{
  "aliases": [
    "smokedham"
  ],
  "attack_id": null,
  "attack_name": null,
  "attack_url": null,
  "counts": {
    "domain": 2030
  },
  "first_seen": {
    "domain": {
      "08f0.proxy-edge-c5f.workers.dev": "2026-06-07",
      "10bet.space": "2026-07-21",
      "12.workbencn.com": "2026-05-21",
      "178.159.43.206.sslip.io": "2026-06-07",
      "1r.rvtoolsed.com": "2026-05-22",
      "1s.rvtoolsai.com": "2026-05-16",
      "1v.rvtoollsa.com": "2026-05-14",
      "1v.rvtootsad.com": "2026-05-18",
      "1yeralti.com": "2026-05-15",
      "20.rvtoolsaq.com": "2026-05-15",
      "20.rvtoolse.info": "2026-05-16",
      "20.rvtoolsme.com": "2026-05-23",
      "21.rvtoolsen.com": "2026-05-18",
      "22.rvtoolsik.com": "2026-05-14",
      "24.rvtoolis.info": "2026-05-16",
      "24.rvtoolsgo.com": "2026-05-23",
      "27.rvtoolsax.com": "2026-05-14",
      "2a.rvtoolso.info": "2026-05-18",
      "2b.rvtoolsit.com": "2026-05-21",
      "2j.rvtoolsup.com": "2026-05-18",
      "2w.s3abrowser.com": "2026-05-19",
      "3g.s3brovvser.com": "2026-05-15",
      "3p.workbenche.com": "2026-05-15",
      "40.workbencse.com": "2026-05-20",
      "45perhour.org": "2026-05-02",
      "4l.rvtoolslab.com": "2026-05-20",
      "4t.rvtoolsacs.com": "2026-05-18",
      "54.rvtoolsone.com": "2026-05-18",
      "58.rvtoolsmax.com": "2026-05-18",
      "5b.rvtoolsbox.com": "2026-05-16",
      "5n.rvtoolsrun.com": "2026-05-23",
      "7stories.sbs": "2026-05-02",
      "91movs.com": "2026-05-02",
      "9xstream.live": "2026-05-02",
      "aapanel116864.hostkey.in": "2026-04-15",
      "aapanel34768.hostkey.in": "2026-05-02",
      "abstractest-hydroski.site": "2026-05-02",
      "academytradeai.com": "2026-05-02",
      "accessbs.us": "2026-08-06",
      "accoumtsclienntsarea.us": "2026-07-22",
      "acquasicuras.com": "2026-05-02",
      "actbluecs.com": "2026-05-02",
      "actblues.net": "2026-05-03",
      "adionetjrei.shop": "2026-05-02",
      "admin.rvtoolacs.online": "2026-04-15",
      "adrilex.digital": "2026-05-03",
      "advipscan.com": "2026-08-07",
      "aexnp.com": "2026-05-02",
      "afd-esign.info": "2026-05-21",
      "afeherbopenuk.com": "2026-05-02",
      "afmo.it": "2026-07-28",
      "agora-mesmo.com": "2026-05-19",
      "agronomywork.info": "2026-05-02",
      "aiadvancedreasoning.com": "2026-05-02",
      "aiagentanalytics.com": "2026-07-21",
      "aiagentledger.com": "2026-06-17",
      "aialgocamp.com": "2026-05-02",
      "aialgocore.com": "2026-05-02",
      "aialgodrive.com": "2026-05-02",
      "aialgoflow.com": "2026-05-02",
      "aialgofusion.com": "2026-05-02",
      "aialgohash.com": "2026-05-02",
      "aialgorithmforge.com": "2026-05-02",
      "aialgorithmicforge.com": "2026-05-02",
      "aialgorithmicpath.com": "2026-05-02",
      "aialgosense.com": "2026-05-02",
      "aialgosphere.com": "2026-05-02",
      "aianalyticengine.com": "2026-05-02",
      "aianalyticmesh.com": "2026-05-02",
      "aiautomationframework.com": "2026-05-02",
      "aiautonomycore.com": "2026-05-02",
      "aibigdatamap.com": "2026-05-02",
      "aibotscale.com": "2026-05-02",
      "aibrainatelier.com": "2026-05-02",
      "aibrainframe.com": "2026-05-02",
      "aibrainlogicc.com": "2026-05-02",
      "aibrainmatrixed.com": "2026-05-02",
      "aibrainyard.com": "2026-05-02",
      "aibuildersguild.com": "2026-05-02",
      "aibuildnet.com": "2026-05-02",
      "aibuildspark.com": "2026-05-02",
      "aibytepad.com": "2026-05-02",
      "aicalcengine.com": "2026-05-02",
      "aichatbeam.com": "2026-05-02",
      "aichatfuse.com": "2026-05-02",
      "aichattask.com": "2026-05-02",
      "aichippad.com": "2026-05-02",
      "aicloudcamp.com": "2026-05-02",
      "aicloudlayer.com": "2026-05-02",
      "aicloudreactor.com": "2026-05-02",
      "aicloudthread.com": "2026-05-02",
      "aicodealpha.com": "2026-05-02",
      "aicodebeam.com": "2026-05-02",
      "aicodebrain.com": "2026-05-02",
      "aicodefoundry.com": "2026-05-02",
      "aicodeport.com": "2026-05-02",
      "aicognexora.com": "2026-05-02",
      "aicognistack.com": "2026-05-02",
      "aicognitiongrid.com": "2026-05-02",
      "aicognitiveforge.com": "2026-05-02",
      "aicognitiveframework.com": "2026-05-02",
      "aicognivaults.com": "2026-05-02",
      "aicomputedgrid.com": "2026-05-02",
      "aiconsciousgrid.com": "2026-05-02",
      "aicontentarc.com": "2026-05-02",
      "aicoremodels.com": "2026-05-02",
      "aicortexlayer.com": "2026-05-02",
      "aicortexnexus.com": "2026-05-02",
      "aicyberbyte.com": "2026-05-02",
      "aicybercraft.com": "2026-05-02",
      "aicyberimatrix.com": "2026-05-02",
      "aicybernode.com": "2026-05-02",
      "aicyberpath.com": "2026-05-02",
      "aicyberscale.com": "2026-05-02",
      "aidadynamics.com": "2026-05-02",
      "aidatabay.com": "2026-05-02",
      "aidataclustering.com": "2026-05-02",
      "aidatafathom.com": "2026-05-02",
      "aidataprime.com": "2026-05-02",
      "aidatasflux.com": "2026-05-02",
      "aideepanalytics.com": "2026-05-02",
      "aideepboard.com": "2026-05-02",
      "aideepdeck.com": "2026-05-02",
      "aideepflux.com": "2026-05-03",
      "aideepreasoning.com": "2026-05-02",
      "aideepspark.com": "2026-05-02",
      "aidigitalmesh.com": "2026-05-02",
      "aiepochepixels.com": "2026-05-09",
      "aievolvelogic.com": "2026-05-02",
      "aifuturewave.com": "2026-05-02",
      "aigainforge.com": "2026-05-02",
      "aigenorbit.com": "2026-05-02",
      "aigripe.com": "2026-05-02",
      "aihyperepoch.com": "2026-05-12",
      "aihyperpulse.com": "2026-05-02",
      "aiimageflux.com": "2026-05-02",
      "aiimagelayer.com": "2026-05-04",
      "aiinsighttgrid.com": "2026-05-02",
      "aiintellifuse.com": "2026-05-02",
      "ailabsync.com": "2026-05-02",
      "ailayergrid.com": "2026-05-02",
      "ailearnstack.com": "2026-05-02",
      "ailogiccanvas.com": "2026-05-02",
      "ailogicfetch.com": "2026-05-08",
      "ailogicframe.com": "2026-05-02",
      "ailogicmatrix.com": "2026-05-02",
      "ailogicmesh.com": "2026-05-02",
      "ailogicnest.com": "2026-05-02",
      "ailogicpod.com": "2026-05-02",
      "ailogicscale.com": "2026-05-02",
      "ailogicvault.com": "2026-05-02",
      "aimatrixbeam.com": "2026-05-02",
      "aimatrixcast.com": "2026-05-02",
      "aimatrixcore.com": "2026-05-02",
      "aimediabox.com": "2026-05-02",
      "aimediapath.com": "2026-05-02",
      "aimetanode.com": "2026-05-02",
      "aimindbuilders.com": "2026-05-02",
      "aiminddock.com": "2026-05-02",
      "aimindgenesis.com": "2026-05-02",
      "aimodeldrift.com": "2026-05-02",
      "aimodelrun.com": "2026-05-02",
      "aimodelworks.com": "2026-05-02",
      "aineuralcascade.com": "2026-05-02",
      "aineuralfabric.com": "2026-05-02",
      "aineuralforge.com": "2026-05-02",
      "aineuralinference.com": "2026-05-02",
      "aineuralline.com": "2026-05-02",
      "aineurallnet.com": "2026-05-02",
      "aineuralnex.com": "2026-05-02",
      "aineuralpath.com": "2026-05-02",
      "aineuralpulse.com": "2026-05-02",
      "aineuralquery.com": "2026-05-02",
      "aineuralscribe.com": "2026-05-02",
      "aineurodeck.com": "2026-05-02",
      "aineurofluxion.com": "2026-05-02",
      "aineurogenesis.com": "2026-05-02",
      "aineuroloop.com": "2026-05-02",
      "aineuronspark.com": "2026-05-02",
      "ainewlevelwealth.com": "2026-05-06",
      "ainexorasystem.com": "2026-05-02",
      "ainexusgear.com": "2026-05-02",
      "ainexuspoint.com": "2026-05-02",
      "ainexussync.com": "2026-05-02",
      "aio-streamer.live": "2026-05-02",
      "aio18app.live": "2026-05-02",
      "aioptimizecore.com": "2026-05-02",
      "aiparadigmmodel.com": "2026-05-02",
      "aipathstoday.com": "2026-06-20",
      "aipatternscan.com": "2026-05-02",
      "aipixelepoch.com": "2026-05-02",
      "aipixelflow.com": "2026-05-02",
      "aipredictai.com": "2026-05-02",
      "aipredictivecode.com": "2026-05-02",
      "aipredictivecore.com": "2026-05-02",
      "aipredictivesystem.com": "2026-05-02",
      "aiprocessnexus.com": "2026-05-02",
      "aiprocessvault.com": "2026-05-02",
      "aiprompttask.com": "2026-05-02",
      "aiprotocolmesh.com": "2026-05-02",
      "aiqantumsynapse.com": "2026-05-02",
      "aiquantaforge.com": "2026-05-02",
      "aiquantumlogic.com": "2026-05-02",
      "aiquantumorbit.com": "2026-05-02",
      "aiquantumrelay.com": "2026-05-02",
      "aiquantumweave.com": "2026-05-02",
      "airastbercore.com": "2026-05-07",
      "airoboticsdata.com": "2026-05-02",
      "airoboticslogic.com": "2026-05-02",
      "airobotmind.com": "2026-05-02",
      "airsoftware.asia": "2026-05-02",
      "aisecureframework.com": "2026-05-02",
      "aisecureprocessing.com": "2026-05-02",
      "aisemanticnexus.com": "2026-05-02",
      "aisensedock.com": "2026-05-02",
      "aisentientgrid.com": "2026-05-02",
      "aisignalengine.com": "2026-05-02",
      "aismartccore.com": "2026-05-02",
      "aismartchassis.com": "2026-05-02",
      "aismartcortex.com": "2026-05-02",
      "aismartdirectionflow.com": "2026-05-02",
      "aismartfabric.com": "2026-05-02",
      "aismartlogic.com": "2026-05-02",
      "aismartmark.com": "2026-05-02",
      "aismartmindsystem.com": "2026-05-02",
      "aismartplatforms.com": "2026-05-02",
      "aismartpod.com": "2026-05-02",
      "aisolutioncore.com": "2026-05-02",
      "aisolvenet.com": "2026-05-02",
      "aispeechroute.com": "2026-05-06",
      "aisvectorflowen.com": "2026-05-02",
      "aisynapseboost.com": "2026-05-02",
      "aisynapseecho.com": "2026-05-02",
      "aisynapseedge.com": "2026-05-02",
      "aisynapselab.com": "2026-05-02",
      "aisynapsematrix.com": "2026-05-02",
      "aisynapsenet.com": "2026-05-02",
      "aisynapticforge.com": "2026-05-02",
      "aisynthesisno.com": "2026-05-02",
      "aisynthesisnodes.com": "2026-05-02",
      "aisynthevora.com": "2026-05-02",
      "aisysprofileage.com": "2026-05-02",
      "aitechyard.com": "2026-05-02",
      "aitensorcore.com": "2026-05-02",
      "aitensorgrid.com": "2026-05-02",
      "aitensorvault.com": "2026-05-02",
      "aitestcore.com": "2026-05-02",
      "aitextscale.com": "2026-05-02",
      "aivectorflow.com": "2026-05-02",
      "aivectornexis.com": "2026-05-02",
      "aivisioneye.com": "2026-05-02",
      "aivisionhost.com": "2026-05-02",
      "aivisionpoint.com": "2026-05-02",
      "aivoicehash.com": "2026-05-02",
      "aiwealthfirstmain.com": "2026-05-02",
      "akaccessories.com": "2026-06-06",
      "aksecurityandlocksmith.org": "2026-05-02",
      "albertaservice.net": "2026-05-02",
      "albertaservices.org": "2026-05-02",
      "alert-router-b3a.workers.dev": "2026-04-15",
      "alfrog.com": "2026-05-19",
      "allbestselling.com": "2026-05-27",
      "alldocreader.ink": "2026-05-02",
      "alpine-quest.live": "2026-05-02",
      "alterasgroup.it.com": "2026-06-03",
      "amf-capital.it": "2026-07-28",
      "amzslotplay.xyz": "2026-08-07",
      "analizainvestitii-ro.com": "2026-07-21",
      "ancora-shop.com": "2026-05-02",
      "angelliost.com": "2026-05-02",
      "angryenterprise.app": "2026-05-14",
      "angryip.cloud": "2026-05-21",
      "angryipa.com": "2026-04-15",
      "angryipac.com": "2026-04-15",
      "angryipac.net": "2026-04-15",
      "angryipsc.com": "2026-04-15",
      "apaalieo.com": "2026-05-02",
      "apaileo.shop": "2026-05-02",
      "apaliieo.com": "2026-05-02",
      "apallieo.com": "2026-05-02",
      "apexorix.com": "2026-05-26",
      "apexvideoproduction.com": "2026-06-06",
      "api-gateway-a3f.workers.dev": "2026-04-15",
      "api.rvtoolacs.online": "2026-06-07",
      "aplicado24tv.stream": "2026-05-02",
      "app-cdn-software-gza4gebuf3cqd8h6.z03.azurefd.net": "2026-05-02",
      "app-cdn.celixi6266.workers.dev": "2026-01-02",
      "app-grand-win.website": "2026-05-02",
      "app-hypeliquid.xyz": "2026-05-02",
      "app-server.comof72509.workers.dev": "2026-06-07",
      "app.alldocreader.ink": "2026-05-02",
      "app.iptv24.live": "2026-05-02",
      "app.mediahubtv.live": "2026-05-02",
      "app.personaltv.live": "2026-05-02",
      "app.pofelal314.workers.dev": "2026-01-02",
      "app.porn-aio.live": "2026-05-02",
      "app.sync-engine-d8b.workers.dev": "2026-04-15",
      "app.tikltok18.live": "2026-05-02",
      "app.tiktko18.live": "2026-05-02",
      "app.tiltok18.live": "2026-05-02",
      "app.tv-aio.live": "2026-05-02",
      "app.watch-aio.live": "2026-05-02",
      "appalleo.com": "2026-05-02",
      "appcraft-academy.com": "2026-05-02",
      "apps-and-grid-play.com": "2026-06-20",
      "aquazdroj.club": "2026-05-02",
      "aquilenthes.info": "2026-05-02",
      "arcfetch.com": "2026-05-21",
      "arcoriumforge.com": "2026-06-19",
      "arcparse.com": "2026-05-15",
      "arcylianquanta.com": "2026-06-02",
      "arcyloriantech.com": "2026-07-29",
      "areacleintsacounts.us": "2026-07-21",
      "areaclienntsaccoumts.us": "2026-07-21",
      "arizonastables.com": "2026-05-15",
      "armada-club-top.website": "2026-05-02",
      "armada-games-app.website": "2026-05-02",
      "armada-grand-win.website": "2026-05-02",
      "artisanskillsacademy.com": "2026-05-02",
      "arvatomedia.com.de": "2026-05-02",
      "arvelionis.com": "2026-05-02",
      "arz-darmstadt.it.com": "2026-07-28",
      "arz-service.it": "2026-07-28",
      "assche.com": "2026-05-02",
      "astem-de.it.com": "2026-05-02",
      "astem.it.com": "2026-07-28",
      "astronexus.pro": "2026-05-02",
      "atlantaitsolutions.com": "2026-05-02",
      "atlasgrous.it.com": "2026-06-19",
      "atlpropertymanagers.com": "2026-05-28",
      "atomlcwallet.us": "2026-05-02",
      "atxauction.com": "2026-05-06",
      "audioassisten.com": "2026-05-02",
      "aureliaromfund.com": "2026-07-21",
      "auroraagencies.com": "2026-05-30",
      "auroragutters.com": "2026-05-05",
      "austinbariatrics.com": "2026-05-28",
      "austinportapotty.com": "2026-06-02",
      "authorlzeacsess.us": "2026-07-21",
      "authorlzesitte.us": "2026-07-21",
      "autnhentcation.us": "2026-07-22",
      "autnhentlcation.us": "2026-07-21",
      "autocarsvehicles.live": "2026-05-02",
      "autoglasguercam.com": "2026-05-02",
      "automotiveblog.club": "2026-05-02",
      "autophorie.blog": "2026-05-02",
      "autovehicles.live": "2026-05-02",
      "avond.it.com": "2026-07-28",
      "axonesubrogation.quest": "2026-05-12",
      "ay.hornetsecuty.com": "2026-05-21",
      "babmbach.com": "2026-07-21",
      "back-europ.it.com": "2026-07-28",
      "baeko.it.com": "2026-07-28",
      "balatonvitalworks.com": "2026-07-21",
      "baltimorepsychic.com": "2026-05-02",
      "bapiyat727.workers.dev": "2026-01-02",
      "baptissa.com": "2026-07-21",
      "bargainlenders.com": "2026-05-27",
      "barnecnoble.com": "2026-05-02",
      "bayareafencecompany.com": "2026-06-15",
      "bayareawaterheater.com": "2026-06-05",
      "bayleaf.icu": "2026-05-02",
      "bayleafkits.top": "2026-05-02",
      "bbi-esign.info": "2026-05-02",
      "beauty-alliance.it.com": "2026-07-28",
      "beehtelar.shop": "2026-05-02",
      "beekeeperstudio-db.com": "2026-02-27",
      "beekeeperstudio.cc": "2026-02-27",
      "beekeeperstudio.co": "2026-02-27",
      "beekeeperstudio.pro": "2026-02-27",
      "beekeeperstudio.softwarep2p.com": "2026-05-02",
      "beekeeperstudio.space": "2026-02-27",
      "beekeeperstudio.tech": "2026-02-27",
      "benavivez.com": "2026-07-30",
      "bennyshvac.com": "2026-05-06",
      "bespokecufflinkjournal.com": "2026-07-21",
      "best-mine-site.website": "2026-05-02",
      "bestcasinoroom.com": "2026-05-02",
      "bestgames-play.com": "2026-06-09",
      "bewidata.it.com": "2026-07-28",
      "bingbong.website": "2026-07-21",
      "blariba.com": "2026-05-02",
      "blazehollow.com": "2026-05-02",
      "blitzblox.com": "2026-05-02",
      "blluewine.com": "2026-05-02",
      "bloodgroupcrib.com": "2026-06-01",
      "blorfizan.cyou": "2026-05-02",
      "blowout-palefaces.website": "2026-05-02",
      "botelcopay.com": "2026-05-02",
      "botelcopay.icu": "2026-05-02",
      "botelcopay.info": "2026-05-02",
      "botelcopay.net": "2026-05-02",
      "botelcopay.online": "2026-05-02",
      "botelcopay.run": "2026-05-02",
      "brandhighland.com": "2026-05-23",
      "braxitrade.info": "2026-05-02",
      "braynebays.com": "2026-05-02",
      "breitenbern.shop": "2026-05-02",
      "breonros.it.com": "2026-06-04",
      "bridgenexis.com": "2026-05-02",
      "bridgetontowing.com": "2026-06-04",
      "brightenforge.com": "2026-05-03",
      "brightflowz.org": "2026-05-02",
      "brightlabsz.com": "2026-05-02",
      "brightlfunds.com": "2026-05-02",
      "brisktangent.com": "2026-06-19",
      "browser-tv.live": "2026-05-02",
      "buchanancapitalpartners.com": "2026-06-19",
      "bucurestivantage.com": "2026-07-21",
      "buletineconomic.com": "2026-07-21",
      "bunbun-fishing.org": "2026-05-02",
      "burnout-pravention.com": "2026-05-02",
      "businessfundwell.com": "2026-07-21",
      "buycanclear.com": "2026-05-02",
      "buyitallnow.com": "2026-06-03",
      "buymolle.com": "2026-05-02",
      "byteforgenova.com": "2026-07-21",
      "bytevaranlabs.com": "2026-06-20",
      "bytonrian.com": "2026-05-25",
      "bytorianforge.com": "2026-06-05",
      "caffedigitale.com": "2026-05-02",
      "calm-haze-cdae.test-runner-4b7.workers.dev": "2026-04-15",
      "calmgroves.com": "2026-05-02",
      "camarillotowing.com": "2026-05-25",
      "cameranextpro.com": "2026-05-05",
