{
  "aliases": [],
  "attack_id": null,
  "attack_name": null,
  "attack_url": null,
  "counts": {
    "domain": 1523,
    "url": 1
  },
  "first_seen": {
    "domain": {
      "123tramites.com": "2022-04-19",
      "14-tracking.com": "2018-09-20",
      "1minto-start.com": "2021-07-18",
      "1place-togo.com": "2022-07-18",
      "24-7clinic.com": "2021-07-18",
      "301-redirecting.com": "2021-07-18",
      "365redirect.co": "2021-07-18",
      "3driving.com": "2021-07-18",
      "456h612i458g.com": "2021-07-18",
      "7style.org": "2021-07-18",
      "800health.net": "2021-07-18",
      "911hig11carcay959454.com": "2021-07-18",
      "9jp1dx8odjw1kbkt.f15fwd322.regularhours.net": "2020-12-20",
      "a-redirect.com": "2021-07-18",
      "a-resolver.com": "2021-07-18",
      "aalaan.tv": "2018-07-05",
      "accomodation-tastes.net": "2021-07-18",
      "accountant-audio.com": "2021-02-14",
      "accountcanceled.com": "2021-07-18",
      "accountnotify.com": "2021-07-18",
      "accounts-unread.com": "2022-07-18",
      "accounts.mx": "2017-04-12",
      "accountsections.com": "2021-07-18",
      "accountsecurities.org": "2023-11-15",
      "activate-discount.com": "2021-07-18",
      "active-folders.com": "2021-07-18",
      "actorsshop.net": "2021-07-18",
      "actu24.online": "2021-07-18",
      "ad-generator.net": "2021-07-18",
      "ad-switcher.com": "2021-07-18",
      "add-client.com": "2021-07-18",
      "additional-costs.com": "2021-07-18",
      "addmyid.net": "2021-07-18",
      "addresstimeframe.com": "2021-07-18",
      "adeal4u.co": "2021-07-18",
      "adjust-local-settings.co": "2018-09-21",
      "adjust-local-settings.com": "2017-04-12",
      "adjustlocalsettings.net": "2021-07-18",
      "adscreator.net": "2021-07-18",
      "adsload.co": "2021-07-18",
      "adsmetrics.co": "2022-04-19",
      "advert-time.com": "2021-07-18",
      "advert-track.com": "2021-07-18",
      "afriquenouvelle.com": "2019-10-07",
      "afternicweb.net": "2018-09-21",
      "agilityprocessing.net": "2021-07-18",
      "aircraftsxhibition.com": "2021-07-18",
      "ajelnews.net": "2019-10-07",
      "akhbar-aliqtisad.com": "2021-07-18",
      "akhbar-almasdar.com": "2022-04-05",
      "akhbar-arabia.com": "2018-09-20",
      "akhbar-islamyah.com": "2022-04-05",
      "akhbara-aalawsat.com": "2019-10-07",
      "akhbarnew.com": "2022-04-05",
      "al-nusr.net": "2022-04-05",
      "al-taleanews.net": "2022-04-05",
      "al-taleanewsonline.net": "2022-04-05",
      "al7erak247.com": "2022-04-05",
      "al7eraknews.com": "2022-04-05",
      "alawaeltech.com": "2018-07-05",
      "albumphotopro.biz": "2021-07-18",
      "alignmentdisabled.net": "2021-07-18",
      "alive2plunge.com": "2021-07-18",
      "all-sales.info": "2018-10-07",
      "allaboutwrightwood.com": "2022-07-10",
      "allafricaninfo.com": "2019-10-07",
      "allbeautifularts.com": "2021-07-18",
      "alldaycooking.co": "2021-07-18",
      "allergiesandcooking.com": "2021-07-18",
      "allfadiha.co": "2021-07-18",
      "alljazeera.co": "2017-04-12",
      "allladiesloveme.com": "2021-07-18",
      "allthecolorsyoulike.com": "2021-07-18",
      "allthegamesyouneed.com": "2021-07-18",
      "allthemakeupyouneed.com": "2021-07-18",
      "allthesongsyoulike.com": "2021-07-18",
      "alluneed4home.net": "2021-07-18",
      "alpharythme.com": "2021-07-18",
      "alrainew.com": "2022-04-05",
      "android-core.org": "2021-07-18",
      "android-updates.net": "2021-07-18",
      "animal-politico.com": "2018-09-20",
      "api.priveetalk.com": "2022-04-17",
      "apiapple.com": "2021-07-18",
      "apigraphs.net": "2021-07-18",
      "apiwacdn.com": "2021-07-18",
      "appleleaveit.co": "2021-07-18",
      "applicationcreation.net": "2021-07-18",
      "appointments-online.com": "2021-07-18",
      "appsgratis.com.mx": "2021-07-18",
      "appsjuegos.com.mx": "2021-07-18",
      "ar-tweets.com": "2021-07-18",
      "arab-share.com": "2021-07-18",
      "arabia-islamion.com": "2022-04-05",
      "arabnews365.com": "2018-09-21",
      "arabworld.biz": "2018-10-07",
      "arabworldnews.info": "2019-10-07",
      "around-theglobe.co": "2021-07-18",
      "arrowowner.com": "2021-07-18",
      "asrararabiya.co": "2018-07-05",
      "asrararablya.com": "2018-07-05",
      "asrarrarabiya.com": "2018-07-05",
      "assembled-battery.com": "2021-07-18",
      "atlaslions.info": "2021-07-18",
      "audienceflake.com": "2021-02-14",
      "auditorcast.com": "2021-07-18",
      "authenticangry.com": "2021-07-18",
      "authenticated-origin.com": "2021-07-18",
      "authlovebirth.com": "2021-07-18",
      "autodiscount.info": "2021-07-18",
      "autoredirect.net": "2021-07-18",
      "av-scanner.com": "2021-07-18",
      "avocadofight.com": "2021-07-18",
      "awardpractice.com": "2021-07-18",
      "awizo.info": "2023-11-15",
      "axis-indication.net": "2021-07-18",
      "babies-bottles.com": "2021-07-18",
      "bahrainsms.co": "2018-07-05",
      "balancewreckpoint.com": "2021-07-18",
      "bananakick.net": "2021-02-14",
      "banca-movil.com": "2018-09-21",
      "banca-movil.net": "2019-03-01",
      "bankportal.net": "2021-07-18",
      "baramije.net": "2021-07-18",
      "bargainservice.online": "2021-07-18",
      "bbc-africa.com": "2017-04-12",
      "bdaynotes.com": "2021-07-18",
      "beanbounce.net": "2021-07-18",
      "beautifulhousesaroundme.com": "2021-07-18",
      "becomeiguana.com": "2021-07-18",
      "beethoventopsymphonies.com": "2021-07-18",
      "behindaquarium.com": "2021-07-18",
      "benjamin-taganga.info": "2021-07-18",
      "bestadventures4u.com": "2021-07-18",
      "bestcandyever.com": "2021-07-18",
      "bestday-sales.com": "2021-07-18",
      "bestfoods.co": "2021-07-18",
      "bestfriendneedshelp.com": "2021-07-18",
      "bestheadphones4u.com": "2021-07-18",
      "besthotelsaroundme.com": "2021-07-18",
      "bestperfumesnow.com": "2021-07-18",
      "bestpresents4all.net": "2021-07-18",
      "bestsalesaroundme.com": "2021-07-18",
      "beststores4u.com": "2018-10-07",
      "bestsushiever.com": "2021-07-18",
      "better-deal.info": "2021-07-18",
      "betterapplesearch.com": "2021-07-18",
      "betterhandsblack.com": "2021-07-18",
      "bicyclerentalnow.com": "2021-07-18",
      "biggunsarefun.com": "2021-07-18",
      "bigseatsout.net": "2021-07-18",
      "billednorth.com": "2021-07-18",
      "bingoblitzvippro.com": "2022-07-10",
      "birdbathmorning.com": "2021-07-18",
      "biscuit-taste.net": "2021-07-18",
      "bitanalysis.net": "2021-07-18",
      "bitfadepens.com": "2021-07-18",
      "bitforeat.net": "2021-07-18",
      "bl33pon6373.com": "2021-07-18",
      "black-bricks.net": "2021-07-18",
      "blackberry.org.mx": "2021-07-18",
      "blackwhitebags.com": "2021-07-18",
      "blindlydivision.com": "2021-07-18",
      "blockedsituation.net": "2021-07-18",
      "blogreseller.net": "2021-07-18",
      "boldconclusion.com": "2021-07-18",
      "booking-tables.com": "2021-07-18",
      "bottlehere.com": "2021-07-18",
      "boxes-mix.net": "2021-07-18",
      "boysrbabies.co": "2021-07-18",
      "br-hashtags.com": "2021-07-18",
      "br-travels.com": "2021-07-18",
      "brand-tech.net": "2021-07-18",
      "brandttoyota.com": "2022-07-10",
      "breakfastisgood.com": "2021-07-18",
      "breaking-extranews.online": "2019-10-07",
      "breaking-news.co": "2019-10-07",
      "breakingnewsasia.com": "2019-10-07",
      "breakthenews.net": "2019-10-07",
      "brighttooth.net": "2021-07-18",
      "brookviewpetgrooming.com": "2022-07-10",
      "brownandblueeyes.com": "2021-07-18",
      "browser-update.online": "2021-07-18",
      "bubblesmoke.net": "2021-07-18",
      "bubblesweetcake.com": "2021-07-18",
      "buildingcarpet.com": "2021-07-18",
      "buildurlife.net": "2021-07-18",
      "buildyourdata.com": "2021-07-18",
      "bulbazaur.com": "2017-04-12",
      "bulk-theft.net": "2021-07-18",
      "bulksender.info": "2021-07-18",
      "bulktheft.com": "2021-07-18",
      "bullgame.net": "2021-07-18",
      "bun54l2b67.get1tn0w.free247downloads.com": "2019-10-10",
      "bunchi.club": "2021-07-18",
      "bundlestofear.com": "2021-07-18",
      "business-today.info": "2019-10-10",
      "businesssupportme.com": "2021-07-18",
      "bussybeesallover.com": "2021-07-18",
      "bustimer.net": "2021-07-18",
      "butterdogchange.com": "2021-07-18",
      "buymanuel.co": "2021-07-18",
      "buypresent4me.net": "2021-07-18",
      "bytlo.com": "2021-07-18",
      "cablegirls.net": "2021-07-18",
      "calculatesymbols.com": "2021-07-18",
      "calendarsapp.com": "2021-07-18",
      "candlealbum.com": "2021-07-18",
      "carpetdignity.com": "2021-07-18",
      "carrefour-des-affaires.com": "2021-07-18",
      "cars-to-buy.com": "2021-07-18",
      "cartsafer.com": "2021-07-18",
      "cashandlife.com": "2021-07-18",
      "cashtowebmail.com": "2021-07-18",
      "casia-news.info": "2021-07-18",
      "casusbocekler.com": "2022-07-10",
      "catbrushcable.com": "2021-07-18",
      "catfoodstorage.net": "2021-07-18",
      "catsndogsproducts.com": "2021-07-18",
      "cdnupdateweb.com": "2021-07-18",
      "cdnwa.com": "2021-07-18",
      "celebrateyourdaynow.com": "2021-07-18",
      "cell-abonnes.com": "2021-07-18",
      "cell-mcel.info": "2021-07-18",
      "cellphone-inside.org": "2021-07-18",
      "cellphonesprices.com": "2021-07-18",
      "cellular-updates.com": "2021-07-18",
      "cellular-updates.online": "2021-07-18",
      "cellularupdates.info": "2021-07-18",
      "centersession.com": "2021-07-18",
      "centrasia-news.com": "2019-10-07",
      "cerfcube.com": "2022-07-10",
      "changesstarted.net": "2021-07-18",
      "chatresponses.com": "2021-07-18",
      "cheapapartmentsaroundme.com": "2018-10-07",
      "cheapcardonline.com": "2021-07-18",
      "cheaphostingtoday.com": "2021-07-18",
      "cheapmotelz.net": "2021-07-18",
      "cheapsolutions4u.com": "2021-07-18",
      "cheaptransporting.net": "2021-07-18",
      "check-my-internetspeed.com": "2021-07-18",
      "checkboxcart.com": "2021-07-18",
      "checkboxfee.com": "2021-07-18",
      "checkinonlinehere.com": "2017-04-12",
      "chickenwaves.com": "2021-07-18",
      "chistedeldia.mx": "2021-07-18",
      "chocolateicecreamlovers.com": "2021-07-18",
      "chocollife.me": "2021-07-18",
      "chormnet3.com": "2021-07-18",
      "chretiendaujoudhui.com": "2020-10-11",
      "chubaka.org": "2021-07-18",
      "classic-furnitures.com": "2021-07-18",
      "classstylemap.com": "2021-07-18",
      "cleanmiddle.com": "2021-07-18",
      "clickrighthere.online": "2021-07-18",
      "clicktrack247.com": "2021-07-18",
      "clients-access.com": "2021-07-18",
      "clockmarkcoffee.com": "2021-07-18",
      "closefly.com": "2021-07-18",
      "cloudads.net": "2021-07-18",
      "cloudbiggest.com": "2021-07-18",
      "clubloading.net": "2021-07-18",
      "clubmovistar.com": "2021-07-18",
      "clubsforus.net": "2021-07-18",
      "cnic-ferify.live": "2022-04-17",
      "cnic-update.com": "2022-04-17",
      "cnn-africa.co": "2017-04-12",
      "coffecups.online": "2021-07-18",
      "coffee2go.org": "2021-07-18",
      "colorfulnotebooks.com": "2021-07-18",
      "colorsoflife.online": "2021-07-18",
      "columbus-parking.com": "2021-07-18",
      "com-reports.net": "2021-07-18",
      "cominfo-urbano.com": "2022-01-13",
      "companybreakfast.net": "2021-07-18",
      "computer-set.com": "2021-07-18",
      "conditionalcell.com": "2021-07-18",
      "conference-ballroom.com": "2021-07-18",
      "confusedmachine.com": "2021-07-18",
      "connecting-to.com": "2021-07-18",
      "contacting-customer.com": "2021-07-18",
      "content-blocking.net": "2021-07-18",
      "contentsbycase.com": "2021-07-18",
      "convertedversion.com": "2021-07-18",
      "cookiescom.com": "2021-07-18",
      "cookiesoutthere.com": "2021-07-18",
      "cool-smartphone-apps.com": "2021-07-18",
      "coolasiankitchen.com": "2021-07-18",
      "coolbbqtools.net": "2021-07-18",
      "coolmath4us.net": "2021-07-18",
      "cornclean.com": "2021-07-18",
      "cottondecay.com": "2021-07-18",
      "countrytrips.net": "2021-07-18",
      "coupedumondepro.com": "2021-07-18",
      "couponshops.info": "2021-07-18",
      "cozmo-store.net": "2022-04-05",
      "cpr-appointments.com": "2021-07-18",
      "crashparadox.net": "2021-02-14",
      "crimebackfire.com": "2021-07-18",
      "crosslocated.net": "2021-07-18",
      "crowndecoration.net": "2021-07-18",
      "crownsafe.net": "2021-07-18",
      "cryptocurrecny.com": "2021-07-18",
      "cryptokoinz.com": "2021-07-18",
      "cryptopcoinz.com": "2021-07-18",
      "csomagodjott.com": "2021-07-18",
      "cssgraphics.net": "2021-07-18",
      "cupscars.net": "2021-07-18",
      "curiousrabbitgame.com": "2021-07-18",
      "currentscan.net": "2021-07-18",
      "currentwestpeople.com": "2021-07-18",
      "daily-sport.news": "2018-10-07",
      "damanhealth.online": "2018-07-05",
      "dancersing.net": "2021-07-18",
      "dancinglife.co": "2021-07-18",
      "dashboardprompt.com": "2021-07-18",
      "data-formula.com": "2021-07-18",
      "databasemeans.net": "2021-07-18",
      "deadwordsstory.com": "2021-07-18",
      "deal4unow.com": "2021-07-18",
      "dearlegendseed.com": "2021-07-18",
      "defencepk.email": "2022-04-17",
      "delivery-24-7.com": "2021-07-18",
      "dental-care-spa.net": "2021-07-18",
      "deportes24-7.com": "2022-01-13",
      "deportesinfo.com": "2021-07-18",
      "derinaydogan.com": "2022-07-10",
      "designednetwork.com": "2021-07-18",
      "destinytool.net": "2021-07-18",
      "detailrush.net": "2021-07-18",
      "deter-individuals.com": "2021-07-18",
      "devicer.co": "2021-07-18",
      "dhcpserver.net": "2021-07-18",
      "diagram-shape.com": "2021-07-18",
      "diaspora-news.com": "2019-10-07",
      "diningip.com": "2021-07-18",
      "dinneraroundyou.com": "2018-10-07",
      "directbegins.com": "2021-07-18",
      "directlyforuse.com": "2021-07-18",
      "directurl-loading.com": "2021-07-18",
      "discountads.net": "2021-07-18",
      "discountmarkets.info": "2021-07-18",
      "discountstores.info": "2021-07-18",
      "discoveredworld-news.com": "2019-10-07",
      "displaytag.net": "2021-07-18",
      "dns-1.co": "2021-07-18",
      "dns-analytics.com": "2021-07-18",
      "dns-direct.net": "2021-07-18",
      "dns-upload.com": "2021-07-18",
      "dnsclocknow.com": "2021-07-18",
      "dnslogs.net": "2021-07-18",
      "dnsmachinefork.com": "2021-07-18",
      "dnsprotector.net": "2021-07-18",
      "dnsroof.com": "2021-07-18",
      "do-itonyour-own.com": "2021-07-18",
      "documentpro.org": "2021-07-18",
      "dogfoodstorage.net": "2021-07-18",
      "dogopics.com": "2021-07-18",
      "doitformom.com": "2021-07-18",
      "doitforthefame-now.com": "2021-07-18",
      "domain-control.net": "2021-07-18",
      "domain-redirect.com": "2021-07-18",
      "domain-resolver.net": "2021-07-18",
      "domain-routing.com": "2021-07-18",
      "domain-security.org": "2021-07-18",
      "domainloading.net": "2021-07-18",
      "domainport.net": "2021-07-18",
      "domains-resolver.net": "2021-07-18",
      "domainsearching.net": "2021-07-18",
      "domesticwindow.com": "2021-07-18",
      "donateabox.co": "2021-07-18",
      "donateaflower.com": "2021-07-18",
      "donateyouroldclothes.net": "2021-07-18",
      "done.events": "2021-07-18",
      "donefordeal.com": "2021-07-18",
      "doorcoffeebrown.com": "2021-07-18",
      "dotroomeight.com": "2021-07-18",
      "dowhatyouneed.com": "2021-07-18",
      "downgradeproduct.com": "2021-07-18",
      "download.fbr.tax": "2022-04-17",
      "dramatic-challenge.com": "2021-07-18",
      "driventicket.com": "2021-07-18",
      "e-loading.biz": "2021-07-18",
      "e-prokuror.info": "2021-07-18",
      "e-sveiciens.com": "2019-10-07",
      "eardooraround.com": "2021-07-18",
      "earsstrawsfive.com": "2021-07-18",
      "easy-pay.info": "2021-07-18",
      "easybett.online": "2021-07-18",
      "ecommerce-ads.org": "2018-09-21",
      "economic-news.co": "2021-07-18",
      "editorscolumn.net": "2021-07-18",
      "effectivespeech.net": "2021-07-18",
      "egov-online.com": "2021-07-18",
      "egov-segek.info": "2021-07-18",
      "egov-sergek.info": "2019-10-07",
      "ehistorybooks.com": "2021-07-18",
      "elementscart.com": "2021-07-18",
      "eliminateadjust.com": "2021-07-18",
      "eliteautosaloninc.com": "2022-07-10",
      "elitecarz.net": "2021-07-18",
      "eltiempo-news.com": "2019-10-07",
      "email-plans.com": "2021-07-18",
      "emiratesfoundation.net": "2017-04-12",
      "emonitoring-paczki.pl": "2021-07-18",
      "energy-dispatch.net": "2021-07-18",
      "enoughtoday.org": "2021-07-18",
      "entertainmentinat.com": "2021-07-18",
      "entire-cases.com": "2021-07-18",
      "equal-gravity.com": "2021-07-18",
      "erty.online": "2021-07-18",
      "estatearea.net": "2021-07-18",
      "eura-cell.com": "2021-07-18",
      "eurasianupdate.com": "2021-07-18",
      "eurosportnews.info": "2019-10-07",
      "event-reg.info": "2021-07-18",
      "everycolor-inside.com": "2021-07-18",
      "everyuse.org": "2021-07-18",
      "ex-forexlive.com": "2021-07-18",
      "exchangenames.net": "2021-07-18",
      "exchangenerate.com": "2021-07-18",
      "existingpass.com": "2021-07-18",
      "exoticsendurance.com": "2021-07-18",
      "expired-getway.net": "2021-07-18",
      "expiredsession.com": "2021-07-18",
      "expiringdate.com": "2021-07-18",
      "exploreemail.net": "2021-07-18",
      "extend-list.net": "2021-07-18",
      "externalprivacy.com": "2021-07-18",
      "externaltransfers.com": "2021-07-18",
      "extractsight.com": "2021-07-18",
      "extrahoney.net": "2021-07-18",
      "eyestoip.com": "2021-07-18",
      "eyesunderspray.com": "2021-07-18",
      "ezdropshipping.net": "2021-07-18",
      "f15fwd322.regularhours.net": "2021-02-14",
      "fabric-shops.com": "2021-07-18",
      "face-image.com": "2021-07-18",
      "facebook-accounts.com.mx": "2021-07-18",
      "fadewallwine.com": "2021-07-18",
      "fadi7apress.com": "2021-07-18",
      "fallround.com": "2021-07-18",
      "fallsjuice.com": "2021-07-18",
      "familyabroad.net": "2021-07-18",
      "fantastic-gardens.com": "2021-07-18",
      "fashion-live.net": "2021-07-18",
      "fashion-online.net": "2021-07-18",
      "fashioncontainer.net": "2021-07-18",
      "fashionpark.info": "2021-07-18",
      "fastdirect.net": "2021-07-18",
      "fastfixs.net": "2021-07-18",
      "fatpop.net": "2021-07-18",
      "fb-accounts.com": "2017-04-12",
      "fbr-update.com": "2022-04-17",
      "fbr.news": "2022-04-17",
      "fbr.tax": "2022-04-17",
      "fbsecurity.co": "2021-07-18",
      "feature-publish.net": "2021-07-18",
      "feelbonesbag.com": "2021-07-18",
      "feeltrail.com": "2021-07-18",
      "femmedaffaire.com": "2021-07-18",
      "fetchlink.net": "2021-07-18",
      "fiestamaghreb.com": "2021-07-18",
      "file-dnld.com": "2022-04-17",
      "files-downloads.com": "2020-01-27",
      "filingwarranty.com": "2021-07-18",
      "financecomments.net": "2021-07-18",
      "findavoucher.online": "2021-07-18",
      "findgoodfood.co": "2021-07-18",
      "findgroupon.com": "2021-07-18",
      "finditout-now.com": "2021-07-18",
      "findmyass.org": "2021-07-18",
      "findmyfriendsnow.com": "2021-07-18",
      "findmylunch.org": "2021-07-18",
      "findmymind.co": "2021-07-18",
      "findmyplants.com": "2018-10-07",
      "findouthere.org": "2021-07-18",
      "firebulletfan.com": "2021-07-18",
      "fishingtrickz.com": "2021-07-18",
      "fitness-for-ever.com": "2021-07-18",
      "flashobligation.com": "2021-07-18",
      "flashtraininggoal.com": "2021-07-18",
      "flights-report.com": "2021-07-18",
      "flights-todays.com": "2021-07-18",
      "flowersarrows.com": "2021-02-14",
      "flying-free.online": "2021-07-18",
      "flynewfries.com": "2021-07-18",
      "fofopiko.org": "2021-07-18",
      "foodeveryhour.com": "2021-07-18",
      "foodforyou.info": "2021-07-18",
      "foodiez.online": "2021-07-18",
      "forgetjustit.com": "2021-07-18",
      "formatpainter.net": "2021-07-18",
      "formattingcells.com": "2021-07-18",
      "forward-page.com": "2021-07-18",
      "forward5costume.com": "2021-07-18",
      "foto-top.info": "2021-07-18",
      "foudefoot.live": "2021-07-18",
      "free-local-events.info": "2021-07-18",
      "free247downloads.com": "2021-07-18",
      "freedominfo.net": "2021-07-18",
      "freelancers-team.org": "2021-07-18",
      "freeshoemoon.com": "2021-07-18",
      "freshandsoftbread.com": "2021-07-18",
      "freshsaladtoday.com": "2021-07-18",
      "functionalcover.com": "2021-07-18",
      "fundum8430.com": "2021-07-18",
      "funinat.com": "2021-07-18",
