{
  "aliases": [
    "RedControle",
    "StickyKeys"
  ],
  "attack_id": null,
  "attack_name": null,
  "attack_url": null,
  "counts": {
    "domain": 201,
    "ipv4": 2
  },
  "first_seen": {
    "domain": {
      "10-sendmail.ru": "2019-11-18",
      "3-sendmail.ru": "2019-11-18",
      "a-nhk.ru": "2019-11-18",
      "agrarnik-ooo.ru": "2019-11-18",
      "agrocentrer-eurohem.ru": "2019-11-18",
      "agroudo.ru": "2019-11-18",
      "amonni.ru": "2019-11-18",
      "audemar-piguet.ru": "2019-11-18",
      "autch-mail.ru": "2019-11-18",
      "azot-n.ru": "2019-11-18",
      "azot-sds.ru": "2019-11-18",
      "azotsds.ru": "2019-11-18",
      "azs-gazpromneft.ru": "2019-11-18",
      "balecsm.ru": "2019-11-18",
      "barsintez.ru": "2019-11-18",
      "bashneft-centralasia.ru": "2019-11-18",
      "bashneft.su": "2019-11-18",
      "berkovetc.ru": "2019-11-18",
      "bitmain.org.ru": "2019-11-18",
      "bitum-gazpromneft.ru": "2019-11-18",
      "bitum-rosneft.ru": "2019-11-18",
      "bitum-samara.ru": "2019-11-18",
      "bitumnpk.ru": "2019-11-18",
      "bor-silicat.ru": "2019-11-18",
      "box5.photosfromcessna.com": "2019-11-18",
      "bulgarsyntezi.ru": "2019-11-18",
      "bunker-rosneft.ru": "2019-11-18",
      "card-rn.ru": "2019-11-18",
      "center-nic.ru": "2019-11-18",
      "chem-torg.ru": "2019-11-18",
      "chemcourier.ru": "2019-11-18",
      "chickenpaws.ru": "2019-11-18",
      "china-technika.ru": "2019-11-18",
      "combisapsan.ru": "2019-11-18",
      "contacts.rosneft-opt.su": "2019-11-18",
      "cryptoman.org.ru": "2019-11-18",
      "dc-02ec0b5f-mail.mail-autch.ru": "2019-11-18",
      "dc-0649e3d7-mail.mp-star.ru": "2019-11-18",
      "dc-45e81045-mail.cibur.ru": "2019-11-18",
      "dc-99de0f72f24b.3-sendmail.ru": "2019-11-18",
      "dv-china.ru": "2019-11-18",
      "electronrg.ru": "2019-11-18",
      "euro-bitum.ru": "2019-11-18",
      "euro-chimgroup.ru": "2019-11-18",
      "eurochem-nevinnomissk.ru": "2019-11-18",
      "eurochem-novomoskovsk.ru": "2019-11-18",
      "eurochem-orel.ru": "2019-11-18",
      "eurochem-trading.com": "2019-11-18",
      "eurochem-trading.ru": "2019-11-18",
      "eurochemnovomoskovsk.ru": "2019-11-18",
      "eurohem-novomokcovsk.ru": "2019-11-18",
      "eurohem.ru": "2019-11-18",
      "eurohemgroup.ru": "2019-11-18",
      "exp.gazpromlpj.ru": "2019-11-18",
      "expert-cabel.ru": "2019-11-18",
      "farr-post.ru": "2019-11-18",
      "fesagro.ru": "2019-11-18",
      "flatglas.ru": "2019-11-18",
      "frigat-m.ru": "2019-11-18",
      "g-pntrade.ru": "2019-11-18",
      "gazprom-bitumen.ru": "2019-11-18",
      "gazprom-centralasia.ru": "2019-11-18",
      "gazprom-international.su": "2019-11-18",
      "gazpromlpg.com": "2019-11-18",
      "gazpromlpj.ru": "2019-11-18",
      "gazpromlpq.ru": "2019-11-18",
      "gazpromneft-aero.ru": "2019-11-18",
      "gispnd.ru": "2019-11-18",
      "gpn-salavat.ru": "2019-11-18",
      "hcsds-azot.ru": "2019-11-18",
      "imap.mrggazprom.ru": "2019-11-18",
      "inter-finans.ru": "2019-11-18",
      "inter-lens.ru": "2019-11-18",
      "john-dir.ru": "2019-11-18",
      "kartll.ru": "2019-11-18",
      "kolomna-profil.ru": "2019-11-18",
      "kub-oil.ru": "2019-11-18",
      "kuban-phosagro.ru": "2019-11-18",
      "kubeliai.lt": "2019-11-18",
      "kubmaslozavod.ru": "2019-11-18",
      "kyrgyzstan-gazprom.ru": "2019-11-18",