      "cantharides-obscene.website": "2026-05-02",
      "capitalrios.com": "2026-06-07",
      "carereroom.pro": "2026-05-02",
      "carlifeyamato.com": "2026-05-02",
      "carnieal.com": "2026-05-02",
      "carpatiareport.com": "2026-07-21",
      "carrierbrokeragreements.us": "2026-05-02",
      "carvalhl.site": "2026-07-21",
      "cashlatvia.com": "2026-06-07",
      "casino-vitoria.ink": "2026-05-02",
      "casinobonusranking.com": "2026-05-02",
      "casnellano.icu": "2026-05-10",
      "casualjuegosportal.net": "2026-05-02",
      "cdn-ae.azureedge.net": "2026-06-07",
      "cdn-app-server.vewojo9572.workers.dev": "2026-01-02",
      "cdn-app-software-3425.tech": "2026-06-07",
      "cdn-app-software-67423.store": "2026-06-07",
      "cdn-app-web.piniyi9484.workers.dev": "2026-01-02",
      "cdn-server-1.xiren77418.workers.dev": "2024-11-25",
      "cdn-server-2.wesoc40288.workers.dev": "2024-11-25",
      "cdn-server-full.taros12579.workers.dev": "2024-11-25",
      "cdn-web-app-10.site": "2026-06-07",
      "cdn-web-app-10.tech": "2026-06-07",
      "cdn-web-server1.techserver01.workers.dev": "2024-11-25",
      "cdn1.cowivat156.workers.dev": "2024-11-25",
      "cdn1.poyag17470.workers.dev": "2024-11-25",
      "cedarspoint.it.com": "2026-06-05",
      "celestes-occasion.website": "2026-05-02",
      "cemteracsess.us": "2026-07-21",
      "cemtercliemt.us": "2026-07-21",
      "cemtersitte.us": "2026-07-21",
      "cemterweb.us": "2026-07-21",
      "centrises.com": "2026-05-02",
      "chain-analys.eu.com": "2026-05-02",
      "chainbork.com": "2026-05-02",
      "chaosbloomcheck.com": "2026-05-02",
      "chargesmartuk.com": "2026-05-02",
      "chatusability.com": "2026-05-02",
      "chatuxlab.com": "2026-05-02",
      "cheapsigscanada.com": "2026-05-02",
      "cheoasanarnnda.com": "2026-07-30",
      "cherniymehmet.com": "2026-05-02",
      "chickensroad.ink": "2026-05-02",
      "chicopeetowing.com": "2026-05-02",
      "chinohillstowing.com": "2026-05-02",
      "chiroaz.com": "2026-06-01",
      "chvent.com": "2026-05-03",
      "cinchona-congruence.site": "2026-05-02",
      "cinematographymastery.com": "2026-05-02",
      "cipheriumforge.com": "2026-05-26",
      "cipheriumlabs.com": "2026-06-16",
      "cipherlix.com": "2026-05-08",
      "cipherquantix.com": "2026-05-27",
      "claysoultrue.pro": "2026-05-02",
      "claytonpestcontrol.com": "2026-06-01",
      "cleintsareaacounts.us": "2026-07-21",
      "clienntsareaaccoumts.us": "2026-07-21",
      "climasubito.com": "2026-05-02",
      "cloudbillers.com": "2026-05-09",
      "cloudsurferway.com": "2026-05-02",
      "cloudwhispercheep.com": "2026-05-02",
      "club-play-grand.website": "2026-05-02",
      "club-vegas-casino.ink": "2026-05-02",
      "cmcmarkets.promo-links.com": "2026-05-02",
      "co-part-offset.live": "2026-05-03",
      "coba-osnabrueck.it.com": "2026-07-28",
      "cocuscompany.com": "2026-05-02",
      "code-wallets-de.com": "2026-05-02",
      "cognopix.com": "2026-05-02",
      "comof72509.workers.dev": "2026-06-07",
      "compassgrowpat.com": "2026-05-02",
      "computerservicesource.com": "2026-02-27",
      "connecticutcre.com": "2026-05-11",
      "contextualdesigns.com": "2026-06-01",
      "contorion-uk.com": "2026-05-02",
      "controle-universal.fit": "2026-05-02",
      "cooperativebamkcafe.com": "2026-08-06",
      "cooperativecaffes.us": "2026-07-21",
      "cooperativecollectivecafe.com": "2026-08-01",
      "cooperativecreatives.com": "2026-07-21",
      "cooperativecreatives.us": "2026-07-21",
      "cooperativecreativs.com": "2026-07-21",
      "corden.it.com": "2026-06-16",
      "corevantaq.com": "2026-05-15",
      "corevoryx.com": "2026-06-16",
      "corlopt.it.com": "2026-06-17",
      "crafteddreams.net": "2026-05-02",
      "craftycuddle.com": "2026-05-02",
      "craneservicepa.com": "2026-07-21",
      "crankous-plumosity.website": "2026-05-09",
      "crazy-app.best": "2026-05-02",
      "crazy-app.ink": "2026-05-02",
      "creativewritingretreats.com": "2026-05-02",
      "creditanova.com": "2026-06-09",
      "cresterero.com": "2026-07-30",
      "crestpoints.it.com": "2026-06-09",
      "crimson-unit-2561.kopis56799.workers.dev": "2026-01-02",
      "cromwellstorage.com": "2026-07-21",
      "crown-advisor.com": "2026-05-02",
      "crredixas.com": "2026-05-02",
      "cryptazal.icu": "2026-05-02",
      "cryptofinance.com.de": "2026-05-02",
      "csdob.com": "2026-05-02",
      "cullendersbarnacles.quest": "2026-05-14",
      "cupertinoconstruction.com": "2026-08-01",
      "cyberrec.shop": "2026-05-02",
      "cybershield-academy.net": "2026-05-02",
      "cystocarehungary.com": "2026-07-21",
      "d-extrax.com": "2026-05-02",
      "daddled-overgirds.website": "2026-05-02",
      "daddled-uncinariasis.website": "2026-05-02",
      "daiwa-cycle.pro": "2026-05-02",
      "daniel-foster.workers.dev": "2026-04-15",
      "danrodphotos.com": "2026-05-02",
      "danubereview.com": "2026-07-21",
      "danubiusgrowthlab.com": "2026-07-22",
      "dark-bar-d282.nina-alvarez.workers.dev": "2026-04-15",
      "dash-server.servertech03.workers.dev": "2024-11-25",
      "dash-server2.servertech02.workers.dev": "2026-06-07",
      "dashbourd.us": "2026-07-21",
      "data-pipeline-9e4.workers.dev": "2026-04-15",
      "database-dbeaver.com": "2026-05-02",
      "database-heidisql.com": "2026-05-02",
      "database-lists.com": "2026-02-27",
      "datagrip-logic.com": "2026-05-18",
      "dataops-center.com": "2026-05-02",
      "datatools26.org": "2026-07-21",
      "datovenza.com": "2026-05-02",
      "dawnsparknever.com": "2026-05-02",
      "db-proxy-9b2.daniel-foster.workers.dev": "2026-04-15",
      "dbeaver-architect-hub.com": "2026-05-06",
      "dbeaver-ce.com": "2026-05-02",
      "dbeaver-center.com": "2026-05-02",
      "dbeaver-connect.com": "2026-05-02",
      "dbeaver-database.app": "2026-02-27",
      "dbeaver-database.cc": "2026-02-27",
      "dbeaver-database.cloud": "2026-02-27",
      "dbeaver-database.co": "2026-02-27",
      "dbeaver-database.com": "2026-02-27",
      "dbeaver-database.org": "2026-02-27",
      "dbeaver-database.pro": "2026-02-27",
      "dbeaver-database.tech": "2026-02-27",
      "dbeaver-database.us": "2026-02-27",
      "dbeaver-datamesh.com": "2026-05-02",
      "dbeaver-dataops.com": "2026-05-02",
      "dbeaver-db.com": "2026-05-03",
      "dbeaver-dba-foundation.com": "2026-05-07",
      "dbeaver-failover.com": "2026-05-06",
      "dbeaver-join.com": "2026-05-02",
      "dbeaver-munster.com": "2026-05-02",
      "dbeaver-project.com": "2026-05-02",
      "dbeaver-protocol.com": "2026-05-05",
      "dbeaver-schema.com": "2026-05-03",
      "dbeaver-sqlhub.com": "2026-05-02",
      "dbeaver-sqlops.com": "2026-05-03",
      "dbeaver-workspace.com": "2026-05-02",
      "dbeaver.dataops-center.com": "2026-05-02",
      "dbeaver.schema-harbor.com": "2026-05-02",
      "dbeaver.softwarep2p.com": "2026-05-02",
      "dbforges.com": "2026-04-15",
      "dealsauctions.com": "2026-05-02",
      "dede1000x.com": "2026-05-07",
      "deep-mine-app.site": "2026-05-02",
      "deepcipherquanta.com": "2026-06-06",
      "deepfluxorian.com": "2026-06-18",
      "deeporiumforge.com": "2026-06-20",
      "deguercuernavaca.mx": "2026-03-14",
      "deltacasino.website": "2026-07-21",
      "delvonax.cyou": "2026-05-02",
      "demapas.com": "2026-05-02",
      "denizened-blowout.website": "2026-05-02",
      "dentagen.it.com": "2026-07-28",
      "der-postillon.org": "2026-05-02",
      "deram71445.workers.dev": "2026-04-15",
      "dev-web-serv.noroho5002.workers.dev": "2026-04-15",
      "dev.rvtoolacs.online": "2026-06-07",
      "dev1-server.sogal69343.workers.dev": "2026-04-15",
      "devartc.com": "2026-04-15",
      "devartes.com": "2026-04-15",
      "devartos.com": "2026-04-15",
      "devartq.com": "2026-04-15",
      "devartsi.com": "2026-04-15",
      "devolutions-adminops.com": "2026-05-02",
      "devolutions-center.com": "2026-05-03",
      "devolutions-endpoint.com": "2026-05-02",
      "devolutions-fieldcraft.com": "2026-05-10",
      "devolutions-governance.com": "2026-05-02",
      "devolutions-itdesk.com": "2026-05-02",
      "devolutions-manager.com": "2026-05-02",
      "devolutions-rdm.click": "2026-05-07",
      "devolutions-rdm.com": "2026-04-15",
      "devolutions-rdm.online": "2026-05-04",
      "devolutions-stack.com": "2026-05-02",
      "devolutions-subnetlab.com": "2026-05-02",
      "devolutions-sysarch.com": "2026-05-08",
      "devolutions.rd-manager.com": "2026-05-02",
      "devolutions.space": "2026-04-15",
      "devolutions.workgridlab.com": "2026-05-02",
      "devolutionscontrolroom.com": "2026-05-02",
      "devopstechnologies.site": "2026-06-07",
      "dexelora.com": "2026-05-08",
      "dexentraq.com": "2026-05-09",
      "dexontra.com": "2026-05-26",
      "dexorith.com": "2026-06-07",
      "dexovanta.com": "2026-05-09",
      "dexscreeners.cloud": "2026-05-02",
      "dexscreeners.ink": "2026-05-02",
      "dexscreeners.life": "2026-05-02",
      "dexscreeners.pics": "2026-05-02",
      "dexscreeners.sbs": "2026-05-02",
      "dexscreeners.shop": "2026-05-02",
      "dicknns.shop": "2026-05-02",
      "die6.it.com": "2026-07-28",
      "digitalsystemprofit.com": "2026-05-02",
      "dirtyca.top": "2026-05-02",
      "dirtyup.top": "2026-05-02",
      "dirtyus.top": "2026-05-02",
      "discoveryrails.com": "2026-05-02",
      "disk-7133.identity-svc-9mz.workers.dev": "2026-04-15",
      "diskqenios.com": "2026-04-15",
      "diversionarcade.net": "2026-05-02",
      "dividexusstel.digital": "2026-05-02",
      "divine-glitter-cfb4.elena-morales.workers.dev": "2026-04-15",
      "doglep.com": "2026-05-02",
      "dogtrainingdfw.com": "2026-05-03",
      "download-tightvnc.com": "2026-05-02",
      "download.rvtools-dev.com": "2026-05-02",
      "download.rvtools-skillcamp.com": "2026-05-02",
      "dowojnes.com": "2026-05-02",
      "dr.hornetsecuety.com": "2026-05-15",
      "draxafied.cyou": "2026-05-02",
      "dreamchaserpeak.com": "2026-05-02",
      "dreamrupturevice.com": "2026-05-02",
      "dreamspinhub.com": "2026-05-02",
      "dreamweavegrey.com": "2026-05-02",
      "drenslio.it.com": "2026-06-02",
      "drexano.de": "2026-05-02",
      "driftpixelmonster.com": "2026-05-02",
      "duskblazeworld.com": "2026-05-02",
      "dy.hornetseculty.com": "2026-05-14",
      "e-gradanis.info": "2026-05-02",
      "e-hzz.info": "2026-05-02",
      "e-hzz.world": "2026-05-02",
      "e-hzzo.digital": "2026-05-02",
      "e-hzzo.homes": "2026-05-02",
      "e-porezn.digital": "2026-05-02",
      "e-porezn.org": "2026-05-02",
      "e-porezn.world": "2026-05-02",
      "e-porezna.homes": "2026-05-02",
      "e-porezna.org": "2026-05-02",
      "e-porezna.world": "2026-05-02",
      "e-poreznas.digital": "2026-05-02",
      "e-porezno.digital": "2026-05-02",
      "e-zdrav.org": "2026-05-02",
      "e-zdravlj.digital": "2026-05-02",
      "e-zdravlj.info": "2026-05-02",
      "e-zdravlje.info": "2026-05-02",
      "e-zdravlje.life": "2026-05-02",
      "e-zdravlje.today": "2026-05-02",
      "e-zdravljes.digital": "2026-05-02",
      "ec2-app.lewoha7320.workers.dev": "2026-01-02",
      "ec2-server-noisy-band-0fe8.focapaj280.workers.dev": "2026-01-02",
      "ec2-server.bayaj19162.workers.dev": "2026-01-02",
      "ec2-server.gegodec527.workers.dev": "2026-01-02",
      "ec2-server.milago3967.workers.dev": "2026-01-02",
      "echofallsr.com": "2026-05-02",
      "echofallsupport.com": "2026-05-02",
      "ecohomelive.org": "2026-05-02",
      "economiaazi.com": "2026-07-28",
      "ecorecip.shop": "2026-05-02",
      "ecovoltkit.shop": "2026-05-02",
      "ede.it.com": "2026-08-01",
      "edge-proxy-7kx.workers.dev": "2026-04-15",
      "eds-go.life": "2026-05-02",
      "eds-life.life": "2026-05-02",
      "eds-on.life": "2026-05-02",
      "eds-online.icu": "2026-05-02",
      "eduglen.com": "2026-05-02",
      "edulustra.com": "2026-05-02",
      "edutrelix.com": "2026-05-02",
      "egeszsegtippek-magazin.com": "2026-07-21",
      "egradani.icu": "2026-05-02",
      "einfacheonlineanfrage.com": "2026-05-24",
      "ek-retail.it.com": "2026-08-01",
      "elasticsa.com": "2026-04-15",
      "elasticse.com": "2026-04-15",
      "elasticso.com": "2026-04-15",
      "electdev.com": "2026-05-21",
      "electricshop.org": "2026-05-02",
      "elena-morales.workers.dev": "2026-04-15",
      "eletrue.com": "2026-05-02",
      "elevatsys.it.com": "2026-06-05",
      "eliasic.com": "2026-04-15",
      "elite-games-ltd.website": "2026-05-02",
      "elite-play-base.website": "2026-05-02",
      "emcocoftvare.com": "2026-04-15",
      "emcosoftwr.com": "2026-04-15",
      "enem-inep2025.com": "2026-05-02",
      "entretenimientoplay.net": "2026-05-02",
      "eporezna.info": "2026-05-02",
      "eporezna.world": "2026-05-02",
      "equipmentohio.com": "2026-05-24",
      "esanewablogo.com": "2026-05-02",
      "estnews-ro.com": "2026-07-21",
      "etherial.groover.workers.dev": "2026-01-22",
      "etsena.eu.com": "2026-05-02",
      "eurobaustoff.it.com": "2026-08-06",
      "eurodelkredere.it.com": "2026-08-06",
      "evans-esign.info": "2026-05-02",
      "evolutionblends.com": "2026-05-02",
      "evolutionpestcontrol.com": "2026-05-15",
      "evolyraz.com": "2026-05-02",
      "exomegene.com": "2026-06-06",
      "exosomegene.com": "2026-06-08",
      "expatpower.com": "2026-05-02",
      "expresss-fin.com": "2026-05-02",
      "ezdravlj.info": "2026-05-02",
      "ezdravlje.digital": "2026-05-02",
      "ezdravlje.org": "2026-05-02",
      "fabsaintsimons.org": "2026-05-02",
      "faithful-sigh.com": "2026-05-23",
      "falor75.com": "2026-05-02",
      "falserollplay.com": "2026-05-02",
      "fareharbores.com": "2026-05-03",
      "fast-play-city.site": "2026-05-02",
      "fastpanel116864.hostkey.in": "2026-06-07",
      "feedlister.com": "2026-07-21",
      "feleasofit.com": "2026-04-15",
      "feleasot.com": "2026-04-15",
      "felenasofts.com": "2026-04-15",
      "felenasoftse.com": "2026-04-15",
      "fenceidaho.com": "2026-05-30",
      "fenlira.de": "2026-05-02",
      "fileseekslay.pro": "2026-05-02",
      "filezilla-app.com": "2026-05-02",
      "filezilla-workspace.com": "2026-05-02",
      "filmoperatorschule.com": "2026-05-02",
      "filodarte.net": "2026-05-02",
      "finanseller.com": "2026-05-02",
      "finanziahubs.com": "2026-06-08",
      "findoffering.com": "2026-05-26",
      "finex-pert.com": "2026-05-02",
      "fingrowe.com": "2026-05-02",
      "finnarco.com": "2026-05-02",
      "finsolis.shop": "2026-05-02",
      "fintherix.com": "2026-05-02",
      "fiotidasorte2025.com": "2026-05-02",
      "firstbaze.com": "2026-05-02",
      "fisheryguide.org": "2026-05-02",
      "fishingguidesmiami.com": "2026-05-27",
      "fiveback.xyz": "2026-05-02",
      "fivebackgift.io": "2026-05-02",
      "fivebackgiftus.com": "2026-05-02",
      "fiviebelow.com": "2026-05-02",
      "fl-studio-mobile.fit": "2026-05-02",
      "flairfootballs.com": "2026-05-02",
      "flameechosaber.com": "2026-05-02",
      "fleksskell.ink": "2026-05-02",
      "flexiblemoeglichkeiten.com": "2026-05-19",
      "flightradar-canada.com": "2026-05-02",
      "floral-grass-3c6f.cowivat156.workers.dev": "2026-04-15",
      "floral-paper-8eb1.pihara4672.workers.dev": "2026-01-02",
      "florovex.com": "2026-05-02",
      "fluxelyx.com": "2026-05-20",
      "fluxileir.com": "2026-05-21",
      "fluxiqa.com": "2026-05-10",
      "fluxiroz.com": "2026-05-02",
      "fluxiverianlabs.com": "2026-06-15",
      "fluxoderia.com": "2026-05-24",
      "fluxontra.com": "2026-05-27",
      "fluxoraviantech.com": "2026-06-05",
      "fluxoriumlabs.com": "2026-05-24",
      "fluxquantatech.com": "2026-07-22",
      "fluxquantorian.com": "2026-07-21",
      "flywerd.it.com": "2026-05-06",
      "fokuspyna.com": "2026-05-02",
      "fokussperk.com": "2026-05-02",
      "fortcampbellausa.com": "2026-05-02",
      "francefinhelp.com": "2026-06-17",
      "freaegent.com": "2026-05-02",
      "freeagenlt.com": "2026-05-03",
      "fresagent.com": "2026-05-03",
      "frialerynetuha.com": "2026-08-07",
      "friloktertys.de": "2026-05-02",
      "frostveilslay.com": "2026-05-02",
      "frostysmiles.com": "2026-05-02",
      "fuer-sie-eg.it": "2026-08-03",
      "fuleroidos.de": "2026-05-02",
      "fuzionssolens.it.com": "2026-05-02",
      "fuzoyesos.de": "2026-05-02",
      "g.rv-tools.info": "2026-05-14",
      "gadgman.ink": "2026-05-02",
      "game-city-ltd.site": "2026-05-02",
      "gammoned-dopier.website": "2026-05-08",
      "gamorz.com": "2026-05-02",
      "garagedoorscentralflorida.com": "2026-06-03",
      "gates-olympus.live": "2026-05-02",
      "gauleteres.de": "2026-05-02",
      "gbdiystore.art": "2026-05-02",
      "gcrda.com": "2026-05-02",
      "geliopetry.de": "2026-05-02",
      "gersolaoe.de": "2026-05-02",
      "getetenos.com": "2026-05-27",
      "getreceived.com": "2026-05-02",
      "getting-keepass.com": "2026-05-02",
      "getxenow.com": "2026-07-21",
      "gfilimtonkas.de": "2026-05-03",
      "giftcardmallmygiftac.com": "2026-05-02",
      "giftcardmallmygiftai.com": "2026-05-02",
      "giftcardmallmygiftf.com": "2026-05-02",
      "giftcardmallmygiftss.com": "2026-05-02",
      "giftcardmallmygiftsus.com": "2026-05-02",
      "giftcardmallmygiftus.com": "2026-05-02",
      "giftcardmallus.com": "2026-05-02",
      "giftcardsecure.com": "2026-05-02",
      "giftcodemygift.xyz": "2026-05-02",