      "funinthesun4u.com": "2021-07-18",
      "funintheuk.com": "2021-07-18",
      "funnytvclips.com": "2021-07-18",
      "funtifu.live": "2022-04-17",
      "fwupdating.com": "2021-07-18",
      "gadgetproof.net": "2021-07-18",
      "gadgetsshop.info": "2021-07-18",
      "garrigareptiles.com": "2022-07-10",
      "gate-sync.net": "2021-07-18",
      "gdfr.online": "2021-07-18",
      "gearstereotype.com": "2021-07-18",
      "getagift.info": "2021-07-18",
      "getoutofyourmind.com": "2021-07-18",
      "getphotosinstant.net": "2021-07-18",
      "getpoints.net": "2021-07-18",
      "getspeednows.com": "2021-07-18",
      "gettingchances.com": "2021-07-18",
      "gettingurl.com": "2021-07-18",
      "gherboshop.com": "2022-07-10",
      "girlimstill.com": "2021-07-18",
      "girlsyoulike.com": "2021-07-18",
      "glassesofwine.com": "2021-07-18",
      "glasstaken.com": "2021-07-18",
      "glittercases.net": "2021-07-18",
      "global-redirect.net": "2021-07-18",
      "globalcoverage.co": "2021-07-18",
      "globalnews247.net": "2021-07-18",
      "globalsupporteam.com": "2021-07-18",
      "go-trip.online": "2021-07-18",
      "golf-news.live": "2019-10-07",
      "good-games.org": "2021-07-18",
      "goodcookingonline.com": "2021-07-18",
      "goodflowersinside.com": "2021-07-18",
      "goodthoughts4u.com": "2021-07-18",
      "googleplay-store.com": "2017-04-12",
      "goroskop.co": "2021-07-18",
      "gossipsbollywoods.com": "2021-07-18",
      "gostatspro.com": "2021-07-18",
      "greatcitymore.com": "2021-07-18",
      "greenbusnoise.com": "2021-07-18",
      "greensmallcanvas.com": "2021-07-18",
      "greenwatermovement.com": "2021-07-18",
      "grevejeunesmedecins.com": "2022-07-10",
      "growstart.net": "2021-07-18",
      "guardnotes.com": "2021-07-18",
      "gulf-financials.com": "2021-07-18",
      "gulf-news.info": "2019-10-07",
      "gulfca.net": "2021-07-18",
      "gumclockberry.com": "2021-07-18",
      "hairdresseraroundme.com": "2021-07-18",
      "halal-place.com": "2021-07-18",
      "handcraftedformat.com": "2021-07-18",
      "handcreamforyou.com": "2021-07-18",
      "handymanwood.com": "2021-07-18",
      "happiness4us.com": "2021-07-18",
      "hardthinmetal.com": "2021-07-18",
      "hatsampledc.com": "2021-07-18",
      "hdsoccerstream.com": "2021-07-18",
      "health-club.online": "2021-07-18",
      "healthyguess.com": "2021-07-18",
      "healthykids-food.com": "2021-07-18",
      "hearsmugglergarden.com": "2021-07-18",
      "heavy-flood.com": "2021-07-18",
      "hellomydaddy.com": "2021-07-18",
      "hellomymommy.com": "2021-07-18",
      "henrietta-commerce.com": "2022-07-10",
      "highclassdining.net": "2021-07-18",
      "hillsaround.com": "2021-07-18",
      "hitrafficip.com": "2021-07-18",
      "hmizat.co": "2019-10-10",
      "holdingspider.com": "2021-07-18",
      "holdmydoor.com": "2021-07-18",
      "holdstory.com": "2021-07-18",
      "holecatorange.com": "2021-07-18",
      "holiday-sun.net": "2023-11-15",
      "holiday4u.work": "2021-07-18",
      "homeishere.co": "2021-07-18",
      "homemadecandies.net": "2021-07-18",
      "hona-alrabe3.com": "2022-04-05",
      "horsefingercoffee.com": "2021-07-18",
      "host-one-more.com": "2021-07-18",
      "host-redirect.net": "2021-07-18",
      "hot-motors.com": "2021-07-18",
      "hotels-review.org": "2021-07-18",
      "hotelsauto.co": "2021-07-18",
      "hotelstax.co": "2021-07-18",
      "hotelsurvey.info": "2021-07-18",
      "hothdwallpaperz.com": "2021-07-18",
      "hotinfosource.com": "2021-07-18",
      "housesfurniture.com": "2018-10-07",
      "housing-update.com": "2021-07-18",
      "howisurday.com": "2021-07-18",
      "howtoexplorebirds.com": "2021-07-18",
      "howtomakeavocadotoastandegg.com": "2021-07-18",
      "hracingtips.com": "2021-07-18",
      "htmlmetrics.com": "2021-07-18",
      "htmlstats.net": "2021-07-18",
      "httpaccess.com": "2021-07-18",
      "humandiven.com": "2021-07-18",
      "humblebenefit.com": "2021-07-18",
      "hundredsofdesigns.net": "2021-07-18",
      "icecreamlovesme.com": "2021-07-18",
      "icloudcacher.com": "2018-07-05",
      "icrcworld.com": "2017-04-12",
      "ideas-telcel.com.mx": "2018-09-22",
      "igiheonline.com": "2021-07-18",
      "ikomek.info": "2021-07-18",
      "ilovemybeatifulnails.com": "2021-07-18",
      "ilovemymilf.com": "2021-07-18",
      "img565vv6.holdmydoor.com": "2021-02-14",
      "in-weather.com": "2021-07-18",
      "in2date.com": "2021-07-18",
      "inbox-messages.net": "2021-07-18",
      "income-tax.online": "2021-07-18",
      "indrive.info": "2021-07-18",
      "industry-specialist.com": "2021-07-18",
      "ineediscounts.com": "2021-07-18",
      "info24.live": "2021-07-18",
      "infoquiz.net": "2022-04-19",
      "informados24h.cominfo-urbano.com": "2022-01-13",
      "infospotpro.com": "2021-07-18",
      "infospress.com": "2019-10-10",
      "insertfilters.net": "2021-07-18",
      "insta-foto.net": "2021-07-18",
      "instangram.com.mx": "2021-07-18",
      "internetmobilespeed.com": "2021-07-18",
      "intim-media.net": "2021-07-18",
      "investigationews.com": "2019-10-07",
      "investormanage.net": "2021-07-18",
      "ipjackets.com": "2021-07-18",
      "ipurlredirect.com": "2021-07-18",
      "islam-today.info": "2021-07-18",
      "islam-world.net": "2021-07-18",
      "islamic-news-today.com": "2019-10-07",
      "islamiyaat.com": "2021-07-18",
      "ispr.email": "2022-04-17",
      "istgr-foto.com": "2021-07-18",
      "itsthebrowser.com": "2021-07-18",
      "iusacell-movil.com.mx": "2017-04-12",
      "iwantitallnow.com": "2021-07-18",
      "jaimelire.net": "2021-07-18",
      "jeeyarworld.com": "2021-07-18",
      "judgeauthority.com": "2021-07-18",
      "judo-genlis.com": "2022-07-10",
      "just-one-left.com": "2021-07-18",
      "kaidee.info": "2021-07-18",
      "karbalaeyat.com": "2021-07-18",
      "kaspi-payment.com": "2019-10-07",
      "keepiptext.com": "2021-07-18",
      "keepthiseasy.com": "2021-07-18",
      "kenyasms.org": "2021-07-18",
      "keyindoors.com": "2021-07-18",
      "keynotepalm.com": "2021-07-18",
      "khaleejtimes.online": "2021-07-18",
      "khilafah-islamic.com": "2022-04-05",
      "kingdom-deals.com": "2018-09-21",
      "kingdom-news.com": "2018-10-07",
      "klientuserviss.com": "2019-10-07",
      "knowingfun.com": "2021-07-18",
      "knowseminar.com": "2021-07-18",
      "koramaghreb.com": "2021-07-18",
      "kra.center": "2021-07-18",
      "kruseswiss.com": "2022-07-10",
      "kurjerserviss.com": "2019-10-07",
      "labonneforme.net": "2021-07-18",
      "lamyterie.com": "2022-07-10",
      "landflatheart.com": "2021-07-18",
      "landstofree.com": "2021-07-18",
      "laptop-parts.org": "2021-07-18",
      "last-chainleash.net": "2021-07-18",
      "latest-songs.com": "2021-07-18",
      "lawlowvat.net": "2021-07-18",
      "layerprotect.com": "2021-07-18",
      "layoutfill.com": "2021-07-18",
      "leadersnews.org": "2019-10-07",
      "leavehomego.com": "2021-07-18",
      "leggingsjustforyou.com": "2021-07-18",
      "legsfriesears.com": "2021-07-18",
      "legyelvodas.com": "2019-10-07",
      "legyelvodas.net": "2021-07-18",
      "leleader.org": "2021-07-18",
      "leprotestant.com": "2020-10-11",
      "lesbonnesaffaires.online": "2021-07-18",
      "leshutchins.com": "2022-07-10",
      "lesportail.biz": "2021-07-18",
      "letyoufall.com": "2021-07-18",
      "levelsteelwhite.com": "2021-07-18",
      "liam-ryan.co": "2021-07-18",
      "license-updater.com": "2021-07-18",
      "lifedonor.net": "2021-07-18",
      "lifenoonkid.com": "2021-07-18",
      "like-the-rest.com": "2021-07-18",
      "limitedfeature.com": "2021-07-18",
      "link-crawler.com": "2021-07-18",
      "link-scan.net": "2021-07-18",
      "linking-page.com": "2021-07-18",
      "linksnew.info": "2021-07-18",
      "littlefrogalarm.com": "2021-07-18",
      "live-once.net": "2021-07-18",
      "lizzardsnail.com": "2021-07-18",
      "loading-ads.net": "2021-07-18",
      "loading-domain.com": "2021-07-18",
      "loading-images.com": "2021-07-18",
      "loading-pag.net": "2021-07-18",
      "loading-page.net": "2021-07-18",
      "loading-url.net": "2021-07-18",
      "loadingpage1.net": "2021-07-18",
      "loadingpage4.net": "2021-07-18",
      "loadingurl.net": "2021-07-18",
      "loadthatpage.com": "2021-07-18",
      "localgreenflowers.com": "2021-07-18",
      "login-service.net": "2022-04-05",
      "loginverify.net": "2023-11-15",
      "loisiragogo.com": "2021-07-18",
      "lonely-place.com": "2021-07-18",
      "look-outsidenow.com": "2021-07-18",
      "looking-for-two.com": "2021-07-18",
      "lookitupnow.website": "2021-07-18",
      "looklifewhite.com": "2021-07-18",
      "loschanquetes.com": "2022-07-10",
      "loschismescalientes.com": "2021-07-18",
      "losnegocios.biz": "2021-07-18",
      "lost-n-found.net": "2021-07-18",
      "loveandhatenow.com": "2021-07-18",
      "lowervalues.com": "2021-07-18",
      "m-resume.com": "2021-07-18",
      "macmaclaren.com": "2022-07-10",
      "maghrebfoot.com": "2021-07-18",
      "maghrebfunny.biz": "2021-07-18",
      "magicalipone.com": "2021-07-18",
      "mailappzone.com": "2021-07-18",
      "mailerservice.directory": "2022-04-17",
      "maingreatessay.com": "2021-07-18",
      "mainredirecter.com": "2021-07-18",
      "mamba-live.com": "2021-07-18",
      "managedsnap.com": "2021-07-18",
      "management-help.com": "2021-07-18",
      "managingincluded.com": "2021-07-18",
      "mangoutlet.net": "2022-04-05",
      "manoraonline.net": "2018-07-05",
      "manydnsnow.com": "2021-07-18",
      "maphonortea.com": "2021-07-18",
      "mapupdatezone.com": "2021-07-18",
      "martinipicnic.com": "2021-07-18",
      "massagetax.co": "2021-07-18",
      "masternicherights.com": "2022-07-10",
      "masterpolishformula.com": "2022-07-10",
      "matlauinlondon.com": "2022-07-10",
      "maymknch2026.co": "2021-07-18",
      "mcel-update.com": "2021-07-18",
      "mcel.info": "2021-07-18",
      "mealrentyard.com": "2021-07-18",
      "meanspursuit.com": "2021-07-18",
      "medical-updates.com": "2021-07-18",
      "medicalcircle.net": "2021-07-18",
      "megacenter.info": "2021-07-18",
      "megaticket.info": "2021-07-18",
      "mercedesbenz-vip.com": "2021-07-18",
      "merchant-businesses.com": "2021-07-18",
      "mergeandcenter.com": "2021-07-18",
      "methodslocal.com": "2021-07-18",
      "mgifweb.com": "2021-07-18",
      "mideast-today.com": "2018-10-07",
      "mijn-vgz-overzicht-nl.info": "2022-02-08",
      "miles-club.com": "2021-07-18",
      "miralo-rapidamente.com": "2021-07-18",
      "mirrorgossip.com": "2021-07-18",
      "mixershake.net": "2021-07-18",
      "mixsinger.com": "2021-07-18",
      "mobi-up.net": "2021-07-18",
      "mobile-analytics.netweb-cloud-services.com": "2022-01-13",
      "mobile-softs.com": "2021-07-18",
      "mobile-update.online": "2021-07-18",
      "mobile-updates.info": "2021-07-18",
      "mobilebrowsing.net": "2021-07-18",
      "mobilephonesme.com": "2021-07-18",
      "mobiles-security.net": "2022-04-05",
      "mobileweatherweb.com": "2021-07-18",
      "modifytimezone.net": "2021-07-18",
      "moh-followup.com": "2021-07-18",
      "moh-online.com": "2021-07-18",
      "monawa3ate.org": "2021-07-18",
      "mondaymornings.co": "2021-07-18",
      "moneycheesecolor.com": "2021-07-18",
      "moneycoincurrency.com": "2021-07-18",
      "moneydigitalcurrency.com": "2021-07-18",
      "moneyxchanges.com": "2021-07-18",
      "moregatesthere.com": "2021-07-18",
      "morning-maps.com": "2021-07-18",
      "mosque-salah.com": "2021-07-18",
      "mosque-salah.net": "2021-07-18",
      "mosquesfinder.com": "2021-07-18",
      "motiontastebad.com": "2021-07-18",
      "motivation-go.com": "2021-07-18",
      "motordeal.info": "2021-07-18",
      "movie-tickets.online": "2021-07-18",
      "moyfoto.net": "2021-07-18",
      "moz-noticias.com": "2021-07-18",
      "mozillaname.com": "2021-07-18",
      "mozsafety.com": "2021-07-18",
      "muftyat.com": "2021-07-18",
      "multiplecurrencies.com": "2021-07-18",
      "music-electric.org": "2021-07-18",
      "music-headphones.org": "2021-07-18",
      "muslim-world.info": "2018-10-07",
      "muzicclips.com": "2021-07-18",
      "muziclovers.org": "2021-07-18",
      "my-privacy.co": "2021-07-18",
      "mybrightidea.co": "2021-07-18",
      "mydailycooking.net": "2021-07-18",
      "mydarkarms.com": "2021-07-18",
      "myfiles.photos": "2021-07-18",
      "myfreecharge.online": "2021-07-18",
      "myfundsdns.com": "2021-07-18",
      "mygreathat.com": "2021-07-18",
      "mygummyjelly.com": "2021-07-18",
      "myheartbuild.com": "2021-07-18",
      "mykaspi.com": "2019-10-07",
      "mylogfrog.com": "2021-07-18",
      "mylovelypet.net": "2021-07-18",
      "mymanagement-service.com": "2021-07-18",
      "mymensaje-sms.com": "2018-09-22",
      "mymobile-cell.com": "2021-07-18",
      "mynewbesttime.com": "2021-07-18",
      "mypostservice.online": "2021-07-18",
      "mysadaga.com": "2021-07-18",
      "myseesea.com": "2021-07-18",
      "myself-dns.com": "2021-07-18",
      "myshoesforever.com": "2021-07-18",
      "myshop4u.net": "2021-07-18",
      "mystulchik.com": "2019-10-07",
      "mysuperheadphones.co": "2021-07-18",
      "myukadventures.com": "2021-07-18",
      "mywebbargains.com": "2022-07-10",
      "mz-vodacom.info": "2017-04-12",
      "nation-news.com": "2021-07-18",
      "nation24.info": "2021-07-18",
      "nationalleagues.net": "2021-07-18",
      "natural-ice.com": "2021-07-18",
      "navywalls.com": "2021-07-18",
      "nbrowser.org": "2021-07-18",
      "nerdtvfan.com": "2021-07-18",
      "net-protector.com": "2021-07-18",
      "netstatistics.net": "2021-07-18",
      "nettprofile.com": "2022-07-10",
      "netvisualizer.com": "2021-07-18",
      "netweb-cloud-services.com": "2022-01-13",
      "network-bots.com": "2021-07-18",
      "network190.com": "2018-09-22",
      "networkinfo.org": "2021-07-18",
      "networkingloading.com": "2021-07-18",
      "networkingproperty.com": "2021-07-18",
      "neutralpages.com": "2021-07-18",
      "neverwayneck.com": "2021-07-18",
      "newandfresh.com": "2021-07-18",
      "newandroidapps.net": "2021-07-18",
      "newarrivals.club": "2021-07-18",
      "newcooking.org": "2021-07-18",
      "newdailycoupons.com": "2021-07-18",
      "newenvelope.net": "2021-07-18",
      "newip-info.com": "2021-07-18",
      "newipconfig.com": "2021-07-18",
      "newmodel.online": "2021-07-18",
      "newnhotapps.com": "2021-07-18",
      "newredirect.net": "2021-07-18",
      "news-alert.org": "2019-10-07",
      "news-flash.net": "2021-07-18",
      "news-gazette.info": "2018-10-07",
      "news-news.co": "2021-07-18",
      "newscurrent.info": "2019-10-07",
      "newsdirect.online": "2019-10-07",
      "newsofficial.info": "2019-10-07",
      "newsofgames.com": "2021-07-18",
      "newsofthemoment.net": "2019-10-07",
      "newsportal24.online": "2023-11-15",
      "newtarrifs.net": "2017-04-12",
      "newworld-news.com": "2019-10-07",
      "nicevibezaction.net": "2021-07-18",
      "nightevents.info": "2021-07-18",
      "nightscloudwant.com": "2021-07-18",
      "nnews.co": "2022-04-19",
      "noextramoney.com": "2021-07-18",
      "noloveforyou.com": "2021-07-18",
      "nomorewarnow.com": "2018-09-20",
      "noodlegray.com": "2021-07-18",
      "noonstore.sale": "2021-07-18",
      "noor-alhedaya.com": "2021-07-18",
      "normal-brain.com": "2021-07-18",
      "normal-strength.com": "2021-07-18",
      "normalseason.com": "2021-07-18",
      "northridgebest.com": "2022-07-10",
      "nosalternatives.com": "2021-07-18",
      "nosemorningnine.com": "2021-07-18",
      "nothernkivu.com": "2019-10-07",
      "noti-global.com": "2021-07-18",
      "noti-hot.com": "2021-07-18",
      "noti-hoy.co": "2021-07-18",
      "noticiaspoliticos.com": "2018-09-20",
      "notificationsneeded.com": "2021-07-18",
      "notisms.net": "2021-07-18",
      "notresante-infos.com": "2021-07-18",
      "nouveau-president.com": "2018-09-20",
      "nouvelles247.com": "2018-10-07",
      "noveletters.com": "2021-07-18",
      "novoicenoprob.net": "2021-07-18",
      "novosti247.com": "2021-07-18",
      "now-online.net": "2021-07-18",
      "nsoqa.com": "2018-09-21",
      "nuevaidea.co": "2021-07-18",
      "objectreduction.com": "2021-07-18",
      "odnoklass-profile.com": "2019-10-07",
      "offresimmobilier.com": "2021-07-18",
      "offspringperform.net": "2021-07-18",
      "ok-group.org": "2021-07-18",
      "old-glasses.net": "2021-07-18",
      "oldmywater.com": "2021-07-18",
      "one-isnot-enough.com": "2021-07-18",
      "oneadjump.com": "2023-11-15",
      "oneleadingchat.com": "2021-07-18",
      "onetreeinheaven.com": "2021-07-18",
      "online-dailynews.com": "2019-10-07",
      "online-loading.com": "2021-07-18",
      "onlinefreework.com": "2021-07-18",
      "onlineshopzm.com": "2019-10-07",
      "only-news.net": "2019-10-07",
      "onlycart.net": "2021-07-18",
      "onlygossip.info": "2021-07-18",
      "onlytoday.biz": "2021-07-18",
      "onlywebsite.org": "2021-07-18",
      "onthegoodtime.com": "2021-07-18",
      "ooredoodeals.com": "2018-07-05",
      "openingquestion.org": "2021-07-18",
      "opera-van.com": "2021-07-18",
      "operatingnews.com": "2019-10-07",
      "operations-delivery.com": "2021-07-18",
      "operations-shifts.com": "2021-07-18",
      "oplata-shtraf.info": "2021-07-18",
      "opposedarrangement.net": "2021-07-18",
      "optionalshift.online": "2021-07-18",
      "optionstoreplace.com": "2021-07-18",
      "orange-updates.com": "2021-07-18",
      "organicdiamonds.net": "2021-07-18",
      "ourorder.info": "2021-07-18",
      "ourperfume.net": "2021-07-18",
      "outgoingurl.com": "2021-07-18",
      "outletsaroundme.com": "2021-07-18",
      "outletstore.tech": "2021-07-18",
      "page-host.net": "2021-07-18",
      "page-info.com": "2021-07-18",
      "pageisloading.net": "2021-07-18",
      "pageredirect.co": "2021-07-18",
      "pageupdate.co": "2021-07-18",
      "painruncart.com": "2021-07-18",
      "painting-walls.com": "2021-07-18",
      "pakistanarmy.email": "2022-04-17",
      "panelbreed.com": "2021-07-18",
      "papers2go.co": "2021-07-18",
      "papervoice.net": "2021-07-18",
      "parinari.xyz": "2022-04-17",
      "park4free.info": "2021-07-18",
      "particularmechanic.net": "2021-07-18",
      "parties-fun.com": "2021-07-18",
      "pastesbin.com": "2021-07-18",
      "pathtogo.net": "2021-07-18",
      "pay-city.com": "2021-07-18",
      "pay-penalty.info": "2021-07-18",
      "paynfly.info": "2021-07-18",
      "paywithcrytpo.com": "2021-07-18",
      "pc-views.net": "2021-07-18",
      "pemra.email": "2022-04-17",
      "performinghost.com": "2021-07-18",
      "permalinking.com": "2021-07-18",
      "phonemetrics.co": "2021-07-18",
      "phonering4you.com": "2021-07-18",
      "phonestats.net": "2021-07-18",
      "photo-afisha.net": "2021-07-18",
      "photo-my.net": "2021-07-18",
      "physicalcheetah.com": "2021-07-18",
      "pickcard.info": "2021-07-18",
      "pickuchu.com": "2017-04-12",
      "picture4us.com": "2021-07-18",
      "pincattape.com": "2021-07-18",
      "pine-sales.com": "2018-09-21",
      "pirnaram.xyz": "2022-04-17",
      "pizzatoyourplace.com": "2021-07-18",
      "planeocean.com": "2021-07-18",
      "playfantasticsplastic.com": "2021-07-18",
      "playwithusonline.com": "2021-07-18",
      "pleaseusenew.com": "2021-07-18",
      "pleaseusenew.net": "2021-07-18",
      "pmogovpk.email": "2022-04-17",
      "pochta-info.com": "2021-07-18",
      "politica504.com": "2021-07-18",
      "politicalpress.org": "2018-09-20",
      "politicoportales.org": "2018-09-20",
      "politiques-infos.info": "2018-09-20",
      "popagency.net": "2021-07-18",
      "popularmessages.net": "2021-07-18",
      "port-connection.com": "2021-07-18",
      "portredirect.net": "2021-07-18",
      "possibilitytotransfer.com": "2021-07-18",
      "posta.news": "2019-10-07",
      "postainf.net": "2021-07-18",
      "pourcentfilers.com": "2021-07-18",
      "poweredbycpanel.com": "2021-07-18",
      "poweredlock.com": "2021-07-18",
      "ppcisdead.com": "2021-07-18",
      "pprocessor.net": "2021-07-18",
      "practical-basis.net": "2021-07-18",
      "practicehazard.com": "2021-07-18",
      "preferenceviews.com": "2021-07-18",
      "preferring.org": "2021-07-18",
      "presidentialagent.com": "2021-07-18",
      "preventadmission.com": "2021-07-18",
      "preventsusing.com": "2021-07-18",
      "pride-industry.com": "2021-07-18",
      "pride-industry.net": "2021-07-18",
      "pridetomyself.net": "2021-07-18",
      "prikol-girls.com": "2021-07-18",