      "lpggazprom.ru": "2019-11-18",
      "lubricants-rn.ru": "2019-11-18",
      "lubricants-rosneft.com": "2019-11-18",
      "lubricants-rosneft.ru": "2019-11-18",
      "mag-numoil.ru": "2019-11-18",
      "mail-autch.ru": "2019-11-18",
      "map.ros-razvitie.ru": "2019-11-18",
      "margcom.ru": "2019-11-18",
      "masterhoste.ru": "2019-11-18",
      "mazutibitum.ru": "2019-11-18",
      "mc-gp.ru": "2019-11-18",
      "mekstekla.ru": "2019-11-18",
      "mendeleevscazot.ru": "2019-11-18",
      "mendeleevsk-azot.ru": "2019-11-18",
      "metalloprakat.ru": "2019-11-18",
      "mp-star.ru": "2019-11-18",
      "mpt-o.ru": "2019-11-18",
      "mrg-gazprom.ru": "2019-11-18",
      "mrggazprom.ru": "2019-11-18",
      "mta5.boommail.org": "2019-11-18",
      "nic-center.ru": "2019-11-18",
      "nknpz.rosneft-opt.su": "2019-11-18",
      "nl-mk.ru": "2019-11-18",
      "oil-gazpromneft.ru": "2019-11-18",
      "omega-metal.ru": "2019-11-18",
      "onlinecontract.su": "2019-11-18",
      "ooo-agrarnik.com": "2019-11-18",
      "ooo-tandem.net": "2019-11-18",
      "phaz.ru": "2019-11-18",
      "polietileni.ru": "2019-11-18",
      "poligal-vostok.ru": "2019-11-18",
      "polimer-trubi.ru": "2019-11-18",
      "pop.gazprom-centralasia.ru": "2019-11-18",
      "pop.rnp-rosneft.ru": "2019-11-18",
      "pop.ros-razvitie.ru": "2019-11-18",
      "postaitaliana.win": "2019-11-18",
      "prof-nastillist.ru": "2019-11-18",
      "prof-zavod.ru": "2019-11-18",
      "profzavod.net": "2019-11-18",
      "promximiya.ru": "2019-11-18",
      "prosintezi.ru": "2019-11-18",
      "pushkinomill.ru": "2019-11-18",
      "refas.rnp-rosneft.ru": "2019-11-18",
      "refinery-yaroslavl.ru": "2019-11-18",
      "refinery-yaroslavl.su": "2019-11-18",
      "rn-cpr.ru": "2019-11-18",
      "rn-lubricants.ru": "2019-11-18",
      "rnp-rosneft.ru": "2019-11-18",
      "roamingupdate.eu": "2019-11-18",
      "ros-eurochem.ru": "2019-11-18",
      "ros-nefti.ru": "2019-11-18",
      "ros-razvitie.ru": "2019-11-18",
      "rosagrotrayd.ru": "2019-11-18",
      "rosneft-de.com": "2019-11-18",
      "rosneft-opt.su": "2019-11-18",
      "rosneft-tender.su": "2019-11-18",
      "rosneft-tuapse.ru": "2019-11-18",
      "rospolimery.ru": "2019-11-18",
      "rost-selmash.ru": "2019-11-18",
      "rps.ru.com": "2019-11-18",
      "ru-uralhim.ru": "2019-11-18",
      "ruproflist.ru": "2019-11-18",
      "rus-agrohim.ru": "2019-11-18",
      "rusagro-him.ru": "2019-11-18",
      "rusagrohim.com": "2019-11-18",
      "saharzol.com": "2019-11-18",
      "sal-stek.ru": "2019-11-18",
      "salavstek.ru": "2019-11-18",
      "salstec.ru": "2019-11-18",
      "sarat-steklo.ru": "2019-11-18",
      "saratovstroisteklo.ru": "2019-11-18",
      "saratovstroy-steklo.ru": "2019-11-18",
      "siburint.ru": "2019-11-18",
      "simf-khp.ru": "2019-11-18",
      "smtp.gazpromlpj.ru": "2019-11-18",
      "spectech-china.ru": "2019-11-18",
      "spi-mex.ru": "2019-11-18",
      "steklo-stroj.ru": "2019-11-18",
      "successex.ru": "2019-11-18",
      "successex24.ru": "2019-11-18",
      "sx.perfecttool.net": "2019-11-18",
      "sxe-csgo.net": "2019-11-18",
      "ta-bitum.ru": "2019-11-18",
      "teh-mail.ru": "2019-11-18",
      "tektorg-rosneft.ru": "2019-11-18",
      "tender-rosneft.com": "2019-11-18",
      "tender-rosneft.net": "2019-11-18",