      "gijeqiko.de": "2026-05-02",
      "gis-arta.online": "2026-07-22",
      "glavonix.info": "2026-05-02",
      "glaxtonia.info": "2026-05-02",
      "gleization-leptospiroses.website": "2026-05-06",
      "glidepilotjp.com": "2026-05-02",
      "global-games-ltd.website": "2026-05-02",
      "global-iptv-china.live": "2026-05-02",
      "global-iptv-japan.live": "2026-05-02",
      "global-iptv-korea.live": "2026-05-02",
      "glow-skinstore.com": "2026-05-02",
      "glowreignmost.com": "2026-05-02",
      "gloxtram.info": "2026-05-02",
      "glucometrwellness.com": "2026-05-02",
      "go-play-ltd.site": "2026-05-02",
      "godlessnesses-game-city.website": "2026-05-02",
      "gogisich.shop": "2026-05-02",
      "gold-game-apps.site": "2026-05-02",
      "gold-iptv-portugal.live": "2026-05-02",
      "gold-mine-app.site": "2026-05-02",
      "goshipppo.com": "2026-05-02",
      "gospffuf.com": "2026-05-02",
      "gothepuff.com": "2026-05-02",
      "gq.harnetsecurlty.com": "2026-05-15",
      "gradani.digital": "2026-05-02",
      "graphicin.com": "2026-05-02",
      "greenbase.it.com": "2026-08-07",
      "gridmellow.com": "2026-06-20",
      "grok-assistente.live": "2026-05-02",
      "groover.workers.dev": "2026-01-22",
      "grubfoaub.com": "2026-05-02",
      "grubphub.com": "2026-05-02",
      "grubshubs.com": "2026-05-03",
      "gruihub.com": "2026-05-02",
      "grulbhub.com": "2026-05-02",
      "grusthub.com": "2026-05-02",
      "gyogynovenyvilag24.com": "2026-07-21",
      "gzlarza.com": "2026-07-21",
      "h3.horpetsecurity.com": "2026-05-22",
      "hair-clipper.icu": "2026-05-02",
      "handwerkzeit.com": "2026-05-02",
      "harborfreihgt.net": "2026-05-02",
      "harnetsecuriity.com": "2026-02-16",
      "harnetsecurity.com": "2026-02-16",
      "harnetsecurlty.com": "2026-05-15",
      "harrybradley.com": "2026-05-02",
      "hartmarn.shop": "2026-05-02",
      "hauswaermepumpe.com": "2026-05-02",
      "havenlys.com": "2026-05-02",
      "heatfuturenow.com": "2026-05-02",
      "heavychest.com": "2026-05-02",
      "heeev.com": "2026-05-02",
      "heidisql-app.com": "2026-05-02",
      "heidisql-center.com": "2026-05-02",
      "heidisql-connect.com": "2026-05-02",
      "heidisql-db.com": "2026-05-02",
      "heidisql-enterprise.app": "2026-02-27",
      "heidisql-enterprise.cc": "2026-02-27",
      "heidisql-enterprise.cloud": "2026-02-27",
      "heidisql-enterprise.co": "2026-02-27",
      "heidisql-enterprise.com": "2026-02-27",
      "heidisql-enterprise.ltd": "2026-02-27",
      "heidisql-enterprise.org": "2026-02-27",
      "heidisql-enterprise.pro": "2026-02-27",
      "heidisql-enterprise.tech": "2026-02-27",
      "heidisql-enterprise.us": "2026-02-27",
      "heidisql-project.com": "2026-05-02",
      "heidisql-queryladder.com": "2026-05-02",
      "heidisql-schema.com": "2026-05-02",
      "heidisql-studio.com": "2026-05-03",
      "heidisql-workbench.com": "2026-05-02",
      "heidisql.database-lists.com": "2026-05-02",
      "heidisql.space": "2026-02-27",
      "heimatjetzt.com": "2026-05-02",
      "henriiues.space": "2026-07-21",
      "henriquee.com": "2026-07-21",
      "heritage-interiiors.com": "2026-05-02",
      "hexenabenteuer.com": "2026-05-02",
      "hirekazegeszsegrol.com": "2026-07-21",
      "hodkhewicz.shop": "2026-05-02",
      "hohnston.shop": "2026-05-02",
      "hongkongfocus.com": "2026-05-02",
      "honorivalearn.com": "2026-05-02",
      "hootsuite.promo-links.com": "2026-05-02",
      "hopeplayeaux.com": "2026-05-02",
      "horizon-client-download.com": "2026-03-09",
      "horizonenterprise.app": "2026-05-21",
      "hornetsecuety.com": "2026-03-10",
      "hornetseculty.com": "2026-02-25",
      "hornetsecurety.com": "2026-03-09",
      "hornetsecurty.com": "2026-03-09",
      "hornetsecuty.com": "2026-03-10",
      "horpetsecurity.com": "2026-02-16",
      "hostupdate.site": "2026-05-18",
      "hotnewsreels.com": "2026-05-03",
      "hplpert.shop": "2026-05-02",
      "hrs-store.com": "2026-05-02",
      "hunativ.com": "2026-07-28",
      "hungarovitalcenter.com": "2026-07-21",
      "hunherbal.com": "2026-07-29",
      "huttonagency.com": "2026-05-28",
      "hyperliqiud.cc": "2026-05-02",
      "hyperlora.com": "2026-05-18",
      "hypohq.com": "2026-05-02",
      "iaclaude.com": "2026-05-02",
      "ibispaint.ink": "2026-05-02",
      "icelap.com": "2026-05-02",
      "identity-svc-9mz.workers.dev": "2026-04-15",
      "ideogramy.com": "2026-05-12",
      "ideyakraaft.com": "2026-05-02",
      "illinoismerchantservices.com": "2026-05-02",
      "immovablenesses-wishfulnesses.website": "2026-05-02",
      "impulso-familiar.com": "2026-05-02",
      "impulsolatinohn.com": "2026-05-15",
      "imputation-daddled.website": "2026-05-02",
      "imputation-regretful.website": "2026-05-02",
      "independentuknews.com": "2026-05-02",
      "indianatowingservice.com": "2026-05-30",
      "infomediabeen.top": "2026-05-02",
      "infopiete.com": "2026-07-22",
      "infusiya.com": "2026-05-02",
      "ingress-ctrl-7c9.workers.dev": "2026-04-15",
      "inrvsa.com": "2026-07-28",
      "inscricao-enem2025.com": "2026-05-02",
      "inteero.org": "2026-05-02",
      "inteligente-iptv.live": "2026-05-02",
      "intellectforge.com": "2026-05-02",
      "interviewakademiedeutschland.com": "2026-05-02",
      "interviewerbest-de.com": "2026-05-02",
      "intex360.com": "2026-05-02",
      "iperiusremot.app": "2026-08-04",
      "iperiusremote.app": "2026-08-04",
      "iperiusremote.online": "2026-08-04",
      "iptv-pt.live": "2026-05-02",
      "iptv-smart.ink": "2026-05-02",
      "iptv-tugao.live": "2026-05-02",
      "iptv-xtream.live": "2026-05-02",
      "iptv24-app.online": "2026-05-02",
      "iptv24.live": "2026-05-02",
      "ispyconect.com": "2026-04-15",
      "it-quotidiana.com": "2026-07-21",
      "ital-secure.com": "2026-05-02",
      "italia-interviewers.com": "2026-05-02",
      "itasobres.com": "2026-05-02",
      "iterm2.fabsaintsimons.org": "2026-05-02",
      "itmurrieta.com": "2026-05-02",
      "ivms-4200.com": "2026-04-15",
      "iwervoex.icu": "2026-05-16",
      "japanesale.icu": "2026-05-02",
      "jaskolski.shop": "2026-05-02",
      "jeeplandgrow.pro": "2026-05-02",
      "jensenprinting.com": "2026-06-06",
      "jeremywray.com": "2026-05-02",
      "jogar-cassino.live": "2026-05-02",
      "joinmorteseek.com": "2026-05-02",
      "jokerlandia.pro": "2026-05-02",
      "jokers-club-app.online": "2026-05-02",
      "jondoninc.com": "2026-08-04",
      "jongbloedwheels.com": "2026-05-02",
      "joubert.icu": "2026-05-08",
      "jourjan.icu": "2026-05-09",
      "jpbluesalter.top": "2026-05-02",
      "jpmdswap.com": "2026-05-30",
      "jponeclean.icu": "2026-05-02",
      "juegosocialhub.net": "2026-05-02",
      "juisekingd.com": "2026-05-02",
      "junexley.digital": "2026-05-02",
      "junglebet.website": "2026-07-28",
      "jurnaleconomic.com": "2026-07-21",
      "kaatzer.shop": "2026-05-02",
      "kaizenflowtrade.com": "2026-05-02",
      "kalosintelligence.com": "2026-06-07",
      "kalosrobotics.com": "2026-05-23",
      "kamerakunstakademie.com": "2026-05-02",
      "kaneko-optical.info": "2026-05-02",
      "kanta-suomi.info": "2026-05-02",
      "kanta.info": "2026-05-02",
      "karpatwellnesslab.com": "2026-07-21",
      "kaxij51156.workers.dev": "2026-04-15",
      "keepass-client.com": "2026-05-02",
      "kegemom113.workers.dev": "2026-04-15",
      "kelulurn.com": "2026-05-02",
      "kertelssugiaho.com": "2026-07-28",
      "keston-carcare.com": "2026-05-02",
      "keycornthegoldkey.us": "2026-08-06",
      "keystore-explorer.com": "2026-01-02",
      "keystore-explorer.site": "2026-06-07",
      "kibanal.com": "2026-04-15",
      "kievstar.digital": "2026-05-02",
      "kikuchikara-jp.com": "2026-05-02",
      "kimimena.com": "2026-08-06",
      "kiroxpath.com": "2026-05-02",
      "kitchekinetic.com": "2026-05-02",
      "klivontra.icu": "2026-05-02",
      "knowarya.com": "2026-05-02",
      "knoweriq.com": "2026-05-02",
      "knowledgejumps.com": "2026-05-02",
      "kokoro-travel.org": "2026-05-23",
      "kosquex.fit": "2026-05-02",
      "krylentra.com": "2026-05-09",
      "krypkryphora.com": "2026-05-11",
      "kryptrona.com": "2026-05-09",
      "lairatech.it.com": "2026-06-04",
      "landioverday.com": "2026-05-02",
      "landloverday.com": "2026-05-02",
      "lchmeler.shop": "2026-05-02",
      "leafdriftlandys.com": "2026-05-02",
      "learnarabroostz.com": "2026-05-02",
      "learndriftz.com": "2026-05-02",
      "learnkomm.com": "2026-05-02",
      "learnoxaorira.com": "2026-05-02",
      "learnzypp.com": "2026-05-02",
      "legacydate.com": "2026-05-02",
      "lernkompass-de.com": "2026-05-02",
      "lestrangelondon.work": "2026-05-02",
      "letreton.icu": "2026-05-09",
      "letssignjapan.com": "2026-05-02",
      "liberolavoro.com": "2026-05-02",
      "libracontrol.com": "2026-05-02",
      "lifewarehouses.com": "2026-05-02",
      "linkbioda.com": "2026-05-02",
      "liqvorax.de": "2026-05-02",
      "little-frog-2e65.kaxij51156.workers.dev": "2026-04-15",
      "live-fun.ink": "2026-05-02",
      "lively-37b6.edge-proxy-7kx.workers.dev": "2026-04-15",
      "lleraedosimuba.com": "2026-07-28",
      "lnastcart.com": "2026-05-02",
      "lnstcard.com": "2026-05-02",
      "lnstecart.com": "2026-05-02",
      "log-ingest-f1d.nina-alvarez.workers.dev": "2026-04-15",
      "logpayset.pro": "2026-05-02",
      "lorettostorage.com": "2026-06-09",
      "ltngworth.icu": "2026-05-02",
      "lucky-portal.com": "2026-05-04",
      "lufkintowing.com": "2026-05-27",
      "lumensavesolar.com": "2026-05-02",
      "luminousfinancialgroup.com": "2026-05-28",
      "lumverse.shop": "2026-05-02",
      "lunarwhisper.world": "2026-05-02",
      "lunatrixo.com": "2026-05-08",
      "lunettes-selection-de.com": "2026-05-02",
      "lurnexpulse.com": "2026-05-02",
      "lusthack.com": "2026-05-02",
      "luxebilliards.com": "2026-05-16",
      "macchetti.icu": "2026-05-10",
      "macejkovic.shop": "2026-05-02",
      "magiciansd.com": "2026-05-11",
      "magyarurocare.com": "2026-07-28",
      "mail.aussierealestate.net.au": "2026-07-21",
      "maisondu-bois.com": "2026-05-02",
      "majimaya.org": "2026-05-02",
      "manabi-michi.com": "2026-05-02",
      "marbellavacations.com": "2026-06-05",
      "markden.com": "2026-05-02",
      "masjidimamalias.com": "2026-05-02",
      "mavorapath.com": "2026-05-02",
      "maxgenhoupe.pro": "2026-05-02",
      "mayisi1259.workers.dev": "2026-04-15",
      "md-ahk.com": "2026-05-02",
      "mediahubtv.live": "2026-05-02",
      "mediaifnosocia.icu": "2026-05-02",
      "mega-app-games.website": "2026-05-02",
      "mega-play-hub.site": "2026-05-02",
      "mel-peludinhos.com": "2026-05-02",
      "memeclip.org": "2026-05-02",
      "mentoxapath.com": "2026-05-02",
      "meridiasolution.it.com": "2026-06-05",
      "meritkings.org": "2026-05-02",
      "meshcipherlab.com": "2026-07-21",
      "meshoramor.com": "2026-06-08",
      "meshorialquant.com": "2026-06-17",
      "meshorianforge.com": "2026-06-17",
      "meshoverian.com": "2026-05-26",
      "meshquantumlab.com": "2026-05-23",
      "meshvariantech.com": "2026-07-28",
      "mesitunel.it.com": "2026-05-02",
      "methodunit.fun": "2026-05-02",
      "metric-harbor.com": "2026-05-02",
      "miamiposters.com": "2026-05-24",
      "michiganfostercarecloset.us": "2026-07-21",
      "michigansecurityguard.com": "2026-05-30",
      "midnightridergrey.com": "2026-05-02",
      "mikestonegoldcard.com": "2026-06-06",
      "mikoflow.org": "2026-05-02",
      "millpp.com": "2026-08-07",
      "mim-iptv.live": "2026-05-02",
      "mindaicademia.com": "2026-05-02",
      "mindarablock.com": "2026-05-02",
      "mindevarafluxis.com": "2026-05-02",
      "mindexiscorez.com": "2026-05-02",
      "mindospherex.com": "2026-05-02",
      "mindzocore.com": "2026-05-02",
      "mine-gold-play.site": "2026-05-02",
      "minidoxiepups.com": "2026-05-02",
      "mioriticholdings.com": "2026-07-21",
      "mirae-patho.com": "2026-05-02",
      "missyork.com": "2026-05-02",
      "misterorgan.com": "2026-05-02",
      "mistertradeai.com": "2026-05-02",
      "mistfoldteddy.com": "2026-05-02",
      "mixenaz.com": "2026-05-02",
      "mobaxterm-app.com": "2026-05-02",
      "mobaxterm-terminal.com": "2026-05-02",
      "mobaxterm.console-workspace.com": "2026-05-02",
      "mobaxtermatlas.com": "2026-05-02",
      "mobaxtermdesk.com": "2026-05-02",
      "mobile-game-city.website": "2026-05-02",
      "mobilescoding.de": "2026-05-02",
      "model-engineer.family": "2026-05-02",
      "molassist.com": "2026-05-02",
      "moltsavvy.com": "2026-05-30",
      "monbonvivant.com": "2026-05-02",
      "moneyfinla.com": "2026-05-02",
      "moneyresor.com": "2026-05-02",
      "monitoreffect.com": "2026-05-02",
      "monitorulcapitalului.com": "2026-07-21",
      "monsieurs-paris.com": "2026-05-02",
      "monstergrowdeep.pro": "2026-05-02",
      "moonwhisperhaze.com": "2026-05-02",
      "moonwhisperlake.com": "2026-05-02",
      "moorabanco-ad.com": "2026-06-07",
      "moraabanco-ad.com": "2026-06-07",
      "morabanco-ad.com": "2026-06-07",
      "moretti-menswear.com": "2026-05-02",
      "mornava.com": "2026-05-07",
      "motorverso.org": "2026-05-02",
      "moverssocal.com": "2026-05-30",
      "movobility.com": "2026-05-13",
      "moxabazco.info": "2026-05-02",
      "moxabrain.info": "2026-05-02",
      "moxantria.cyou": "2026-05-02",
      "moxatrade.info": "2026-05-02",
      "moxatrend.icu": "2026-05-02",
      "msperformance.org": "2026-05-02",
      "mstore.framfarmers.co.uk": "2026-01-02",
      "mud.alert-router-b3a.workers.dev": "2026-04-15",
      "musclebrite.com": "2026-08-07",
      "musicolet.live": "2026-05-02",
      "myeks.com": "2026-05-02",
      "mygift-myonlymail.com": "2026-05-02",
      "myndlyft.org": "2026-05-02",
      "myndpusha.com": "2026-05-02",
      "mytoolshed.club": "2026-05-02",
      "nailsope.com": "2026-05-02",
      "narz-avn.it": "2026-07-21",
      "nelmods.com": "2026-05-02",
      "neonreport.com": "2026-06-19",
      "neonwhisperbay.com": "2026-05-02",
      "neonwrathnice.com": "2026-05-02",
      "neorev.it.com": "2026-05-14",
      "neosolage.shop": "2026-05-02",
      "neowernest.icu": "2026-05-16",
      "nepensens.org": "2026-05-02",
      "net-optimizer.ink": "2026-05-02",
      "nettoyaget.com": "2026-05-02",
      "netzzecho.de": "2026-05-02",
      "neuralsboost.com": "2026-05-02",
      "nevadaslp.com": "2026-05-02",
      "newhopechiro.com": "2026-05-02",
      "newmexicomartialarts.com": "2026-05-28",
      "nexasforges.it.com": "2026-06-06",
      "nexiqora.com": "2026-05-18",
      "nexiratrack.com": "2026-05-02",
      "nexityz.com": "2026-05-02",
      "nexovryn.com": "2026-06-07",
      "nextrollen.com": "2026-05-02",
      "nick.hostupdate.site": "2026-05-18",
      "nightgleamclays.com": "2026-05-02",
      "nina-alvarez.workers.dev": "2026-04-15",
      "ninajkitchen.com": "2026-05-02",
      "ninjasharsk.com": "2026-05-02",
      "ninjenkitchen.com": "2026-05-02",
      "nmap-scanner.com": "2026-05-02",
      "nmap.softwarep2p.com": "2026-05-02",
      "nmap.space": "2026-02-27",
      "nodequantforge.com": "2026-07-21",
      "nodequantixlab.com": "2026-06-16",
      "nodevarianlabs.com": "2026-06-02",
      "nordicfriendly.com": "2026-05-02",
      "noroho5002.workers.dev": "2026-04-15",
      "norseware.com": "2026-06-08",
      "norvaxiss.com": "2026-05-02",
      "novaryns.org": "2026-05-02",
      "novexagroups.com": "2026-05-02",
      "noviqora.com": "2026-05-09",
      "nxvmss.com": "2026-05-28",
      "nxvmss.org": "2026-05-28",
      "nymcu-us.com": "2026-05-02",
      "nymcu-usa.com": "2026-05-02",
      "observatorfinanciar-ro.com": "2026-07-21",
      "ocalatreeservices.com": "2026-06-09",
      "oceaneyedpray.com": "2026-05-02",
      "ocoeeflooring.com": "2026-05-02",
      "octorate.homes": "2026-05-02",
      "offensive-microphylls.website": "2026-05-02",
      "oililychoreas.quest": "2026-05-12",
      "oililyideologized.quest": "2026-05-14",
      "okcbusinessbrokers.com": "2026-05-03",
      "oma-kanta.info": "2026-05-02",
      "omakanta.today": "2026-05-02",
      "omex-tv.live": "2026-05-02",
      "omnilumity.shop": "2026-05-02",
      "omnirecipist.shop": "2026-05-02",
      "omniscaryahaven.com": "2026-05-02",
      "omnivolt.shop": "2026-05-02",
      "onbrandwriting.com": "2026-05-26",
      "onlinenweb.us": "2026-07-21",
      "orangecountywaterheater.com": "2026-06-16",
      "orca-spa.click": "2026-05-02",
      "oregonbathroomremodeling.com": "2026-06-18",
      "oregonpianos.com": "2026-05-22",
      "orlandoapt.com": "2026-05-20",
      "orlandoweddingfilms.com": "2026-06-04",
      "orthonormal-versos.site": "2026-05-02",
      "osinsii.shop": "2026-05-02",
      "otp-performance.info": "2026-05-02",
      "otp-planner.digital": "2026-05-02",
      "otp-planner.info": "2026-05-02",
      "otp-platform.digital": "2026-05-02",
      "otp-provider.digital": "2026-05-02",
      "ottawacriminaldefencelawyer.com": "2026-05-02",
      "overbrowses-carboniferous.com": "2026-05-07",
      "overgirds-stalwart.website": "2026-05-02",
      "ox-fanzine.org": "2026-05-02",
      "oyunlar.fun": "2026-05-02",
      "pablackcar.com": "2026-06-06",
      "packagedwisdom.com": "2026-08-04",
      "pacote-premium.pics": "2026-05-02",
      "pacs4less.com": "2026-05-18",