      "primarystrike.net": "2021-07-18",
      "prioritytrail.net": "2021-07-18",
      "priveetalk.com": "2022-04-17",
      "privo7799add.net": "2021-07-18",
      "productsall.net": "2021-07-18",
      "productsview.co": "2021-07-18",
      "produitsjpcote.com": "2022-07-10",
      "projectgoals.net": "2021-07-18",
      "promosdereve.com": "2018-10-07",
      "promotionlove.co": "2021-07-18",
      "proudmorale.com": "2021-07-18",
      "pub-dns.com": "2021-07-18",
      "publishbig.net": "2021-07-18",
      "puffyteddybear.com": "2021-07-18",
      "purchaseusingcoins.com": "2021-07-18",
      "purple-enveloppe.com": "2021-07-18",
      "puttylearning.com": "2021-07-18",
      "qaintqa.com": "2018-09-21",
      "qaoffers.net": "2021-07-18",
      "qualityfeeling.net": "2021-07-18",
      "quitmyjob.xyz": "2021-07-18",
      "quota-reader.net": "2021-07-18",
      "quran-quote.com": "2021-07-18",
      "rainingcats.net": "2021-07-18",
      "raininscreen.com": "2021-07-18",
      "randomlane.net": "2021-07-18",
      "rapidredirecting.com": "2021-07-18",
      "raresound.org": "2021-07-18",
      "raw-console.com": "2021-07-18",
      "reachcomputer.com": "2021-07-18",
      "readingbooksnow.com": "2021-07-18",
      "readirectly.com": "2021-07-18",
      "realmythtrend.com": "2021-07-18",
      "receiptpending.net": "2021-07-18",
      "reception-desk.net": "2021-07-18",
      "recepzihni.com": "2022-07-10",
      "recordinglamping.com": "2021-07-18",
      "redcrossworld.com": "2017-04-12",
      "redemptionphrase.com": "2021-07-18",
      "redirect-connection.com": "2021-07-18",
      "redirect-link.com": "2021-07-18",
      "redirect-net.com": "2021-07-18",
      "redirect-protocol.com": "2021-07-18",
      "redirect-service.net": "2021-07-18",
      "redirect-systems.com": "2021-07-18",
      "redirect-traffic.net": "2021-07-18",
      "redirect-tunnel.net": "2021-07-18",
      "redirect-webpage.net": "2021-07-18",
      "redirect2url.net": "2021-07-18",
      "redirectchannel.net": "2021-07-18",
      "redirectcheck.net": "2021-07-18",
      "redirectconnection.net": "2021-07-18",
      "redirectdoor.com": "2021-07-18",
      "redirecteur.net": "2021-07-18",
      "redirectgate.com": "2021-07-18",
      "redirecting-url.com": "2021-07-18",
      "redirectingpage.net": "2021-07-18",
      "redirectingurl.net": "2021-07-18",
      "redirectingurl.org": "2021-07-18",
      "redirection-url.net": "2021-07-18",
      "redirectit.net": "2021-07-18",
      "redirectking.net": "2021-07-18",
      "redirectload.com": "2021-07-18",
      "redirectmotion.org": "2021-07-18",
      "redirectnet.net": "2021-07-18",
      "redirectool.com": "2021-07-18",
      "redirectprotocol.net": "2021-07-18",
      "redirectshare.com": "2021-07-18",
      "redirectweburl.com": "2021-07-18",
      "redirigir.net": "2021-07-18",
      "redirstats.com": "2022-04-19",
      "redstarnews.net": "2021-07-18",
      "reflectextension.net": "2021-07-18",
      "regionews.net": "2019-10-07",
      "regularhours.net": "2021-07-18",
      "reklamas.info": "2019-10-07",
      "related-ads.com": "2021-07-18",
      "relatedspams.net": "2021-07-18",
      "reload-url.com": "2021-07-18",
      "reload-url.net": "2021-07-18",
      "reloading-page1.com": "2021-07-18",
      "reloadinput.com": "2021-07-18",
      "reloadpage.net": "2021-07-18",
      "remove-client.com": "2021-07-18",
      "remove-from-mailing-list.com": "2021-07-18",
      "remove-from-mailinglist.com": "2021-07-18",
      "remove-subscription.co": "2018-09-21",
      "remove-subscription.com": "2021-07-18",
      "renewal-control.net": "2021-07-18",
      "rentalindustries.com": "2021-07-18",
      "rentmotors.net": "2021-07-18",
      "research-archive.com": "2021-07-18",
      "reseausocialsolutions.co": "2021-07-18",
      "reservationszone.com": "2021-07-18",
      "reseufun.com": "2021-07-18",
      "resolutionsbox.com": "2021-07-18",
      "restaurantsstar.com": "2021-07-18",
      "results-house.net": "2021-07-18",
      "revoke-dashboard.com": "2021-07-18",
      "revolution-news.co": "2018-09-20",
      "rewards-club.info": "2021-07-18",
      "rhymeshey.com": "2021-07-18",
      "righttriangle.net": "2021-07-18",
      "roadwide.net": "2021-07-18",
      "robotscan.net": "2021-07-18",
      "rockbreakdown.com": "2021-07-18",
      "rockmusic4u.com": "2021-07-18",
      "rockstarpony.com": "2021-07-18",
      "rosegoldjewerly.com": "2021-07-18",
      "rosesforus.com": "2021-07-18",
      "rotaryimports.com": "2022-07-10",
      "rss-me.com": "2022-04-05",
      "russian4u.net": "2021-07-18",
      "sabafon.info": "2017-04-12",
      "safe-mondays.net": "2021-07-18",
      "safecrusade.com": "2021-07-18",
      "saladsaroundme.com": "2021-07-18",
      "sale-2019.com": "2023-11-15",
      "saltyapplepie.com": "2021-07-18",
      "same-old.net": "2021-07-18",
      "savemoretime.co": "2021-07-18",
      "savephotos.net": "2019-03-01",
      "saveurday.net": "2021-07-18",
      "scannerservices.net": "2021-07-18",
      "scaryaudience.com": "2021-07-18",
      "scriptincluded.com": "2021-07-18",
      "scriptsinstallers.com": "2021-07-18",
      "seacoastkaraoke.com": "2022-07-10",
      "searchjustdont.net": "2021-07-18",
      "searchunit.net": "2021-07-18",
      "sec-checker.com": "2021-07-18",
      "secretgirlfriend.net": "2021-07-18",
      "secure-access10.mx": "2018-09-22",
      "secured-url.net": "2021-07-18",
      "securedloading.com": "2021-07-18",
      "securedlogin.org": "2021-07-18",
      "securesmsing.com": "2021-07-18",
      "secureyouradd.com": "2021-02-14",
      "securisurf.com": "2021-07-18",
      "securlaw.com": "2021-07-18",
      "select-edition.net": "2021-07-18",
      "send2url.com": "2021-07-18",
      "sendhtml.net": "2021-07-18",
      "sendingurl.com": "2021-07-18",
      "sendingurl.net": "2021-07-18",
      "sergek.info": "2019-10-07",
      "seriousprotection.net": "2021-07-18",
      "service-update.online": "2021-07-18",
      "services-sync.com": "2021-07-18",
      "servingshade.com": "2021-07-18",
      "severalheroes.com": "2021-07-18",
      "sexxclip.com": "2022-07-18",
      "sharepassageset.com": "2021-07-18",
      "shia-voice.com": "2018-09-20",
      "shipment-status.org": "2021-07-18",
      "shoppingdailydeals.net": "2021-07-18",
      "short-address.com": "2021-07-18",
      "shortfb.com": "2021-07-18",
      "shortredirect.com": "2021-07-18",
      "shtraf.info": "2021-07-18",
      "shuturl.com": "2021-07-18",
      "siamha.info": "2022-07-18",
      "signpetition.co": "2018-09-20",
      "silverodgone.com": "2021-07-18",
      "simplycode.co": "2021-07-18",
      "site-lock.net": "2021-07-18",
      "site-redirecting.com": "2021-07-18",
      "skillsforest.net": "2021-07-18",
      "smallperfumerain.com": "2021-02-14",
      "smallridebar.com": "2021-07-18",
      "smarttarfi.com": "2021-07-18",
      "smokeshowshoe.com": "2021-07-18",
      "smoothurl.com": "2021-07-18",
      "sms-center.info": "2021-07-18",
      "sms-sending.net": "2021-07-18",
      "sms-zone.org": "2021-07-18",
      "sms.webadv.co": "2018-07-05",
      "smscentro.com": "2018-09-22",
      "smser.net": "2018-07-05",
      "smsmensaje.mx": "2018-09-21",
      "snoweverywhere.com": "2021-07-18",
      "so-this-is.com": "2021-07-18",
      "soccerstreamingstars.com": "2021-07-18",
      "social-artist.net": "2021-07-18",
      "social-exercise.com": "2021-07-18",
      "social-life.info": "2018-09-20",
      "social-rights.com": "2021-07-18",
      "sockstubename.com": "2021-07-18",
      "solo-hoy.com": "2022-01-13",
      "somewarmremember.com": "2021-07-18",
      "somuchrain.com": "2021-07-18",
      "sparepresence.com": "2021-07-18",
      "specialgifts4all.com": "2021-07-18",
      "speechenforce.com": "2021-07-18",
      "speedservicenow.com": "2021-07-18",
      "spiritualbrakes.com": "2021-07-18",
      "sportssaint.net": "2021-07-18",
      "sportupdates.info": "2021-07-18",
      "sportupdates.online": "2021-07-18",
      "sputnik-news.info": "2019-10-07",
      "squaretables.net": "2021-07-18",
      "sslbind.com": "2021-07-18",
      "standartsheet.com": "2021-07-18",
      "standstock.net": "2021-07-18",
      "starbuckscoffeeweb.com": "2021-07-18",
      "starreturned.com": "2021-07-18",
      "stars4sale.co": "2021-07-18",
      "start2playnow.com": "2021-07-18",
      "starting-from0.com": "2021-07-18",
      "startupsservices.net": "2021-07-18",
      "stationfunds.net": "2021-07-18",
      "statisticsdb.net": "2021-07-18",
      "statsads.co": "2022-04-19",
      "statsupplier.com": "2022-04-19",
      "stayallalone.com": "2022-07-18",
      "staysystem.net": "2021-07-18",
      "sterlingpetcare.com": "2022-07-10",
      "stilloak.net": "2021-02-14",
      "stopmysms.com": "2021-07-18",
      "stopsms.biz": "2019-10-10",
      "storageseminar.net": "2021-07-18",
      "storelive.co": "2021-07-18",
      "strangegloom.net": "2021-07-18",
      "strategyroles.com": "2021-07-18",
      "suitcasesmellnice.com": "2021-07-18",
      "summermover.com": "2021-07-18",
      "sunday-deals.com": "2018-10-07",
      "sunnydaylight.com": "2021-07-18",
      "sunrise-brink.net": "2021-07-18",
      "sunsetdnsnow.com": "2021-07-18",
      "superlinks4u.com": "2021-07-18",
      "support-team.tech": "2022-04-17",
      "supportonline4me.com": "2021-07-18",
      "surprising-sites.com": "2021-07-18",
      "sweet-water.org": "2021-07-18",
      "sweetcup.co": "2021-07-18",
      "sync-cdn.com": "2021-07-18",
      "syncingprocess.com": "2021-07-18",
      "syncmap.org": "2021-07-18",
      "systemtrees.com": "2021-07-18",
      "t-support.net": "2021-07-18",
      "tablereservation.info": "2021-07-18",
      "tahmilmilafate.com": "2021-07-18",
      "tahmilmilafate.info": "2021-07-18",
      "takecarhomes.com": "2021-07-18",
      "takemallelectric.com": "2021-02-14",
      "takethat.co": "2021-07-18",
      "talabatt.net": "2022-04-05",
      "tastyteaflavors.com": "2021-07-18",
      "teachskate.com": "2021-07-18",
      "techhelping.net": "2021-07-18",
      "telangana-news24.com": "2021-07-18",
      "telecom-info.com": "2021-07-18",
      "telephonequality.com": "2021-07-18",
      "template-iso.net": "2021-07-18",
      "tengrinews.co": "2019-10-07",
      "tentrosegain.com": "2021-07-18",
      "thainews.asia": "2021-07-18",
      "thankstossl.com": "2021-07-18",
      "the-only-way-out.com": "2021-07-18",
      "theappanalytics.com": "2021-07-18",
      "theastafrican.com": "2019-10-07",
      "thebestclassicalmusic.net": "2021-07-18",
      "thecoffeeilove.com": "2021-07-18",
      "thefuturearticle.net": "2021-07-18",
      "thehighesttemple.com": "2021-07-18",
      "thehoteloffers.com": "2021-07-18",
      "theredirect.net": "2021-07-18",
      "theshopclub.org": "2021-07-18",
      "thesimplestairs.com": "2021-07-18",
      "thespaclub.net": "2021-07-18",
      "theway2get.com": "2021-07-18",
      "thoughtfulbundle.com": "2021-07-18",
      "thtube.video": "2022-07-18",
      "tibetnews365.net": "2021-07-18",
      "ticket-aviata.info": "2021-07-18",
      "ticket-selections.com": "2021-07-18",
      "tiketon.info": "2021-07-18",
      "timelesscelebrity.com": "2021-07-18",
      "timeofflife.com": "2021-07-18",
      "tinyurler.com": "2021-07-18",
      "tlgr-me.org": "2021-07-18",
      "tobepure.com": "2021-07-18",
      "todaysdeals4u.com": "2021-07-18",
      "todoinfonet.com": "2021-07-18",
      "toggletools.com": "2021-07-18",
      "tommyfame.com": "2021-07-18",
      "tomorrowpastno.com": "2021-07-18",
      "tookcheckout.com": "2021-07-18",
      "top100vidz.com": "2021-07-18",
      "top10gifts4men.com": "2021-07-18",
      "top10leadsgen.com": "2021-07-18",
      "topadblocker.net": "2021-07-18",
      "topbraingames4u.com": "2021-07-18",
      "topcontactco.com": "2017-04-12",
      "topoems.com": "2021-07-18",
      "topten-news.info": "2019-10-07",
      "touristvaca.com": "2021-07-18",
      "towebsite.net": "2021-07-18",
      "track-your-fedex-package.com": "2021-07-18",
      "track-your-fedex-package.online": "2018-09-21",
      "track-your-fedex-package.org": "2017-04-12",
      "trackyourfedexpackage.net": "2021-07-18",
      "trade-agreement.com": "2021-07-18",
      "tradeexchanging.com": "2021-07-18",
      "traffic-pay.com": "2021-07-18",
      "traffic-updates.info": "2021-07-18",
      "transfer-rate.com": "2021-07-18",
      "transferbase.co": "2021-07-18",
      "transferkeep.com": "2021-07-18",
      "transferlights.com": "2021-07-18",
      "travel-foryou.online": "2021-07-18",
      "travelcrimea.info": "2022-02-08",
      "travelight.online": "2021-07-18",
      "traveltogether.link": "2021-07-18",
      "trendsymbol.net": "2021-07-18",
      "trialvariable.net": "2021-07-18",
      "trianglerank.net": "2021-07-18",
      "tricksinswiss.com": "2021-07-18",
      "trililihihi.com": "2021-07-18",
      "tripleclickpays.com": "2021-07-18",
      "tunnelprotocol.net": "2021-07-18",
      "turismo-aqui.com": "2021-07-18",
      "turkeynewsupdates.com": "2018-07-05",
      "turkishairines.info": "2017-04-12",
      "tvshowcusting.com": "2021-07-18",
      "twiitter.com.mx": "2018-09-22",
      "uaenews.online": "2018-07-05",
      "uidebol.info": "2021-07-18",
      "umbrellacover.net": "2021-07-18",
      "un-limitededitions.com": "2021-07-18",
      "un0noticias.com": "2018-09-20",
      "un0noticias.net": "2018-09-20",
      "unavailableentry.com": "2021-07-18",
      "unionofteenagers.com": "2021-07-18",
      "uniquesite.co": "2021-07-18",
      "universopolitico.net": "2018-09-20",
      "univision.click": "2017-04-12",
      "unlockaccount.net": "2021-07-18",
      "unonoticias.net": "2017-04-12",
      "unsubscribe-now.net": "2022-04-05",
      "unsubscribed.co": "2021-07-18",
      "unsubscribeinhere.com": "2021-07-18",
      "untoldinfo.net": "2021-07-18",
      "unusualneighbor.com": "2021-07-18",
      "updateapps.net": "2021-07-18",
      "updatedchargers.com": "2021-07-18",
      "updatedcharges.net": "2021-07-18",
      "updating-link.com": "2021-07-18",
      "updating-url.com": "2021-07-18",
      "updating-url.net": "2021-07-18",
      "updatingpage.com": "2021-07-18",
      "updatingwebpage.com": "2021-07-18",
      "upgrade-sim-card.com": "2021-07-18",
      "upkeepno.com": "2021-07-18",
      "upload-now.net": "2021-07-18",
      "uptownfun.co": "2021-07-18",
      "urbestfriends.com": "2021-07-18",
      "url-configure.com": "2021-07-18",
      "url-direct.com": "2021-07-18",
      "url-hoster.com": "2021-07-18",
      "url-loading.com": "2021-07-18",
      "url-redirect.com": "2021-07-18",
      "url-redirect.net": "2021-07-18",
      "url2all.net": "2021-07-18",
      "urlconfig.net": "2021-07-18",
      "urlconnection.net": "2021-07-18",
      "urldefender.net": "2021-07-18",
      "urlpage-redirect.com": "2021-07-18",
      "urlpush.net": "2021-07-18",
      "urlredirect.net": "2021-07-18",
      "urlregistrar.net": "2021-07-18",
      "urlreload.net": "2021-07-18",
      "urlscanner.net": "2021-07-18",
      "urlsync.com": "2021-07-18",
      "urlupdates.com": "2021-07-18",
      "urlviaweb.com": "2021-07-18",
      "urspanishteacher.net": "2021-07-18",
      "user-registration.com": "2021-07-18",
      "utensils.pro": "2021-07-18",
      "vamizi.info": "2021-07-18",
      "vanillaandcream.com": "2021-07-18",
      "varietyjobspaid.org": "2021-07-18",
      "varietyregistrar.com": "2021-07-18",
      "vastdealsnow.com": "2021-07-18",
      "vault-encryption.com": "2021-07-18",
      "verify-app.online": "2021-07-18",
      "videosdownload.co": "2019-10-10",
      "videotubbe.net": "2021-07-18",
      "vider-image.com": "2021-07-18",
      "vie-en-islam.com": "2020-10-11",
      "viedechretien.org": "2020-10-11",
      "viewhdvideos.com": "2021-07-18",
      "viewstracker.com": "2021-07-18",
      "vipmasajes.com": "2021-07-18",
      "viva-droid.com": "2021-07-18",
      "vivrechezsoi.info": "2021-07-18",
      "vkan-profile.com": "2021-07-18",
      "volcanodistance.com": "2021-07-18",
      "volcanosregion.com": "2021-07-18",
      "waffleswithnutella.com": "2021-07-18",
      "waitingtoload.com": "2021-07-18",
      "walkerpost.net": "2021-07-18",
      "walkhatclock.com": "2021-07-18",
      "wallagainsthall.com": "2021-07-18",
      "walltome.com": "2021-07-18",
      "wasted-nights.com": "2021-07-18",
      "waterforplants.net": "2021-07-18",
      "watersport4u.net": "2021-07-18",
      "weakdistance.com": "2021-07-18",
      "weather4free.com": "2021-07-18",
      "weatherapi.co": "2021-07-18",
      "web-check.co": "2021-07-18",
      "web-config.org": "2021-07-18",
      "web-developper.net": "2021-07-18",
      "web-domain.net": "2021-07-18",
      "web-hoster.co": "2021-07-18",
      "web-loading.com": "2021-07-18",
      "web-loading.net": "2021-07-18",
      "web-only.net": "2021-07-18",
      "web-page.co": "2021-07-18",
      "web-scanner.co": "2021-07-18",
      "web-spider.net": "2021-07-18",
      "web-url.net": "2021-07-18",
      "web-viewer.online": "2021-07-18",
      "webadv.co": "2021-07-18",
      "webexaminer.net": "2021-07-18",
      "webpageupdate.co": "2021-07-18",
      "webprotector.co": "2021-07-18",
      "webprotocol.net": "2021-07-18",
      "webresourcer.com": "2021-07-18",
      "websconnector.co": "2021-07-18",
      "websiteconnecting.com": "2021-07-18",
      "websiteeco.com": "2021-07-18",
      "websitereconnecting.com": "2021-07-18",
      "websites4yourhost.com": "2021-07-18",
      "websitetosubmit.com": "2021-07-18",
      "webstrings.net": "2021-07-18",
      "websupporter.co": "2021-07-18",
      "webtunnels.net": "2021-07-18",
      "webupdater.net": "2021-07-18",
      "webview-redirect.com": "2021-07-18",
      "wedding-strategy.com": "2021-07-18",
      "weddingbandsoft.com": "2021-02-14",
      "welcomehosting.net": "2021-07-18",
      "welovebigcakes.com": "2021-07-18",
      "welovelollipops.com": "2021-07-18",
      "welovemorningcoffees.com": "2021-07-18",
      "wewantflowersnow.com": "2021-07-18",
      "whatcanidowithbirds.com": "2021-07-18",
      "whats-new.org": "2021-07-18",
      "whatsapp-app.com": "2017-04-12",
      "whatsappsupport.net": "2021-07-18",
      "whereismybonus.com": "2021-07-18",
      "whereismyhand.com": "2021-07-18",
      "whereismytree.net": "2021-07-18",
      "whereisthehat.com": "2021-07-18",
      "whynotyesterday.com": "2021-07-18",
      "whypillyellow.com": "2021-07-18",
      "willpurpleshe.com": "2021-07-18",
      "windyone.net": "2021-07-18",
      "winfoxflip.com": "2021-07-18",
      "winter-balance.com": "2021-07-18",
      "wintertimes.co": "2021-07-18",
      "wishdownget.com": "2021-07-18",
      "without-additional.com": "2021-07-18",
      "witness-delay.com": "2021-07-18",
      "wonderfulinsights.com": "2018-10-07",
      "woodhome4u.com": "2021-07-18",
      "wordstore.net": "2021-07-18",
      "working-online.net": "2021-07-18",
      "workshopmanager.net": "2021-07-18",
      "wraptext.net": "2021-07-18",
      "xchange4u.net": "2021-07-18",
      "xchangerates247.net": "2021-07-18",
      "xn--nissn-3jc.com": "2021-07-18",
      "xn--noki-t5b.com": "2021-07-18",
      "xn--telegrm-qbd.com": "2021-07-18",
      "xtremelivesupport.com": "2021-07-18",
      "y0utube.com.mx": "2017-04-12",
      "youaresostupid.net": "2021-07-18",
      "youcantpass.com": "2021-07-18",
      "youintelligence.com": "2021-07-18",
      "youliehow.com": "2021-07-18",
      "yourbestclothes.com": "2021-07-18",
      "yourbestefforts.com": "2021-07-18",
      "yourbestvaca.com": "2021-07-18",
      "yourgreatestsmartphone.com": "2021-07-18",
      "yourhotelreservation.info": "2021-07-18",
      "yourlastchance.net": "2021-07-18",
      "yousunhard.com": "2021-07-18",
      "yummyfoodallover.com": "2021-07-18",
      "zednewszm.com": "2019-10-07",
      "zm-banks.com": "2019-10-07",
      "zm-weather.com": "2019-10-07",
      "zsports-info.com": "2021-07-18"
    },
    "url": {
      "mp3.ucrazy.org/music/": "2019-03-18"
    }
  },
  "first_seen_precision": {
    "domain": {},
    "url": {}
  },
  "first_seen_range": {
    "earliest": "2017-04-12",
    "latest": "2023-11-15"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "123tramites.com",
      "14-tracking.com",
      "1minto-start.com",
      "1place-togo.com",
      "24-7clinic.com",
      "301-redirecting.com",
      "365redirect.co",
      "3driving.com",
      "456h612i458g.com",
      "7style.org",
      "800health.net",
      "911hig11carcay959454.com",
      "9jp1dx8odjw1kbkt.f15fwd322.regularhours.net",
      "a-redirect.com",
      "a-resolver.com",
      "aalaan.tv",
      "accomodation-tastes.net",
      "accountant-audio.com",
      "accountcanceled.com",
      "accountnotify.com",
      "accounts-unread.com",
      "accounts.mx",
      "accountsections.com",
