.website",
      "demoprojectsuk.com",
      "dnsserverprv.com",
      "domainblacklistcheck.com",
      "domainemailhostings.com",
      "domainexpertswebuk.com",
      "domainforhostuk.com",
      "domainformailinguk.com",
      "domainhostnetworkuk.com",
      "domainhostnetworkusa.com",
      "domainhostworkeu.com",
      "domainlocalhostingeu.com",
      "domainlocalhostinghk.com",
      "domainlocalhostinguk.com",
      "domainmanager33.com",
      "domainmanager33.site",
      "domainmanager33.website",
      "domainserver322.com",
      "domainserver399.com",
      "domainserveractive.com",
      "domainsforfreehosting.com",
      "domainsforsupport.com",
      "domainsfortechhelp.com",
      "domainsserver4f.com",
      "dotnerserversg.com",
      "dotnetserverhk.com",
      "dsrvrer.com",
      "ecom-servicelogin.com",
      "economyfeeds.com",
      "economyservicesil.com",
      "ecoserveraus.com",
      "emailauthservice.com",
      "emailbaseserverhl.com",
      "emaildeliverysuccess.com",
      "emailhostholland.com",
      "emailhostsecurehk.com",
      "emailmappingservice.com",
      "emailsecurenode.com",
      "emailserver399.com",
      "emailserver4859.com",
      "emailserver499.com",
      "emailserverhk48.com",
      "emailserverholland.com",
      "emailservername299.com",
      "emailseverrus23.com",
      "emailvalidateservice.com",
      "esrvrer.com",
      "euanticorruption.com",
      "exchangeserver2345.com",
      "exchangeserverformailing.com",
      "extranetserviceonline.com",
      "fastserverasia.com",
      "fastservereurope.com",
      "fastserveruk.com",
      "fastserverusa.com",
      "forumtechtopic.com",
      "frwrdrurl.com",
      "frwrdrwr.com",
      "getemailopens.com",
      "getreadytorunhalfmarathon.com",
      "getsetgoforhealth.com",
      "goomail.ml",
      "hardcoretechnologiesllp.com",
      "hathwaynetwork.com",
      "hbh-europe-ripoff-report.com",
      "hiretechservicehg.com",
      "hkdrillonline.com",
      "hklinbas.com",
      "hollandtourandtravel.com",
      "homeforallorphans.com",
      "homeremedytipntricks.com",
      "homeserver87.com",
      "hongkongshippingcompany.com",
      "hostbasichk.com",
      "hostbasicholl.com",
      "hostbasicmy.com",
      "hostbasicru.com",
      "hostbasicsg.com",
      "hostemailsecureserver.com",
      "hostemailserver.com",
      "hostfeasta.com",
      "hostingserviceclean.com",
      "hostingserviceforall.com",
      "hostingservicesloyal.com",
      "hostingservicesukit.com",
      "hostmailsecure.com",
      "hostmailsecureserver.com",
      "hostsecuremail.com",
      "hostsecuremail544.com",
      "hostserverrus.com",
      "hostusewithtech.com",
      "imapserverholland.com",
      "imgsrvrer.com",
      "inrsrvrer.com",
      "internetmarketingservicehg.com",
      "interserver439.com",
      "intrsrvrer.com",
      "isrvrer.com",
      "javaservermy.com",
      "knowledgebaseonlineuk.com",
      "linkfollowservice.com",
      "linkforwrder.com",
      "linkshortnr.com",
      "linkshrtnr22.com",
      "linksrtnr.com",
      "linuxbasichk.com",
      "linuxbasichk1.com",
      "linuxbasicmy.com",
      "linuxbasicru.com",
      "linuxbasicru1.com",
      "linuxbasicru3.com",
      "linuxbasicsg.com",
      "linuxbasicsg1.com",
      "linuxhostingplatformuk.com",
      "linuxserverfast.com",
      "lnkshrtnr.com",
      "localhostinguk.com",
      "localserversa.com",
      "loginauths-service.com",
      "logincontrolserver.com",
      "loginservercheck.com",
      "loginservicebasic.com",
      "loginservicehelp.com",
      "loginservicesmailsonlinesaccounts.com",
      "loginserviceunified.com",
      "logserver39.com",
      "look-com.org",
      "luxlinbas.com",
      "mail-com.org",
      "mail-logger.com",
      "mail-msrgr.info",
      "mailannounceservice.com",
      "mailapiservice.com",
      "mailauthenticatorservice.com",
      "mailauthorizationservice.com",
      "mailauthservice.com",