      "pannonuroguide.com": "2026-07-28",
      "panotarypublic.com": "2026-05-04",
      "panpacs.com": "2026-05-02",
      "paprastas-sprendimas.com": "2026-05-21",
      "paradoxmellow.com": "2026-07-21",
      "parsemesh.com": "2026-05-23",
      "parsoraviant.com": "2026-07-21",
      "parsoriumtech.com": "2026-06-15",
      "parsovaled.com": "2026-05-24",
      "parsovianlogic.com": "2026-05-24",
      "pathvera.org": "2026-05-02",
      "pawrobot.com": "2026-05-08",
      "paycrenta.com": "2026-05-02",
      "paylumon.shop": "2026-05-02",
      "payservicespro.com": "2026-05-02",
      "payshopp.net": "2026-05-02",
      "payvoltize.shop": "2026-05-02",
      "pdf-fuel.fit": "2026-05-02",
      "pdf-gear.xn-customer-67f9.info": "2026-07-28",
      "pdf-gear.xn-customer-68f2.info": "2026-07-30",
      "pdf-gear.xn-customer-68f3.info": "2026-08-01",
      "pdf-gear.xn-customer-68f5.info": "2026-08-01",
      "pdfdocred.digital": "2026-05-09",
      "pensionikesk.life": "2026-05-02",
      "pensionikeskus.life": "2026-05-02",
      "perceptiveasi.com": "2026-05-02",
      "peregrineclothing.co": "2026-05-02",
      "personal-iptv.live": "2026-05-02",
      "personal-tv.live": "2026-05-02",
      "personaltv.live": "2026-05-02",
      "phantomtuning.org": "2026-05-02",
      "phoenixpigeonremoval.com": "2026-06-06",
      "photo2-app.fun": "2026-05-02",
      "pietezi.com": "2026-07-21",
      "pizaiolo.icu": "2026-05-02",
      "pizaiolo.shop": "2026-05-02",
      "pizza73-ca.shop": "2026-05-02",
      "pizzaiiola.top": "2026-05-02",
      "pizzaiiolo.top": "2026-05-02",
      "pizzailo.shop": "2026-05-02",
      "pizzaiola.icu": "2026-05-02",
      "pizzaiola.top": "2026-05-02",
      "pizzaiolla.icu": "2026-05-02",
      "pizzaiolla.shop": "2026-05-02",
      "pizzaiolla.top": "2026-05-02",
      "pizzaiollo.icu": "2026-05-02",
      "pizzaiollo.shop": "2026-05-02",
      "pizzaiollo.top": "2026-05-02",
      "pizzaiolo.cyou": "2026-05-02",
      "pizzaiolo.top": "2026-05-02",
      "pizzaloio.shop": "2026-05-02",
      "pizzalolo.cyou": "2026-05-02",
      "pizzalolo.icu": "2026-05-02",
      "pizzalolo.shop": "2026-05-02",
      "pizzalolo.top": "2026-05-02",
      "pizzapilzza.top": "2026-05-02",
      "pizzaplza.top": "2026-05-02",
      "plainscops.it.com": "2026-05-15",
      "play-best-games.online": "2026-06-09",
      "play-best-games.website": "2026-05-27",
      "plays-to-fun-apps.com": "2026-06-18",
      "playstillway.com": "2026-05-02",
      "playzones-hub.com": "2026-05-05",
      "plexatrim.info": "2026-05-02",
      "plubgbstore.com": "2026-05-02",
      "plumbingservicestucson.com": "2026-05-27",
      "plumosity-gammoned.website": "2026-05-06",
      "plyzorva.com": "2026-05-08",
      "plzzaiolo.shop": "2026-05-02",
      "pms-manage.us": "2026-05-02",
      "pms-setup.us": "2026-05-02",
      "pnhuby.top": "2026-07-21",
      "pnhubz.top": "2026-05-18",
      "pnohub.top": "2026-06-16",
      "pochstudio.info": "2026-05-02",
      "poeritosanik.icu": "2026-05-02",
      "pofelal314.workers.dev": "2026-01-02",
      "poiiier.icu": "2026-05-12",
      "polarscres.it.com": "2026-06-06",
      "polemicized-godlessnesses.website": "2026-05-02",
      "polyvids.com": "2026-05-02",
      "pontuscarpathia.com": "2026-07-21",
      "porezna-technology.digital": "2026-05-02",
      "porezna.homes": "2026-05-02",
      "porezna.today": "2026-05-02",
      "porezna.world": "2026-05-02",
      "porn-aio.live": "2026-05-02",
      "portalvridge.com": "2026-05-02",
      "portaul.us": "2026-07-21",
      "potentility.com": "2026-05-02",
      "power-bank.digital": "2026-05-02",
      "powerblink.com": "2026-05-02",
      "powerfulbrain-hub.com": "2026-05-02",
      "pratica-mentes.com": "2026-07-22",
      "pravontix.info": "2026-05-02",
      "praxcloud.icu": "2026-05-02",
      "preschoolorlando.com": "2026-06-06",
      "pressurewashingalabama.com": "2026-06-05",
      "presta-facil-cr.com": "2026-05-02",
      "prime-city-games.site": "2026-05-02",
      "prime-game-zone.website": "2026-05-02",
      "prime-gaming-app.website": "2026-05-02",
      "primhori.it.com": "2026-06-18",
      "privatedetectivetampa.com": "2026-06-01",
      "prnhub.top": "2026-05-16",
      "pro-neustart.com": "2026-05-02",
      "promo-links.com": "2026-05-02",
      "propelwisemedia.com": "2026-05-02",
      "prorecnest.shop": "2026-05-02",
      "prosacro.shop": "2026-05-02",
      "prosolery.shop": "2026-05-02",
      "prosolis.shop": "2026-05-02",
      "proxy-edge-c5f.workers.dev": "2026-04-15",
      "ptns-sp.org": "2026-05-02",
      "pulsexor.com": "2026-05-24",
      "pulsirox.com": "2026-06-06",
      "pulsynex.com": "2026-05-16",
      "purecanopywong.com": "2026-05-02",
      "putty-info.com": "2026-05-02",
      "qa-testing-academy.com": "2026-05-02",
      "qintelai.com": "2026-05-02",
      "quadrumgroup.com": "2026-07-21",
      "qualborex.info": "2026-05-02",
      "quantafys.com": "2026-05-21",
      "quanteroza.com": "2026-05-02",
      "qubahar.com": "2026-05-02",
      "quelamira.info": "2026-05-02",
      "quietgroveover.com": "2026-05-02",
      "quilzaven.icu": "2026-05-02",
      "quixamora.info": "2026-05-02",
      "quorynex.com": "2026-05-08",
      "racedeepseek.pro": "2026-05-02",
      "racertrickwill.com": "2026-05-02",
      "radio-portugal.live": "2026-05-02",
      "radiohead.world": "2026-05-02",
      "rangermeow.com": "2026-05-02",
      "rapid.data-pipeline-9e4.workers.dev": "2026-04-15",
      "rapidonline.org": "2026-05-02",
      "reader-doc.digital": "2026-06-04",
      "readera-ebook.info": "2026-05-02",
      "rebgale.com": "2026-05-02",
      "rebgalenews.com": "2026-05-02",
      "reco-deet.online": "2026-06-06",
      "recover-mefile.online": "2026-08-06",
      "redlinetuning.org": "2026-05-02",
      "reelsqueen.com": "2026-05-02",
      "reflectface.com": "2026-08-06",
      "reise-mobiltechnik.com": "2026-05-02",
      "rem-cdn-server.mayisi1259.workers.dev": "2026-04-15",
      "remodeal.com": "2026-05-02",
      "remote-console-vmware.com": "2026-03-09",
      "render3dai.com": "2026-05-02",
      "rerluke.com": "2026-07-21",
      "resilientmindsetportal.com": "2026-07-28",
      "resterd.it.com": "2026-05-02",
      "revitalsolutions.com": "2026-05-02",
      "revolution-say.pics": "2026-05-02",
      "rich-mine-games.site": "2026-05-02",
      "risevioz.com": "2026-05-02",
      "riverbendpacks.com": "2026-05-02",
      "robwaree.net": "2026-04-15",
      "robwares.com": "2026-04-15",
      "rocrestere.com": "2026-07-28",
      "romterravest.com": "2026-07-21",
      "royaiapps.com": "2026-04-15",
      "royaiaps.com": "2026-04-15",
      "royal-play-apps.site": "2026-05-02",
      "royalscarribbean.com": "2026-05-02",
      "royalts-app.com": "2026-05-02",
      "royalts-console.com": "2026-05-02",
      "royalts-remoteops.com": "2026-05-02",
      "rrenier.icu": "2026-05-10",
      "runolfsfon.shop": "2026-05-02",
      "ruqwazen.de": "2026-05-02",
      "rustore.rvtouls.com": "2026-05-02",
      "rv-tool.net": "2026-04-15",
      "rv-toolls.com": "2026-04-15",
      "rv-tools.eu": "2026-01-12",
      "rv-tools.info": "2026-02-27",
      "rv-toolsa.com": "2026-04-15",
      "rv-toolso.com": "2026-04-15",
      "rvpro.app": "2026-08-07",
      "rvtenterprise.com": "2026-07-21",
      "rvtoo.app": "2026-08-06",
      "rvtoo.com": "2026-08-06",
      "rvtoo1.com": "2026-04-15",
      "rvtoo1s.com": "2026-01-12",
      "rvtooik.com": "2026-04-21",
      "rvtoois.com": "2026-04-15",
      "rvtoolaca.com": "2026-02-17",
      "rvtoolaca.online": "2026-02-16",
      "rvtoolacs.com": "2026-02-17",
      "rvtoolacs.online": "2026-04-15",
      "rvtoolas.com": "2026-02-16",
      "rvtoolc.info": "2026-02-24",
      "rvtoole.com": "2026-04-15",
      "rvtoolenterprise.com": "2026-07-21",
      "rvtooles.com": "2026-01-12",
      "rvtooles.info": "2026-02-25",
      "rvtooli.info": "2026-02-24",
      "rvtoolik.com": "2026-04-15",
      "rvtoolis.com": "2026-01-12",
      "rvtoolis.info": "2026-05-04",
      "rvtoolit.com": "2026-01-12",
      "rvtoolls.info": "2026-02-28",
      "rvtoollsa.com": "2026-03-24",
      "rvtoollsi.com": "2026-03-24",
      "rvtools-app.com": "2026-03-09",
      "rvtools-capacityops.com": "2026-05-02",
      "rvtools-cloud.com": "2026-03-09",
      "rvtools-dataops.com": "2026-05-03",
      "rvtools-dell.com": "2026-03-09",
      "rvtools-dev.com": "2026-02-27",
      "rvtools-download-dell.com": "2026-03-09",
      "rvtools-enterprise.com": "2026-03-09",
      "rvtools-install.com": "2026-03-09",
      "rvtools-inventory.com": "2026-03-09",
      "rvtools-kernelops.com": "2026-05-07",
      "rvtools-kit.com": "2026-03-09",
      "rvtools-official.com": "2026-03-09",
      "rvtools-optimization.com": "2026-05-09",
      "rvtools-pipeline.com": "2026-05-02",
      "rvtools-reference.com": "2026-05-02",
      "rvtools-registry.com": "2026-05-07",
      "rvtools-skillcamp.com": "2026-02-27",
      "rvtools-vmware.com": "2026-03-09",
      "rvtools-vsphere.com": "2026-03-09",
      "rvtools.link": "2026-02-27",
      "rvtools.metric-harbor.com": "2026-05-02",
      "rvtools.softwarep2p.com": "2026-05-02",
      "rvtools.vmwarevelocity.com": "2026-05-02",
      "rvtoolsac.com": "2026-01-12",
      "rvtoolsacad.com": "2026-01-12",
      "rvtoolsacs.com": "2026-02-16",
      "rvtoolsai.com": "2026-03-12",
      "rvtoolsaq.com": "2026-04-15",
      "rvtoolsax.com": "2026-02-16",
      "rvtoolsbox.com": "2026-03-12",
      "rvtoolse.info": "2026-04-26",
      "rvtoolsed.com": "2026-02-16",
      "rvtoolsen.com": "2026-04-26",
      "rvtoolses.com": "2026-02-17",
      "rvtoolseu.com": "2026-03-28",
      "rvtoolsgo.com": "2026-02-16",
      "rvtoolshq.com": "2026-02-16",
      "rvtoolsi.info": "2026-04-25",
      "rvtoolsik.com": "2026-05-14",
      "rvtoolsio.com": "2026-02-16",
      "rvtoolsit.com": "2026-03-12",
      "rvtoolsl.com": "2026-02-16",
      "rvtoolslab.com": "2026-02-16",
      "rvtoolsmax.com": "2026-03-06",
      "rvtoolsme.com": "2026-04-15",
      "rvtoolsnet.com": "2026-02-17",
      "rvtoolsnow.com": "2026-02-16",
      "rvtoolsnt.com": "2026-02-16",
      "rvtoolso.com": "2026-02-16",
      "rvtoolso.info": "2026-05-04",
      "rvtoolson.com": "2026-04-25",
      "rvtoolson.info": "2026-04-26",
      "rvtoolsone.com": "2026-03-05",
      "rvtoolspro.com": "2026-01-12",
      "rvtoolspro.info": "2026-01-12",
      "rvtoolspro.online": "2026-01-12",
      "rvtoolsrun.com": "2026-03-12",
      "rvtoolss.com": "2026-02-16",
      "rvtoolsuk.com": "2026-03-28",
      "rvtoolsun.com": "2026-02-17",
      "rvtoolsup.com": "2026-03-13",
      "rvtoolsus.com": "2026-01-12",
      "rvtoolsusa.com": "2026-01-12",
      "rvtoolsv.com": "2026-04-15",
      "rvtoolsz.com": "2026-04-15",
      "rvtoolvm.com": "2026-04-15",
      "rvtoolz.info": "2026-05-04",
      "rvtoolze.com": "2026-04-15",
      "rvtootsacad.com": "2026-04-20",
      "rvtootsad.com": "2026-04-22",
      "rvtop.app": "2026-07-21",
      "rvtoptools.app": "2026-07-21",
      "rvtouls.com": "2026-02-16",
      "rvvtools.com": "2026-02-17",
      "rychlereseni.com": "2026-05-20",
      "s.workbanch.com": "2026-05-18",
      "s3abrowser.com": "2026-05-19",
      "s3bravser.com": "2026-04-15",
      "s3brawser.com": "2026-04-15",
      "s3brovser.com": "2026-04-15",
      "s3brovvser.com": "2026-04-15",
      "s3browserenterprise.app": "2026-05-06",
      "s3browserenterprize.app": "2026-05-05",
      "sailvatore.icu": "2026-05-02",
      "sailvatore.shop": "2026-05-02",
      "sakura-travel.org": "2026-05-02",
      "salavatore.icu": "2026-05-02",
      "salavatore.shop": "2026-05-02",
      "salavattore.shop": "2026-05-02",
      "salemajeri.icu": "2026-05-02",
      "salfhlal.com": "2026-05-02",
      "salivatore.cyou": "2026-05-02",
      "salivatore.icu": "2026-05-02",
      "salivatore.shop": "2026-05-02",
      "sallvatore.cyou": "2026-05-02",
      "sallvatore.site": "2026-05-02",
      "sallvatore.store": "2026-05-02",
      "sallvattore.online": "2026-05-02",
      "sallvattore.shop": "2026-05-02",
      "sallvattore.site": "2026-05-02",
      "sallvattore.store": "2026-05-02",
      "salvattore.icu": "2026-05-02",
      "salvattore.shop": "2026-05-02",
      "salvattores.top": "2026-05-02",
      "sandboxfinancialpartners.com": "2026-05-30",
      "sapceagent.com": "2026-05-02",
      "satoricraftbox.com": "2026-05-02",
      "saxo.promo-links.com": "2026-05-02",
      "scan-engine-a2d.workers.dev": "2026-04-15",
      "scentgold.com": "2026-05-02",
      "schema-harbor.com": "2026-05-02",
      "schnellportals.com": "2026-06-19",
      "scorespend.com": "2026-05-02",
      "scuolaoperator.com": "2026-05-02",
      "seattlebathtub.com": "2026-06-06",
      "secrid-de.com": "2026-05-02",
      "securecrt-app.com": "2026-05-02",
      "securecrt-configledger.com": "2026-05-04",
      "securecrt-console.com": "2026-05-02",
      "securecrt-terminalops.com": "2026-05-02",
      "securecrt.session-ops.com": "2026-05-02",
      "securecrtrunbook.com": "2026-05-02",
      "sehopay.com": "2026-08-01",
      "sejilod7488888.workers.dev": "2026-06-07",
      "sellvarions.com": "2026-05-02",
      "sendpap.com": "2026-05-02",
      "sensational-slots.ink": "2026-05-02",
      "septictankservicing.com": "2026-05-05",
      "server-cd2.bipewi2747.workers.dev": "2026-01-02",
      "server-cdn.jawigaw383.workers.dev": "2024-11-25",
      "server-cdn.lafise2419.workers.dev": "2024-11-25",
      "server-cdn.lecoc56350.workers.dev": "2024-11-25",
      "server-cdn.sidoke9822.workers.dev": "2024-11-25",
      "server-cdn.virej10913.workers.dev": "2024-11-25",
      "server-cdn.xohahey822.workers.dev": "2024-11-25",
      "server-software-cdn.azureedge.net": "2026-06-07",
      "server-software.azureedge.net": "2026-06-07",
      "server-web-cdn.detocim498.workers.dev": "2024-11-25",
      "server-web-cdn.dones86497.workers.dev": "2026-01-02",
      "server-web-cdn.kagoli5215.workers.dev": "2024-11-25",
      "server-web-cdn.kegemom113.workers.dev": "2026-04-15",
      "server-web-cdn.mevame4224.workers.dev": "2026-01-02",
      "server-web-cdn.nefixeg373.workers.dev": "2024-11-25",
      "server-web-cdn.pixece7948.workers.dev": "2024-11-25",
      "server-web-cdn.ravebo3233.workers.dev": "2026-01-02",
      "server-web-cdn.rojotoc516.workers.dev": "2024-11-25",
      "server-web-cdn.vosax32455.workers.dev": "2024-11-25",
      "server-web-cdn.yevobod379.workers.dev": "2026-01-02",
      "server-web-cdn1.gekod80409.workers.dev": "2026-01-02",
      "server-web.sasex59966.workers.dev": "2026-01-02",
      "servertech02.workers.dev": "2026-06-07",
      "servicesml.com": "2026-05-02",
      "session-center.com": "2026-05-02",
      "session-ops.com": "2026-05-02",
      "shadowbloombay.com": "2026-05-02",
      "shadowbloomever.com": "2026-05-02",
      "shadowdancerplay.com": "2026-05-02",
      "shaimabeauty.shop": "2026-05-02",
      "shaoppay.com": "2026-05-02",
      "sharkniaenja.com": "2026-05-02",
      "shhiller.com": "2026-07-21",
      "shintralearno.com": "2026-05-02",
      "shjopay.com": "2026-05-02",
      "shlop.app": "2026-05-02",
      "shnopay.com": "2026-08-01",
      "shoepay.io": "2026-06-04",
      "sholpay.com": "2026-05-02",
      "shopapp.cc": "2026-05-02",
      "shopayse.app": "2026-05-27",
      "shopeay.com": "2026-05-02",
      "shoppau.com": "2026-05-02",
      "shopperapp.net": "2026-05-02",
      "shosppay.com": "2026-05-02",
      "shrink-say.pics": "2026-05-02",
      "shrseninjas.com": "2026-05-02",
      "sibstarpro.com": "2026-05-02",
      "sign-mess.digital": "2026-06-04",
      "sign-ms.online": "2026-07-21",
      "signal-online.digital": "2026-05-02",
      "signalonline.digital": "2026-05-02",
      "signalprivat.digital": "2026-05-05",
      "signaturedfj.us": "2026-08-06",
      "signaturedg.us": "2026-07-21",
      "signaturedj.us": "2026-08-06",
      "signatureje.us": "2026-08-06",
      "signatureji.us": "2026-08-01",
      "signmes.world": "2026-07-28",
      "siliconvalleyvet.com": "2026-05-18",
      "silverhazesoup.com": "2026-05-02",
      "sinssay.com": "2026-07-21",
      "skaldapath.com": "2026-05-02",
      "skillforge-academy.org": "2026-05-02",
      "skillignix.com": "2026-05-02",
      "skillpathlyn.com": "2026-05-02",
      "skyshiftnever.com": "2026-05-02",
      "slash-agency.org": "2026-05-02",
      "slayvortexdays.com": "2026-05-02",
      "slgnal.online": "2026-05-19",
      "smartdent-lab.com": "2026-05-02",
      "smartgpuai.com": "2026-05-02",
      "smartgrowx.com": "2026-05-02",
      "smartheatswitchs.com": "2026-05-02",
      "smartlinetech.co.uk": "2026-05-02",
      "smarttecnica.com": "2026-05-02",
      "snapriase.com": "2026-05-02",
      "snarvadir.cyou": "2026-05-02",
      "sneaxbird.icu": "2026-05-02",
      "snhopay.com": "2026-08-01",
      "snugaldor.icu": "2026-05-02",
      "snuxtrade.info": "2026-05-02",
      "social-ventures.it.com": "2026-05-07",
      "sofort-gelds.com": "2026-06-09",
      "soft-base-01.ginigiy117.workers.dev": "2024-11-25",
      "soft-dns-999.tech": "2026-06-07",
      "soft-dns-999001.store": "2026-06-07",
      "soft-dns.sejilod748.workers.dev": "2024-11-25",
      "soft-dns.sejilod7488888.workers.dev": "2026-06-07",
      "softwarep2p.com": "2026-02-27",
      "sogal69343.workers.dev": "2026-04-15",
      "solboundlandys.com": "2026-05-02",
      "solerisparimo.com": "2026-05-02",
      "soliste.it.com": "2026-06-15",
      "solscaner.app": "2026-05-02",