      "accountsecurities.org",
      "activate-discount.com",
      "active-folders.com",
      "actorsshop.net",
      "actu24.online",
      "ad-generator.net",
      "ad-switcher.com",
      "add-client.com",
      "additional-costs.com",
      "addmyid.net",
      "addresstimeframe.com",
      "adeal4u.co",
      "adjust-local-settings.co",
      "adjust-local-settings.com",
      "adjustlocalsettings.net",
      "adscreator.net",
      "adsload.co",
      "adsmetrics.co",
      "advert-time.com",
      "advert-track.com",
      "afriquenouvelle.com",
      "afternicweb.net",
      "agilityprocessing.net",
      "aircraftsxhibition.com",
      "ajelnews.net",
      "akhbar-aliqtisad.com",
      "akhbar-almasdar.com",
      "akhbar-arabia.com",
      "akhbar-islamyah.com",
      "akhbara-aalawsat.com",
      "akhbarnew.com",
      "al-nusr.net",
      "al-taleanews.net",
      "al-taleanewsonline.net",
      "al7erak247.com",
      "al7eraknews.com",
      "alawaeltech.com",
      "albumphotopro.biz",
      "alignmentdisabled.net",
      "alive2plunge.com",
      "all-sales.info",
      "allaboutwrightwood.com",
      "allafricaninfo.com",
      "allbeautifularts.com",
      "alldaycooking.co",
      "allergiesandcooking.com",
      "allfadiha.co",
      "alljazeera.co",
      "allladiesloveme.com",
      "allthecolorsyoulike.com",
      "allthegamesyouneed.com",
      "allthemakeupyouneed.com",
      "allthesongsyoulike.com",
      "alluneed4home.net",
      "alpharythme.com",
      "alrainew.com",
      "android-core.org",
      "android-updates.net",
      "animal-politico.com",
      "api.priveetalk.com",
      "apiapple.com",
      "apigraphs.net",
      "apiwacdn.com",
      "appleleaveit.co",
      "applicationcreation.net",
      "appointments-online.com",
      "appsgratis.com.mx",
      "appsjuegos.com.mx",
      "ar-tweets.com",
      "arab-share.com",
      "arabia-islamion.com",
      "arabnews365.com",
      "arabworld.biz",
      "arabworldnews.info",
      "around-theglobe.co",
      "arrowowner.com",
      "asrararabiya.co",
      "asrararablya.com",
      "asrarrarabiya.com",
      "assembled-battery.com",
      "atlaslions.info",
      "audienceflake.com",
      "auditorcast.com",
      "authenticangry.com",
      "authenticated-origin.com",
      "authlovebirth.com",
      "autodiscount.info",
      "autoredirect.net",
      "av-scanner.com",
      "avocadofight.com",
      "awardpractice.com",
      "awizo.info",
      "axis-indication.net",
      "babies-bottles.com",
      "bahrainsms.co",
      "balancewreckpoint.com",
      "bananakick.net",
      "banca-movil.com",
      "banca-movil.net",
      "bankportal.net",
      "baramije.net",
      "bargainservice.online",
      "bbc-africa.com",
      "bdaynotes.com",
      "beanbounce.net",
      "beautifulhousesaroundme.com",
      "becomeiguana.com",
      "beethoventopsymphonies.com",
      "behindaquarium.com",
      "benjamin-taganga.info",
      "bestadventures4u.com",
      "bestcandyever.com",
      "bestday-sales.com",
      "bestfoods.co",
      "bestfriendneedshelp.com",
      "bestheadphones4u.com",
      "besthotelsaroundme.com",
      "bestperfumesnow.com",
      "bestpresents4all.net",
      "bestsalesaroundme.com",
      "beststores4u.com",
      "bestsushiever.com",
      "better-deal.info",
      "betterapplesearch.com",
      "betterhandsblack.com",
      "bicyclerentalnow.com",
      "biggunsarefun.com",
      "bigseatsout.net",
      "billednorth.com",
      "bingoblitzvippro.com",
      "birdbathmorning.com",
      "biscuit-taste.net",
      "bitanalysis.net",
      "bitfadepens.com",
      "bitforeat.net",
      "bl33pon6373.com",
      "black-bricks.net",
      "blackberry.org.mx",
      "blackwhitebags.com",
      "blindlydivision.com",
      "blockedsituation.net",
      "blogreseller.net",
      "boldconclusion.com",
      "booking-tables.com",
      "bottlehere.com",
      "boxes-mix.net",
      "boysrbabies.co",
      "br-hashtags.com",
      "br-travels.com",
      "brand-tech.net",
      "brandttoyota.com",
      "breakfastisgood.com",
      "breaking-extranews.online",
      "breaking-news.co",
      "breakingnewsasia.com",
      "breakthenews.net",
      "brighttooth.net",
      "brookviewpetgrooming.com",
      "brownandblueeyes.com",
      "browser-update.online",
      "bubblesmoke.net",
      "bubblesweetcake.com",
      "buildingcarpet.com",
      "buildurlife.net",
      "buildyourdata.com",
      "bulbazaur.com",
      "bulk-theft.net",
      "bulksender.info",
      "bulktheft.com",
      "bullgame.net",
      "bun54l2b67.get1tn0w.free247downloads.com",
      "bunchi.club",
      "bundlestofear.com",
      "business-today.info",
      "businesssupportme.com",
      "bussybeesallover.com",
      "bustimer.net",
      "butterdogchange.com",
      "buymanuel.co",
      "buypresent4me.net",
      "bytlo.com",
      "cablegirls.net",
      "calculatesymbols.com",
      "calendarsapp.com",
      "candlealbum.com",
      "carpetdignity.com",
      "carrefour-des-affaires.com",
      "cars-to-buy.com",
      "cartsafer.com",
      "cashandlife.com",
      "cashtowebmail.com",
      "casia-news.info",
      "casusbocekler.com",
      "catbrushcable.com",
      "catfoodstorage.net",
      "catsndogsproducts.com",
      "cdnupdateweb.com",
      "cdnwa.com",
      "celebrateyourdaynow.com",
      "cell-abonnes.com",
      "cell-mcel.info",
      "cellphone-inside.org",
      "cellphonesprices.com",
      "cellular-updates.com",
      "cellular-updates.online",
      "cellularupdates.info",
      "centersession.com",
      "centrasia-news.com",
      "cerfcube.com",
      "changesstarted.net",
      "chatresponses.com",
      "cheapapartmentsaroundme.com",
      "cheapcardonline.com",
      "cheaphostingtoday.com",
      "cheapmotelz.net",
      "cheapsolutions4u.com",
      "cheaptransporting.net",
      "check-my-internetspeed.com",
      "checkboxcart.com",
      "checkboxfee.com",
      "checkinonlinehere.com",
      "chickenwaves.com",
      "chistedeldia.mx",
      "chocolateicecreamlovers.com",
      "chocollife.me",
      "chormnet3.com",
      "chretiendaujoudhui.com",
      "chubaka.org",
      "classic-furnitures.com",
      "classstylemap.com",
      "cleanmiddle.com",
      "clickrighthere.online",
      "clicktrack247.com",
      "clients-access.com",
      "clockmarkcoffee.com",
      "closefly.com",
      "cloudads.net",
      "cloudbiggest.com",
      "clubloading.net",
      "clubmovistar.com",
      "clubsforus.net",
      "cnic-ferify.live",
      "cnic-update.com",
      "cnn-africa.co",
      "coffecups.online",
      "coffee2go.org",
      "colorfulnotebooks.com",
      "colorsoflife.online",
      "columbus-parking.com",
      "com-reports.net",
      "cominfo-urbano.com",
      "companybreakfast.net",
      "computer-set.com",
      "conditionalcell.com",
      "conference-ballroom.com",
      "confusedmachine.com",
      "connecting-to.com",
      "contacting-customer.com",
      "content-blocking.net",
      "contentsbycase.com",
      "convertedversion.com",
      "cookiescom.com",
      "cookiesoutthere.com",
      "cool-smartphone-apps.com",
      "coolasiankitchen.com",
      "coolbbqtools.net",
      "coolmath4us.net",
      "cornclean.com",
      "cottondecay.com",
      "countrytrips.net",
      "coupedumondepro.com",
      "couponshops.info",
      "cozmo-store.net",
      "cpr-appointments.com",
      "crashparadox.net",
      "crimebackfire.com",
      "crosslocated.net",
      "crowndecoration.net",
      "crownsafe.net",
      "cryptocurrecny.com",
      "cryptokoinz.com",
      "cryptopcoinz.com",
      "csomagodjott.com",
      "cssgraphics.net",
      "cupscars.net",
      "curiousrabbitgame.com",
      "currentscan.net",
      "currentwestpeople.com",
      "daily-sport.news",
      "damanhealth.online",
      "dancersing.net",
      "dancinglife.co",
      "dashboardprompt.com",
      "data-formula.com",
      "databasemeans.net",
      "deadwordsstory.com",
      "deal4unow.com",
      "dearlegendseed.com",
      "defencepk.email",
      "delivery-24-7.com",
      "dental-care-spa.net",
      "deportes24-7.com",
      "deportesinfo.com",
      "derinaydogan.com",
      "designednetwork.com",
      "destinytool.net",
      "detailrush.net",
      "deter-individuals.com",
      "devicer.co",
      "dhcpserver.net",
      "diagram-shape.com",
      "diaspora-news.com",
      "diningip.com",
      "dinneraroundyou.com",
      "directbegins.com",
      "directlyforuse.com",
      "directurl-loading.com",
      "discountads.net",
      "discountmarkets.info",
      "discountstores.info",
      "discoveredworld-news.com",
      "displaytag.net",
      "dns-1.co",
      "dns-analytics.com",
      "dns-direct.net",
      "dns-upload.com",
      "dnsclocknow.com",
      "dnslogs.net",
      "dnsmachinefork.com",
      "dnsprotector.net",
      "dnsroof.com",
      "do-itonyour-own.com",
      "documentpro.org",
      "dogfoodstorage.net",
      "dogopics.com",
      "doitformom.com",
      "doitforthefame-now.com",
      "domain-control.net",
      "domain-redirect.com",
      "domain-resolver.net",
      "domain-routing.com",
      "domain-security.org",
      "domainloading.net",
      "domainport.net",
      "domains-resolver.net",
      "domainsearching.net",
      "domesticwindow.com",
      "donateabox.co",
      "donateaflower.com",
      "donateyouroldclothes.net",
      "done.events",
      "donefordeal.com",
      "doorcoffeebrown.com",
      "dotroomeight.com",
      "dowhatyouneed.com",
      "downgradeproduct.com",
      "download.fbr.tax",
      "dramatic-challenge.com",
      "driventicket.com",
      "e-loading.biz",
      "e-prokuror.info",
      "e-sveiciens.com",
      "eardooraround.com",
      "earsstrawsfive.com",
      "easy-pay.info",
      "easybett.online",
      "ecommerce-ads.org",
      "economic-news.co",
      "editorscolumn.net",
      "effectivespeech.net",
      "egov-online.com",
      "egov-segek.info",
      "egov-sergek.info",
      "ehistorybooks.com",
      "elementscart.com",
      "eliminateadjust.com",
      "eliteautosaloninc.com",
      "elitecarz.net",
      "eltiempo-news.com",
      "email-plans.com",
      "emiratesfoundation.net",
      "emonitoring-paczki.pl",
      "energy-dispatch.net",
      "enoughtoday.org",
      "entertainmentinat.com",
      "entire-cases.com",
      "equal-gravity.com",
      "erty.online",
      "estatearea.net",
      "eura-cell.com",
      "eurasianupdate.com",
      "eurosportnews.info",
      "event-reg.info",
      "everycolor-inside.com",
      "everyuse.org",
      "ex-forexlive.com",
      "exchangenames.net",
      "exchangenerate.com",
      "existingpass.com",
      "exoticsendurance.com",
      "expired-getway.net",
      "expiredsession.com",
      "expiringdate.com",
      "exploreemail.net",
      "extend-list.net",
      "externalprivacy.com",
      "externaltransfers.com",
      "extractsight.com",
      "extrahoney.net",
      "eyestoip.com",
      "eyesunderspray.com",
      "ezdropshipping.net",
      "f15fwd322.regularhours.net",
      "fabric-shops.com",
      "face-image.com",
      "facebook-accounts.com.mx",
      "fadewallwine.com",
      "fadi7apress.com",
      "fallround.com",
      "fallsjuice.com",
      "familyabroad.net",
      "fantastic-gardens.com",
      "fashion-live.net",
      "fashion-online.net",
      "fashioncontainer.net",
      "fashionpark.info",
      "fastdirect.net",
      "fastfixs.net",
      "fatpop.net",
      "fb-accounts.com",
      "fbr-update.com",
      "fbr.news",
      "fbr.tax",
      "fbsecurity.co",
      "feature-publish.net",
      "feelbonesbag.com",
      "feeltrail.com",
      "femmedaffaire.com",
      "fetchlink.net",
      "fiestamaghreb.com",
      "file-dnld.com",
      "files-downloads.com",
      "filingwarranty.com",
      "financecomments.net",
      "findavoucher.online",
      "findgoodfood.co",
      "findgroupon.com",
      "finditout-now.com",
      "findmyass.org",
      "findmyfriendsnow.com",
      "findmylunch.org",
      "findmymind.co",
      "findmyplants.com",
      "findouthere.org",
      "firebulletfan.com",
      "fishingtrickz.com",
      "fitness-for-ever.com",
      "flashobligation.com",
      "flashtraininggoal.com",
      "flights-report.com",
      "flights-todays.com",
      "flowersarrows.com",
      "flying-free.online",
      "flynewfries.com",
      "fofopiko.org",
      "foodeveryhour.com",
      "foodforyou.info",
      "foodiez.online",
      "forgetjustit.com",
      "formatpainter.net",
      "formattingcells.com",
      "forward-page.com",
      "forward5costume.com",
      "foto-top.info",
      "foudefoot.live",
      "free-local-events.info",
      "free247downloads.com",
      "freedominfo.net",
      "freelancers-team.org",
      "freeshoemoon.com",
      "freshandsoftbread.com",
      "freshsaladtoday.com",
      "functionalcover.com",
      "fundum8430.com",
      "funinat.com",
      "funinthesun4u.com",
      "funintheuk.com",
      "funnytvclips.com",
      "funtifu.live",
      "fwupdating.com",
      "gadgetproof.net",
      "gadgetsshop.info",
      "garrigareptiles.com",
      "gate-sync.net",
      "gdfr.online",
      "gearstereotype.com",
      "getagift.info",
      "getoutofyourmind.com",
      "getphotosinstant.net",
      "getpoints.net",
      "getspeednows.com",
      "gettingchances.com",
      "gettingurl.com",
      "gherboshop.com",
      "girlimstill.com",
      "girlsyoulike.com",
      "glassesofwine.com",
      "glasstaken.com",
      "glittercases.net",
      "global-redirect.net",
      "globalcoverage.co",
      "globalnews247.net",
      "globalsupporteam.com",
      "go-trip.online",
      "golf-news.live",
      "good-games.org",
      "goodcookingonline.com",
      "goodflowersinside.com",
      "goodthoughts4u.com",
      "googleplay-store.com",
      "goroskop.co",
      "gossipsbollywoods.com",
      "gostatspro.com",
      "greatcitymore.com",
      "greenbusnoise.com",
      "greensmallcanvas.com",
      "greenwatermovement.com",
      "grevejeunesmedecins.com",
      "growstart.net",
      "guardnotes.com",
      "gulf-financials.com",
      "gulf-news.info",
      "gulfca.net",
      "gumclockberry.com",
      "hairdresseraroundme.com",
      "halal-place.com",
      "handcraftedformat.com",
      "handcreamforyou.com",
      "handymanwood.com",
      "happiness4us.com",
      "hardthinmetal.com",
      "hatsampledc.com",
      "hdsoccerstream.com",
      "health-club.online",
      "healthyguess.com",
      "healthykids-food.com",
      "hearsmugglergarden.com",
      "heavy-flood.com",
      "hellomydaddy.com",
      "hellomymommy.com",
      "henrietta-commerce.com",
      "highclassdining.net",
      "hillsaround.com",
      "hitrafficip.com",
      "hmizat.co",
      "holdingspider.com",
      "holdmydoor.com",
      "holdstory.com",
      "holecatorange.com",
      "holiday-sun.net",
      "holiday4u.work",
      "homeishere.co",
      "homemadecandies.net",
      "hona-alrabe3.com",
      "horsefingercoffee.com",
      "host-one-more.com",
      "host-redirect.net",
      "hot-motors.com",
      "hotels-review.org",
      "hotelsauto.co",
      "hotelstax.co",
      "hotelsurvey.info",
      "hothdwallpaperz.com",
      "hotinfosource.com",
      "housesfurniture.com",
      "housing-update.com",
      "howisurday.com",
      "howtoexplorebirds.com",
      "howtomakeavocadotoastandegg.com",
      "hracingtips.com",
      "htmlmetrics.com",
      "htmlstats.net",
      "httpaccess.com",
      "humandiven.com",
      "humblebenefit.com",
      "hundredsofdesigns.net",
      "icecreamlovesme.com",
      "icloudcacher.com",
      "icrcworld.com",
      "ideas-telcel.com.mx",
      "igiheonline.com",
      "ikomek.info",
      "ilovemybeatifulnails.com",
      "ilovemymilf.com",
      "img565vv6.holdmydoor.com",
      "in-weather.com",
      "in2date.com",
      "inbox-messages.net",
      "income-tax.online",
      "indrive.info",
      "industry-specialist.com",
      "ineediscounts.com",
      "info24.live",
      "infoquiz.net",
      "informados24h.cominfo-urbano.com",
      "infospotpro.com",
      "infospress.com",
      "insertfilters.net",
      "insta-foto.net",
      "instangram.com.mx",
      "internetmobilespeed.com",
      "intim-media.net",
      "investigationews.com",
      "investormanage.net",
      "ipjackets.com",
      "ipurlredirect.com",
      "islam-today.info",
      "islam-world.net",
      "islamic-news-today.com",
      "islamiyaat.com",
      "ispr.email",
      "istgr-foto.com",
      "itsthebrowser.com",
      "iusacell-movil.com.mx",
      "iwantitallnow.com",
      "jaimelire.net",
      "jeeyarworld.com",
      "judgeauthority.com",
      "judo-genlis.com",
      "just-one-left.com",
      "kaidee.info",
      "karbalaeyat.com",
      "kaspi-payment.com",
      "keepiptext.com",
      "keepthiseasy.com",
      "kenyasms.org",
      "keyindoors.com",
      "keynotepalm.com",
      "khaleejtimes.online",
      "khilafah-islamic.com",
      "kingdom-deals.com",
      "kingdom-news.com",
      "klientuserviss.com",
      "knowingfun.com",
      "knowseminar.com",
      "koramaghreb.com",
      "kra.center",
      "kruseswiss.com",
      "kurjerserviss.com",
      "labonneforme.net",
      "lamyterie.com",
      "landflatheart.com",
      "landstofree.com",
      "laptop-parts.org",
      "last-chainleash.net",
      "latest-songs.com",
      "lawlowvat.net",
      "layerprotect.com",
      "layoutfill.com",
      "leadersnews.org",
      "leavehomego.com",
      "leggingsjustforyou.com",
      "legsfriesears.com",
      "legyelvodas.com",
      "legyelvodas.net",
      "leleader.org",
      "leprotestant.com",
      "lesbonnesaffaires.online",
      "leshutchins.com",
      "lesportail.biz",
      "letyoufall.com",
      "levelsteelwhite.com",
      "liam-ryan.co",
      "license-updater.com",
      "lifedonor.net",
      "lifenoonkid.com",
      "like-the-rest.com",
      "limitedfeature.com",
      "link-crawler.com",
      "link-scan.net",
      "linking-page.com",
      "linksnew.info",
      "littlefrogalarm.com",
      "live-once.net",
      "lizzardsnail.com",
      "loading-ads.net",
      "loading-domain.com",
      "loading-images.com",
      "loading-pag.net",
      "loading-page.net",
      "loading-url.net",
      "loadingpage1.net",
      "loadingpage4.net",
      "loadingurl.net",
      "loadthatpage.com",
      "localgreenflowers.com",
      "login-service.net",
      "loginverify.net",
      "loisiragogo.com",
      "lonely-place.com",
      "look-outsidenow.com",
      "looking-for-two.com",
      "lookitupnow.website",
      "looklifewhite.com",
      "loschanquetes.com",
      "loschismescalientes.com",
      "losnegocios.biz",
      "lost-n-found.net",
      "loveandhatenow.com",
      "lowervalues.com",
      "m-resume.com",
      "macmaclaren.com",
      "maghrebfoot.com",
      "maghrebfunny.biz",
      "magicalipone.com",
      "mailappzone.com",
      "mailerservice.directory",
      "maingreatessay.com",
      "mainredirecter.com",
      "mamba-live.com",
      "managedsnap.com",
      "management-help.com",
      "managingincluded.com",
      "mangoutlet.net",
      "manoraonline.net",
      "manydnsnow.com",
      "maphonortea.com",
      "mapupdatezone.com",
      "martinipicnic.com",
      "massagetax.co",
      "masternicherights.com",
      "masterpolishformula.com",
      "matlauinlondon.com",
      "maymknch2026.co",
      "mcel-update.com",
      "mcel.info",
      "mealrentyard.com",
      "meanspursuit.com",
      "medical-updates.com",
      "medicalcircle.net",
      "megacenter.info",
      "megaticket.info",
      "mercedesbenz-vip.com",
      "merchant-businesses.com",
      "mergeandcenter.com",
      "methodslocal.com",
      "mgifweb.com",
      "mideast-today.com",
      "mijn-vgz-overzicht-nl.info",
      "miles-club.com",
      "miralo-rapidamente.com",
      "mirrorgossip.com",
      "mixershake.net",
      "mixsinger.com",
      "mobi-up.net",
      "mobile-analytics.netweb-cloud-services.com",
      "mobile-softs.com",
      "mobile-update.online",
      "mobile-updates.info",
      "mobilebrowsing.net",
      "mobilephonesme.com",
      "mobiles-security.net",
      "mobileweatherweb.com",
      "modifytimezone.net",
      "moh-followup.com",
      "moh-online.com",
      "monawa3ate.org",
      "mondaymornings.co",
      "moneycheesecolor.com",
      "moneycoincurrency.com",
      "moneydigitalcurrency.com",
      "moneyxchanges.com",
      "moregatesthere.com",
      "morning-maps.com",
      "mosque-salah.com",
      "mosque-salah.net",
      "mosquesfinder.com",
      "motiontastebad.com",
      "motivation-go.com",
      "motordeal.info",
      "movie-tickets.online",
      "moyfoto.net",