      "tender-rosneft.ru": "2019-11-18",
      "tender-rosneft.su": "2019-11-18",
      "tender.ros-nefti.ru": "2019-11-18",
      "titanomsk.ru": "2019-11-18",
      "tmez.ru": "2019-11-18",
      "tolyatiazot.ru": "2019-11-18",
      "transneft.su": "2019-11-18",
      "trstorg.ru": "2019-11-18",
      "tsenazabora.ru": "2019-11-18",
      "tuapse-rosneft.ru": "2019-11-18",
      "ufaneftehim.bashneft.su": "2019-11-18",
      "ufaorgsintez.bashneft.su": "2019-11-18",
      "ural-met.su": "2019-11-18",
      "uralchem.net.ru": "2019-11-18",
      "uralchemm.ru": "2019-11-18",
      "uralhem.ru": "2019-11-18",
      "vitohim-rostov.ru": "2019-11-18",
      "vmznasos.ru": "2019-11-18",
      "vmzz.ru": "2019-11-18",
      "vojxua.iheys.in": "2019-11-18",
      "vostok-polygal.ru": "2019-11-18",
      "wapmafija.eu": "2019-11-18",
      "world-provodnik.ru": "2019-11-18",
      "wtpc.ru": "2019-11-18",
      "xn----7sbiki4aifik1ax.xn--p1ai": "2019-11-18",
      "xn----8sbyfdnfhp0c.xn--p1ai": "2019-11-18",
      "xn----gtbcbb8bdhqbmdl1a.xn--p1ai": "2019-11-18",
      "xn----gtbcbb8bdhqbmdl1a5j.xn--p1ai": "2019-11-18",
      "xn--80aaoboarccvfll0ah5mza.xn--p1ai": "2019-11-18",
      "xn--e1apchgin.xn--p1ai": "2019-11-18",
      "xn--j1aicfcj5e.xn--e1apchgin.xn--p1ai": "2019-11-18",
      "yandex.mail-autch.ru": "2019-11-18",
      "yug-polimer.ru": "2019-11-18"
    },
    "ipv4": {
      "83.166.242.15:17425": "2019-11-18",
      "91.211.245.246:80": "2019-11-18"
    }
  },
  "first_seen_precision": {
    "domain": {},
    "ipv4": {}
  },
  "first_seen_range": {
    "earliest": "2019-11-18",
    "latest": "2019-11-18"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "10-sendmail.ru",
      "3-sendmail.ru",
      "a-nhk.ru",
      "agrarnik-ooo.ru",
      "agrocentrer-eurohem.ru",
      "agroudo.ru",
      "amonni.ru",
      "audemar-piguet.ru",
      "autch-mail.ru",
      "azot-n.ru",
      "azot-sds.ru",
      "azotsds.ru",
      "azs-gazpromneft.ru",
      "balecsm.ru",
      "barsintez.ru",
      "bashneft-centralasia.ru",
      "bashneft.su",
      "berkovetc.ru",
      "bitmain.org.ru",
      "bitum-gazpromneft.ru",
      "bitum-rosneft.ru",
      "bitum-samara.ru",
      "bitumnpk.ru",
      "bor-silicat.ru",
      "box5.photosfromcessna.com",
      "bulgarsyntezi.ru",
      "bunker-rosneft.ru",
      "card-rn.ru",
      "center-nic.ru",
      "chem-torg.ru",
      "chemcourier.ru",
      "chickenpaws.ru",
      "china-technika.ru",
      "combisapsan.ru",
      "contacts.rosneft-opt.su",
      "cryptoman.org.ru",
      "dc-02ec0b5f-mail.mail-autch.ru",
      "dc-0649e3d7-mail.mp-star.ru",
      "dc-45e81045-mail.cibur.ru",
      "dc-99de0f72f24b.3-sendmail.ru",
      "dv-china.ru",
      "electronrg.ru",
      "euro-bitum.ru",
      "euro-chimgroup.ru",
      "eurochem-nevinnomissk.ru",
      "eurochem-novomoskovsk.ru",
      "eurochem-orel.ru",
      "eurochem-trading.com",
      "eurochem-trading.ru",
      "eurochemnovomoskovsk.ru",
      "eurohem-novomokcovsk.ru",
      "eurohem.ru",
      "eurohemgroup.ru",
      "exp.gazpromlpj.ru",
      "expert-cabel.ru",
      "farr-post.ru",
      "fesagro.ru",
      "flatglas.ru",
      "frigat-m.ru",
      "g-pntrade.ru",
      "gazprom-bitumen.ru",
      "gazprom-centralasia.ru",
      "gazprom-international.su",
      "gazpromlpg.com",
      "gazpromlpj.ru",
      "gazpromlpq.ru",
      "gazpromneft-aero.ru",