      "soluciones-yas.com": "2026-05-02",
      "soluzionerapide.com": "2026-05-15",
      "solventas360.com": "2026-06-07",
      "somerestlike.com": "2026-05-02",
      "sonnyanglusa.com": "2026-05-02",
      "southwestchevy.com": "2026-05-10",
      "spacepile.com": "2026-05-22",
      "sparklingsenior.com": "2026-05-25",
      "speakingmastershool.com": "2026-05-02",
      "spin-vault.com": "2026-05-05",
      "spraygraund.com": "2026-05-02",
      "spyconect.com": "2026-04-15",
      "spycygen.store": "2026-05-02",
      "square-wave-65dd.api-gateway-a3f.workers.dev": "2026-04-15",
      "squaredinc.com": "2026-05-23",
      "ssl.bapiyat727.workers.dev": "2026-01-02",
      "staoton.shop": "2026-05-02",
      "star-play-mobile.site": "2026-05-02",
      "starcrushworry.com": "2026-05-02",
      "stardriftshift.com": "2026-05-02",
      "starjumperlake.com": "2026-05-02",
      "starrfy.com": "2026-05-02",
      "statryxo.com": "2026-05-02",
      "stellar-concept.site": "2026-05-02",
      "stickman-farcers.com": "2026-05-08",
      "stimme-wirkung.de": "2026-05-02",
      "stiridininvestitii.com": "2026-07-21",
      "store-mauchs.com": "2026-05-02",
      "stores-fine23.com": "2026-05-02",
      "streakslouk.com": "2026-05-02",
      "streamhub-tv.live": "2026-05-02",
      "streamtv-hub.live": "2026-05-02",
      "studiport.com": "2026-05-02",
      "studylexz.com": "2026-05-02",
      "studysinsight.com": "2026-05-02",
      "studyviax.com": "2026-05-02",
      "subito-fatto.com": "2026-05-20",
      "sunset.vault-proxy-5d3.workers.dev": "2026-04-15",
      "sunsetkissed.com": "2026-05-02",
      "sunshinesnotes.com": "2026-05-02",
      "super-game-city.website": "2026-05-02",
      "swarthmorepubliclibrary.us": "2026-07-28",
      "sydelsierra.com": "2026-05-02",
      "synaxopath.de": "2026-05-02",
      "sync-engine-d8b.workers.dev": "2026-04-15",
      "synrecipum.shop": "2026-05-02",
      "sys-log-7qw.workers.dev": "2026-06-07",
      "tagesechode.com": "2026-05-02",
      "taiwan-interviewers.com": "2026-05-02",
      "talentsmomentum.com": "2026-05-02",
      "tamaautoservice.com": "2026-05-02",
      "tastylikeleaves.com": "2026-05-02",
      "taycharon.com": "2026-05-02",
      "teamalliant.com": "2026-05-02",
      "tech-novapro.com": "2026-05-02",
      "techelitegb.com": "2026-05-02",
      "techrecory.shop": "2026-05-02",
      "techvoltpad.shop": "2026-05-02",
      "test-runner-4b7.workers.dev": "2026-04-15",
      "testmindset.com": "2026-05-14",
      "texashardwoodfloor.com": "2026-06-15",
      "thafarmrsdog.com": "2026-05-02",
      "the-digital-news.com": "2026-05-02",
      "thefarmorsdog.com": "2026-05-02",
      "thefiarmersdog.com": "2026-05-02",
      "thefield.club": "2026-05-02",
      "theine-overall.website": "2026-05-02",
      "thenarcjournal.com": "2026-06-03",
      "thesexmart.com": "2026-05-03",
      "thewrightlegal.com": "2026-05-02",
      "thfarmrsdog.com": "2026-05-02",
      "thibaalt.icu": "2026-05-09",
      "thinkstrac.de": "2026-05-02",
      "thirtysixstore.work": "2026-05-02",
      "thisthingofours.org": "2026-05-02",
      "threivemarket.com": "2026-05-02",
      "thriftycard.shop": "2026-05-02",
      "thrillforgenight.com": "2026-05-02",
      "thrivemakret.com": "2026-05-02",
      "thrivemerket.com": "2026-05-02",
      "thrivemurket.com": "2026-05-02",
      "thrlwemarket.com": "2026-05-02",
      "thumaas.com": "2026-04-15",
      "thumaos.com": "2026-04-15",
      "thunderlaught.com": "2026-05-02",
      "tight-vnc.com": "2026-05-02",
      "tightvnc-center.com": "2026-05-02",
      "tightvnc-courseware.com": "2026-05-02",
      "tightvnc-ops.com": "2026-05-02",
      "tightvnc.session-center.com": "2026-05-02",
      "tik-app.ink": "2026-05-02",
      "tik-app.org": "2026-05-02",
      "tikltok18.live": "2026-05-02",
      "tiktko18.live": "2026-05-02",
      "tiltok18.live": "2026-05-02",
      "timocorn.com": "2026-05-02",
      "tirnocorn.info": "2026-05-02",
      "titok-app.live": "2026-05-02",
      "tjpull.com": "2026-05-02",
      "tkmathsacademy.com": "2026-05-02",
      "tokacarameis.com": "2026-05-02",
      "tokaikisen.club": "2026-05-02",
      "tokcu.top": "2026-05-18",
      "tokfi.top": "2026-05-21",
      "tokgo.top": "2026-05-22",
      "tokhu.top": "2026-05-25",
      "tokke.top": "2026-06-18",
      "tokmu.top": "2026-07-21",
      "tokqy.top": "2026-07-28",
      "tokrwards.com": "2026-05-02",
      "tolanielesokon.com": "2026-07-28",
      "tons-kohl.site": "2026-05-02",
      "toolstoreuk.live": "2026-05-02",
      "top-game-world.website": "2026-05-02",
      "top-play-app.site": "2026-05-02",
      "top-play-games.com": "2026-05-15",
      "top-play-studio.site": "2026-05-02",
      "top-tuning.org": "2026-05-02",
      "topaz-belive.site": "2026-05-02",
      "toretti.icu": "2026-05-10",
      "totalists-syndrome.website": "2026-05-07",
      "toyo-sasaki.info": "2026-05-02",
      "tradingview-app.com": "2026-05-02",
      "traidecode.com": "2026-05-02",
      "trailerflorida.com": "2026-06-09",
      "trainloftz.com": "2026-05-02",
      "trainnestz.com": "2026-05-02",
      "trainyxa.com": "2026-05-02",
      "transilvanequity.com": "2026-07-21",
      "travelfountain.com": "2026-05-30",
      "traviora.shop": "2026-08-07",
      "treeshadowmonster.com": "2026-05-02",
      "trendorabhs.com": "2026-05-02",
      "trendorabnko.com": "2026-05-02",
      "trendorabtkom.com": "2026-05-02",
      "trendoragame.com": "2026-06-01",
      "trendoramario.com": "2026-05-02",
      "trendorataraf.com": "2026-05-02",
      "trezqifo.de": "2026-05-02",
      "trinktiger.com": "2026-05-02",
      "trolley-swipe.pics": "2026-05-02",
      "truenews1.com": "2026-05-02",
      "trx-rent.com": "2026-05-02",
      "tu-salvavidas.com": "2026-05-02",
      "tubings-bonaci.site": "2026-05-02",
      "turelarnalernix.com": "2026-05-02",
      "tuser-vicio.com": "2026-05-02",
      "tutto-chiaros.com": "2026-07-28",
      "tv-aio.live": "2026-05-02",
      "tv-navegador.live": "2026-05-02",
      "tweehandwork.quest": "2026-05-13",
      "txartificialturf.com": "2026-05-23",
      "tylarlink.com": "2026-05-02",
      "tylioners.com": "2026-05-02",
      "tylorvex.de": "2026-05-02",
      "tyronpath.com": "2026-05-02",
      "ubelivery.com": "2026-05-03",
      "ui.s3browserenterprise.app": "2026-05-15",
      "uk-sibstar.com": "2026-05-02",
      "ukcampsite.reviews": "2026-05-02",
      "ukcarpfishing.org": "2026-05-02",
      "ultra-game-vault.website": "2026-05-02",
      "ultra-play-ltd.site": "2026-05-02",
      "unbiaseddaily.com": "2026-06-16",
      "uni-tv.live": "2026-05-02",
      "unionclothing.fit": "2026-05-02",
      "unispacetechsys.com": "2026-07-22",
      "unitv-ca.live": "2026-05-02",
      "universaleduet.com": "2026-06-06",
      "universalupdcode.com": "2026-05-02",
      "unwerpad.icu": "2026-05-16",
      "update.rvtoolsl.com": "2026-05-21",
      "update.rvtouls.com": "2026-05-02",
      "update.rvvtools.com": "2026-05-02",
      "urban-play-city.site": "2026-05-02",
      "urbanindustry.org": "2026-05-02",
      "urovitalmagyar.com": "2026-07-29",
      "usbouldering.com": "2026-05-25",
      "usbsv.com": "2026-08-06",
      "utahpoolsandspas.com": "2026-06-07",
      "utahposters.com": "2026-05-16",
      "valahinvestcore.com": "2026-07-21",
      "valiantwealthmanagement.com": "2026-05-31",
      "vault-proxy-5d3.workers.dev": "2026-04-15",
      "vaultopsacademy.com": "2026-05-02",
      "vchekac.com": "2026-02-17",
      "vchekacad.com": "2026-02-17",
      "vedic-uk.com": "2026-05-02",
      "velmorahubs.com": "2026-05-02",
      "velmoraqq.com": "2026-05-02",
      "velqonix.com": "2026-05-10",
      "velvetstrikehipe.com": "2026-05-02",
      "veresen.com": "2026-05-02",
      "verifica-facile.com": "2026-07-21",
      "vert-feu.com": "2026-05-20",
      "verteglo.it.com": "2026-06-16",
      "vexinakyn.com": "2026-05-02",
      "vexlanix.com": "2026-05-02",
      "vexnatira.com": "2026-05-02",
      "vibesurgeclay.com": "2026-05-02",
      "vicarageartfully.pics": "2026-05-02",
      "viguor.com": "2026-05-12",
      "vip-best-games.com": "2026-05-26",
      "vip-play-center.website": "2026-05-02",
      "vireloraq.com": "2026-05-08",
      "viretrix.com": "2026-05-10",
      "visitpandys.com": "2026-05-02",
      "visualstorycraft.com": "2026-05-02",
      "vita-novas.com": "2026-07-21",
      "vivanotizie.com": "2026-05-02",
      "vivantestudio.com": "2026-05-02",
      "vivere-meglio.com": "2026-07-21",
      "vm5042999.1nvme.had.wf": "2026-06-07",
      "vmback.com": "2026-04-15",
      "vmbacku.com": "2026-04-15",
      "vmbackups.com": "2026-04-15",
      "vmenterprise.app": "2026-07-21",
      "vmoneenterprise.app": "2026-07-21",
      "vmrentertrise.com": "2026-05-14",
      "vmsbackup.com": "2026-04-15",
      "vmw.enterprises": "2026-07-21",
      "vmware-programs.com": "2026-03-09",
      "vmware-remote-console.com": "2026-03-09",
      "vmware-rvtools.app": "2026-02-27",
      "vmware-rvtools.cc": "2026-02-27",
      "vmware-rvtools.cloud": "2026-02-27",
      "vmware-rvtools.com": "2026-02-27",
      "vmware-rvtools.ltd": "2026-02-27",
      "vmware-rvtools.org": "2026-02-27",
      "vmware-rvtools.pro": "2026-02-27",
      "vmware-rvtools.tech": "2026-02-27",
      "vmware-rvtools.us": "2026-02-27",
      "vmware-vsphere.com": "2026-03-09",
      "vmwareenterprize.app": "2026-05-06",
      "vmwarevelocity.com": "2026-02-27",
      "vmwarevsphere.com": "2026-03-09",
      "vmwenterprise.app": "2026-05-06",
      "vmwone.app": "2026-07-21",
      "vmwone.enterprises": "2026-07-21",
      "vmwoneenterprise.app": "2026-07-21",
      "volksreport.com": "2026-05-02",
      "vorlentra.com": "2026-05-08",
      "vortiqra.com": "2026-05-12",
      "voyanest.shop": "2026-08-06",
      "vrfuckablegirls.live": "2026-05-02",
      "vrfuckdolls.live": "2026-05-02",
      "vsphere-client.com": "2026-03-09",
      "vsphere-client.org": "2026-03-09",
      "vurmafied.cyou": "2026-05-02",
      "vuxtamira.icu": "2026-05-02",
      "vynqore.com": "2026-05-02",
      "w5.rvtooks.com": "2026-05-21",
      "walletcounselor.com": "2026-05-02",
      "wanderlust-journeys.org": "2026-05-02",
      "watch-aio.live": "2026-05-02",
      "wc.rvtouls.com": "2026-05-15",
      "weallmarket.com": "2026-05-02",
      "wear-london.cloud": "2026-05-02",
      "web-app.dasik14289.workers.dev": "2026-01-02",
      "web-app.larij21770.workers.dev": "2026-01-02",
      "webacncess.us": "2026-07-21",
      "webapp.ingress-ctrl-7c9.workers.dev": "2026-04-15",
      "webapp.scan-engine-a2d.workers.dev": "2026-04-15",
      "webauthisecure.us": "2026-07-28",
      "webauthseciure.us": "2026-07-21",
      "webauthsecvre.us": "2026-07-21",
      "webauthseicure.us": "2026-07-21",
      "webnaccenss.us": "2026-07-21",
      "westmiflightacademy.us": "2026-07-28",
      "white-salad-4c7f.sys-log-7qw.workers.dev": "2026-06-07",
      "wildemberborn.com": "2026-05-02",
      "wildfireheart.com": "2026-05-02",
      "wildview18.top": "2026-05-12",
      "willcountycriminaldefense.com": "2026-06-16",
      "windcarveolive.com": "2026-05-02",
      "winstonsofyork.world": "2026-05-02",
      "wizardmerge.com": "2026-05-02",
      "work-server-1.picalob750.workers.dev": "2024-11-25",
      "workbecn.com": "2026-05-18",
      "workbenc.com": "2026-05-19",
      "workbenche.com": "2026-04-07",
      "workbencn.com": "2026-04-07",
      "workbencse.com": "2026-05-20",
      "workbenech.com": "2026-04-07",
      "workbeneh.com": "2026-04-08",
      "works-forge.com": "2026-05-02",
      "worldseafishing.org": "2026-05-02",
      "wristbandalarm.com": "2026-06-06",
      "wuckeet.shop": "2026-05-02",
      "wysoria.com": "2026-05-02",
      "xenoluxa.com": "2026-05-08",
      "xentriqa.com": "2026-05-09",
      "xn-customer-67f9.info": "2026-07-28",
      "xn-customer-68f2.info": "2026-07-30",
      "xn-customer-68f3.info": "2026-08-01",
      "xn-customer-68f5.info": "2026-08-01",
      "xonilqup.de": "2026-05-02",
      "xtream-tv.live": "2026-05-02",
      "xyaraieabryade.com": "2026-07-28",
      "y.workbeneh.com": "2026-05-18",
      "y0.workbecn.com": "2026-05-18",
      "y0.workbenc.com": "2026-05-19",
      "yoforge.com": "2026-05-18",
      "youfreedomspinws.com": "2026-05-02",
      "young-tooth-5980.deram71445.workers.dev": "2026-04-15",
      "yr.rvtoolc.info": "2026-05-18",
      "yudokoro.com": "2026-05-02",
      "yv.rvtoolas.com": "2026-05-23",
      "yx.rvtooli.info": "2026-05-20",
      "z6.rvtoolsl.com": "2026-05-15",
      "z9.rvtoolso.com": "2026-05-16",
      "za-serverhub.online": "2026-06-07",
      "za.rvtoolvm.com": "2026-06-07",
      "zd.rvtoolss.com": "2026-05-16",
      "zdravljes.digital": "2026-05-02",
      "zeemann.shop": "2026-05-02",
      "zelontra.com": "2026-05-09",
      "zelovanta.com": "2026-05-10",
      "zen-iptv.live": "2026-05-02",
      "zestplay.pro": "2026-05-02",
      "zolunqer.de": "2026-05-02",
      "zopanews.com": "2026-07-21",
      "zowimcode.com": "2026-05-02",
      "zs.s3bravser.com": "2026-05-23",
      "zt.s3brawser.com": "2026-05-16",
      "zylariq.com": "2026-05-08",
      "zynelith.com": "2026-05-09",
      "zyntricaz.com": "2026-05-02",
      "zyphentra.com": "2026-05-08"
    }
  },
  "first_seen_precision": {
    "domain": {
      "app-cdn.celixi6266.workers.dev": "at-or-before",
      "app.pofelal314.workers.dev": "at-or-before",
      "bapiyat727.workers.dev": "at-or-before",
      "cdn-app-server.vewojo9572.workers.dev": "at-or-before",
      "cdn-app-web.piniyi9484.workers.dev": "at-or-before",
      "crimson-unit-2561.kopis56799.workers.dev": "at-or-before",
      "ec2-app.lewoha7320.workers.dev": "at-or-before",
      "ec2-server-noisy-band-0fe8.focapaj280.workers.dev": "at-or-before",
      "ec2-server.bayaj19162.workers.dev": "at-or-before",
      "ec2-server.gegodec527.workers.dev": "at-or-before",
      "ec2-server.milago3967.workers.dev": "at-or-before",
      "floral-paper-8eb1.pihara4672.workers.dev": "at-or-before",
      "keystore-explorer.com": "at-or-before",
      "mstore.framfarmers.co.uk": "at-or-before",
      "pofelal314.workers.dev": "at-or-before",
      "server-cd2.bipewi2747.workers.dev": "at-or-before",
      "server-web-cdn.dones86497.workers.dev": "at-or-before",
      "server-web-cdn.mevame4224.workers.dev": "at-or-before",
      "server-web-cdn.ravebo3233.workers.dev": "at-or-before",
      "server-web-cdn.yevobod379.workers.dev": "at-or-before",
      "server-web-cdn1.gekod80409.workers.dev": "at-or-before",
      "server-web.sasex59966.workers.dev": "at-or-before",
      "ssl.bapiyat727.workers.dev": "at-or-before",
      "web-app.dasik14289.workers.dev": "at-or-before",
      "web-app.larij21770.workers.dev": "at-or-before"
    }
  },
  "first_seen_range": {
    "earliest": "2024-11-25",
    "latest": "2026-08-07"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "08f0.proxy-edge-c5f.workers.dev",
      "10bet.space",
      "12.workbencn.com",
      "178.159.43.206.sslip.io",
      "1r.rvtoolsed.com",
      "1s.rvtoolsai.com",
      "1v.rvtoollsa.com",
      "1v.rvtootsad.com",
      "1yeralti.com",
      "20.rvtoolsaq.com",
      "20.rvtoolse.info",
      "20.rvtoolsme.com",
      "21.rvtoolsen.com",
      "22.rvtoolsik.com",
      "24.rvtoolis.info",
      "24.rvtoolsgo.com",
      "27.rvtoolsax.com",
      "2a.rvtoolso.info",
      "2b.rvtoolsit.com",
      "2j.rvtoolsup.com",
      "2w.s3abrowser.com",
      "3g.s3brovvser.com",
      "3p.workbenche.com",
      "40.workbencse.com",
      "45perhour.org",
      "4l.rvtoolslab.com",
      "4t.rvtoolsacs.com",
      "54.rvtoolsone.com",
      "58.rvtoolsmax.com",
      "5b.rvtoolsbox.com",
      "5n.rvtoolsrun.com",
      "7stories.sbs",
      "91movs.com",
      "9xstream.live",
      "aapanel116864.hostkey.in",
      "aapanel34768.hostkey.in",
      "abstractest-hydroski.site",
      "academytradeai.com",
      "accessbs.us",
      "accoumtsclienntsarea.us",
      "acquasicuras.com",
      "actbluecs.com",
      "actblues.net",
      "adionetjrei.shop",
      "admin.rvtoolacs.online",
      "adrilex.digital",
      "advipscan.com",
      "aexnp.com",
      "afd-esign.info",
      "afeherbopenuk.com",
      "afmo.it",
      "agora-mesmo.com",
      "agronomywork.info",
      "aiadvancedreasoning.com",
      "aiagentanalytics.com",
      "aiagentledger.com",
      "aialgocamp.com",
      "aialgocore.com",
      "aialgodrive.com",
      "aialgoflow.com",
      "aialgofusion.com",
      "aialgohash.com",
      "aialgorithmforge.com",
      "aialgorithmicforge.com",
      "aialgorithmicpath.com",
      "aialgosense.com",
      "aialgosphere.com",
      "aianalyticengine.com",
      "aianalyticmesh.com",
      "aiautomationframework.com",
      "aiautonomycore.com",
      "aibigdatamap.com",
      "aibotscale.com",
      "aibrainatelier.com",
      "aibrainframe.com",
      "aibrainlogicc.com",
      "aibrainmatrixed.com",
      "aibrainyard.com",
      "aibuildersguild.com",
      "aibuildnet.com",
      "aibuildspark.com",
      "aibytepad.com",
      "aicalcengine.com",
      "aichatbeam.com",
      "aichatfuse.com",
      "aichattask.com",
      "aichippad.com",
      "aicloudcamp.com",
      "aicloudlayer.com",
      "aicloudreactor.com",
      "aicloudthread.com",
      "aicodealpha.com",
      "aicodebeam.com",
      "aicodebrain.com",
      "aicodefoundry.com",
      "aicodeport.com",
      "aicognexora.com",
      "aicognistack.com",
      "aicognitiongrid.com",
      "aicognitiveforge.com",