      "moz-noticias.com",
      "mozillaname.com",
      "mozsafety.com",
      "muftyat.com",
      "multiplecurrencies.com",
      "music-electric.org",
      "music-headphones.org",
      "muslim-world.info",
      "muzicclips.com",
      "muziclovers.org",
      "my-privacy.co",
      "mybrightidea.co",
      "mydailycooking.net",
      "mydarkarms.com",
      "myfiles.photos",
      "myfreecharge.online",
      "myfundsdns.com",
      "mygreathat.com",
      "mygummyjelly.com",
      "myheartbuild.com",
      "mykaspi.com",
      "mylogfrog.com",
      "mylovelypet.net",
      "mymanagement-service.com",
      "mymensaje-sms.com",
      "mymobile-cell.com",
      "mynewbesttime.com",
      "mypostservice.online",
      "mysadaga.com",
      "myseesea.com",
      "myself-dns.com",
      "myshoesforever.com",
      "myshop4u.net",
      "mystulchik.com",
      "mysuperheadphones.co",
      "myukadventures.com",
      "mywebbargains.com",
      "mz-vodacom.info",
      "nation-news.com",
      "nation24.info",
      "nationalleagues.net",
      "natural-ice.com",
      "navywalls.com",
      "nbrowser.org",
      "nerdtvfan.com",
      "net-protector.com",
      "netstatistics.net",
      "nettprofile.com",
      "netvisualizer.com",
      "netweb-cloud-services.com",
      "network-bots.com",
      "network190.com",
      "networkinfo.org",
      "networkingloading.com",
      "networkingproperty.com",
      "neutralpages.com",
      "neverwayneck.com",
      "newandfresh.com",
      "newandroidapps.net",
      "newarrivals.club",
      "newcooking.org",
      "newdailycoupons.com",
      "newenvelope.net",
      "newip-info.com",
      "newipconfig.com",
      "newmodel.online",
      "newnhotapps.com",
      "newredirect.net",
      "news-alert.org",
      "news-flash.net",
      "news-gazette.info",
      "news-news.co",
      "newscurrent.info",
      "newsdirect.online",
      "newsofficial.info",
      "newsofgames.com",
      "newsofthemoment.net",
      "newsportal24.online",
      "newtarrifs.net",
      "newworld-news.com",
      "nicevibezaction.net",
      "nightevents.info",
      "nightscloudwant.com",
      "nnews.co",
      "noextramoney.com",
      "noloveforyou.com",
      "nomorewarnow.com",
      "noodlegray.com",
      "noonstore.sale",
      "noor-alhedaya.com",
      "normal-brain.com",
      "normal-strength.com",
      "normalseason.com",
      "northridgebest.com",
      "nosalternatives.com",
      "nosemorningnine.com",
      "nothernkivu.com",
      "noti-global.com",
      "noti-hot.com",
      "noti-hoy.co",
      "noticiaspoliticos.com",
      "notificationsneeded.com",
      "notisms.net",
      "notresante-infos.com",
      "nouveau-president.com",
      "nouvelles247.com",
      "noveletters.com",
      "novoicenoprob.net",
      "novosti247.com",
      "now-online.net",
      "nsoqa.com",
      "nuevaidea.co",
      "objectreduction.com",
      "odnoklass-profile.com",
      "offresimmobilier.com",
      "offspringperform.net",
      "ok-group.org",
      "old-glasses.net",
      "oldmywater.com",
      "one-isnot-enough.com",
      "oneadjump.com",
      "oneleadingchat.com",
      "onetreeinheaven.com",
      "online-dailynews.com",
      "online-loading.com",
      "onlinefreework.com",
      "onlineshopzm.com",
      "only-news.net",
      "onlycart.net",
      "onlygossip.info",
      "onlytoday.biz",
      "onlywebsite.org",
      "onthegoodtime.com",
      "ooredoodeals.com",
      "openingquestion.org",
      "opera-van.com",
      "operatingnews.com",
      "operations-delivery.com",
      "operations-shifts.com",
      "oplata-shtraf.info",
      "opposedarrangement.net",
      "optionalshift.online",
      "optionstoreplace.com",
      "orange-updates.com",
      "organicdiamonds.net",
      "ourorder.info",
      "ourperfume.net",
      "outgoingurl.com",
      "outletsaroundme.com",
      "outletstore.tech",
      "page-host.net",
      "page-info.com",
      "pageisloading.net",
      "pageredirect.co",
      "pageupdate.co",
      "painruncart.com",
      "painting-walls.com",
      "pakistanarmy.email",
      "panelbreed.com",
      "papers2go.co",
      "papervoice.net",
      "parinari.xyz",
      "park4free.info",
      "particularmechanic.net",
      "parties-fun.com",
      "pastesbin.com",
      "pathtogo.net",
      "pay-city.com",
      "pay-penalty.info",
      "paynfly.info",
      "paywithcrytpo.com",
      "pc-views.net",
      "pemra.email",
      "performinghost.com",
      "permalinking.com",
      "phonemetrics.co",
      "phonering4you.com",
      "phonestats.net",
      "photo-afisha.net",
      "photo-my.net",
      "physicalcheetah.com",
      "pickcard.info",
      "pickuchu.com",
      "picture4us.com",
      "pincattape.com",
      "pine-sales.com",
      "pirnaram.xyz",
      "pizzatoyourplace.com",
      "planeocean.com",
      "playfantasticsplastic.com",
      "playwithusonline.com",
      "pleaseusenew.com",
      "pleaseusenew.net",
      "pmogovpk.email",
      "pochta-info.com",
      "politica504.com",
      "politicalpress.org",
      "politicoportales.org",
      "politiques-infos.info",
      "popagency.net",
      "popularmessages.net",
      "port-connection.com",
      "portredirect.net",
      "possibilitytotransfer.com",
      "posta.news",
      "postainf.net",
      "pourcentfilers.com",
      "poweredbycpanel.com",
      "poweredlock.com",
      "ppcisdead.com",
      "pprocessor.net",
      "practical-basis.net",
      "practicehazard.com",
      "preferenceviews.com",
      "preferring.org",
      "presidentialagent.com",
      "preventadmission.com",
      "preventsusing.com",
      "pride-industry.com",
      "pride-industry.net",
      "pridetomyself.net",
      "prikol-girls.com",
      "primarystrike.net",
      "prioritytrail.net",
      "priveetalk.com",
      "privo7799add.net",
      "productsall.net",
      "productsview.co",
      "produitsjpcote.com",
      "projectgoals.net",
      "promosdereve.com",
      "promotionlove.co",
      "proudmorale.com",
      "pub-dns.com",
      "publishbig.net",
      "puffyteddybear.com",
      "purchaseusingcoins.com",
      "purple-enveloppe.com",
      "puttylearning.com",
      "qaintqa.com",
      "qaoffers.net",
      "qualityfeeling.net",
      "quitmyjob.xyz",
      "quota-reader.net",
      "quran-quote.com",
      "rainingcats.net",
      "raininscreen.com",
      "randomlane.net",
      "rapidredirecting.com",
      "raresound.org",
      "raw-console.com",
      "reachcomputer.com",
      "readingbooksnow.com",
      "readirectly.com",
      "realmythtrend.com",
      "receiptpending.net",
      "reception-desk.net",
      "recepzihni.com",
      "recordinglamping.com",
      "redcrossworld.com",
      "redemptionphrase.com",
      "redirect-connection.com",
      "redirect-link.com",
      "redirect-net.com",
      "redirect-protocol.com",
      "redirect-service.net",
      "redirect-systems.com",
      "redirect-traffic.net",
      "redirect-tunnel.net",
      "redirect-webpage.net",
      "redirect2url.net",
      "redirectchannel.net",
      "redirectcheck.net",
      "redirectconnection.net",
      "redirectdoor.com",
      "redirecteur.net",
      "redirectgate.com",
      "redirecting-url.com",
      "redirectingpage.net",
      "redirectingurl.net",
      "redirectingurl.org",
      "redirection-url.net",
      "redirectit.net",
      "redirectking.net",
      "redirectload.com",
      "redirectmotion.org",
      "redirectnet.net",
      "redirectool.com",
      "redirectprotocol.net",
      "redirectshare.com",
      "redirectweburl.com",
      "redirigir.net",
      "redirstats.com",
      "redstarnews.net",
      "reflectextension.net",
      "regionews.net",
      "regularhours.net",
      "reklamas.info",
      "related-ads.com",
      "relatedspams.net",
      "reload-url.com",
      "reload-url.net",
      "reloading-page1.com",
      "reloadinput.com",
      "reloadpage.net",
      "remove-client.com",
      "remove-from-mailing-list.com",
      "remove-from-mailinglist.com",
      "remove-subscription.co",
      "remove-subscription.com",
      "renewal-control.net",
      "rentalindustries.com",
      "rentmotors.net",
      "research-archive.com",
      "reseausocialsolutions.co",
      "reservationszone.com",
      "reseufun.com",
      "resolutionsbox.com",
      "restaurantsstar.com",
      "results-house.net",
      "revoke-dashboard.com",
      "revolution-news.co",
      "rewards-club.info",
      "rhymeshey.com",
      "righttriangle.net",
      "roadwide.net",
      "robotscan.net",
      "rockbreakdown.com",
      "rockmusic4u.com",
      "rockstarpony.com",
      "rosegoldjewerly.com",
      "rosesforus.com",
      "rotaryimports.com",
      "rss-me.com",
      "russian4u.net",
      "sabafon.info",
      "safe-mondays.net",
      "safecrusade.com",
      "saladsaroundme.com",
      "sale-2019.com",
      "saltyapplepie.com",
      "same-old.net",
      "savemoretime.co",
      "savephotos.net",
      "saveurday.net",
      "scannerservices.net",
      "scaryaudience.com",
      "scriptincluded.com",
      "scriptsinstallers.com",
      "seacoastkaraoke.com",
      "searchjustdont.net",
      "searchunit.net",
      "sec-checker.com",
      "secretgirlfriend.net",
      "secure-access10.mx",
      "secured-url.net",
      "securedloading.com",
      "securedlogin.org",
      "securesmsing.com",
      "secureyouradd.com",
      "securisurf.com",
      "securlaw.com",
      "select-edition.net",
      "send2url.com",
      "sendhtml.net",
      "sendingurl.com",
      "sendingurl.net",
      "sergek.info",
      "seriousprotection.net",
      "service-update.online",
      "services-sync.com",
      "servingshade.com",
      "severalheroes.com",
      "sexxclip.com",
      "sharepassageset.com",
      "shia-voice.com",
      "shipment-status.org",
      "shoppingdailydeals.net",
      "short-address.com",
      "shortfb.com",
      "shortredirect.com",
      "shtraf.info",
      "shuturl.com",
      "siamha.info",
      "signpetition.co",
      "silverodgone.com",
      "simplycode.co",
      "site-lock.net",
      "site-redirecting.com",
      "skillsforest.net",
      "smallperfumerain.com",
      "smallridebar.com",
      "smarttarfi.com",
      "smokeshowshoe.com",
      "smoothurl.com",
      "sms-center.info",
      "sms-sending.net",
      "sms-zone.org",
      "sms.webadv.co",
      "smscentro.com",
      "smser.net",
      "smsmensaje.mx",
      "snoweverywhere.com",
      "so-this-is.com",
      "soccerstreamingstars.com",
      "social-artist.net",
      "social-exercise.com",
      "social-life.info",
      "social-rights.com",
      "sockstubename.com",
      "solo-hoy.com",
      "somewarmremember.com",
      "somuchrain.com",
      "sparepresence.com",
      "specialgifts4all.com",
      "speechenforce.com",
      "speedservicenow.com",
      "spiritualbrakes.com",
      "sportssaint.net",
      "sportupdates.info",
      "sportupdates.online",
      "sputnik-news.info",
      "squaretables.net",
      "sslbind.com",
      "standartsheet.com",
      "standstock.net",
      "starbuckscoffeeweb.com",
      "starreturned.com",
      "stars4sale.co",
      "start2playnow.com",
      "starting-from0.com",
      "startupsservices.net",
      "stationfunds.net",
      "statisticsdb.net",
      "statsads.co",
      "statsupplier.com",
      "stayallalone.com",
      "staysystem.net",
      "sterlingpetcare.com",
      "stilloak.net",
      "stopmysms.com",
      "stopsms.biz",
      "storageseminar.net",
      "storelive.co",
      "strangegloom.net",
      "strategyroles.com",
      "suitcasesmellnice.com",
      "summermover.com",
      "sunday-deals.com",
      "sunnydaylight.com",
      "sunrise-brink.net",
      "sunsetdnsnow.com",
      "superlinks4u.com",
      "support-team.tech",
      "supportonline4me.com",
      "surprising-sites.com",
      "sweet-water.org",
      "sweetcup.co",
      "sync-cdn.com",
      "syncingprocess.com",
      "syncmap.org",
      "systemtrees.com",
      "t-support.net",
      "tablereservation.info",
      "tahmilmilafate.com",
      "tahmilmilafate.info",
      "takecarhomes.com",
      "takemallelectric.com",
      "takethat.co",
      "talabatt.net",
      "tastyteaflavors.com",
      "teachskate.com",
      "techhelping.net",
      "telangana-news24.com",
      "telecom-info.com",
      "telephonequality.com",
      "template-iso.net",
      "tengrinews.co",
      "tentrosegain.com",
      "thainews.asia",
      "thankstossl.com",
      "the-only-way-out.com",
      "theappanalytics.com",
      "theastafrican.com",
      "thebestclassicalmusic.net",
      "thecoffeeilove.com",
      "thefuturearticle.net",
      "thehighesttemple.com",
      "thehoteloffers.com",
      "theredirect.net",
      "theshopclub.org",
      "thesimplestairs.com",
      "thespaclub.net",
      "theway2get.com",
      "thoughtfulbundle.com",
      "thtube.video",
      "tibetnews365.net",
      "ticket-aviata.info",
      "ticket-selections.com",
      "tiketon.info",
      "timelesscelebrity.com",
      "timeofflife.com",
      "tinyurler.com",
      "tlgr-me.org",
      "tobepure.com",
      "todaysdeals4u.com",
      "todoinfonet.com",
      "toggletools.com",
      "tommyfame.com",
      "tomorrowpastno.com",
      "tookcheckout.com",
      "top100vidz.com",
      "top10gifts4men.com",
      "top10leadsgen.com",
      "topadblocker.net",
      "topbraingames4u.com",
      "topcontactco.com",
      "topoems.com",
      "topten-news.info",
      "touristvaca.com",
      "towebsite.net",
      "track-your-fedex-package.com",
      "track-your-fedex-package.online",
      "track-your-fedex-package.org",
      "trackyourfedexpackage.net",
      "trade-agreement.com",
      "tradeexchanging.com",
      "traffic-pay.com",
      "traffic-updates.info",
      "transfer-rate.com",
      "transferbase.co",
      "transferkeep.com",
      "transferlights.com",
      "travel-foryou.online",
      "travelcrimea.info",
      "travelight.online",
      "traveltogether.link",
      "trendsymbol.net",
      "trialvariable.net",
      "trianglerank.net",
      "tricksinswiss.com",
      "trililihihi.com",
      "tripleclickpays.com",
      "tunnelprotocol.net",
      "turismo-aqui.com",
      "turkeynewsupdates.com",
      "turkishairines.info",
      "tvshowcusting.com",
      "twiitter.com.mx",
      "uaenews.online",
      "uidebol.info",
      "umbrellacover.net",
      "un-limitededitions.com",
      "un0noticias.com",
      "un0noticias.net",
      "unavailableentry.com",
      "unionofteenagers.com",
      "uniquesite.co",
      "universopolitico.net",
      "univision.click",
      "unlockaccount.net",
      "unonoticias.net",
      "unsubscribe-now.net",
      "unsubscribed.co",
      "unsubscribeinhere.com",
      "untoldinfo.net",
      "unusualneighbor.com",
      "updateapps.net",
      "updatedchargers.com",
      "updatedcharges.net",
      "updating-link.com",
      "updating-url.com",
      "updating-url.net",
      "updatingpage.com",
      "updatingwebpage.com",
      "upgrade-sim-card.com",
      "upkeepno.com",
      "upload-now.net",
      "uptownfun.co",
      "urbestfriends.com",
      "url-configure.com",
      "url-direct.com",
      "url-hoster.com",
      "url-loading.com",
      "url-redirect.com",
      "url-redirect.net",
      "url2all.net",
      "urlconfig.net",
      "urlconnection.net",
      "urldefender.net",
      "urlpage-redirect.com",
      "urlpush.net",
      "urlredirect.net",
      "urlregistrar.net",
      "urlreload.net",
      "urlscanner.net",
      "urlsync.com",
      "urlupdates.com",
      "urlviaweb.com",
      "urspanishteacher.net",
      "user-registration.com",
      "utensils.pro",
      "vamizi.info",
      "vanillaandcream.com",
      "varietyjobspaid.org",
      "varietyregistrar.com",
      "vastdealsnow.com",
      "vault-encryption.com",
      "verify-app.online",
      "videosdownload.co",
      "videotubbe.net",
      "vider-image.com",
      "vie-en-islam.com",
      "viedechretien.org",
      "viewhdvideos.com",
      "viewstracker.com",
      "vipmasajes.com",
      "viva-droid.com",
      "vivrechezsoi.info",
      "vkan-profile.com",
      "volcanodistance.com",
      "volcanosregion.com",
      "waffleswithnutella.com",
      "waitingtoload.com",
      "walkerpost.net",
      "walkhatclock.com",
      "wallagainsthall.com",
      "walltome.com",
      "wasted-nights.com",
      "waterforplants.net",
      "watersport4u.net",
      "weakdistance.com",
      "weather4free.com",
      "weatherapi.co",
      "web-check.co",
      "web-config.org",
      "web-developper.net",
      "web-domain.net",
      "web-hoster.co",
      "web-loading.com",
      "web-loading.net",
      "web-only.net",
      "web-page.co",
      "web-scanner.co",
      "web-spider.net",
      "web-url.net",
      "web-viewer.online",
      "webadv.co",
      "webexaminer.net",
      "webpageupdate.co",
      "webprotector.co",
      "webprotocol.net",
      "webresourcer.com",
      "websconnector.co",
      "websiteconnecting.com",
      "websiteeco.com",
      "websitereconnecting.com",
      "websites4yourhost.com",
      "websitetosubmit.com",
      "webstrings.net",
      "websupporter.co",
      "webtunnels.net",
      "webupdater.net",
      "webview-redirect.com",
      "wedding-strategy.com",
      "weddingbandsoft.com",
      "welcomehosting.net",
      "welovebigcakes.com",
      "welovelollipops.com",
      "welovemorningcoffees.com",
      "wewantflowersnow.com",
      "whatcanidowithbirds.com",
      "whats-new.org",
      "whatsapp-app.com",
      "whatsappsupport.net",
      "whereismybonus.com",
      "whereismyhand.com",
      "whereismytree.net",
      "whereisthehat.com",
      "whynotyesterday.com",
      "whypillyellow.com",
      "willpurpleshe.com",
      "windyone.net",
      "winfoxflip.com",
      "winter-balance.com",
      "wintertimes.co",
      "wishdownget.com",
      "without-additional.com",
      "witness-delay.com",
      "wonderfulinsights.com",
      "woodhome4u.com",
      "wordstore.net",
      "working-online.net",
      "workshopmanager.net",
      "wraptext.net",
      "xchange4u.net",
      "xchangerates247.net",
      "xn--nissn-3jc.com",
      "xn--noki-t5b.com",
      "xn--telegrm-qbd.com",
      "xtremelivesupport.com",
      "y0utube.com.mx",
      "youaresostupid.net",
      "youcantpass.com",
      "youintelligence.com",
      "youliehow.com",
      "yourbestclothes.com",
      "yourbestefforts.com",
      "yourbestvaca.com",
      "yourgreatestsmartphone.com",
      "yourhotelreservation.info",
      "yourlastchance.net",
      "yousunhard.com",
      "yummyfoodallover.com",
      "zednewszm.com",
      "zm-banks.com",
      "zm-weather.com",
      "zsports-info.com"
    ],
    "url": [
      "mp3.ucrazy.org/music/"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "PEGASUS"
  ],
  "references": [
    "http://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/",
    "https://citizenlab.ca/2017/06/reckless-exploit-mexico-nso/",
    "https://citizenlab.ca/2017/08/nso-spyware-mexico-corruption/",
    "https://citizenlab.ca/2018/07/nso-spyware-targeting-amnesty-international/",
    "https://citizenlab.ca/2018/09/hide-and-seek-tracking-nso-groups-pegasus-spyware-to-operations-in-45-countries/",
    "https://citizenlab.ca/2018/10/the-kingdom-came-to-canada-how-saudi-linked-digital-espionage-reached-canadian-soil/",
    "https://citizenlab.ca/2018/11/mexican-journalists-investigating-cartels-targeted-nso-spyware-following-assassination-colleague/",
    "https://citizenlab.ca/2020/08/nothing-sacred-nso-sypware-in-togo/",
    "https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hacked-with-suspected-nso-group-imessage-zero-click-exploit/",
    "https://citizenlab.ca/2022/01/project-torogoz-extensive-hacking-media-civil-society-el-salvador-pegasus-spyware/",
    "https://citizenlab.ca/2022/04/catalangate-extensive-mercenary-spyware-operation-against-catalans-using-pegasus-candiru/",
    "https://citizenlab.ca/2022/04/peace-through-pegasus-jordanian-human-rights-defenders-and-journalists-hacked-with-pegasus-spyware/",
    "https://citizenlab.ca/2022/07/geckospy-pegasus-spyware-used-against-thailands-pro-democracy-movement/",
    "https://github.com/AmnestyTech/investigations/blob/master/2021-07-18_nso/domains.txt",
    "https://otx.alienvault.com/pulse/5d9f05596b5109e891f42a24",
    "https://otx.alienvault.com/pulse/611e21b71a08edbfb6061a06",
    "https://otx.alienvault.com/pulse/624c56d3b71d3fc25f820e87",
    "https://otx.alienvault.com/pulse/62d56bfbcb851c6bfcfdaf4d",
    "https://twitter.com/AmnestyTech/status/1416810917216538629",
    "https://twitter.com/VK_Intel/status/1017190191864434689",
    "https://twitter.com/blackorbird/status/1481548876918439936",