      "gispnd.ru",
      "gpn-salavat.ru",
      "hcsds-azot.ru",
      "imap.mrggazprom.ru",
      "inter-finans.ru",
      "inter-lens.ru",
      "john-dir.ru",
      "kartll.ru",
      "kolomna-profil.ru",
      "kub-oil.ru",
      "kuban-phosagro.ru",
      "kubeliai.lt",
      "kubmaslozavod.ru",
      "kyrgyzstan-gazprom.ru",
      "lpggazprom.ru",
      "lubricants-rn.ru",
      "lubricants-rosneft.com",
      "lubricants-rosneft.ru",
      "mag-numoil.ru",
      "mail-autch.ru",
      "map.ros-razvitie.ru",
      "margcom.ru",
      "masterhoste.ru",
      "mazutibitum.ru",
      "mc-gp.ru",
      "mekstekla.ru",
      "mendeleevscazot.ru",
      "mendeleevsk-azot.ru",
      "metalloprakat.ru",
      "mp-star.ru",
      "mpt-o.ru",
      "mrg-gazprom.ru",
      "mrggazprom.ru",
      "mta5.boommail.org",
      "nic-center.ru",
      "nknpz.rosneft-opt.su",
      "nl-mk.ru",
      "oil-gazpromneft.ru",
      "omega-metal.ru",
      "onlinecontract.su",
      "ooo-agrarnik.com",
      "ooo-tandem.net",
      "phaz.ru",
      "polietileni.ru",
      "poligal-vostok.ru",
      "polimer-trubi.ru",
      "pop.gazprom-centralasia.ru",
      "pop.rnp-rosneft.ru",
      "pop.ros-razvitie.ru",
      "postaitaliana.win",
      "prof-nastillist.ru",
      "prof-zavod.ru",
      "profzavod.net",
      "promximiya.ru",
      "prosintezi.ru",
      "pushkinomill.ru",
      "refas.rnp-rosneft.ru",
      "refinery-yaroslavl.ru",
      "refinery-yaroslavl.su",
      "rn-cpr.ru",
      "rn-lubricants.ru",
      "rnp-rosneft.ru",
      "roamingupdate.eu",
      "ros-eurochem.ru",
      "ros-nefti.ru",
      "ros-razvitie.ru",
      "rosagrotrayd.ru",
      "rosneft-de.com",
      "rosneft-opt.su",
      "rosneft-tender.su",
      "rosneft-tuapse.ru",
      "rospolimery.ru",
      "rost-selmash.ru",
      "rps.ru.com",
      "ru-uralhim.ru",
      "ruproflist.ru",
      "rus-agrohim.ru",
      "rusagro-him.ru",
      "rusagrohim.com",
      "saharzol.com",
      "sal-stek.ru",
      "salavstek.ru",
      "salstec.ru",
      "sarat-steklo.ru",
      "saratovstroisteklo.ru",
      "saratovstroy-steklo.ru",
      "siburint.ru",
      "simf-khp.ru",
      "smtp.gazpromlpj.ru",
      "spectech-china.ru",
      "spi-mex.ru",
      "steklo-stroj.ru",
      "successex.ru",
      "successex24.ru",
      "sx.perfecttool.net",
      "sxe-csgo.net",
      "ta-bitum.ru",
      "teh-mail.ru",
      "tektorg-rosneft.ru",
      "tender-rosneft.com",
      "tender-rosneft.net",
      "tender-rosneft.ru",
      "tender-rosneft.su",
      "tender.ros-nefti.ru",
      "titanomsk.ru",
      "tmez.ru",
      "tolyatiazot.ru",
      "transneft.su",
      "trstorg.ru",
      "tsenazabora.ru",
      "tuapse-rosneft.ru",
      "ufaneftehim.bashneft.su",
      "ufaorgsintez.bashneft.su",
      "ural-met.su",
      "uralchem.net.ru",
      "uralchemm.ru",
      "uralhem.ru",
      "vitohim-rostov.ru",
      "vmznasos.ru",
      "vmzz.ru",
      "vojxua.iheys.in",
      "vostok-polygal.ru",
      "wapmafija.eu",
      "world-provodnik.ru",
      "wtpc.ru",
      "xn----7sbiki4aifik1ax.xn--p1ai",
      "xn----8sbyfdnfhp0c.xn--p1ai",
      "xn----gtbcbb8bdhqbmdl1a.xn--p1ai",
      "xn----gtbcbb8bdhqbmdl1a5j.xn--p1ai",
      "xn--80aaoboarccvfll0ah5mza.xn--p1ai",
      "xn--e1apchgin.xn--p1ai",
      "xn--j1aicfcj5e.xn--e1apchgin.xn--p1ai",
      "yandex.mail-autch.ru",
      "yug-polimer.ru"