      "aicognitiveframework.com",
      "aicognivaults.com",
      "aicomputedgrid.com",
      "aiconsciousgrid.com",
      "aicontentarc.com",
      "aicoremodels.com",
      "aicortexlayer.com",
      "aicortexnexus.com",
      "aicyberbyte.com",
      "aicybercraft.com",
      "aicyberimatrix.com",
      "aicybernode.com",
      "aicyberpath.com",
      "aicyberscale.com",
      "aidadynamics.com",
      "aidatabay.com",
      "aidataclustering.com",
      "aidatafathom.com",
      "aidataprime.com",
      "aidatasflux.com",
      "aideepanalytics.com",
      "aideepboard.com",
      "aideepdeck.com",
      "aideepflux.com",
      "aideepreasoning.com",
      "aideepspark.com",
      "aidigitalmesh.com",
      "aiepochepixels.com",
      "aievolvelogic.com",
      "aifuturewave.com",
      "aigainforge.com",
      "aigenorbit.com",
      "aigripe.com",
      "aihyperepoch.com",
      "aihyperpulse.com",
      "aiimageflux.com",
      "aiimagelayer.com",
      "aiinsighttgrid.com",
      "aiintellifuse.com",
      "ailabsync.com",
      "ailayergrid.com",
      "ailearnstack.com",
      "ailogiccanvas.com",
      "ailogicfetch.com",
      "ailogicframe.com",
      "ailogicmatrix.com",
      "ailogicmesh.com",
      "ailogicnest.com",
      "ailogicpod.com",
      "ailogicscale.com",
      "ailogicvault.com",
      "aimatrixbeam.com",
      "aimatrixcast.com",
      "aimatrixcore.com",
      "aimediabox.com",
      "aimediapath.com",
      "aimetanode.com",
      "aimindbuilders.com",
      "aiminddock.com",
      "aimindgenesis.com",
      "aimodeldrift.com",
      "aimodelrun.com",
      "aimodelworks.com",
      "aineuralcascade.com",
      "aineuralfabric.com",
      "aineuralforge.com",
      "aineuralinference.com",
      "aineuralline.com",
      "aineurallnet.com",
      "aineuralnex.com",
      "aineuralpath.com",
      "aineuralpulse.com",
      "aineuralquery.com",
      "aineuralscribe.com",
      "aineurodeck.com",
      "aineurofluxion.com",
      "aineurogenesis.com",
      "aineuroloop.com",
      "aineuronspark.com",
      "ainewlevelwealth.com",
      "ainexorasystem.com",
      "ainexusgear.com",
      "ainexuspoint.com",
      "ainexussync.com",
      "aio-streamer.live",
      "aio18app.live",
      "aioptimizecore.com",
      "aiparadigmmodel.com",
      "aipathstoday.com",
      "aipatternscan.com",
      "aipixelepoch.com",
      "aipixelflow.com",
      "aipredictai.com",
      "aipredictivecode.com",
      "aipredictivecore.com",
      "aipredictivesystem.com",
      "aiprocessnexus.com",
      "aiprocessvault.com",
      "aiprompttask.com",
      "aiprotocolmesh.com",
      "aiqantumsynapse.com",
      "aiquantaforge.com",
      "aiquantumlogic.com",
      "aiquantumorbit.com",
      "aiquantumrelay.com",
      "aiquantumweave.com",
      "airastbercore.com",
      "airoboticsdata.com",
      "airoboticslogic.com",
      "airobotmind.com",
      "airsoftware.asia",
      "aisecureframework.com",
      "aisecureprocessing.com",
      "aisemanticnexus.com",
      "aisensedock.com",
      "aisentientgrid.com",
      "aisignalengine.com",
      "aismartccore.com",
      "aismartchassis.com",
      "aismartcortex.com",
      "aismartdirectionflow.com",
      "aismartfabric.com",
      "aismartlogic.com",
      "aismartmark.com",
      "aismartmindsystem.com",
      "aismartplatforms.com",
      "aismartpod.com",
      "aisolutioncore.com",
      "aisolvenet.com",
      "aispeechroute.com",
      "aisvectorflowen.com",
      "aisynapseboost.com",
      "aisynapseecho.com",
      "aisynapseedge.com",
      "aisynapselab.com",
      "aisynapsematrix.com",
      "aisynapsenet.com",
      "aisynapticforge.com",
      "aisynthesisno.com",
      "aisynthesisnodes.com",
      "aisynthevora.com",
      "aisysprofileage.com",
      "aitechyard.com",
      "aitensorcore.com",
      "aitensorgrid.com",
      "aitensorvault.com",
      "aitestcore.com",
      "aitextscale.com",
      "aivectorflow.com",
      "aivectornexis.com",
      "aivisioneye.com",
      "aivisionhost.com",
      "aivisionpoint.com",
      "aivoicehash.com",
      "aiwealthfirstmain.com",
      "akaccessories.com",
      "aksecurityandlocksmith.org",
      "albertaservice.net",
      "albertaservices.org",
      "alert-router-b3a.workers.dev",
      "alfrog.com",
      "allbestselling.com",
      "alldocreader.ink",
      "alpine-quest.live",
      "alterasgroup.it.com",
      "amf-capital.it",
      "amzslotplay.xyz",
      "analizainvestitii-ro.com",
      "ancora-shop.com",
      "angelliost.com",
      "angryenterprise.app",
      "angryip.cloud",
      "angryipa.com",
      "angryipac.com",
      "angryipac.net",
      "angryipsc.com",
      "apaalieo.com",
      "apaileo.shop",
      "apaliieo.com",
      "apallieo.com",
      "apexorix.com",
      "apexvideoproduction.com",
      "api-gateway-a3f.workers.dev",
      "api.rvtoolacs.online",
      "aplicado24tv.stream",
      "app-cdn-software-gza4gebuf3cqd8h6.z03.azurefd.net",
      "app-cdn.celixi6266.workers.dev",
      "app-grand-win.website",
      "app-hypeliquid.xyz",
      "app-server.comof72509.workers.dev",
      "app.alldocreader.ink",
      "app.iptv24.live",
      "app.mediahubtv.live",
      "app.personaltv.live",
      "app.pofelal314.workers.dev",
      "app.porn-aio.live",
      "app.sync-engine-d8b.workers.dev",
      "app.tikltok18.live",
      "app.tiktko18.live",
      "app.tiltok18.live",
      "app.tv-aio.live",
      "app.watch-aio.live",
      "appalleo.com",
      "appcraft-academy.com",
      "apps-and-grid-play.com",
      "aquazdroj.club",
      "aquilenthes.info",
      "arcfetch.com",
      "arcoriumforge.com",
      "arcparse.com",
      "arcylianquanta.com",
      "arcyloriantech.com",
      "areacleintsacounts.us",
      "areaclienntsaccoumts.us",
      "arizonastables.com",
      "armada-club-top.website",
      "armada-games-app.website",
      "armada-grand-win.website",
      "artisanskillsacademy.com",
      "arvatomedia.com.de",
      "arvelionis.com",
      "arz-darmstadt.it.com",
      "arz-service.it",
      "assche.com",
      "astem-de.it.com",
      "astem.it.com",
      "astronexus.pro",
      "atlantaitsolutions.com",
      "atlasgrous.it.com",
      "atlpropertymanagers.com",
      "atomlcwallet.us",
      "atxauction.com",
      "audioassisten.com",
      "aureliaromfund.com",
      "auroraagencies.com",
      "auroragutters.com",
      "austinbariatrics.com",
      "austinportapotty.com",
      "authorlzeacsess.us",
      "authorlzesitte.us",
      "autnhentcation.us",
      "autnhentlcation.us",
      "autocarsvehicles.live",
      "autoglasguercam.com",
      "automotiveblog.club",
      "autophorie.blog",
      "autovehicles.live",
      "avond.it.com",
      "axonesubrogation.quest",
      "ay.hornetsecuty.com",
      "babmbach.com",
      "back-europ.it.com",
      "baeko.it.com",
      "balatonvitalworks.com",
      "baltimorepsychic.com",
      "bapiyat727.workers.dev",
      "baptissa.com",
      "bargainlenders.com",
      "barnecnoble.com",
      "bayareafencecompany.com",
      "bayareawaterheater.com",
      "bayleaf.icu",
      "bayleafkits.top",
      "bbi-esign.info",
      "beauty-alliance.it.com",
      "beehtelar.shop",
      "beekeeperstudio-db.com",
      "beekeeperstudio.cc",
      "beekeeperstudio.co",
      "beekeeperstudio.pro",
      "beekeeperstudio.softwarep2p.com",
      "beekeeperstudio.space",
      "beekeeperstudio.tech",
      "benavivez.com",
      "bennyshvac.com",
      "bespokecufflinkjournal.com",
      "best-mine-site.website",
      "bestcasinoroom.com",
      "bestgames-play.com",
      "bewidata.it.com",
      "bingbong.website",
      "blariba.com",
      "blazehollow.com",
      "blitzblox.com",
      "blluewine.com",
      "bloodgroupcrib.com",
      "blorfizan.cyou",
      "blowout-palefaces.website",
      "botelcopay.com",
      "botelcopay.icu",
      "botelcopay.info",
      "botelcopay.net",
      "botelcopay.online",
      "botelcopay.run",
      "brandhighland.com",
      "braxitrade.info",
      "braynebays.com",
      "breitenbern.shop",
      "breonros.it.com",
      "bridgenexis.com",
      "bridgetontowing.com",
      "brightenforge.com",
      "brightflowz.org",
      "brightlabsz.com",
      "brightlfunds.com",
      "brisktangent.com",
      "browser-tv.live",
      "buchanancapitalpartners.com",
      "bucurestivantage.com",
      "buletineconomic.com",
      "bunbun-fishing.org",
      "burnout-pravention.com",
      "businessfundwell.com",
      "buycanclear.com",
      "buyitallnow.com",
      "buymolle.com",
      "byteforgenova.com",
      "bytevaranlabs.com",
      "bytonrian.com",
      "bytorianforge.com",
      "caffedigitale.com",
      "calm-haze-cdae.test-runner-4b7.workers.dev",
      "calmgroves.com",
      "camarillotowing.com",
      "cameranextpro.com",
      "cantharides-obscene.website",
      "capitalrios.com",
      "carereroom.pro",
      "carlifeyamato.com",
      "carnieal.com",
      "carpatiareport.com",
      "carrierbrokeragreements.us",
      "carvalhl.site",
      "cashlatvia.com",
      "casino-vitoria.ink",
      "casinobonusranking.com",
      "casnellano.icu",
      "casualjuegosportal.net",
      "cdn-ae.azureedge.net",
      "cdn-app-server.vewojo9572.workers.dev",
      "cdn-app-software-3425.tech",
      "cdn-app-software-67423.store",
      "cdn-app-web.piniyi9484.workers.dev",
      "cdn-server-1.xiren77418.workers.dev",
      "cdn-server-2.wesoc40288.workers.dev",
      "cdn-server-full.taros12579.workers.dev",
      "cdn-web-app-10.site",
      "cdn-web-app-10.tech",
      "cdn-web-server1.techserver01.workers.dev",
      "cdn1.cowivat156.workers.dev",
      "cdn1.poyag17470.workers.dev",
      "cedarspoint.it.com",
      "celestes-occasion.website",
      "cemteracsess.us",
      "cemtercliemt.us",
      "cemtersitte.us",
      "cemterweb.us",
      "centrises.com",
      "chain-analys.eu.com",
      "chainbork.com",
      "chaosbloomcheck.com",
      "chargesmartuk.com",
      "chatusability.com",
      "chatuxlab.com",
      "cheapsigscanada.com",
      "cheoasanarnnda.com",
      "cherniymehmet.com",
      "chickensroad.ink",
      "chicopeetowing.com",
      "chinohillstowing.com",
      "chiroaz.com",
      "chvent.com",
      "cinchona-congruence.site",
      "cinematographymastery.com",
      "cipheriumforge.com",
      "cipheriumlabs.com",
      "cipherlix.com",
      "cipherquantix.com",
      "claysoultrue.pro",
      "claytonpestcontrol.com",
      "cleintsareaacounts.us",
      "clienntsareaaccoumts.us",
      "climasubito.com",
      "cloudbillers.com",
      "cloudsurferway.com",
      "cloudwhispercheep.com",
      "club-play-grand.website",
      "club-vegas-casino.ink",
      "cmcmarkets.promo-links.com",
      "co-part-offset.live",
      "coba-osnabrueck.it.com",
      "cocuscompany.com",
      "code-wallets-de.com",
      "cognopix.com",
      "comof72509.workers.dev",
      "compassgrowpat.com",
      "computerservicesource.com",
      "connecticutcre.com",
      "contextualdesigns.com",
      "contorion-uk.com",
      "controle-universal.fit",
      "cooperativebamkcafe.com",
      "cooperativecaffes.us",
      "cooperativecollectivecafe.com",
      "cooperativecreatives.com",
      "cooperativecreatives.us",
      "cooperativecreativs.com",
      "corden.it.com",
      "corevantaq.com",
      "corevoryx.com",
      "corlopt.it.com",
      "crafteddreams.net",
      "craftycuddle.com",
      "craneservicepa.com",
      "crankous-plumosity.website",
      "crazy-app.best",
      "crazy-app.ink",
      "creativewritingretreats.com",
      "creditanova.com",
      "cresterero.com",
      "crestpoints.it.com",
      "crimson-unit-2561.kopis56799.workers.dev",
      "cromwellstorage.com",
      "crown-advisor.com",
      "crredixas.com",
      "cryptazal.icu",
      "cryptofinance.com.de",
      "csdob.com",
      "cullendersbarnacles.quest",
      "cupertinoconstruction.com",
      "cyberrec.shop",
      "cybershield-academy.net",
      "cystocarehungary.com",
      "d-extrax.com",
      "daddled-overgirds.website",
      "daddled-uncinariasis.website",
      "daiwa-cycle.pro",
      "daniel-foster.workers.dev",
      "danrodphotos.com",
      "danubereview.com",
      "danubiusgrowthlab.com",
      "dark-bar-d282.nina-alvarez.workers.dev",
      "dash-server.servertech03.workers.dev",
      "dash-server2.servertech02.workers.dev",
      "dashbourd.us",
      "data-pipeline-9e4.workers.dev",
      "database-dbeaver.com",
      "database-heidisql.com",
      "database-lists.com",
      "datagrip-logic.com",
      "dataops-center.com",
      "datatools26.org",
      "datovenza.com",
      "dawnsparknever.com",
      "db-proxy-9b2.daniel-foster.workers.dev",
      "dbeaver-architect-hub.com",
      "dbeaver-ce.com",
      "dbeaver-center.com",
      "dbeaver-connect.com",
      "dbeaver-database.app",
      "dbeaver-database.cc",
      "dbeaver-database.cloud",
      "dbeaver-database.co",
      "dbeaver-database.com",
      "dbeaver-database.org",
      "dbeaver-database.pro",
      "dbeaver-database.tech",
      "dbeaver-database.us",
      "dbeaver-datamesh.com",
      "dbeaver-dataops.com",
      "dbeaver-db.com",
      "dbeaver-dba-foundation.com",
      "dbeaver-failover.com",
      "dbeaver-join.com",
      "dbeaver-munster.com",
      "dbeaver-project.com",
      "dbeaver-protocol.com",
      "dbeaver-schema.com",
      "dbeaver-sqlhub.com",
      "dbeaver-sqlops.com",
      "dbeaver-workspace.com",
      "dbeaver.dataops-center.com",
      "dbeaver.schema-harbor.com",
      "dbeaver.softwarep2p.com",
      "dbforges.com",
      "dealsauctions.com",
      "dede1000x.com",
      "deep-mine-app.site",
      "deepcipherquanta.com",
      "deepfluxorian.com",
      "deeporiumforge.com",
      "deguercuernavaca.mx",
      "deltacasino.website",
      "delvonax.cyou",
      "demapas.com",
      "denizened-blowout.website",
      "dentagen.it.com",
      "der-postillon.org",
      "deram71445.workers.dev",
      "dev-web-serv.noroho5002.workers.dev",
      "dev.rvtoolacs.online",
      "dev1-server.sogal69343.workers.dev",
      "devartc.com",
      "devartes.com",
      "devartos.com",
      "devartq.com",
      "devartsi.com",
      "devolutions-adminops.com",
      "devolutions-center.com",
      "devolutions-endpoint.com",
      "devolutions-fieldcraft.com",
      "devolutions-governance.com",
      "devolutions-itdesk.com",
      "devolutions-manager.com",
      "devolutions-rdm.click",
      "devolutions-rdm.com",
      "devolutions-rdm.online",
      "devolutions-stack.com",
      "devolutions-subnetlab.com",
      "devolutions-sysarch.com",
      "devolutions.rd-manager.com",
      "devolutions.space",
      "devolutions.workgridlab.com",
      "devolutionscontrolroom.com",
      "devopstechnologies.site",
      "dexelora.com",
      "dexentraq.com",
      "dexontra.com",
      "dexorith.com",
      "dexovanta.com",
      "dexscreeners.cloud",
      "dexscreeners.ink",
      "dexscreeners.life",
      "dexscreeners.pics",
      "dexscreeners.sbs",
      "dexscreeners.shop",
      "dicknns.shop",
      "die6.it.com",
      "digitalsystemprofit.com",
      "dirtyca.top",
      "dirtyup.top",
      "dirtyus.top",
      "discoveryrails.com",
      "disk-7133.identity-svc-9mz.workers.dev",
      "diskqenios.com",
      "diversionarcade.net",
      "dividexusstel.digital",
      "divine-glitter-cfb4.elena-morales.workers.dev",
      "doglep.com",
      "dogtrainingdfw.com",
      "download-tightvnc.com",
      "download.rvtools-dev.com",
      "download.rvtools-skillcamp.com",
      "dowojnes.com",
      "dr.hornetsecuety.com",
      "draxafied.cyou",
      "dreamchaserpeak.com",
      "dreamrupturevice.com",
      "dreamspinhub.com",
      "dreamweavegrey.com",
      "drenslio.it.com",
      "drexano.de",
      "driftpixelmonster.com",
      "duskblazeworld.com",
      "dy.hornetseculty.com",
      "e-gradanis.info",
      "e-hzz.info",
      "e-hzz.world",
      "e-hzzo.digital",
      "e-hzzo.homes",
      "e-porezn.digital",
      "e-porezn.org",
      "e-porezn.world",
      "e-porezna.homes",
      "e-porezna.org",
      "e-porezna.world",
      "e-poreznas.digital",
      "e-porezno.digital",
      "e-zdrav.org",
      "e-zdravlj.digital",
      "e-zdravlj.info",
      "e-zdravlje.info",
      "e-zdravlje.life",
      "e-zdravlje.today",
      "e-zdravljes.digital",
      "ec2-app.lewoha7320.workers.dev",
      "ec2-server-noisy-band-0fe8.focapaj280.workers.dev",
      "ec2-server.bayaj19162.workers.dev",
      "ec2-server.gegodec527.workers.dev",
      "ec2-server.milago3967.workers.dev",
      "echofallsr.com",
      "echofallsupport.com",
      "ecohomelive.org",
      "economiaazi.com",
      "ecorecip.shop",
      "ecovoltkit.shop",
      "ede.it.com",
      "edge-proxy-7kx.workers.dev",
      "eds-go.life",
      "eds-life.life",
      "eds-on.life",
      "eds-online.icu",
      "eduglen.com",
      "edulustra.com",
      "edutrelix.com",
      "egeszsegtippek-magazin.com",
      "egradani.icu",
      "einfacheonlineanfrage.com",
      "ek-retail.it.com",
      "elasticsa.com",
      "elasticse.com",
      "elasticso.com",
      "electdev.com",
      "electricshop.org",
      "elena-morales.workers.dev",
      "eletrue.com",
      "elevatsys.it.com",
      "eliasic.com",
      "elite-games-ltd.website",
      "elite-play-base.website",
      "emcocoftvare.com",
      "emcosoftwr.com",
      "enem-inep2025.com",
      "entretenimientoplay.net",
      "eporezna.info",
      "eporezna.world",