    "https://twitter.com/h2jazi/status/1490829405106569217",
    "https://www.amnesty.org/en/latest/research/2018/08/amnesty-international-among-targets-of-nso-powered-campaign/",
    "https://www.amnesty.org/en/latest/research/2019/10/morocco-human-rights-defenders-targeted-with-nso-groups-spyware/",
    "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/",
    "https://www.proofpoint.com/us/daily-ruleset-update-summary-20160825",
    "https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html",
    "https://www.virustotal.com/gui/file/8b5279e449004c98c8693363cf9a1d143eb3ef3537bd81cc6f03f41305f6316d/detection",
    "https://www.virustotal.com/gui/ip-address/161.8.149.21/relations",
    "https://www.virustotal.com/gui/ip-address/185.198.58.178/relations",
    "https://www.virustotal.com/gui/ip-address/185.244.151.172/relations"
  ],
  "related": [],
  "slug": "PEGASUS",
  "timeline": [
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2023-11-15",
      "indicators": {
        "domain": [
          "accountsecurities.org",
          "awizo.info",
          "holiday-sun.net",
          "loginverify.net",
          "newsportal24.online",
          "oneadjump.com",
          "sale-2019.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/AmnestyTech/status/1416810917216538629",
        "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/",
        "https://github.com/AmnestyTech/investigations/blob/master/2021-07-18_nso/domains.txt"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2022-07-18",
      "indicators": {
        "domain": [
          "1place-togo.com",
          "accounts-unread.com",
          "sexxclip.com",
          "siamha.info",
          "stayallalone.com",
          "thtube.video"
        ]
      },
      "precision": "exact",
      "references": [
        "https://citizenlab.ca/2022/07/geckospy-pegasus-spyware-used-against-thailands-pro-democracy-movement/",
        "https://otx.alienvault.com/pulse/62d56bfbcb851c6bfcfdaf4d"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 29
      },
      "first_seen": "2022-07-10",
      "indicators": {
        "domain": [
          "allaboutwrightwood.com",
          "bingoblitzvippro.com",
          "brandttoyota.com",
          "brookviewpetgrooming.com",
          "casusbocekler.com",
          "cerfcube.com",
          "derinaydogan.com",
          "eliteautosaloninc.com",
          "garrigareptiles.com",
          "gherboshop.com",
          "grevejeunesmedecins.com",
          "henrietta-commerce.com",
          "judo-genlis.com",
          "kruseswiss.com",
          "lamyterie.com",
          "leshutchins.com",
          "loschanquetes.com",
          "macmaclaren.com",
          "masternicherights.com",
          "masterpolishformula.com",
          "matlauinlondon.com",
          "mywebbargains.com",
          "nettprofile.com",
          "northridgebest.com",
          "produitsjpcote.com",
          "recepzihni.com",
          "rotaryimports.com",
          "seacoastkaraoke.com",
          "sterlingpetcare.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/161.8.149.21/relations"
      ],
      "total": 29
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2022-04-19",
      "indicators": {
        "domain": [
          "123tramites.com",
          "adsmetrics.co",
          "infoquiz.net",
          "nnews.co",
          "redirstats.com",
          "statsads.co",
          "statsupplier.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/AmnestyTech/status/1416810917216538629",
        "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/",
        "https://github.com/AmnestyTech/investigations/blob/master/2021-07-18_nso/domains.txt",
        "https://citizenlab.ca/2022/04/catalangate-extensive-mercenary-spyware-operation-against-catalans-using-pegasus-candiru/"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 19
      },
      "first_seen": "2022-04-17",
      "indicators": {
        "domain": [
          "api.priveetalk.com",
          "cnic-ferify.live",
          "cnic-update.com",
          "defencepk.email",
          "download.fbr.tax",
          "fbr-update.com",
          "fbr.news",
          "fbr.tax",
          "file-dnld.com",
          "funtifu.live",
          "ispr.email",
          "mailerservice.directory",
          "pakistanarmy.email",
          "parinari.xyz",
          "pemra.email",
          "pirnaram.xyz",
          "pmogovpk.email",
          "priveetalk.com",
          "support-team.tech"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html",
        "https://otx.alienvault.com/pulse/611e21b71a08edbfb6061a06"
      ],
      "total": 19
    },
    {
      "counts": {
        "domain": 18
      },
      "first_seen": "2022-04-05",
      "indicators": {
        "domain": [
          "akhbar-almasdar.com",
          "akhbar-islamyah.com",
          "akhbarnew.com",
          "al-nusr.net",
          "al-taleanewsonline.net",
          "al7erak247.com",
          "al7eraknews.com",
          "alrainew.com",
          "arabia-islamion.com",
          "cozmo-store.net",
          "hona-alrabe3.com",
          "khilafah-islamic.com",
          "login-service.net",
          "mangoutlet.net",
          "mobiles-security.net",
          "rss-me.com",
          "talabatt.net",
          "unsubscribe-now.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/AmnestyTech/status/1416810917216538629",
        "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/",
        "https://github.com/AmnestyTech/investigations/blob/master/2021-07-18_nso/domains.txt",
        "https://citizenlab.ca/2022/04/peace-through-pegasus-jordanian-human-rights-defenders-and-journalists-hacked-with-pegasus-spyware/",
        "https://otx.alienvault.com/pulse/624c56d3b71d3fc25f820e87"
      ],
      "total": 18
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-04-05",
      "indicators": {
        "domain": [
          "al-taleanews.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://citizenlab.ca/2022/04/peace-through-pegasus-jordanian-human-rights-defenders-and-journalists-hacked-with-pegasus-spyware/",
        "https://otx.alienvault.com/pulse/624c56d3b71d3fc25f820e87"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-02-08",
      "indicators": {
        "domain": [
          "mijn-vgz-overzicht-nl.info",
          "travelcrimea.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1490829405106569217",
        "https://www.virustotal.com/gui/ip-address/185.244.151.172/relations",
        "https://www.virustotal.com/gui/ip-address/185.198.58.178/relations",
        "https://www.virustotal.com/gui/file/8b5279e449004c98c8693363cf9a1d143eb3ef3537bd81cc6f03f41305f6316d/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2022-01-13",
      "indicators": {
        "domain": [
          "cominfo-urbano.com",
          "deportes24-7.com",
          "informados24h.cominfo-urbano.com",
          "mobile-analytics.netweb-cloud-services.com",
          "netweb-cloud-services.com",
          "solo-hoy.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1481548876918439936",
        "https://citizenlab.ca/2022/01/project-torogoz-extensive-hacking-media-civil-society-el-salvador-pegasus-spyware/"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 1264
      },
      "first_seen": "2021-07-18",
      "indicators": {
        "domain": [
          "1minto-start.com",
          "24-7clinic.com",
          "301-redirecting.com",
          "365redirect.co",
          "3driving.com",
          "456h612i458g.com",
          "7style.org",
          "800health.net",
          "911hig11carcay959454.com",
          "a-redirect.com",
          "a-resolver.com",
          "accomodation-tastes.net",
          "accountcanceled.com",
          "accountnotify.com",
          "accountsections.com",
          "activate-discount.com",
          "active-folders.com",
          "actorsshop.net",
          "actu24.online",
          "ad-generator.net",
          "ad-switcher.com",
          "add-client.com",
          "additional-costs.com",
          "addmyid.net",
          "addresstimeframe.com",
          "adeal4u.co",
          "adjustlocalsettings.net",
          "adscreator.net",
          "adsload.co",
          "advert-time.com",
          "advert-track.com",
          "agilityprocessing.net",
          "aircraftsxhibition.com",
          "akhbar-aliqtisad.com",
          "albumphotopro.biz",
          "alignmentdisabled.net",
          "alive2plunge.com",
          "allbeautifularts.com",
          "alldaycooking.co",
          "allergiesandcooking.com",
          "allfadiha.co",
          "allladiesloveme.com",
          "allthecolorsyoulike.com",
          "allthegamesyouneed.com",
          "allthemakeupyouneed.com",
          "allthesongsyoulike.com",
          "alluneed4home.net",
          "alpharythme.com",
          "android-core.org",
          "android-updates.net",
          "apiapple.com",
          "apigraphs.net",
          "apiwacdn.com",
          "appleleaveit.co",
          "applicationcreation.net",
          "appointments-online.com",
          "appsgratis.com.mx",
          "appsjuegos.com.mx",
          "ar-tweets.com",
          "arab-share.com",
          "around-theglobe.co",
          "arrowowner.com",
          "assembled-battery.com",
          "atlaslions.info",
          "auditorcast.com",
          "authenticangry.com",
          "authenticated-origin.com",
          "authlovebirth.com",
          "autodiscount.info",
          "autoredirect.net",
          "av-scanner.com",
          "avocadofight.com",
          "awardpractice.com",
          "axis-indication.net",
          "babies-bottles.com",
          "balancewreckpoint.com",
          "bankportal.net",
          "baramije.net",
          "bargainservice.online",
          "bdaynotes.com",
          "beanbounce.net",
          "beautifulhousesaroundme.com",
          "becomeiguana.com",
          "beethoventopsymphonies.com",
          "behindaquarium.com",
          "benjamin-taganga.info",
          "bestadventures4u.com",
          "bestcandyever.com",
          "bestday-sales.com",
          "bestfoods.co",
          "bestfriendneedshelp.com",
          "bestheadphones4u.com",
          "besthotelsaroundme.com",
          "bestperfumesnow.com",
          "bestpresents4all.net",
          "bestsalesaroundme.com",
          "bestsushiever.com",
          "better-deal.info",
          "betterapplesearch.com",
          "betterhandsblack.com",
          "bicyclerentalnow.com",
          "biggunsarefun.com",
          "bigseatsout.net",
          "billednorth.com",
          "birdbathmorning.com",
          "biscuit-taste.net",
          "bitanalysis.net",
          "bitfadepens.com",
          "bitforeat.net",
          "bl33pon6373.com",
          "black-bricks.net",
          "blackberry.org.mx",
          "blackwhitebags.com",
          "blindlydivision.com",
          "blockedsituation.net",
          "blogreseller.net",
          "boldconclusion.com",
          "booking-tables.com",
          "bottlehere.com",
          "boxes-mix.net",
          "boysrbabies.co",
          "br-hashtags.com",
          "br-travels.com",
          "brand-tech.net",
          "breakfastisgood.com",
          "brighttooth.net",
          "brownandblueeyes.com",
          "browser-update.online",
          "bubblesmoke.net",
          "bubblesweetcake.com",
          "buildingcarpet.com",
          "buildurlife.net",
          "buildyourdata.com",
          "bulk-theft.net",
          "bulksender.info",
          "bulktheft.com",
          "bullgame.net",
          "bunchi.club",
          "bundlestofear.com",
          "businesssupportme.com",
          "bussybeesallover.com",
          "bustimer.net",
          "butterdogchange.com",
          "buymanuel.co",
          "buypresent4me.net",
          "bytlo.com",
          "cablegirls.net",
          "calculatesymbols.com",
          "calendarsapp.com",
          "candlealbum.com",
          "carpetdignity.com",
          "carrefour-des-affaires.com",
          "cars-to-buy.com",
          "cartsafer.com",
          "cashandlife.com",
          "cashtowebmail.com",
          "casia-news.info",
          "catbrushcable.com",
          "catfoodstorage.net",
          "catsndogsproducts.com",
          "cdnupdateweb.com",
          "cdnwa.com",
          "celebrateyourdaynow.com",
          "cell-abonnes.com",
          "cell-mcel.info",
          "cellphone-inside.org",
          "cellphonesprices.com",
          "cellular-updates.com",
          "cellular-updates.online",
          "cellularupdates.info",
          "centersession.com",
          "changesstarted.net",
          "chatresponses.com",
          "cheapcardonline.com",
          "cheaphostingtoday.com",
          "cheapmotelz.net",
          "cheapsolutions4u.com",
          "cheaptransporting.net",
          "check-my-internetspeed.com",
          "checkboxcart.com",
          "checkboxfee.com",
          "chickenwaves.com",
          "chistedeldia.mx",
          "chocolateicecreamlovers.com",
          "chocollife.me",
          "chormnet3.com",
          "chubaka.org",
          "classic-furnitures.com",
          "classstylemap.com",
          "cleanmiddle.com",
          "clickrighthere.online",
          "clicktrack247.com",
          "clients-access.com",
          "clockmarkcoffee.com",
          "closefly.com",
          "cloudads.net",
          "cloudbiggest.com",
          "clubloading.net",
          "clubmovistar.com",
          "clubsforus.net",
          "coffecups.online",
          "coffee2go.org",
          "colorfulnotebooks.com",
          "colorsoflife.online",
          "columbus-parking.com",
          "com-reports.net",
          "companybreakfast.net",
          "computer-set.com",
          "conditionalcell.com",
          "conference-ballroom.com",
          "confusedmachine.com",
          "connecting-to.com",
          "contacting-customer.com",
          "content-blocking.net",
          "contentsbycase.com",
          "convertedversion.com",
          "cookiescom.com",
          "cookiesoutthere.com",
          "cool-smartphone-apps.com",
          "coolasiankitchen.com",
          "coolbbqtools.net",
          "coolmath4us.net",
          "cornclean.com",
          "cottondecay.com",
          "countrytrips.net",
          "coupedumondepro.com",
          "couponshops.info",
          "cpr-appointments.com",
          "crimebackfire.com",
          "crosslocated.net",
          "crowndecoration.net",
          "crownsafe.net",
          "cryptocurrecny.com",
          "cryptokoinz.com",
          "cryptopcoinz.com",
          "csomagodjott.com",
          "cssgraphics.net",
          "cupscars.net",
          "curiousrabbitgame.com",
          "currentscan.net",
          "currentwestpeople.com",
          "dancersing.net",
          "dancinglife.co",
          "dashboardprompt.com",
          "data-formula.com",
          "databasemeans.net",
          "deadwordsstory.com",
          "deal4unow.com",
          "dearlegendseed.com",
          "delivery-24-7.com",
          "dental-care-spa.net",
          "deportesinfo.com",
          "designednetwork.com",
          "destinytool.net",
          "detailrush.net",
          "deter-individuals.com",
          "devicer.co",
          "dhcpserver.net",
          "diagram-shape.com",
          "diningip.com",
          "directbegins.com",
          "directlyforuse.com",
          "directurl-loading.com",
          "discountads.net",
          "discountmarkets.info",
          "discountstores.info",
          "displaytag.net",
          "dns-1.co",
          "dns-analytics.com",
          "dns-direct.net",
          "dns-upload.com",
          "dnsclocknow.com",
          "dnslogs.net",
          "dnsmachinefork.com",
          "dnsprotector.net",
          "dnsroof.com",
          "do-itonyour-own.com",
          "documentpro.org",
          "dogfoodstorage.net",
          "dogopics.com",
          "doitformom.com",
          "doitforthefame-now.com",
          "domain-control.net",
          "domain-redirect.com",
          "domain-resolver.net",
          "domain-routing.com",
          "domain-security.org",
          "domainloading.net",
          "domainport.net",
          "domains-resolver.net",
          "domainsearching.net",
          "domesticwindow.com",
          "donateabox.co",
          "donateaflower.com",
          "donateyouroldclothes.net",
          "done.events",
          "donefordeal.com",
          "doorcoffeebrown.com",
          "dotroomeight.com",
          "dowhatyouneed.com",
          "downgradeproduct.com",
          "dramatic-challenge.com",
          "driventicket.com",
          "e-loading.biz",
          "e-prokuror.info",
          "eardooraround.com",
          "earsstrawsfive.com",
          "easy-pay.info",
          "easybett.online",
          "economic-news.co",
          "editorscolumn.net",
          "effectivespeech.net",
          "egov-online.com",
          "egov-segek.info",
          "ehistorybooks.com",
          "elementscart.com",
          "eliminateadjust.com",
          "elitecarz.net",
          "email-plans.com",
          "emonitoring-paczki.pl",
          "energy-dispatch.net",
          "enoughtoday.org",
          "entertainmentinat.com",
          "entire-cases.com",
          "equal-gravity.com",
          "erty.online",
          "estatearea.net",
          "eura-cell.com",
          "eurasianupdate.com",
          "event-reg.info",
          "everycolor-inside.com",
          "everyuse.org",
          "ex-forexlive.com",
          "exchangenames.net",
          "exchangenerate.com",
          "existingpass.com",
          "exoticsendurance.com",
          "expired-getway.net",
          "expiredsession.com",
          "expiringdate.com",
          "exploreemail.net",
          "extend-list.net",
          "externalprivacy.com",
          "externaltransfers.com",
          "extractsight.com",
          "extrahoney.net",
          "eyestoip.com",
          "eyesunderspray.com",
          "ezdropshipping.net",
          "fabric-shops.com",
          "face-image.com",
          "facebook-accounts.com.mx",
          "fadewallwine.com",
          "fadi7apress.com",
          "fallround.com",
          "fallsjuice.com",
          "familyabroad.net",
          "fantastic-gardens.com",
          "fashion-live.net",
          "fashion-online.net",
          "fashioncontainer.net",
          "fashionpark.info",
          "fastdirect.net",
          "fastfixs.net",
          "fatpop.net",
          "fbsecurity.co",
          "feature-publish.net",
          "feelbonesbag.com",
          "feeltrail.com",
          "femmedaffaire.com",
          "fetchlink.net",
          "fiestamaghreb.com",
          "filingwarranty.com",
          "financecomments.net",
          "findavoucher.online",
          "findgoodfood.co",
          "findgroupon.com",
          "finditout-now.com",
          "findmyass.org",
          "findmyfriendsnow.com",
          "findmylunch.org",
          "findmymind.co",
          "findouthere.org",
          "firebulletfan.com",
          "fishingtrickz.com",
          "fitness-for-ever.com",
          "flashobligation.com",
          "flashtraininggoal.com",
          "flights-report.com",
          "flights-todays.com",
          "flying-free.online",
          "flynewfries.com",
          "fofopiko.org",
          "foodeveryhour.com",
          "foodforyou.info",
          "foodiez.online",
          "forgetjustit.com",
          "formatpainter.net",
          "formattingcells.com",
          "forward-page.com",
          "forward5costume.com",
          "foto-top.info",
          "foudefoot.live",
          "free-local-events.info",
          "free247downloads.com",
          "freedominfo.net",
          "freelancers-team.org",
          "freeshoemoon.com",
          "freshandsoftbread.com",
          "freshsaladtoday.com",
          "functionalcover.com",
          "fundum8430.com",
          "funinat.com",
          "funinthesun4u.com",
          "funintheuk.com",
          "funnytvclips.com",
          "fwupdating.com",
          "gadgetproof.net",
          "gadgetsshop.info",
          "gate-sync.net",
          "gdfr.online",
          "gearstereotype.com",
          "getagift.info",
          "getoutofyourmind.com",
          "getphotosinstant.net",
          "getpoints.net",
          "getspeednows.com",
          "gettingchances.com",
          "gettingurl.com",
          "girlimstill.com",
          "girlsyoulike.com",
          "glassesofwine.com",
          "glasstaken.com",
          "glittercases.net",
          "global-redirect.net",
          "globalcoverage.co",
          "globalnews247.net",
          "globalsupporteam.com",
          "go-trip.online",
          "good-games.org",