      "mailauthservice399.com",
      "mailchimpservice.com",
      "mailcollectorservice.com",
      "mailcommunicationservice.com",
      "mailcommute.com",
      "maildeliveryagent.com",
      "mailer-domain.com",
      "mailerdomain56.com",
      "mailgatorservice.com",
      "mailhostingsecurenet.com",
      "mailingserver938.com",
      "maillinkservice.com",
      "mailmarknotes.com",
      "mailmarkservice.com",
      "mailpostsecure.com",
      "mailpostsecureservice.com",
      "mailrockservice.com",
      "mailsecurehost.com",
      "mailsecureservers.com",
      "mailserver39.com",
      "mailserver89.com",
      "mailserver89.net",
      "mailserver89.org",
      "mailserverdirect3994.com",
      "mailserverenterprise.com",
      "mailservereurope.com",
      "mailserveroutlook.com",
      "mailserverru2099.com",
      "mailservershare.com",
      "mailserveruk.com",
      "mailserveruk89.com",
      "mailserveruk89.net",
      "mailserveruk89.org",
      "mailserviceloginonline.com",
      "mailtickr.com",
      "mailtransferserver.com",
      "maxlaboratories.com",
      "mblk1.com",
      "mgrsr.com",
      "minrsrvr.com",
      "mnrsrvrer.com",
      "mrgrhr.com",
      "msgrdrg.com",
      "msrdr.com",
      "msrfrgr.com",
      "msrvrgeh.com",
      "msrvrgh.com",
      "msrwr.com",
      "mvrsrvrer.com",
      "myfacetik.cf",
      "mylinbas.com",
      "mywebredirect.info",
      "nameserver3476.com",
      "nameserverredirect.com",
      "netcomserviceonline.com",
      "netgeoserversg.com",
      "netmapservice.com",
      "netsecureemailservice.com",
      "netsecurehostingmy.com",
      "netsecuremailhosting.com",
      "netsecureserver399.com",
      "netserviceru.com",
      "networkshareserver.com",
      "newserver39.com",
      "nigeriaoilleaks.com",
      "nodeserver50.com",
      "nrgrsrvrer.com",
      "offshorecompanyllp.com",
      "offshoretoursntravels.com",
      "ondemand.pushthisurl.com",
      "onlineloginportal.com",
      "onlineloginportalhk.com",
      "onlineloginportalmy.com",
      "onlineloginportalsg.com",
      "onlineloginserviceeu.com",
      "onlineloginserviceuk.com",
      "onlineloginserviceusa.com",
      "onlinemusicstoreuk.com",
      "onlinenetworkinghelp.com",
      "openserverholland.com",
      "optionalblogging.com",
      "optionalblogginges.com",
      "optionalbloggingeu.com",
      "optionalblogginguk.com",
      "optionaldesigners.com",
      "optionsothego.com",
      "pageredirectservice.com",
      "pageserver299.com",
      "pageserver77.com",
      "pageserverru.com",
      "personaldoaminru.com",
      "personaldoaminsg.com",
      "phpwebserver34.best",
      "phpwebserver34.site",
      "phpwebserver34.tech",
      "phpwebserver34.xyz",
      "planyourexoticvacation.com",
      "portfoliofasinating.com",
      "post-manager.com",
      "postmarkapiservice.com",
      "postserverem.com",
      "postserviceemaildomain.com",
      "ppleid.org",
      "productdemoservice.com",
      "promotespritialbelief.com",
      "prwebsiteuk.com",
      "racksackserveruk.com",
      "rackserver39.com",
      "readmytipsntricks.com",
      "redirectonline.xyz",
      "redirectserviceonline.com",
      "registrationonlineeurope.com",
      "rockerhostings.com",
      "rulinuxbasic.com",
      "ruslinbas.com",
      "russialinuxbasic.com",
      "saferedirect.pw",
      "santanaservice.com",
      "sapserver39j.com",
      "sapserverhg.com",
      "sapserverhike.com",
      "sapserverhipe.com",
      "searchsimple.info",
      "searchsimple.net",
      "secureemailserver65.com",
      "securemailhost46.com",
      "secureserver9898.com",
      "secureserverasia.com",
      "secureservereurope.com",
      "selectedmaxstores.com",
      "selectedservicemy.com",
      "selectedserviceru.com",
      "selectedservicesg.com",
      "selectiveservicemax.com",
      "selectyourgroom.com",
      "serverasiasap.com",
      "serverdemoservice.com",
      "serverforhelphk.com",