      "equipmentohio.com",
      "esanewablogo.com",
      "estnews-ro.com",
      "etherial.groover.workers.dev",
      "etsena.eu.com",
      "eurobaustoff.it.com",
      "eurodelkredere.it.com",
      "evans-esign.info",
      "evolutionblends.com",
      "evolutionpestcontrol.com",
      "evolyraz.com",
      "exomegene.com",
      "exosomegene.com",
      "expatpower.com",
      "expresss-fin.com",
      "ezdravlj.info",
      "ezdravlje.digital",
      "ezdravlje.org",
      "fabsaintsimons.org",
      "faithful-sigh.com",
      "falor75.com",
      "falserollplay.com",
      "fareharbores.com",
      "fast-play-city.site",
      "fastpanel116864.hostkey.in",
      "feedlister.com",
      "feleasofit.com",
      "feleasot.com",
      "felenasofts.com",
      "felenasoftse.com",
      "fenceidaho.com",
      "fenlira.de",
      "fileseekslay.pro",
      "filezilla-app.com",
      "filezilla-workspace.com",
      "filmoperatorschule.com",
      "filodarte.net",
      "finanseller.com",
      "finanziahubs.com",
      "findoffering.com",
      "finex-pert.com",
      "fingrowe.com",
      "finnarco.com",
      "finsolis.shop",
      "fintherix.com",
      "fiotidasorte2025.com",
      "firstbaze.com",
      "fisheryguide.org",
      "fishingguidesmiami.com",
      "fiveback.xyz",
      "fivebackgift.io",
      "fivebackgiftus.com",
      "fiviebelow.com",
      "fl-studio-mobile.fit",
      "flairfootballs.com",
      "flameechosaber.com",
      "fleksskell.ink",
      "flexiblemoeglichkeiten.com",
      "flightradar-canada.com",
      "floral-grass-3c6f.cowivat156.workers.dev",
      "floral-paper-8eb1.pihara4672.workers.dev",
      "florovex.com",
      "fluxelyx.com",
      "fluxileir.com",
      "fluxiqa.com",
      "fluxiroz.com",
      "fluxiverianlabs.com",
      "fluxoderia.com",
      "fluxontra.com",
      "fluxoraviantech.com",
      "fluxoriumlabs.com",
      "fluxquantatech.com",
      "fluxquantorian.com",
      "flywerd.it.com",
      "fokuspyna.com",
      "fokussperk.com",
      "fortcampbellausa.com",
      "francefinhelp.com",
      "freaegent.com",
      "freeagenlt.com",
      "fresagent.com",
      "frialerynetuha.com",
      "friloktertys.de",
      "frostveilslay.com",
      "frostysmiles.com",
      "fuer-sie-eg.it",
      "fuleroidos.de",
      "fuzionssolens.it.com",
      "fuzoyesos.de",
      "g.rv-tools.info",
      "gadgman.ink",
      "game-city-ltd.site",
      "gammoned-dopier.website",
      "gamorz.com",
      "garagedoorscentralflorida.com",
      "gates-olympus.live",
      "gauleteres.de",
      "gbdiystore.art",
      "gcrda.com",
      "geliopetry.de",
      "gersolaoe.de",
      "getetenos.com",
      "getreceived.com",
      "getting-keepass.com",
      "getxenow.com",
      "gfilimtonkas.de",
      "giftcardmallmygiftac.com",
      "giftcardmallmygiftai.com",
      "giftcardmallmygiftf.com",
      "giftcardmallmygiftss.com",
      "giftcardmallmygiftsus.com",
      "giftcardmallmygiftus.com",
      "giftcardmallus.com",
      "giftcardsecure.com",
      "giftcodemygift.xyz",
      "gijeqiko.de",
      "gis-arta.online",
      "glavonix.info",
      "glaxtonia.info",
      "gleization-leptospiroses.website",
      "glidepilotjp.com",
      "global-games-ltd.website",
      "global-iptv-china.live",
      "global-iptv-japan.live",
      "global-iptv-korea.live",
      "glow-skinstore.com",
      "glowreignmost.com",
      "gloxtram.info",
      "glucometrwellness.com",
      "go-play-ltd.site",
      "godlessnesses-game-city.website",
      "gogisich.shop",
      "gold-game-apps.site",
      "gold-iptv-portugal.live",
      "gold-mine-app.site",
      "goshipppo.com",
      "gospffuf.com",
      "gothepuff.com",
      "gq.harnetsecurlty.com",
      "gradani.digital",
      "graphicin.com",
      "greenbase.it.com",
      "gridmellow.com",
      "grok-assistente.live",
      "groover.workers.dev",
      "grubfoaub.com",
      "grubphub.com",
      "grubshubs.com",
      "gruihub.com",
      "grulbhub.com",
      "grusthub.com",
      "gyogynovenyvilag24.com",
      "gzlarza.com",
      "h3.horpetsecurity.com",
      "hair-clipper.icu",
      "handwerkzeit.com",
      "harborfreihgt.net",
      "harnetsecuriity.com",
      "harnetsecurity.com",
      "harnetsecurlty.com",
      "harrybradley.com",
      "hartmarn.shop",
      "hauswaermepumpe.com",
      "havenlys.com",
      "heatfuturenow.com",
      "heavychest.com",
      "heeev.com",
      "heidisql-app.com",
      "heidisql-center.com",
      "heidisql-connect.com",
      "heidisql-db.com",
      "heidisql-enterprise.app",
      "heidisql-enterprise.cc",
      "heidisql-enterprise.cloud",
      "heidisql-enterprise.co",
      "heidisql-enterprise.com",
      "heidisql-enterprise.ltd",
      "heidisql-enterprise.org",
      "heidisql-enterprise.pro",
      "heidisql-enterprise.tech",
      "heidisql-enterprise.us",
      "heidisql-project.com",
      "heidisql-queryladder.com",
      "heidisql-schema.com",
      "heidisql-studio.com",
      "heidisql-workbench.com",
      "heidisql.database-lists.com",
      "heidisql.space",
      "heimatjetzt.com",
      "henriiues.space",
      "henriquee.com",
      "heritage-interiiors.com",
      "hexenabenteuer.com",
      "hirekazegeszsegrol.com",
      "hodkhewicz.shop",
      "hohnston.shop",
      "hongkongfocus.com",
      "honorivalearn.com",
      "hootsuite.promo-links.com",
      "hopeplayeaux.com",
      "horizon-client-download.com",
      "horizonenterprise.app",
      "hornetsecuety.com",
      "hornetseculty.com",
      "hornetsecurety.com",
      "hornetsecurty.com",
      "hornetsecuty.com",
      "horpetsecurity.com",
      "hostupdate.site",
      "hotnewsreels.com",
      "hplpert.shop",
      "hrs-store.com",
      "hunativ.com",
      "hungarovitalcenter.com",
      "hunherbal.com",
      "huttonagency.com",
      "hyperliqiud.cc",
      "hyperlora.com",
      "hypohq.com",
      "iaclaude.com",
      "ibispaint.ink",
      "icelap.com",
      "identity-svc-9mz.workers.dev",
      "ideogramy.com",
      "ideyakraaft.com",
      "illinoismerchantservices.com",
      "immovablenesses-wishfulnesses.website",
      "impulso-familiar.com",
      "impulsolatinohn.com",
      "imputation-daddled.website",
      "imputation-regretful.website",
      "independentuknews.com",
      "indianatowingservice.com",
      "infomediabeen.top",
      "infopiete.com",
      "infusiya.com",
      "ingress-ctrl-7c9.workers.dev",
      "inrvsa.com",
      "inscricao-enem2025.com",
      "inteero.org",
      "inteligente-iptv.live",
      "intellectforge.com",
      "interviewakademiedeutschland.com",
      "interviewerbest-de.com",
      "intex360.com",
      "iperiusremot.app",
      "iperiusremote.app",
      "iperiusremote.online",
      "iptv-pt.live",
      "iptv-smart.ink",
      "iptv-tugao.live",
      "iptv-xtream.live",
      "iptv24-app.online",
      "iptv24.live",
      "ispyconect.com",
      "it-quotidiana.com",
      "ital-secure.com",
      "italia-interviewers.com",
      "itasobres.com",
      "iterm2.fabsaintsimons.org",
      "itmurrieta.com",
      "ivms-4200.com",
      "iwervoex.icu",
      "japanesale.icu",
      "jaskolski.shop",
      "jeeplandgrow.pro",
      "jensenprinting.com",
      "jeremywray.com",
      "jogar-cassino.live",
      "joinmorteseek.com",
      "jokerlandia.pro",
      "jokers-club-app.online",
      "jondoninc.com",
      "jongbloedwheels.com",
      "joubert.icu",
      "jourjan.icu",
      "jpbluesalter.top",
      "jpmdswap.com",
      "jponeclean.icu",
      "juegosocialhub.net",
      "juisekingd.com",
      "junexley.digital",
      "junglebet.website",
      "jurnaleconomic.com",
      "kaatzer.shop",
      "kaizenflowtrade.com",
      "kalosintelligence.com",
      "kalosrobotics.com",
      "kamerakunstakademie.com",
      "kaneko-optical.info",
      "kanta-suomi.info",
      "kanta.info",
      "karpatwellnesslab.com",
      "kaxij51156.workers.dev",
      "keepass-client.com",
      "kegemom113.workers.dev",
      "kelulurn.com",
      "kertelssugiaho.com",
      "keston-carcare.com",
      "keycornthegoldkey.us",
      "keystore-explorer.com",
      "keystore-explorer.site",
      "kibanal.com",
      "kievstar.digital",
      "kikuchikara-jp.com",
      "kimimena.com",
      "kiroxpath.com",
      "kitchekinetic.com",
      "klivontra.icu",
      "knowarya.com",
      "knoweriq.com",
      "knowledgejumps.com",
      "kokoro-travel.org",
      "kosquex.fit",
      "krylentra.com",
      "krypkryphora.com",
      "kryptrona.com",
      "lairatech.it.com",
      "landioverday.com",
      "landloverday.com",
      "lchmeler.shop",
      "leafdriftlandys.com",
      "learnarabroostz.com",
      "learndriftz.com",
      "learnkomm.com",
      "learnoxaorira.com",
      "learnzypp.com",
      "legacydate.com",
      "lernkompass-de.com",
      "lestrangelondon.work",
      "letreton.icu",
      "letssignjapan.com",
      "liberolavoro.com",
      "libracontrol.com",
      "lifewarehouses.com",
      "linkbioda.com",
      "liqvorax.de",
      "little-frog-2e65.kaxij51156.workers.dev",
      "live-fun.ink",
      "lively-37b6.edge-proxy-7kx.workers.dev",
      "lleraedosimuba.com",
      "lnastcart.com",
      "lnstcard.com",
      "lnstecart.com",
      "log-ingest-f1d.nina-alvarez.workers.dev",
      "logpayset.pro",
      "lorettostorage.com",
      "ltngworth.icu",
      "lucky-portal.com",
      "lufkintowing.com",
      "lumensavesolar.com",
      "luminousfinancialgroup.com",
      "lumverse.shop",
      "lunarwhisper.world",
      "lunatrixo.com",
      "lunettes-selection-de.com",
      "lurnexpulse.com",
      "lusthack.com",
      "luxebilliards.com",
      "macchetti.icu",
      "macejkovic.shop",
      "magiciansd.com",
      "magyarurocare.com",
      "mail.aussierealestate.net.au",
      "maisondu-bois.com",
      "majimaya.org",
      "manabi-michi.com",
      "marbellavacations.com",
      "markden.com",
      "masjidimamalias.com",
      "mavorapath.com",
      "maxgenhoupe.pro",
      "mayisi1259.workers.dev",
      "md-ahk.com",
      "mediahubtv.live",
      "mediaifnosocia.icu",
      "mega-app-games.website",
      "mega-play-hub.site",
      "mel-peludinhos.com",
      "memeclip.org",
      "mentoxapath.com",
      "meridiasolution.it.com",
      "meritkings.org",
      "meshcipherlab.com",
      "meshoramor.com",
      "meshorialquant.com",
      "meshorianforge.com",
      "meshoverian.com",
      "meshquantumlab.com",
      "meshvariantech.com",
      "mesitunel.it.com",
      "methodunit.fun",
      "metric-harbor.com",
      "miamiposters.com",
      "michiganfostercarecloset.us",
      "michigansecurityguard.com",
      "midnightridergrey.com",
      "mikestonegoldcard.com",
      "mikoflow.org",
      "millpp.com",
      "mim-iptv.live",
      "mindaicademia.com",
      "mindarablock.com",
      "mindevarafluxis.com",
      "mindexiscorez.com",
      "mindospherex.com",
      "mindzocore.com",
      "mine-gold-play.site",
      "minidoxiepups.com",
      "mioriticholdings.com",
      "mirae-patho.com",
      "missyork.com",
      "misterorgan.com",
      "mistertradeai.com",
      "mistfoldteddy.com",
      "mixenaz.com",
      "mobaxterm-app.com",
      "mobaxterm-terminal.com",
      "mobaxterm.console-workspace.com",
      "mobaxtermatlas.com",
      "mobaxtermdesk.com",
      "mobile-game-city.website",
      "mobilescoding.de",
      "model-engineer.family",
      "molassist.com",
      "moltsavvy.com",
      "monbonvivant.com",
      "moneyfinla.com",
      "moneyresor.com",
      "monitoreffect.com",
      "monitorulcapitalului.com",
      "monsieurs-paris.com",
      "monstergrowdeep.pro",
      "moonwhisperhaze.com",
      "moonwhisperlake.com",
      "moorabanco-ad.com",
      "moraabanco-ad.com",
      "morabanco-ad.com",
      "moretti-menswear.com",
      "mornava.com",
      "motorverso.org",
      "moverssocal.com",
      "movobility.com",
      "moxabazco.info",
      "moxabrain.info",
      "moxantria.cyou",
      "moxatrade.info",
      "moxatrend.icu",
      "msperformance.org",
      "mstore.framfarmers.co.uk",
      "mud.alert-router-b3a.workers.dev",
      "musclebrite.com",
      "musicolet.live",
      "myeks.com",
      "mygift-myonlymail.com",
      "myndlyft.org",
      "myndpusha.com",
      "mytoolshed.club",
      "nailsope.com",
      "narz-avn.it",
      "nelmods.com",
      "neonreport.com",
      "neonwhisperbay.com",
      "neonwrathnice.com",
      "neorev.it.com",
      "neosolage.shop",
      "neowernest.icu",
      "nepensens.org",
      "net-optimizer.ink",
      "nettoyaget.com",
      "netzzecho.de",
      "neuralsboost.com",
      "nevadaslp.com",
      "newhopechiro.com",
      "newmexicomartialarts.com",
      "nexasforges.it.com",
      "nexiqora.com",
      "nexiratrack.com",
      "nexityz.com",
      "nexovryn.com",
      "nextrollen.com",
      "nick.hostupdate.site",
      "nightgleamclays.com",
      "nina-alvarez.workers.dev",
      "ninajkitchen.com",
      "ninjasharsk.com",
      "ninjenkitchen.com",
      "nmap-scanner.com",
      "nmap.softwarep2p.com",
      "nmap.space",
      "nodequantforge.com",
      "nodequantixlab.com",
      "nodevarianlabs.com",
      "nordicfriendly.com",
      "noroho5002.workers.dev",
      "norseware.com",
      "norvaxiss.com",
      "novaryns.org",
      "novexagroups.com",
      "noviqora.com",
      "nxvmss.com",
      "nxvmss.org",
      "nymcu-us.com",
      "nymcu-usa.com",
      "observatorfinanciar-ro.com",
      "ocalatreeservices.com",
      "oceaneyedpray.com",
      "ocoeeflooring.com",
      "octorate.homes",
      "offensive-microphylls.website",
      "oililychoreas.quest",
      "oililyideologized.quest",
      "okcbusinessbrokers.com",
      "oma-kanta.info",
      "omakanta.today",
      "omex-tv.live",
      "omnilumity.shop",
      "omnirecipist.shop",
      "omniscaryahaven.com",
      "omnivolt.shop",
      "onbrandwriting.com",
      "onlinenweb.us",
      "orangecountywaterheater.com",
      "orca-spa.click",
      "oregonbathroomremodeling.com",
      "oregonpianos.com",
      "orlandoapt.com",
      "orlandoweddingfilms.com",
      "orthonormal-versos.site",
      "osinsii.shop",
      "otp-performance.info",
      "otp-planner.digital",
      "otp-planner.info",
      "otp-platform.digital",
      "otp-provider.digital",
      "ottawacriminaldefencelawyer.com",
      "overbrowses-carboniferous.com",
      "overgirds-stalwart.website",
      "ox-fanzine.org",
      "oyunlar.fun",
      "pablackcar.com",
      "packagedwisdom.com",
      "pacote-premium.pics",
      "pacs4less.com",
      "pannonuroguide.com",
      "panotarypublic.com",
      "panpacs.com",
      "paprastas-sprendimas.com",
      "paradoxmellow.com",
      "parsemesh.com",
      "parsoraviant.com",
      "parsoriumtech.com",
      "parsovaled.com",
      "parsovianlogic.com",
      "pathvera.org",
      "pawrobot.com",
      "paycrenta.com",
      "paylumon.shop",
      "payservicespro.com",
      "payshopp.net",
      "payvoltize.shop",
      "pdf-fuel.fit",
      "pdf-gear.xn-customer-67f9.info",
      "pdf-gear.xn-customer-68f2.info",
      "pdf-gear.xn-customer-68f3.info",
      "pdf-gear.xn-customer-68f5.info",
      "pdfdocred.digital",
      "pensionikesk.life",
      "pensionikeskus.life",
      "perceptiveasi.com",
      "peregrineclothing.co",
      "personal-iptv.live",
      "personal-tv.live",
      "personaltv.live",
      "phantomtuning.org",
      "phoenixpigeonremoval.com",
      "photo2-app.fun",
      "pietezi.com",
      "pizaiolo.icu",
      "pizaiolo.shop",
      "pizza73-ca.shop",
      "pizzaiiola.top",
      "pizzaiiolo.top",
      "pizzailo.shop",
      "pizzaiola.icu",
      "pizzaiola.top",
      "pizzaiolla.icu",
      "pizzaiolla.shop",
      "pizzaiolla.top",
      "pizzaiollo.icu",
      "pizzaiollo.shop",
      "pizzaiollo.top",
      "pizzaiolo.cyou",
      "pizzaiolo.top",
      "pizzaloio.shop",
      "pizzalolo.cyou",
      "pizzalolo.icu",
      "pizzalolo.shop",
      "pizzalolo.top",
      "pizzapilzza.top",
      "pizzaplza.top",
      "plainscops.it.com",
      "play-best-games.online",
      "play-best-games.website",
      "plays-to-fun-apps.com",
      "playstillway.com",
      "playzones-hub.com",
      "plexatrim.info",
      "plubgbstore.com",
      "plumbingservicestucson.com",
      "plumosity-gammoned.website",
      "plyzorva.com",
      "plzzaiolo.shop",
      "pms-manage.us",
      "pms-setup.us",
      "pnhuby.top",
      "pnhubz.top",
      "pnohub.top",
      "pochstudio.info",
      "poeritosanik.icu",
      "pofelal314.workers.dev",
      "poiiier.icu",
      "polarscres.it.com",
      "polemicized-godlessnesses.website",
      "polyvids.com",
      "pontuscarpathia.com",
      "porezna-technology.digital",
      "porezna.homes",
      "porezna.today",
      "porezna.world",
      "porn-aio.live",
      "portalvridge.com",
      "portaul.us",
      "potentility.com",
      "power-bank.digital",
      "powerblink.com",
      "powerfulbrain-hub.com",
      "pratica-mentes.com",
      "pravontix.info",
      "praxcloud.icu",
      "preschoolorlando.com",
      "pressurewashingalabama.com",
      "presta-facil-cr.com",
      "prime-city-games.site",
      "prime-game-zone.website",
      "prime-gaming-app.website",
      "primhori.it.com",
      "privatedetectivetampa.com",
      "prnhub.top",
      "pro-neustart.com",
      "promo-links.com",
      "propelwisemedia.com",
      "prorecnest.shop",
      "prosacro.shop",
      "prosolery.shop",
      "prosolis.shop",