    ],
    "ipv4": [
      "83.166.242.15:17425",
      "91.211.245.246:80"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "POKINGTHEBEAR"
  ],
  "references": [
    "https://threatvector.cylance.com/en_us/home/poking-the-bear-three-year-campaign-targets-russian-critical-infrastructure.html"
  ],
  "related": [],
  "slug": "POKINGTHEBEAR",
  "timeline": [
    {
      "counts": {
        "domain": 201,
        "ipv4": 2
      },
      "first_seen": "2019-11-18",
      "indicators": {
        "domain": [
          "10-sendmail.ru",
          "3-sendmail.ru",
          "a-nhk.ru",
          "agrarnik-ooo.ru",
          "agrocentrer-eurohem.ru",
          "agroudo.ru",
          "amonni.ru",
          "audemar-piguet.ru",
          "autch-mail.ru",
          "azot-n.ru",
          "azot-sds.ru",
          "azotsds.ru",
          "azs-gazpromneft.ru",
          "balecsm.ru",
          "barsintez.ru",
          "bashneft-centralasia.ru",
          "bashneft.su",
          "berkovetc.ru",
          "bitmain.org.ru",
          "bitum-gazpromneft.ru",
          "bitum-rosneft.ru",
          "bitum-samara.ru",
          "bitumnpk.ru",
          "bor-silicat.ru",
          "box5.photosfromcessna.com",
          "bulgarsyntezi.ru",
          "bunker-rosneft.ru",
          "card-rn.ru",
          "center-nic.ru",
          "chem-torg.ru",
          "chemcourier.ru",
          "chickenpaws.ru",
          "china-technika.ru",
          "combisapsan.ru",
          "contacts.rosneft-opt.su",
          "cryptoman.org.ru",
          "dc-02ec0b5f-mail.mail-autch.ru",
          "dc-0649e3d7-mail.mp-star.ru",
          "dc-45e81045-mail.cibur.ru",
          "dc-99de0f72f24b.3-sendmail.ru",
          "dv-china.ru",
          "electronrg.ru",
          "euro-bitum.ru",
          "euro-chimgroup.ru",
          "eurochem-nevinnomissk.ru",
          "eurochem-novomoskovsk.ru",
          "eurochem-orel.ru",
          "eurochem-trading.com",
          "eurochem-trading.ru",
          "eurochemnovomoskovsk.ru",
          "eurohem-novomokcovsk.ru",
          "eurohem.ru",
          "eurohemgroup.ru",
          "exp.gazpromlpj.ru",
          "expert-cabel.ru",
          "farr-post.ru",
          "fesagro.ru",
          "flatglas.ru",
          "frigat-m.ru",
          "g-pntrade.ru",
          "gazprom-bitumen.ru",
          "gazprom-centralasia.ru",
          "gazprom-international.su",
          "gazpromlpg.com",
          "gazpromlpj.ru",
          "gazpromlpq.ru",
          "gazpromneft-aero.ru",
          "gispnd.ru",
          "gpn-salavat.ru",
          "hcsds-azot.ru",
          "imap.mrggazprom.ru",
          "inter-finans.ru",
          "inter-lens.ru",
          "john-dir.ru",
          "kartll.ru",
          "kolomna-profil.ru",
          "kub-oil.ru",
          "kuban-phosagro.ru",
          "kubeliai.lt",
          "kubmaslozavod.ru",
          "kyrgyzstan-gazprom.ru",
          "lpggazprom.ru",
          "lubricants-rn.ru",
          "lubricants-rosneft.com",
          "lubricants-rosneft.ru",
          "mag-numoil.ru",
          "mail-autch.ru",
          "map.ros-razvitie.ru",
          "margcom.ru",
          "masterhoste.ru",
          "mazutibitum.ru",
          "mc-gp.ru",
          "mekstekla.ru",
          "mendeleevscazot.ru",
          "mendeleevsk-azot.ru",
          "metalloprakat.ru",
          "mp-star.ru",
          "mpt-o.ru",