      "serverforhelplux.com",
      "serverforhelpmy.com",
      "serverforhelpru.com",
      "serverforhelpsg.com",
      "serverforhiretech.com",
      "serverforhome.com",
      "serverformailings.com",
      "serverfornetworks.com",
      "serverforshort.com",
      "serverfortechhelp.com",
      "serverfortechies.com",
      "serverforzapper.com",
      "servergateway33.com",
      "servergateway56.com",
      "serverhello54.com",
      "serverloadbalance.com",
      "servermailing34.com",
      "servermain43.com",
      "servermappingserviceonline.com",
      "serversap54.com",
      "serviceasneed.com",
      "serviceforneworder.com",
      "servicegoingfar.com",
      "sglinbas.com",
      "shadymario.com",
      "shipnyatchholland.com",
      "shoponlinefreesg.com",
      "shoponlinefreeuk.com",
      "short-ner.com",
      "shortenup.com",
      "shortenurlservices.com",
      "shortformurl.com",
      "shortformurl.xyz",
      "shortlinkcut.com",
      "shortnerserviceonline.com",
      "shortserver1.com",
      "shorturlservice.com",
      "shrinkandshareurl.com",
      "shrinkthisurl.com",
      "shrtnerlnk.com",
      "siteadmineurope.com",
      "siteadminhk.com",
      "sitebloginfo.com",
      "smtpserver389.com",
      "smtpserver466.com",
      "snaphosterservice.com",
      "softnetworksolutions.com",
      "softredirect.info",
      "srtnr.co",
      "srtnr.com",
      "srvrgruk.com",
      "standardofficeholland.com",
      "standardofficeil.com",
      "standardofficeuk.com",
      "strngbltru.com",
      "strongbolthostinghk.com",
      "strongwingtechnologies.com",
      "strurl.click",
      "supportserviceeu.com",
      "tineeurl.com",
      "tinyurlshortner.com",
      "tnyurlservice.com",
      "trackserviceonline.xyz",
      "transferdomainhk.com",
      "transferdomainlu.com",
      "transferdomainmy.com",
      "transferserver33.com",
      "tricktravelbooking.com",
      "trustedserviceonline.com",
      "trusteventservices.com",
      "ultimateresponseservice.com",
      "ultronnetworksolution.com",
      "un-told.net",
      "updatenameserver45.com",
      "upgradetravelservice.com",
      "usewithcareathome.com",
      "watchmanservice.com",
      "webdomainexperts.com",
      "webhostwebcare.com",
      "webmailmanageruk.com",
      "webmasterserver39.com",
      "webnetonlineservice.com",
      "webredirect.click",
      "webredirect39.com",
      "websecurehostings.com",
      "webserver39.com",
      "webserver39490.com",
      "webserver91.website",
      "webserverdomaineu.com",
      "webserverdomainhk.com",
      "webserverdomainuk.com",
      "webserverdomainusa.com",
      "webserverhollandservice.com",
      "webserveroginusa.com",
      "webserveronline9.com",
      "webserverredirect99.com",
      "websiteadminuk.com",
      "websitemanagerusa.com",
      "websociofiles.com",
      "xpertdomain.com",
      "xpertmaildomain.com",
      "youranotherserver.com",
      "zsrvrer.com"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "MERCENARYAMANDA"
  ],
  "references": [
    "https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/",
    "https://github.com/nortonlifelock/indicators/blob/master/mercenary.amanda.txt",
    "https://www.nortonlifelock.com/blogs/security-response/mercenary-amanda-professional-hackers-hire"
  ],
  "related": [
    {
      "evidence": [
        {
          "detail": "2 shared indicators",
          "kind": "infrastructure",
          "weight": 2.0
        }
      ],
      "slug": "G0007"
    }
  ],
  "slug": "MERCENARYAMANDA",
  "timeline": [
    {
      "counts": {
        "domain": 61
      },
      "first_seen": "2023-11-15",
      "indicators": {
        "domain": [
          "4mblk.com",
          "ablyazovangels.com",
          "ablyazovcog.com",
          "ablyazovcrimestory.com",
          "ablyazovcrimesyndicate.com",
          "ablyazovcriminalgang.com",
          "ablyazovcriminals.com",
          "ablyazovgang.com",
          "ablyazovmafia.com",