          "goodcookingonline.com",
          "goodflowersinside.com",
          "goodthoughts4u.com",
          "goroskop.co",
          "gossipsbollywoods.com",
          "gostatspro.com",
          "greatcitymore.com",
          "greenbusnoise.com",
          "greensmallcanvas.com",
          "greenwatermovement.com",
          "growstart.net",
          "guardnotes.com",
          "gulf-financials.com",
          "gulfca.net",
          "gumclockberry.com",
          "hairdresseraroundme.com",
          "halal-place.com",
          "handcraftedformat.com",
          "handcreamforyou.com",
          "handymanwood.com",
          "happiness4us.com",
          "hardthinmetal.com",
          "hatsampledc.com",
          "hdsoccerstream.com",
          "health-club.online",
          "healthyguess.com",
          "healthykids-food.com",
          "hearsmugglergarden.com",
          "heavy-flood.com",
          "hellomydaddy.com",
          "hellomymommy.com",
          "highclassdining.net",
          "hillsaround.com",
          "hitrafficip.com",
          "holdingspider.com",
          "holdmydoor.com",
          "holdstory.com",
          "holecatorange.com",
          "holiday4u.work",
          "homeishere.co",
          "homemadecandies.net",
          "horsefingercoffee.com",
          "host-one-more.com",
          "host-redirect.net",
          "hot-motors.com",
          "hotels-review.org",
          "hotelsauto.co",
          "hotelstax.co",
          "hotelsurvey.info",
          "hothdwallpaperz.com",
          "hotinfosource.com",
          "housing-update.com",
          "howisurday.com",
          "howtoexplorebirds.com",
          "howtomakeavocadotoastandegg.com",
          "hracingtips.com",
          "htmlmetrics.com",
          "htmlstats.net",
          "httpaccess.com",
          "humandiven.com",
          "humblebenefit.com",
          "hundredsofdesigns.net",
          "icecreamlovesme.com",
          "igiheonline.com",
          "ikomek.info",
          "ilovemybeatifulnails.com",
          "ilovemymilf.com",
          "in-weather.com",
          "in2date.com",
          "inbox-messages.net",
          "income-tax.online",
          "indrive.info",
          "industry-specialist.com",
          "ineediscounts.com",
          "info24.live",
          "infospotpro.com",
          "insertfilters.net",
          "insta-foto.net",
          "instangram.com.mx",
          "internetmobilespeed.com",
          "intim-media.net",
          "investormanage.net",
          "ipjackets.com",
          "ipurlredirect.com",
          "islam-today.info",
          "islam-world.net",
          "islamiyaat.com",
          "istgr-foto.com",
          "itsthebrowser.com",
          "iwantitallnow.com",
          "jaimelire.net",
          "jeeyarworld.com",
          "judgeauthority.com",
          "just-one-left.com",
          "kaidee.info",
          "karbalaeyat.com",
          "keepiptext.com",
          "keepthiseasy.com",
          "kenyasms.org",
          "keyindoors.com",
          "keynotepalm.com",
          "khaleejtimes.online",
          "knowingfun.com",
          "knowseminar.com",
          "koramaghreb.com",
          "kra.center",
          "labonneforme.net",
          "landflatheart.com",
          "landstofree.com",
          "laptop-parts.org",
          "last-chainleash.net",
          "latest-songs.com",
          "lawlowvat.net",
          "layerprotect.com",
          "layoutfill.com",
          "leavehomego.com",
          "leggingsjustforyou.com",
          "legsfriesears.com",
          "legyelvodas.net",
          "leleader.org",
          "lesbonnesaffaires.online",
          "lesportail.biz",
          "letyoufall.com",
          "levelsteelwhite.com",
          "liam-ryan.co",
          "license-updater.com",
          "lifedonor.net",
          "lifenoonkid.com",
          "like-the-rest.com",
          "limitedfeature.com",
          "link-crawler.com",
          "link-scan.net",
          "linking-page.com",
          "linksnew.info",
          "littlefrogalarm.com",
          "live-once.net",
          "lizzardsnail.com",
          "loading-ads.net",
          "loading-domain.com",
          "loading-images.com",
          "loading-pag.net",
          "loading-page.net",
          "loading-url.net",
          "loadingpage1.net",
          "loadingpage4.net",
          "loadingurl.net",
          "loadthatpage.com",
          "localgreenflowers.com",
          "loisiragogo.com",
          "lonely-place.com",
          "look-outsidenow.com",
          "looking-for-two.com",
          "lookitupnow.website",
          "looklifewhite.com",
          "loschismescalientes.com",
          "losnegocios.biz",
          "lost-n-found.net",
          "loveandhatenow.com",
          "lowervalues.com",
          "m-resume.com",
          "maghrebfoot.com",
          "maghrebfunny.biz",
          "magicalipone.com",
          "mailappzone.com",
          "maingreatessay.com",
          "mainredirecter.com",
          "mamba-live.com",
          "managedsnap.com",
          "management-help.com",
          "managingincluded.com",
          "manydnsnow.com",
          "maphonortea.com",
          "mapupdatezone.com",
          "martinipicnic.com",
          "massagetax.co",
          "maymknch2026.co",
          "mcel-update.com",
          "mcel.info",
          "mealrentyard.com",
          "meanspursuit.com",
          "medical-updates.com",
          "medicalcircle.net",
          "megacenter.info",
          "megaticket.info",
          "mercedesbenz-vip.com",
          "merchant-businesses.com",
          "mergeandcenter.com",
          "methodslocal.com",
          "mgifweb.com",
          "miles-club.com",
          "miralo-rapidamente.com",
          "mirrorgossip.com",
          "mixershake.net",
          "mixsinger.com",
          "mobi-up.net",
          "mobile-softs.com",
          "mobile-update.online",
          "mobile-updates.info",
          "mobilebrowsing.net",
          "mobilephonesme.com",
          "mobileweatherweb.com",
          "modifytimezone.net",
          "moh-followup.com",
          "moh-online.com",
          "monawa3ate.org",
          "mondaymornings.co",
          "moneycheesecolor.com",
          "moneycoincurrency.com",
          "moneydigitalcurrency.com",
          "moneyxchanges.com",
          "moregatesthere.com",
          "morning-maps.com",
          "mosque-salah.com",
          "mosque-salah.net",
          "mosquesfinder.com",
          "motiontastebad.com",
          "motivation-go.com",
          "motordeal.info",
          "movie-tickets.online",
          "moyfoto.net",
          "moz-noticias.com",
          "mozillaname.com",
          "mozsafety.com",
          "muftyat.com",
          "multiplecurrencies.com",
          "music-electric.org",
          "music-headphones.org",
          "muzicclips.com",
          "muziclovers.org",
          "my-privacy.co",
          "mybrightidea.co",
          "mydailycooking.net",
          "mydarkarms.com",
          "myfiles.photos",
          "myfreecharge.online",
          "myfundsdns.com",
          "mygreathat.com",
          "mygummyjelly.com",
          "myheartbuild.com",
          "mylogfrog.com",
          "mylovelypet.net",
          "mymanagement-service.com",
          "mymobile-cell.com",
          "mynewbesttime.com",
          "mypostservice.online",
          "mysadaga.com",
          "myseesea.com",
          "myself-dns.com",
          "myshoesforever.com",
          "myshop4u.net",
          "mysuperheadphones.co",
          "myukadventures.com",
          "nation-news.com",
          "nation24.info",
          "nationalleagues.net",
          "natural-ice.com",
          "navywalls.com",
          "nbrowser.org",
          "nerdtvfan.com",
          "net-protector.com",
          "netstatistics.net",
          "netvisualizer.com",
          "network-bots.com",
          "networkinfo.org",
          "networkingloading.com",
          "networkingproperty.com",
          "neutralpages.com",
          "neverwayneck.com",
          "newandfresh.com",
          "newandroidapps.net",
          "newarrivals.club",
          "newcooking.org",
          "newdailycoupons.com",
          "newenvelope.net",
          "newip-info.com",
          "newipconfig.com",
          "newmodel.online",
          "newnhotapps.com",
          "newredirect.net",
          "news-flash.net",
          "news-news.co",
          "newsofgames.com",
          "nicevibezaction.net",
          "nightevents.info",
          "nightscloudwant.com",
          "noextramoney.com",
          "noloveforyou.com",
          "noodlegray.com",
          "noonstore.sale",
          "noor-alhedaya.com",
          "normal-brain.com",
          "normal-strength.com",
          "normalseason.com",
          "nosalternatives.com",
          "nosemorningnine.com",
          "noti-global.com",
          "noti-hot.com",
          "noti-hoy.co",
          "notificationsneeded.com",
          "notisms.net",
          "notresante-infos.com",
          "noveletters.com",
          "novoicenoprob.net",
          "novosti247.com",
          "now-online.net",
          "nuevaidea.co",
          "objectreduction.com",
          "offresimmobilier.com",
          "offspringperform.net",
          "ok-group.org",
          "old-glasses.net",
          "oldmywater.com",
          "one-isnot-enough.com",
          "oneleadingchat.com",
          "onetreeinheaven.com",
          "online-loading.com",
          "onlinefreework.com",
          "onlycart.net",
          "onlygossip.info",
          "onlytoday.biz",
          "onlywebsite.org",
          "onthegoodtime.com",
          "openingquestion.org",
          "opera-van.com",
          "operations-delivery.com",
          "operations-shifts.com",
          "oplata-shtraf.info",
          "opposedarrangement.net",
          "optionalshift.online",
          "optionstoreplace.com",
          "orange-updates.com",
          "organicdiamonds.net",
          "ourorder.info",
          "ourperfume.net",
          "outgoingurl.com",
          "outletsaroundme.com",
          "outletstore.tech",
          "page-host.net",
          "page-info.com",
          "pageisloading.net",
          "pageredirect.co",
          "pageupdate.co",
          "painruncart.com",
          "painting-walls.com",
          "panelbreed.com",
          "papers2go.co",
          "papervoice.net",
          "park4free.info",
          "particularmechanic.net",
          "parties-fun.com",
          "pastesbin.com",
          "pathtogo.net",
          "pay-city.com",
          "pay-penalty.info",
          "paynfly.info",
          "paywithcrytpo.com",
          "pc-views.net",
          "performinghost.com",
          "permalinking.com",
          "phonemetrics.co",
          "phonering4you.com",
          "phonestats.net",
          "photo-afisha.net",
          "photo-my.net",
          "physicalcheetah.com",
          "pickcard.info",
          "picture4us.com",
          "pincattape.com",
          "pizzatoyourplace.com",
          "planeocean.com",
          "playfantasticsplastic.com",
          "playwithusonline.com",
          "pleaseusenew.com",
          "pleaseusenew.net",
          "pochta-info.com",
          "politica504.com",
          "popagency.net",
          "popularmessages.net",
          "port-connection.com",
          "portredirect.net",
          "possibilitytotransfer.com",
          "postainf.net",
          "pourcentfilers.com",
          "poweredbycpanel.com",
          "poweredlock.com",
          "ppcisdead.com",
          "pprocessor.net",
          "practical-basis.net",
          "practicehazard.com",
          "preferenceviews.com",
          "preferring.org",
          "presidentialagent.com",
          "preventadmission.com",
          "preventsusing.com",
          "pride-industry.com",
          "pride-industry.net",
          "pridetomyself.net",
          "prikol-girls.com",
          "primarystrike.net",
          "prioritytrail.net",
          "privo7799add.net",
          "productsall.net",
          "productsview.co",
          "projectgoals.net",
          "promotionlove.co",
          "proudmorale.com",
          "pub-dns.com",
          "publishbig.net",
          "puffyteddybear.com",
          "purchaseusingcoins.com",
          "purple-enveloppe.com",
          "puttylearning.com",
          "qaoffers.net",
          "qualityfeeling.net",
          "quitmyjob.xyz",
          "quota-reader.net",
          "quran-quote.com",
          "rainingcats.net",
          "raininscreen.com",
          "randomlane.net",
          "rapidredirecting.com",
          "raresound.org",
          "raw-console.com",
          "reachcomputer.com",
          "readingbooksnow.com",
          "readirectly.com",
          "realmythtrend.com",
          "receiptpending.net",
          "reception-desk.net",
          "recordinglamping.com",
          "redemptionphrase.com",
          "redirect-connection.com",
          "redirect-link.com",
          "redirect-net.com",
          "redirect-protocol.com",
          "redirect-service.net",
          "redirect-systems.com",
          "redirect-traffic.net",
          "redirect-tunnel.net",
          "redirect-webpage.net",
          "redirect2url.net",
          "redirectchannel.net",
          "redirectcheck.net",
          "redirectconnection.net",
          "redirectdoor.com",
          "redirecteur.net",
          "redirectgate.com",
          "redirecting-url.com",
          "redirectingpage.net",
          "redirectingurl.net",
          "redirectingurl.org",
          "redirection-url.net",
          "redirectit.net",
          "redirectking.net",
          "redirectload.com",
          "redirectmotion.org",
          "redirectnet.net",
          "redirectool.com",
          "redirectprotocol.net",
          "redirectshare.com",
          "redirectweburl.com",
          "redirigir.net",
          "redstarnews.net",
          "reflectextension.net",
          "regularhours.net",
          "related-ads.com",
          "relatedspams.net",
          "reload-url.com",
          "reload-url.net",
          "reloading-page1.com",
          "reloadinput.com",
          "reloadpage.net",
          "remove-client.com",
          "remove-from-mailing-list.com",
          "remove-from-mailinglist.com",
          "remove-subscription.com",
          "renewal-control.net",
          "rentalindustries.com",
          "rentmotors.net",
          "research-archive.com",
          "reseausocialsolutions.co",
          "reservationszone.com",
          "reseufun.com",
          "resolutionsbox.com",
          "restaurantsstar.com",
          "results-house.net",
          "revoke-dashboard.com",
          "rewards-club.info",
          "rhymeshey.com",
          "righttriangle.net",
          "roadwide.net",
          "robotscan.net",
          "rockbreakdown.com",
          "rockmusic4u.com",
          "rockstarpony.com",
          "rosegoldjewerly.com",
          "rosesforus.com",
          "russian4u.net",
          "safe-mondays.net",
          "safecrusade.com",
          "saladsaroundme.com",
          "saltyapplepie.com",
          "same-old.net",
          "savemoretime.co",
          "saveurday.net",
          "scannerservices.net",
          "scaryaudience.com",
          "scriptincluded.com",
          "scriptsinstallers.com",
          "searchjustdont.net",
          "searchunit.net",
          "sec-checker.com",
          "secretgirlfriend.net",
          "secured-url.net",
          "securedloading.com",
          "securedlogin.org",
          "securesmsing.com",
          "securisurf.com",
          "securlaw.com",
          "select-edition.net",
          "send2url.com",
          "sendhtml.net",
          "sendingurl.com",
          "sendingurl.net",
          "seriousprotection.net",
          "service-update.online",
          "services-sync.com",
          "servingshade.com",
          "severalheroes.com",
          "sharepassageset.com",
          "shipment-status.org",
          "shoppingdailydeals.net",
          "short-address.com",
          "shortfb.com",
          "shortredirect.com",
          "shtraf.info",
          "shuturl.com",
          "silverodgone.com",
          "simplycode.co",
          "site-lock.net",
          "site-redirecting.com",
          "skillsforest.net",
          "smallridebar.com",
          "smarttarfi.com",
          "smokeshowshoe.com",
          "smoothurl.com",
          "sms-center.info",
          "sms-sending.net",
          "sms-zone.org",
          "snoweverywhere.com",
          "so-this-is.com",
          "soccerstreamingstars.com",
          "social-artist.net",
          "social-exercise.com",
          "social-rights.com",
          "sockstubename.com",
          "somewarmremember.com",
          "somuchrain.com",
          "sparepresence.com",
          "specialgifts4all.com",
          "speechenforce.com",
          "speedservicenow.com",
          "spiritualbrakes.com",
          "sportssaint.net",
          "sportupdates.info",
          "sportupdates.online",
          "squaretables.net",
          "sslbind.com",
          "standartsheet.com",
          "standstock.net",
          "starbuckscoffeeweb.com",
          "starreturned.com",
          "stars4sale.co",
          "start2playnow.com",
          "starting-from0.com",
          "startupsservices.net",
          "stationfunds.net",
          "statisticsdb.net",
          "staysystem.net",
          "stopmysms.com",
          "storageseminar.net",
          "storelive.co",
          "strangegloom.net",
          "strategyroles.com",
          "suitcasesmellnice.com",
          "summermover.com",
          "sunnydaylight.com",
          "sunrise-brink.net",
          "sunsetdnsnow.com",
          "superlinks4u.com",
          "supportonline4me.com",
          "surprising-sites.com",
          "sweet-water.org",
          "sweetcup.co",
          "sync-cdn.com",
          "syncingprocess.com",
          "syncmap.org",
          "systemtrees.com",
          "t-support.net",
          "tablereservation.info",
          "tahmilmilafate.com",
          "tahmilmilafate.info",
          "takecarhomes.com",
          "takethat.co",
          "tastyteaflavors.com",
          "teachskate.com",
          "techhelping.net",
          "telangana-news24.com",
          "telecom-info.com",
          "telephonequality.com",
          "template-iso.net",
          "tentrosegain.com",
          "thainews.asia",
          "thankstossl.com",
          "the-only-way-out.com",
          "theappanalytics.com",
          "thebestclassicalmusic.net",
          "thecoffeeilove.com",
          "thefuturearticle.net",
          "thehighesttemple.com",
          "thehoteloffers.com",
          "theredirect.net",
          "theshopclub.org",
          "thesimplestairs.com",
          "thespaclub.net",
          "theway2get.com",
          "thoughtfulbundle.com",
          "tibetnews365.net",
          "ticket-aviata.info",
          "ticket-selections.com",
          "tiketon.info",
          "timelesscelebrity.com",
          "timeofflife.com",
          "tinyurler.com",
          "tlgr-me.org",
          "tobepure.com",
          "todaysdeals4u.com",
          "todoinfonet.com",
          "toggletools.com",
          "tommyfame.com",
          "tomorrowpastno.com",
          "tookcheckout.com",
          "top100vidz.com",
          "top10gifts4men.com",
          "top10leadsgen.com",
          "topadblocker.net",
          "topbraingames4u.com",
          "topoems.com",
          "touristvaca.com",
          "towebsite.net",
          "track-your-fedex-package.com",
          "trackyourfedexpackage.net",
          "trade-agreement.com",
          "tradeexchanging.com",
          "traffic-pay.com",
          "traffic-updates.info",
          "transfer-rate.com",
          "transferbase.co",
          "transferkeep.com",
          "transferlights.com",
          "travel-foryou.online",
          "travelight.online",
          "traveltogether.link",
          "trendsymbol.net",
          "trialvariable.net",
          "trianglerank.net",
          "tricksinswiss.com",
          "trililihihi.com",
          "tripleclickpays.com",
          "tunnelprotocol.net",
          "turismo-aqui.com",
          "tvshowcusting.com",
          "uidebol.info",
          "umbrellacover.net",
          "un-limitededitions.com",
          "unavailableentry.com",
          "unionofteenagers.com",
          "uniquesite.co",
          "unlockaccount.net",
          "unsubscribed.co",
          "unsubscribeinhere.com",
          "untoldinfo.net",
          "unusualneighbor.com",
          "updateapps.net",
          "updatedchargers.com",
          "updatedcharges.net",
          "updating-link.com",
          "updating-url.com",