          "mrg-gazprom.ru",
          "mrggazprom.ru",
          "mta5.boommail.org",
          "nic-center.ru",
          "nknpz.rosneft-opt.su",
          "nl-mk.ru",
          "oil-gazpromneft.ru",
          "omega-metal.ru",
          "onlinecontract.su",
          "ooo-agrarnik.com",
          "ooo-tandem.net",
          "phaz.ru",
          "polietileni.ru",
          "poligal-vostok.ru",
          "polimer-trubi.ru",
          "pop.gazprom-centralasia.ru",
          "pop.rnp-rosneft.ru",
          "pop.ros-razvitie.ru",
          "postaitaliana.win",
          "prof-nastillist.ru",
          "prof-zavod.ru",
          "profzavod.net",
          "promximiya.ru",
          "prosintezi.ru",
          "pushkinomill.ru",
          "refas.rnp-rosneft.ru",
          "refinery-yaroslavl.ru",
          "refinery-yaroslavl.su",
          "rn-cpr.ru",
          "rn-lubricants.ru",
          "rnp-rosneft.ru",
          "roamingupdate.eu",
          "ros-eurochem.ru",
          "ros-nefti.ru",
          "ros-razvitie.ru",
          "rosagrotrayd.ru",
          "rosneft-de.com",
          "rosneft-opt.su",
          "rosneft-tender.su",
          "rosneft-tuapse.ru",
          "rospolimery.ru",
          "rost-selmash.ru",
          "rps.ru.com",
          "ru-uralhim.ru",
          "ruproflist.ru",
          "rus-agrohim.ru",
          "rusagro-him.ru",
          "rusagrohim.com",
          "saharzol.com",
          "sal-stek.ru",
          "salavstek.ru",
          "salstec.ru",
          "sarat-steklo.ru",
          "saratovstroisteklo.ru",
          "saratovstroy-steklo.ru",
          "siburint.ru",
          "simf-khp.ru",
          "smtp.gazpromlpj.ru",
          "spectech-china.ru",
          "spi-mex.ru",
          "steklo-stroj.ru",
          "successex.ru",
          "successex24.ru",
          "sx.perfecttool.net",
          "sxe-csgo.net",
          "ta-bitum.ru",
          "teh-mail.ru",
          "tektorg-rosneft.ru",
          "tender-rosneft.com",
          "tender-rosneft.net",
          "tender-rosneft.ru",
          "tender-rosneft.su",
          "tender.ros-nefti.ru",
          "titanomsk.ru",
          "tmez.ru",
          "tolyatiazot.ru",
          "transneft.su",
          "trstorg.ru",
          "tsenazabora.ru",
          "tuapse-rosneft.ru",
          "ufaneftehim.bashneft.su",
          "ufaorgsintez.bashneft.su",
          "ural-met.su",
          "uralchem.net.ru",
          "uralchemm.ru",
          "uralhem.ru",
          "vitohim-rostov.ru",
          "vmznasos.ru",
          "vmzz.ru",
          "vojxua.iheys.in",
          "vostok-polygal.ru",
          "wapmafija.eu",
          "world-provodnik.ru",
          "wtpc.ru",
          "xn----7sbiki4aifik1ax.xn--p1ai",
          "xn----8sbyfdnfhp0c.xn--p1ai",
          "xn----gtbcbb8bdhqbmdl1a.xn--p1ai",
          "xn----gtbcbb8bdhqbmdl1a5j.xn--p1ai",
          "xn--80aaoboarccvfll0ah5mza.xn--p1ai",
          "xn--e1apchgin.xn--p1ai",
          "xn--j1aicfcj5e.xn--e1apchgin.xn--p1ai",
          "yandex.mail-autch.ru",
          "yug-polimer.ru"
        ],
        "ipv4": [
          "83.166.242.15:17425",
          "91.211.245.246:80"
        ]
      },
      "precision": "exact",
      "references": [
        "https://threatvector.cylance.com/en_us/home/poking-the-bear-three-year-campaign-targets-russian-critical-infrastructure.html"
      ],
      "total": 203
    }
  ]
}