          "ablyazovorganisedcrime.com",
          "affiliatedomainservice.com",
          "budgtoffmy.com",
          "budgtoffru.com",
          "com-biz.website",
          "com-com-us.com",
          "com-com.website",
          "com-en-us.co.uk",
          "com-hl-en-us.com",
          "com-mail-us.com",
          "com-mail.net",
          "com-us-en-us.com",
          "comservicelogin.com",
          "cyberanalyticals.com",
          "deferrer.website",
          "domainexpertswebuk.com",
          "domainsserver4f.com",
          "euanticorruption.com",
          "goomail.ml",
          "hbh-europe-ripoff-report.com",
          "linuxbasicru3.com",
          "look-com.org",
          "mail-com.org",
          "mailrockservice.com",
          "mailserver89.com",
          "msgrdrg.com",
          "myfacetik.cf",
          "nameserverredirect.com",
          "netcomserviceonline.com",
          "nigeriaoilleaks.com",
          "ondemand.pushthisurl.com",
          "onlinenetworkinghelp.com",
          "post-manager.com",
          "ppleid.org",
          "saferedirect.pw",
          "serverforhelplux.com",
          "serverforhelpmy.com",
          "servermappingserviceonline.com",
          "serviceasneed.com",
          "shadymario.com",
          "shortserver1.com",
          "srtnr.com",
          "transferserver33.com",
          "watchmanservice.com",
          "webdomainexperts.com",
          "webhostwebcare.com",
          "webmailmanageruk.com",
          "websiteadminuk.com",
          "websitemanagerusa.com",
          "websociofiles.com",
          "xpertdomain.com",
          "xpertmaildomain.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/",
        "https://www.nortonlifelock.com/blogs/security-response/mercenary-amanda-professional-hackers-hire",
        "https://github.com/nortonlifelock/indicators/blob/master/mercenary.amanda.txt"
      ],
      "total": 61
    },
    {
      "counts": {
        "domain": 399
      },
      "first_seen": "2020-06-10",
      "indicators": {
        "domain": [
          "2mblk.com",
          "affliatedomainservice.com",
          "allaboutiot.website",
          "anitmationworldnews.com",
          "anothershortnr.com",
          "aplsrvrer.com",
          "assuredreturnplan.com",
          "auditionregistrationonline.com",
          "backwaterreservoir.com",
          "basemailservice.com",
          "baseserveremailbg.com",
          "basichostingrussia.com",
          "basichostnetservice.com",
          "basicmyoffshore.com",
          "basicruoffshore.com",
          "basicservicehk.com",
          "basicservicelux.com",
          "basicservicemy.com",
          "basicservicerus.com",
          "basicservicesg.com",
          "basicsgoffshore.com",
          "bellsouthnetwork.com",
          "belowmargins.com",
          "bitserverhk.com",
          "bitserverlux.com",
          "blogforpranks.com",
          "blogserverlx.com",
          "browserdirectservice.com",
          "browserextensions.info",
          "browserredirect.com",
          "bsrvrer.com",
          "buzzoffbul.com",
          "buzzoffhk.com",
          "buzzoffmy.com",
          "buzzoffru.com",
          "buzzoffsg.com",
          "capitalinvestmentsllp.com",
          "cathostingservice.com",
          "chatserverrussia.com",
          "checkmailserverhk.com",
          "chromeperfection.com",
          "com-ar-en-us.com",
          "com-authmail.com",
          "com-er-en-us.com",
          "com-io-en-us.com",
          "com-nh-en-us.com",
          "com-oa-en-us.com",
          "com-website33.biz",
          "com-website33.com",
          "com-website33.info",
          "com-website33.net",
          "com-website33.org",
          "corn-en-gb.com",
          "corn-en-us.com",
          "corn-fr-fr.com",
          "corn-lang-eng.com",
          "corn-loginservicesverified.com",
          "corn-msrvrgr.com",
          "corn-servicelogin.com",
          "corn-ukr.com",
          "csrvrer.com",