          "updating-url.net",
          "updatingpage.com",
          "updatingwebpage.com",
          "upgrade-sim-card.com",
          "upkeepno.com",
          "upload-now.net",
          "uptownfun.co",
          "urbestfriends.com",
          "url-configure.com",
          "url-direct.com",
          "url-hoster.com",
          "url-loading.com",
          "url-redirect.com",
          "url-redirect.net",
          "url2all.net",
          "urlconfig.net",
          "urlconnection.net",
          "urldefender.net",
          "urlpage-redirect.com",
          "urlpush.net",
          "urlredirect.net",
          "urlregistrar.net",
          "urlreload.net",
          "urlscanner.net",
          "urlsync.com",
          "urlupdates.com",
          "urlviaweb.com",
          "urspanishteacher.net",
          "user-registration.com",
          "utensils.pro",
          "vamizi.info",
          "vanillaandcream.com",
          "varietyjobspaid.org",
          "varietyregistrar.com",
          "vastdealsnow.com",
          "vault-encryption.com",
          "verify-app.online",
          "videotubbe.net",
          "vider-image.com",
          "viewhdvideos.com",
          "viewstracker.com",
          "vipmasajes.com",
          "viva-droid.com",
          "vivrechezsoi.info",
          "vkan-profile.com",
          "volcanodistance.com",
          "volcanosregion.com",
          "waffleswithnutella.com",
          "waitingtoload.com",
          "walkerpost.net",
          "walkhatclock.com",
          "wallagainsthall.com",
          "walltome.com",
          "wasted-nights.com",
          "waterforplants.net",
          "watersport4u.net",
          "weakdistance.com",
          "weather4free.com",
          "weatherapi.co",
          "web-check.co",
          "web-config.org",
          "web-developper.net",
          "web-domain.net",
          "web-hoster.co",
          "web-loading.com",
          "web-loading.net",
          "web-only.net",
          "web-page.co",
          "web-scanner.co",
          "web-spider.net",
          "web-url.net",
          "web-viewer.online",
          "webadv.co",
          "webexaminer.net",
          "webpageupdate.co",
          "webprotector.co",
          "webprotocol.net",
          "webresourcer.com",
          "websconnector.co",
          "websiteconnecting.com",
          "websiteeco.com",
          "websitereconnecting.com",
          "websites4yourhost.com",
          "websitetosubmit.com",
          "webstrings.net",
          "websupporter.co",
          "webtunnels.net",
          "webupdater.net",
          "webview-redirect.com",
          "wedding-strategy.com",
          "welcomehosting.net",
          "welovebigcakes.com",
          "welovelollipops.com",
          "welovemorningcoffees.com",
          "wewantflowersnow.com",
          "whatcanidowithbirds.com",
          "whats-new.org",
          "whatsappsupport.net",
          "whereismybonus.com",
          "whereismyhand.com",
          "whereismytree.net",
          "whereisthehat.com",
          "whynotyesterday.com",
          "whypillyellow.com",
          "willpurpleshe.com",
          "windyone.net",
          "winfoxflip.com",
          "winter-balance.com",
          "wintertimes.co",
          "wishdownget.com",
          "without-additional.com",
          "witness-delay.com",
          "woodhome4u.com",
          "wordstore.net",
          "working-online.net",
          "workshopmanager.net",
          "wraptext.net",
          "xchange4u.net",
          "xchangerates247.net",
          "xn--nissn-3jc.com",
          "xn--noki-t5b.com",
          "xn--telegrm-qbd.com",
          "xtremelivesupport.com",
          "youaresostupid.net",
          "youcantpass.com",
          "youintelligence.com",
          "youliehow.com",
          "yourbestclothes.com",
          "yourbestefforts.com",
          "yourbestvaca.com",
          "yourgreatestsmartphone.com",
          "yourhotelreservation.info",
          "yourlastchance.net",
          "yousunhard.com",
          "yummyfoodallover.com",
          "zsports-info.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/AmnestyTech/status/1416810917216538629",
        "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/",
        "https://github.com/AmnestyTech/investigations/blob/master/2021-07-18_nso/domains.txt"
      ],
      "total": 1264
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2021-02-14",
      "indicators": {
        "domain": [
          "accountant-audio.com",
          "audienceflake.com",
          "secureyouradd.com",
          "smallperfumerain.com",
          "takemallelectric.com",
          "weddingbandsoft.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hacked-with-suspected-nso-group-imessage-zero-click-exploit/",
        "https://twitter.com/AmnestyTech/status/1416810917216538629",
        "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/",
        "https://github.com/AmnestyTech/investigations/blob/master/2021-07-18_nso/domains.txt"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2021-02-14",
      "indicators": {
        "domain": [
          "bananakick.net",
          "crashparadox.net",
          "f15fwd322.regularhours.net",
          "flowersarrows.com",
          "img565vv6.holdmydoor.com",
          "stilloak.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hacked-with-suspected-nso-group-imessage-zero-click-exploit/"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-12-20",
      "indicators": {
        "domain": [
          "9jp1dx8odjw1kbkt.f15fwd322.regularhours.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hacked-with-suspected-nso-group-imessage-zero-click-exploit/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2020-10-11",
      "indicators": {
        "domain": [
          "leprotestant.com",
          "vie-en-islam.com",
          "viedechretien.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://citizenlab.ca/2020/08/nothing-sacred-nso-sypware-in-togo/",
        "https://twitter.com/AmnestyTech/status/1416810917216538629",
        "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/",
        "https://github.com/AmnestyTech/investigations/blob/master/2021-07-18_nso/domains.txt"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-10-11",
      "indicators": {
        "domain": [
          "chretiendaujoudhui.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://citizenlab.ca/2020/08/nothing-sacred-nso-sypware-in-togo/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-01-27",
      "indicators": {
        "domain": [
          "files-downloads.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/AmnestyTech/status/1416810917216538629",
        "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/",
        "https://github.com/AmnestyTech/investigations/blob/master/2021-07-18_nso/domains.txt"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2019-10-10",
      "indicators": {
        "domain": [
          "business-today.info",
          "hmizat.co",
          "infospress.com",
          "stopsms.biz",
          "videosdownload.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.amnesty.org/en/latest/research/2019/10/morocco-human-rights-defenders-targeted-with-nso-groups-spyware/",
        "https://otx.alienvault.com/pulse/5d9f05596b5109e891f42a24",
        "https://twitter.com/AmnestyTech/status/1416810917216538629",
        "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/",
        "https://github.com/AmnestyTech/investigations/blob/master/2021-07-18_nso/domains.txt"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-10-10",
      "indicators": {
        "domain": [
          "bun54l2b67.get1tn0w.free247downloads.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.amnesty.org/en/latest/research/2019/10/morocco-human-rights-defenders-targeted-with-nso-groups-spyware/",
        "https://otx.alienvault.com/pulse/5d9f05596b5109e891f42a24"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 50
      },
      "first_seen": "2019-10-07",
      "indicators": {
        "domain": [
          "afriquenouvelle.com",
          "ajelnews.net",
          "akhbara-aalawsat.com",
          "allafricaninfo.com",
          "arabworldnews.info",
          "breaking-extranews.online",
          "breaking-news.co",
          "breakingnewsasia.com",
          "breakthenews.net",
          "centrasia-news.com",
          "diaspora-news.com",
          "discoveredworld-news.com",
          "e-sveiciens.com",
          "egov-sergek.info",
          "eltiempo-news.com",
          "eurosportnews.info",
          "golf-news.live",
          "gulf-news.info",
          "investigationews.com",
          "islamic-news-today.com",
          "kaspi-payment.com",
          "klientuserviss.com",
          "kurjerserviss.com",
          "leadersnews.org",
          "legyelvodas.com",
          "mykaspi.com",
          "mystulchik.com",
          "news-alert.org",
          "newscurrent.info",
          "newsdirect.online",
          "newsofficial.info",
          "newsofthemoment.net",
          "newworld-news.com",
          "nothernkivu.com",
          "odnoklass-profile.com",
          "online-dailynews.com",
          "onlineshopzm.com",
          "only-news.net",
          "operatingnews.com",
          "posta.news",
          "regionews.net",
          "reklamas.info",
          "sergek.info",
          "sputnik-news.info",
          "tengrinews.co",
          "theastafrican.com",
          "topten-news.info",
          "zednewszm.com",
          "zm-banks.com",
          "zm-weather.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.amnesty.org/en/latest/research/2018/08/amnesty-international-among-targets-of-nso-powered-campaign/",
        "https://twitter.com/AmnestyTech/status/1416810917216538629",
        "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/",
        "https://github.com/AmnestyTech/investigations/blob/master/2021-07-18_nso/domains.txt"
      ],
      "total": 50
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2019-03-18",
      "indicators": {
        "url": [
          "mp3.ucrazy.org/music/"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/VK_Intel/status/1017190191864434689"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2019-03-01",
      "indicators": {
        "domain": [
          "banca-movil.net",
          "savephotos.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://citizenlab.ca/2018/11/mexican-journalists-investigating-cartels-targeted-nso-spyware-following-assassination-colleague/"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 12
      },
      "first_seen": "2018-10-07",
      "indicators": {
        "domain": [
          "all-sales.info",
          "arabworld.biz",
          "beststores4u.com",
          "cheapapartmentsaroundme.com",
          "dinneraroundyou.com",
          "findmyplants.com",
          "housesfurniture.com",
          "mideast-today.com",
          "muslim-world.info",
          "promosdereve.com",
          "sunday-deals.com",
          "wonderfulinsights.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://citizenlab.ca/2018/10/the-kingdom-came-to-canada-how-saudi-linked-digital-espionage-reached-canadian-soil/",
        "https://twitter.com/AmnestyTech/status/1416810917216538629",
        "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/",
        "https://github.com/AmnestyTech/investigations/blob/master/2021-07-18_nso/domains.txt"
      ],
      "total": 12
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2018-10-07",
      "indicators": {
        "domain": [
          "daily-sport.news",
          "kingdom-news.com",
          "news-gazette.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://citizenlab.ca/2018/10/the-kingdom-came-to-canada-how-saudi-linked-digital-espionage-reached-canadian-soil/",
        "https://www.amnesty.org/en/latest/research/2018/08/amnesty-international-among-targets-of-nso-powered-campaign/",
        "https://twitter.com/AmnestyTech/status/1416810917216538629",
        "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/",
        "https://github.com/AmnestyTech/investigations/blob/master/2021-07-18_nso/domains.txt"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2018-10-07",
      "indicators": {
        "domain": [
          "nouvelles247.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/AmnestyTech/status/1416810917216538629",
        "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/",
        "https://github.com/AmnestyTech/investigations/blob/master/2021-07-18_nso/domains.txt"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2018-09-22",
      "indicators": {
        "domain": [
          "ideas-telcel.com.mx",
          "mymensaje-sms.com",
          "network190.com",
          "secure-access10.mx",
          "smscentro.com",
          "twiitter.com.mx"
        ]
      },
      "precision": "exact",
      "references": [
        "https://citizenlab.ca/2017/06/reckless-exploit-mexico-nso/",
        "https://twitter.com/AmnestyTech/status/1416810917216538629",
        "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/",
        "https://github.com/AmnestyTech/investigations/blob/master/2021-07-18_nso/domains.txt"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2018-09-21",
      "indicators": {
        "domain": [
          "banca-movil.com",
          "ecommerce-ads.org",
          "kingdom-deals.com",
          "nsoqa.com",
          "pine-sales.com",
          "qaintqa.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://citizenlab.ca/2018/07/nso-spyware-targeting-amnesty-international/",
        "https://twitter.com/AmnestyTech/status/1416810917216538629",
        "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/",
        "https://github.com/AmnestyTech/investigations/blob/master/2021-07-18_nso/domains.txt"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2018-09-21",
      "indicators": {
        "domain": [
          "adjust-local-settings.co",
          "afternicweb.net",
          "remove-subscription.co",
          "track-your-fedex-package.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://citizenlab.ca/2018/07/nso-spyware-targeting-amnesty-international/"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2018-09-21",
      "indicators": {
        "domain": [
          "arabnews365.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://citizenlab.ca/2018/07/nso-spyware-targeting-amnesty-international/",
        "https://www.amnesty.org/en/latest/research/2018/08/amnesty-international-among-targets-of-nso-powered-campaign/",
        "https://twitter.com/AmnestyTech/status/1416810917216538629",
        "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/",
        "https://github.com/AmnestyTech/investigations/blob/master/2021-07-18_nso/domains.txt"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2018-09-21",
      "indicators": {
        "domain": [
          "smsmensaje.mx"
        ]
      },
      "precision": "exact",
      "references": [
        "https://citizenlab.ca/2017/08/nso-spyware-mexico-corruption/",
        "https://twitter.com/AmnestyTech/status/1416810917216538629",
        "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/",
        "https://github.com/AmnestyTech/investigations/blob/master/2021-07-18_nso/domains.txt"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2018-09-20",
      "indicators": {
        "domain": [
          "14-tracking.com",
          "nomorewarnow.com",
          "nouveau-president.com",
          "politicalpress.org",
          "politiques-infos.info",
          "shia-voice.com",
          "signpetition.co",
          "social-life.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://citizenlab.ca/2018/09/hide-and-seek-tracking-nso-groups-pegasus-spyware-to-operations-in-45-countries/",
        "https://twitter.com/AmnestyTech/status/1416810917216538629",
        "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/",
        "https://github.com/AmnestyTech/investigations/blob/master/2021-07-18_nso/domains.txt"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2018-09-20",
      "indicators": {
        "domain": [
          "animal-politico.com",
          "noticiaspoliticos.com",
          "politicoportales.org",
          "un0noticias.com",
          "un0noticias.net",
          "universopolitico.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://citizenlab.ca/2018/09/hide-and-seek-tracking-nso-groups-pegasus-spyware-to-operations-in-45-countries/"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2018-09-20",
      "indicators": {
        "domain": [
          "revolution-news.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://citizenlab.ca/2018/09/hide-and-seek-tracking-nso-groups-pegasus-spyware-to-operations-in-45-countries/",
        "https://www.amnesty.org/en/latest/research/2019/10/morocco-human-rights-defenders-targeted-with-nso-groups-spyware/",
        "https://otx.alienvault.com/pulse/5d9f05596b5109e891f42a24",
        "https://twitter.com/AmnestyTech/status/1416810917216538629",
        "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/",
        "https://github.com/AmnestyTech/investigations/blob/master/2021-07-18_nso/domains.txt"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2018-09-20",
      "indicators": {
        "domain": [
          "akhbar-arabia.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://citizenlab.ca/2018/09/hide-and-seek-tracking-nso-groups-pegasus-spyware-to-operations-in-45-countries/",
        "https://www.amnesty.org/en/latest/research/2018/08/amnesty-international-among-targets-of-nso-powered-campaign/",
        "https://twitter.com/AmnestyTech/status/1416810917216538629",
        "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/",
        "https://github.com/AmnestyTech/investigations/blob/master/2021-07-18_nso/domains.txt"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 13
      },
      "first_seen": "2018-07-05",
      "indicators": {
        "domain": [
          "aalaan.tv",
          "alawaeltech.com",
          "asrararabiya.co",
          "asrararablya.com",
          "asrarrarabiya.com",
          "bahrainsms.co",
          "damanhealth.online",
          "icloudcacher.com",
          "manoraonline.net",
          "ooredoodeals.com",
          "smser.net",
          "turkeynewsupdates.com",
          "uaenews.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.proofpoint.com/us/daily-ruleset-update-summary-20160825",
        "https://twitter.com/AmnestyTech/status/1416810917216538629",
        "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/",
        "https://github.com/AmnestyTech/investigations/blob/master/2021-07-18_nso/domains.txt"
      ],
      "total": 13
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2018-07-05",
      "indicators": {
        "domain": [
          "sms.webadv.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.proofpoint.com/us/daily-ruleset-update-summary-20160825"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 21
      },
      "first_seen": "2017-04-12",
      "indicators": {
        "domain": [
          "accounts.mx",
          "alljazeera.co",
          "bbc-africa.com",
          "bulbazaur.com",
          "checkinonlinehere.com",
          "cnn-africa.co",
          "emiratesfoundation.net",
          "fb-accounts.com",
          "googleplay-store.com",
          "icrcworld.com",
          "mz-vodacom.info",
          "newtarrifs.net",
          "pickuchu.com",
          "redcrossworld.com",
          "sabafon.info",
          "topcontactco.com",
          "turkishairines.info",
          "univision.click",
          "unonoticias.net",
          "whatsapp-app.com",
          "y0utube.com.mx"
        ]
      },
      "precision": "exact",
      "references": [
        "http://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/",
        "https://www.proofpoint.com/us/daily-ruleset-update-summary-20160825",
        "https://twitter.com/AmnestyTech/status/1416810917216538629",
        "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/",
        "https://github.com/AmnestyTech/investigations/blob/master/2021-07-18_nso/domains.txt"
      ],
      "total": 21
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2017-04-12",
      "indicators": {
        "domain": [
          "adjust-local-settings.com",
          "iusacell-movil.com.mx",
          "track-your-fedex-package.org"
        ]
      },
      "precision": "exact",
      "references": [
        "http://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/",
        "https://twitter.com/AmnestyTech/status/1416810917216538629",
        "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/",
        "https://github.com/AmnestyTech/investigations/blob/master/2021-07-18_nso/domains.txt"
      ],
      "total": 3
    }
  ]
}