          "cyberserverusa.com",
          "demoprojectsuk.com",
          "dnsserverprv.com",
          "domainblacklistcheck.com",
          "domainemailhostings.com",
          "domainforhostuk.com",
          "domainformailinguk.com",
          "domainhostnetworkuk.com",
          "domainhostnetworkusa.com",
          "domainhostworkeu.com",
          "domainlocalhostingeu.com",
          "domainlocalhostinghk.com",
          "domainlocalhostinguk.com",
          "domainmanager33.com",
          "domainmanager33.site",
          "domainmanager33.website",
          "domainserver322.com",
          "domainserver399.com",
          "domainserveractive.com",
          "domainsforfreehosting.com",
          "domainsforsupport.com",
          "domainsfortechhelp.com",
          "dotnerserversg.com",
          "dotnetserverhk.com",
          "dsrvrer.com",
          "ecom-servicelogin.com",
          "economyfeeds.com",
          "economyservicesil.com",
          "ecoserveraus.com",
          "emailauthservice.com",
          "emailbaseserverhl.com",
          "emaildeliverysuccess.com",
          "emailhostholland.com",
          "emailhostsecurehk.com",
          "emailmappingservice.com",
          "emailsecurenode.com",
          "emailserver399.com",
          "emailserver4859.com",
          "emailserver499.com",
          "emailserverhk48.com",
          "emailserverholland.com",
          "emailservername299.com",
          "emailseverrus23.com",
          "emailvalidateservice.com",
          "esrvrer.com",
          "exchangeserver2345.com",
          "exchangeserverformailing.com",
          "extranetserviceonline.com",
          "fastserverasia.com",
          "fastservereurope.com",
          "fastserveruk.com",
          "fastserverusa.com",
          "forumtechtopic.com",
          "frwrdrurl.com",
          "frwrdrwr.com",
          "getemailopens.com",
          "getreadytorunhalfmarathon.com",
          "getsetgoforhealth.com",
          "hardcoretechnologiesllp.com",
          "hathwaynetwork.com",
          "hiretechservicehg.com",
          "hkdrillonline.com",
          "hklinbas.com",
          "hollandtourandtravel.com",
          "homeforallorphans.com",
          "homeremedytipntricks.com",
          "homeserver87.com",
          "hongkongshippingcompany.com",
          "hostbasichk.com",
          "hostbasicholl.com",
          "hostbasicmy.com",
          "hostbasicru.com",
          "hostbasicsg.com",
          "hostemailsecureserver.com",
          "hostemailserver.com",
          "hostfeasta.com",
          "hostingserviceclean.com",
          "hostingserviceforall.com",
          "hostingservicesloyal.com",
          "hostingservicesukit.com",
          "hostmailsecure.com",
          "hostmailsecureserver.com",
          "hostsecuremail.com",
          "hostsecuremail544.com",
          "hostserverrus.com",
          "hostusewithtech.com",
          "imapserverholland.com",
          "imgsrvrer.com",
          "inrsrvrer.com",
          "internetmarketingservicehg.com",
          "interserver439.com",
          "intrsrvrer.com",
          "isrvrer.com",
          "javaservermy.com",
          "knowledgebaseonlineuk.com",
          "linkfollowservice.com",
          "linkforwrder.com",
          "linkshortnr.com",
          "linkshrtnr22.com",
          "linksrtnr.com",
          "linuxbasichk.com",
          "linuxbasichk1.com",
          "linuxbasicmy.com",
          "linuxbasicru.com",
          "linuxbasicru1.com",
          "linuxbasicsg.com",
          "linuxbasicsg1.com",
          "linuxhostingplatformuk.com",
          "linuxserverfast.com",
          "lnkshrtnr.com",
          "localhostinguk.com",
          "localserversa.com",
          "loginauths-service.com",
          "logincontrolserver.com",
          "loginservercheck.com",
          "loginservicebasic.com",
          "loginservicehelp.com",
          "loginservicesmailsonlinesaccounts.com",
          "loginserviceunified.com",
          "logserver39.com",
          "luxlinbas.com",
          "mail-logger.com",
          "mail-msrgr.info",
          "mailannounceservice.com",
          "mailapiservice.com",
          "mailauthenticatorservice.com",
          "mailauthorizationservice.com",
          "mailauthservice.com",
          "mailauthservice399.com",
          "mailchimpservice.com",
          "mailcollectorservice.com",
          "mailcommunicationservice.com",
          "mailcommute.com",
          "maildeliveryagent.com",
          "mailer-domain.com",
          "mailerdomain56.com",
          "mailgatorservice.com",
          "mailhostingsecurenet.com",
          "mailingserver938.com",
          "maillinkservice.com",
          "mailmarknotes.com",
          "mailmarkservice.com",
          "mailpostsecure.com",
          "mailpostsecureservice.com",
          "mailsecurehost.com",
          "mailsecureservers.com",
          "mailserver39.com",
          "mailserver89.net",
          "mailserver89.org",
          "mailserverdirect3994.com",
          "mailserverenterprise.com",
          "mailservereurope.com",
          "mailserveroutlook.com",
          "mailserverru2099.com",
          "mailservershare.com",
          "mailserveruk.com",
          "mailserveruk89.com",
          "mailserveruk89.net",
          "mailserveruk89.org",
          "mailserviceloginonline.com",
          "mailtickr.com",
          "mailtransferserver.com",
          "maxlaboratories.com",
          "mblk1.com",
          "mgrsr.com",
          "minrsrvr.com",
          "mnrsrvrer.com",
          "mrgrhr.com",
          "msrfrgr.com",
          "msrvrgeh.com",
          "msrvrgh.com",
          "mvrsrvrer.com",
          "mylinbas.com",
          "mywebredirect.info",
          "nameserver3476.com",
          "netgeoserversg.com",
          "netmapservice.com",
          "netsecureemailservice.com",
          "netsecurehostingmy.com",
          "netsecuremailhosting.com",
          "netsecureserver399.com",
          "netserviceru.com",
          "networkshareserver.com",
          "newserver39.com",
          "nodeserver50.com",
          "nrgrsrvrer.com",
          "offshorecompanyllp.com",
          "offshoretoursntravels.com",
          "onlineloginportal.com",
          "onlineloginportalhk.com",
          "onlineloginportalmy.com",
          "onlineloginportalsg.com",
          "onlineloginserviceeu.com",
          "onlineloginserviceuk.com",
          "onlineloginserviceusa.com",
          "onlinemusicstoreuk.com",
          "openserverholland.com",
          "optionalblogging.com",
          "optionalblogginges.com",
          "optionalbloggingeu.com",
          "optionalblogginguk.com",
          "optionaldesigners.com",
          "optionsothego.com",
          "pageredirectservice.com",
          "pageserver299.com",
          "pageserver77.com",
          "pageserverru.com",
          "personaldoaminru.com",
          "personaldoaminsg.com",
          "phpwebserver34.best",
          "phpwebserver34.site",
          "phpwebserver34.tech",
          "phpwebserver34.xyz",
          "planyourexoticvacation.com",
          "portfoliofasinating.com",
          "postmarkapiservice.com",
          "postserverem.com",
          "postserviceemaildomain.com",
          "productdemoservice.com",
          "promotespritialbelief.com",
          "prwebsiteuk.com",
          "racksackserveruk.com",
          "rackserver39.com",
          "readmytipsntricks.com",
          "redirectonline.xyz",
          "redirectserviceonline.com",
          "registrationonlineeurope.com",
          "rockerhostings.com",
          "rulinuxbasic.com",
          "ruslinbas.com",
          "russialinuxbasic.com",
          "santanaservice.com",
          "sapserver39j.com",
          "sapserverhg.com",
          "sapserverhike.com",
          "sapserverhipe.com",
          "searchsimple.info",
          "searchsimple.net",
          "secureemailserver65.com",
          "securemailhost46.com",
          "secureserver9898.com",
          "secureserverasia.com",
          "secureservereurope.com",
          "selectedmaxstores.com",
          "selectedservicemy.com",
          "selectedserviceru.com",
          "selectedservicesg.com",
          "selectiveservicemax.com",
          "selectyourgroom.com",
          "serverasiasap.com",
          "serverdemoservice.com",
          "serverforhelphk.com",
          "serverforhelpru.com",
          "serverforhelpsg.com",
          "serverforhiretech.com",
          "serverforhome.com",
          "serverformailings.com",
          "serverfornetworks.com",
          "serverforshort.com",
          "serverfortechhelp.com",
          "serverfortechies.com",
          "serverforzapper.com",
          "servergateway33.com",
          "servergateway56.com",
          "serverhello54.com",
          "serverloadbalance.com",
          "servermailing34.com",
          "servermain43.com",
          "serversap54.com",
          "serviceforneworder.com",
          "servicegoingfar.com",
          "sglinbas.com",
          "shipnyatchholland.com",
          "shoponlinefreesg.com",
          "shoponlinefreeuk.com",
          "short-ner.com",
          "shortenup.com",
          "shortenurlservices.com",
          "shortformurl.com",
          "shortformurl.xyz",
          "shortlinkcut.com",
          "shortnerserviceonline.com",
          "shorturlservice.com",
          "shrinkandshareurl.com",
          "shrinkthisurl.com",
          "shrtnerlnk.com",
          "siteadmineurope.com",
          "siteadminhk.com",
          "sitebloginfo.com",
          "smtpserver389.com",
          "smtpserver466.com",
          "snaphosterservice.com",
          "softnetworksolutions.com",
          "softredirect.info",
          "srtnr.co",
          "srvrgruk.com",
          "standardofficeholland.com",
          "standardofficeil.com",
          "standardofficeuk.com",
          "strngbltru.com",
          "strongbolthostinghk.com",
          "strongwingtechnologies.com",
          "strurl.click",
          "supportserviceeu.com",
          "tineeurl.com",
          "tinyurlshortner.com",
          "tnyurlservice.com",
          "trackserviceonline.xyz",
          "transferdomainhk.com",
          "transferdomainlu.com",
          "transferdomainmy.com",
          "tricktravelbooking.com",
          "trustedserviceonline.com",
          "trusteventservices.com",
          "ultimateresponseservice.com",
          "ultronnetworksolution.com",
          "un-told.net",
          "updatenameserver45.com",
          "upgradetravelservice.com",
          "usewithcareathome.com",
          "webmasterserver39.com",
          "webnetonlineservice.com",
          "webredirect.click",
          "webredirect39.com",
          "websecurehostings.com",
          "webserver39.com",
          "webserver39490.com",
          "webserver91.website",
          "webserverdomaineu.com",
          "webserverdomainhk.com",
          "webserverdomainuk.com",
          "webserverdomainusa.com",
          "webserverhollandservice.com",
          "webserveroginusa.com",
          "webserveronline9.com",
          "webserverredirect99.com",
          "youranotherserver.com",
          "zsrvrer.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/",
        "https://www.nortonlifelock.com/blogs/security-response/mercenary-amanda-professional-hackers-hire",
        "https://github.com/nortonlifelock/indicators/blob/master/mercenary.amanda.txt"
      ],
      "total": 399
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2018-08-30",
      "indicators": {
        "domain": [
          "msrdr.com",
          "msrwr.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/",
        "https://www.nortonlifelock.com/blogs/security-response/mercenary-amanda-professional-hackers-hire",
        "https://github.com/nortonlifelock/indicators/blob/master/mercenary.amanda.txt"
      ],
      "total": 2
    }
  ]
}