      "proxy-edge-c5f.workers.dev",
      "ptns-sp.org",
      "pulsexor.com",
      "pulsirox.com",
      "pulsynex.com",
      "purecanopywong.com",
      "putty-info.com",
      "qa-testing-academy.com",
      "qintelai.com",
      "quadrumgroup.com",
      "qualborex.info",
      "quantafys.com",
      "quanteroza.com",
      "qubahar.com",
      "quelamira.info",
      "quietgroveover.com",
      "quilzaven.icu",
      "quixamora.info",
      "quorynex.com",
      "racedeepseek.pro",
      "racertrickwill.com",
      "radio-portugal.live",
      "radiohead.world",
      "rangermeow.com",
      "rapid.data-pipeline-9e4.workers.dev",
      "rapidonline.org",
      "reader-doc.digital",
      "readera-ebook.info",
      "rebgale.com",
      "rebgalenews.com",
      "reco-deet.online",
      "recover-mefile.online",
      "redlinetuning.org",
      "reelsqueen.com",
      "reflectface.com",
      "reise-mobiltechnik.com",
      "rem-cdn-server.mayisi1259.workers.dev",
      "remodeal.com",
      "remote-console-vmware.com",
      "render3dai.com",
      "rerluke.com",
      "resilientmindsetportal.com",
      "resterd.it.com",
      "revitalsolutions.com",
      "revolution-say.pics",
      "rich-mine-games.site",
      "risevioz.com",
      "riverbendpacks.com",
      "robwaree.net",
      "robwares.com",
      "rocrestere.com",
      "romterravest.com",
      "royaiapps.com",
      "royaiaps.com",
      "royal-play-apps.site",
      "royalscarribbean.com",
      "royalts-app.com",
      "royalts-console.com",
      "royalts-remoteops.com",
      "rrenier.icu",
      "runolfsfon.shop",
      "ruqwazen.de",
      "rustore.rvtouls.com",
      "rv-tool.net",
      "rv-toolls.com",
      "rv-tools.eu",
      "rv-tools.info",
      "rv-toolsa.com",
      "rv-toolso.com",
      "rvpro.app",
      "rvtenterprise.com",
      "rvtoo.app",
      "rvtoo.com",
      "rvtoo1.com",
      "rvtoo1s.com",
      "rvtooik.com",
      "rvtoois.com",
      "rvtoolaca.com",
      "rvtoolaca.online",
      "rvtoolacs.com",
      "rvtoolacs.online",
      "rvtoolas.com",
      "rvtoolc.info",
      "rvtoole.com",
      "rvtoolenterprise.com",
      "rvtooles.com",
      "rvtooles.info",
      "rvtooli.info",
      "rvtoolik.com",
      "rvtoolis.com",
      "rvtoolis.info",
      "rvtoolit.com",
      "rvtoolls.info",
      "rvtoollsa.com",
      "rvtoollsi.com",
      "rvtools-app.com",
      "rvtools-capacityops.com",
      "rvtools-cloud.com",
      "rvtools-dataops.com",
      "rvtools-dell.com",
      "rvtools-dev.com",
      "rvtools-download-dell.com",
      "rvtools-enterprise.com",
      "rvtools-install.com",
      "rvtools-inventory.com",
      "rvtools-kernelops.com",
      "rvtools-kit.com",
      "rvtools-official.com",
      "rvtools-optimization.com",
      "rvtools-pipeline.com",
      "rvtools-reference.com",
      "rvtools-registry.com",
      "rvtools-skillcamp.com",
      "rvtools-vmware.com",
      "rvtools-vsphere.com",
      "rvtools.link",
      "rvtools.metric-harbor.com",
      "rvtools.softwarep2p.com",
      "rvtools.vmwarevelocity.com",
      "rvtoolsac.com",
      "rvtoolsacad.com",
      "rvtoolsacs.com",
      "rvtoolsai.com",
      "rvtoolsaq.com",
      "rvtoolsax.com",
      "rvtoolsbox.com",
      "rvtoolse.info",
      "rvtoolsed.com",
      "rvtoolsen.com",
      "rvtoolses.com",
      "rvtoolseu.com",
      "rvtoolsgo.com",
      "rvtoolshq.com",
      "rvtoolsi.info",
      "rvtoolsik.com",
      "rvtoolsio.com",
      "rvtoolsit.com",
      "rvtoolsl.com",
      "rvtoolslab.com",
      "rvtoolsmax.com",
      "rvtoolsme.com",
      "rvtoolsnet.com",
      "rvtoolsnow.com",
      "rvtoolsnt.com",
      "rvtoolso.com",
      "rvtoolso.info",
      "rvtoolson.com",
      "rvtoolson.info",
      "rvtoolsone.com",
      "rvtoolspro.com",
      "rvtoolspro.info",
      "rvtoolspro.online",
      "rvtoolsrun.com",
      "rvtoolss.com",
      "rvtoolsuk.com",
      "rvtoolsun.com",
      "rvtoolsup.com",
      "rvtoolsus.com",
      "rvtoolsusa.com",
      "rvtoolsv.com",
      "rvtoolsz.com",
      "rvtoolvm.com",
      "rvtoolz.info",
      "rvtoolze.com",
      "rvtootsacad.com",
      "rvtootsad.com",
      "rvtop.app",
      "rvtoptools.app",
      "rvtouls.com",
      "rvvtools.com",
      "rychlereseni.com",
      "s.workbanch.com",
      "s3abrowser.com",
      "s3bravser.com",
      "s3brawser.com",
      "s3brovser.com",
      "s3brovvser.com",
      "s3browserenterprise.app",
      "s3browserenterprize.app",
      "sailvatore.icu",
      "sailvatore.shop",
      "sakura-travel.org",
      "salavatore.icu",
      "salavatore.shop",
      "salavattore.shop",
      "salemajeri.icu",
      "salfhlal.com",
      "salivatore.cyou",
      "salivatore.icu",
      "salivatore.shop",
      "sallvatore.cyou",
      "sallvatore.site",
      "sallvatore.store",
      "sallvattore.online",
      "sallvattore.shop",
      "sallvattore.site",
      "sallvattore.store",
      "salvattore.icu",
      "salvattore.shop",
      "salvattores.top",
      "sandboxfinancialpartners.com",
      "sapceagent.com",
      "satoricraftbox.com",
      "saxo.promo-links.com",
      "scan-engine-a2d.workers.dev",
      "scentgold.com",
      "schema-harbor.com",
      "schnellportals.com",
      "scorespend.com",
      "scuolaoperator.com",
      "seattlebathtub.com",
      "secrid-de.com",
      "securecrt-app.com",
      "securecrt-configledger.com",
      "securecrt-console.com",
      "securecrt-terminalops.com",
      "securecrt.session-ops.com",
      "securecrtrunbook.com",
      "sehopay.com",
      "sejilod7488888.workers.dev",
      "sellvarions.com",
      "sendpap.com",
      "sensational-slots.ink",
      "septictankservicing.com",
      "server-cd2.bipewi2747.workers.dev",
      "server-cdn.jawigaw383.workers.dev",
      "server-cdn.lafise2419.workers.dev",
      "server-cdn.lecoc56350.workers.dev",
      "server-cdn.sidoke9822.workers.dev",
      "server-cdn.virej10913.workers.dev",
      "server-cdn.xohahey822.workers.dev",
      "server-software-cdn.azureedge.net",
      "server-software.azureedge.net",
      "server-web-cdn.detocim498.workers.dev",
      "server-web-cdn.dones86497.workers.dev",
      "server-web-cdn.kagoli5215.workers.dev",
      "server-web-cdn.kegemom113.workers.dev",
      "server-web-cdn.mevame4224.workers.dev",
      "server-web-cdn.nefixeg373.workers.dev",
      "server-web-cdn.pixece7948.workers.dev",
      "server-web-cdn.ravebo3233.workers.dev",
      "server-web-cdn.rojotoc516.workers.dev",
      "server-web-cdn.vosax32455.workers.dev",
      "server-web-cdn.yevobod379.workers.dev",
      "server-web-cdn1.gekod80409.workers.dev",
      "server-web.sasex59966.workers.dev",
      "servertech02.workers.dev",
      "servicesml.com",
      "session-center.com",
      "session-ops.com",
      "shadowbloombay.com",
      "shadowbloomever.com",
      "shadowdancerplay.com",
      "shaimabeauty.shop",
      "shaoppay.com",
      "sharkniaenja.com",
      "shhiller.com",
      "shintralearno.com",
      "shjopay.com",
      "shlop.app",
      "shnopay.com",
      "shoepay.io",
      "sholpay.com",
      "shopapp.cc",
      "shopayse.app",
      "shopeay.com",
      "shoppau.com",
      "shopperapp.net",
      "shosppay.com",
      "shrink-say.pics",
      "shrseninjas.com",
      "sibstarpro.com",
      "sign-mess.digital",
      "sign-ms.online",
      "signal-online.digital",
      "signalonline.digital",
      "signalprivat.digital",
      "signaturedfj.us",
      "signaturedg.us",
      "signaturedj.us",
      "signatureje.us",
      "signatureji.us",
      "signmes.world",
      "siliconvalleyvet.com",
      "silverhazesoup.com",
      "sinssay.com",
      "skaldapath.com",
      "skillforge-academy.org",
      "skillignix.com",
      "skillpathlyn.com",
      "skyshiftnever.com",
      "slash-agency.org",
      "slayvortexdays.com",
      "slgnal.online",
      "smartdent-lab.com",
      "smartgpuai.com",
      "smartgrowx.com",
      "smartheatswitchs.com",
      "smartlinetech.co.uk",
      "smarttecnica.com",
      "snapriase.com",
      "snarvadir.cyou",
      "sneaxbird.icu",
      "snhopay.com",
      "snugaldor.icu",
      "snuxtrade.info",
      "social-ventures.it.com",
      "sofort-gelds.com",
      "soft-base-01.ginigiy117.workers.dev",
      "soft-dns-999.tech",
      "soft-dns-999001.store",
      "soft-dns.sejilod748.workers.dev",
      "soft-dns.sejilod7488888.workers.dev",
      "softwarep2p.com",
      "sogal69343.workers.dev",
      "solboundlandys.com",
      "solerisparimo.com",
      "soliste.it.com",
      "solscaner.app",
      "soluciones-yas.com",
      "soluzionerapide.com",
      "solventas360.com",
      "somerestlike.com",
      "sonnyanglusa.com",
      "southwestchevy.com",
      "spacepile.com",
      "sparklingsenior.com",
      "speakingmastershool.com",
      "spin-vault.com",
      "spraygraund.com",
      "spyconect.com",
      "spycygen.store",
      "square-wave-65dd.api-gateway-a3f.workers.dev",
      "squaredinc.com",
      "ssl.bapiyat727.workers.dev",
      "staoton.shop",
      "star-play-mobile.site",
      "starcrushworry.com",
      "stardriftshift.com",
      "starjumperlake.com",
      "starrfy.com",
      "statryxo.com",
      "stellar-concept.site",
      "stickman-farcers.com",
      "stimme-wirkung.de",
      "stiridininvestitii.com",
      "store-mauchs.com",
      "stores-fine23.com",
      "streakslouk.com",
      "streamhub-tv.live",
      "streamtv-hub.live",
      "studiport.com",
      "studylexz.com",
      "studysinsight.com",
      "studyviax.com",
      "subito-fatto.com",
      "sunset.vault-proxy-5d3.workers.dev",
      "sunsetkissed.com",
      "sunshinesnotes.com",
      "super-game-city.website",
      "swarthmorepubliclibrary.us",
      "sydelsierra.com",
      "synaxopath.de",
      "sync-engine-d8b.workers.dev",
      "synrecipum.shop",
      "sys-log-7qw.workers.dev",
      "tagesechode.com",
      "taiwan-interviewers.com",
      "talentsmomentum.com",
      "tamaautoservice.com",
      "tastylikeleaves.com",
      "taycharon.com",
      "teamalliant.com",
      "tech-novapro.com",
      "techelitegb.com",
      "techrecory.shop",
      "techvoltpad.shop",
      "test-runner-4b7.workers.dev",
      "testmindset.com",
      "texashardwoodfloor.com",
      "thafarmrsdog.com",
      "the-digital-news.com",
      "thefarmorsdog.com",
      "thefiarmersdog.com",
      "thefield.club",
      "theine-overall.website",
      "thenarcjournal.com",
      "thesexmart.com",
      "thewrightlegal.com",
      "thfarmrsdog.com",
      "thibaalt.icu",
      "thinkstrac.de",
      "thirtysixstore.work",
      "thisthingofours.org",
      "threivemarket.com",
      "thriftycard.shop",
      "thrillforgenight.com",
      "thrivemakret.com",
      "thrivemerket.com",
      "thrivemurket.com",
      "thrlwemarket.com",
      "thumaas.com",
      "thumaos.com",
      "thunderlaught.com",
      "tight-vnc.com",
      "tightvnc-center.com",
      "tightvnc-courseware.com",
      "tightvnc-ops.com",
      "tightvnc.session-center.com",
      "tik-app.ink",
      "tik-app.org",
      "tikltok18.live",
      "tiktko18.live",
      "tiltok18.live",
      "timocorn.com",
      "tirnocorn.info",
      "titok-app.live",
      "tjpull.com",
      "tkmathsacademy.com",
      "tokacarameis.com",
      "tokaikisen.club",
      "tokcu.top",
      "tokfi.top",
      "tokgo.top",
      "tokhu.top",
      "tokke.top",
      "tokmu.top",
      "tokqy.top",
      "tokrwards.com",
      "tolanielesokon.com",
      "tons-kohl.site",
      "toolstoreuk.live",
      "top-game-world.website",
      "top-play-app.site",
      "top-play-games.com",
      "top-play-studio.site",
      "top-tuning.org",
      "topaz-belive.site",
      "toretti.icu",
      "totalists-syndrome.website",
      "toyo-sasaki.info",
      "tradingview-app.com",
      "traidecode.com",
      "trailerflorida.com",
      "trainloftz.com",
      "trainnestz.com",
      "trainyxa.com",
      "transilvanequity.com",
      "travelfountain.com",
      "traviora.shop",
      "treeshadowmonster.com",
      "trendorabhs.com",
      "trendorabnko.com",
      "trendorabtkom.com",
      "trendoragame.com",
      "trendoramario.com",
      "trendorataraf.com",
      "trezqifo.de",
      "trinktiger.com",
      "trolley-swipe.pics",
      "truenews1.com",
      "trx-rent.com",
      "tu-salvavidas.com",
      "tubings-bonaci.site",
      "turelarnalernix.com",
      "tuser-vicio.com",
      "tutto-chiaros.com",
      "tv-aio.live",
      "tv-navegador.live",
      "tweehandwork.quest",
      "txartificialturf.com",
      "tylarlink.com",
      "tylioners.com",
      "tylorvex.de",
      "tyronpath.com",
      "ubelivery.com",
      "ui.s3browserenterprise.app",
      "uk-sibstar.com",
      "ukcampsite.reviews",
      "ukcarpfishing.org",
      "ultra-game-vault.website",
      "ultra-play-ltd.site",
      "unbiaseddaily.com",
      "uni-tv.live",
      "unionclothing.fit",
      "unispacetechsys.com",
      "unitv-ca.live",
      "universaleduet.com",
      "universalupdcode.com",
      "unwerpad.icu",
      "update.rvtoolsl.com",
      "update.rvtouls.com",
      "update.rvvtools.com",
      "urban-play-city.site",
      "urbanindustry.org",
      "urovitalmagyar.com",
      "usbouldering.com",
      "usbsv.com",
      "utahpoolsandspas.com",
      "utahposters.com",
      "valahinvestcore.com",
      "valiantwealthmanagement.com",
      "vault-proxy-5d3.workers.dev",
      "vaultopsacademy.com",
      "vchekac.com",
      "vchekacad.com",
      "vedic-uk.com",
      "velmorahubs.com",
      "velmoraqq.com",
      "velqonix.com",
      "velvetstrikehipe.com",
      "veresen.com",
      "verifica-facile.com",
      "vert-feu.com",
      "verteglo.it.com",
      "vexinakyn.com",
      "vexlanix.com",
      "vexnatira.com",
      "vibesurgeclay.com",
      "vicarageartfully.pics",
      "viguor.com",
      "vip-best-games.com",
      "vip-play-center.website",
      "vireloraq.com",
      "viretrix.com",
      "visitpandys.com",
      "visualstorycraft.com",
      "vita-novas.com",
      "vivanotizie.com",
      "vivantestudio.com",
      "vivere-meglio.com",
      "vm5042999.1nvme.had.wf",
      "vmback.com",
      "vmbacku.com",
      "vmbackups.com",
      "vmenterprise.app",
      "vmoneenterprise.app",
      "vmrentertrise.com",
      "vmsbackup.com",
      "vmw.enterprises",
      "vmware-programs.com",
      "vmware-remote-console.com",
      "vmware-rvtools.app",
      "vmware-rvtools.cc",
      "vmware-rvtools.cloud",
      "vmware-rvtools.com",
      "vmware-rvtools.ltd",
      "vmware-rvtools.org",
      "vmware-rvtools.pro",
      "vmware-rvtools.tech",
      "vmware-rvtools.us",
      "vmware-vsphere.com",
      "vmwareenterprize.app",
      "vmwarevelocity.com",
      "vmwarevsphere.com",
      "vmwenterprise.app",
      "vmwone.app",
      "vmwone.enterprises",
      "vmwoneenterprise.app",
      "volksreport.com",
      "vorlentra.com",
      "vortiqra.com",
      "voyanest.shop",
      "vrfuckablegirls.live",
      "vrfuckdolls.live",
      "vsphere-client.com",
      "vsphere-client.org",
      "vurmafied.cyou",
      "vuxtamira.icu",
      "vynqore.com",
      "w5.rvtooks.com",
      "walletcounselor.com",
      "wanderlust-journeys.org",
      "watch-aio.live",
      "wc.rvtouls.com",
      "weallmarket.com",
      "wear-london.cloud",
      "web-app.dasik14289.workers.dev",
      "web-app.larij21770.workers.dev",
      "webacncess.us",
      "webapp.ingress-ctrl-7c9.workers.dev",
      "webapp.scan-engine-a2d.workers.dev",
      "webauthisecure.us",
      "webauthseciure.us",
      "webauthsecvre.us",
      "webauthseicure.us",
      "webnaccenss.us",
      "westmiflightacademy.us",
      "white-salad-4c7f.sys-log-7qw.workers.dev",
      "wildemberborn.com",
      "wildfireheart.com",
      "wildview18.top",
      "willcountycriminaldefense.com",
      "windcarveolive.com",
      "winstonsofyork.world",
      "wizardmerge.com",
      "work-server-1.picalob750.workers.dev",
      "workbecn.com",
      "workbenc.com",
      "workbenche.com",
      "workbencn.com",
      "workbencse.com",
      "workbenech.com",
      "workbeneh.com",
      "works-forge.com",
      "worldseafishing.org",
      "wristbandalarm.com",
      "wuckeet.shop",
      "wysoria.com",
      "xenoluxa.com",
      "xentriqa.com",
      "xn-customer-67f9.info",
      "xn-customer-68f2.info",
      "xn-customer-68f3.info",
      "xn-customer-68f5.info",
      "xonilqup.de",
      "xtream-tv.live",
      "xyaraieabryade.com",
      "y.workbeneh.com",
      "y0.workbecn.com",
      "y0.workbenc.com",
      "yoforge.com",
      "youfreedomspinws.com",
      "young-tooth-5980.deram71445.workers.dev",
      "yr.rvtoolc.info",
      "yudokoro.com",
      "yv.rvtoolas.com",
      "yx.rvtooli.info",
      "z6.rvtoolsl.com",
      "z9.rvtoolso.com",
      "za-serverhub.online",
      "za.rvtoolvm.com",
      "zd.rvtoolss.com",
      "zdravljes.digital",
      "zeemann.shop",
      "zelontra.com",
      "zelovanta.com",
      "zen-iptv.live",
      "zestplay.pro",
      "zolunqer.de",
      "zopanews.com",
      "zowimcode.com",
      "zs.s3bravser.com",
      "zt.s3brawser.com",
      "zylariq.com",
      "zynelith.com",
      "zyntricaz.com",
      "zyphentra.com"
    ]
  },
  "last_modified": "2026-08-07T18:56:19+00:00",
  "maltrail_groups": [
    "UNC2465"
  ],
  "references": [
    "https://app.any.run/tasks/a9391be5-4e71-4a95-9072-477f8afd906f/",
    "https://gist.github.com/drb-ra/179e8e9beca45bc10feba97cf8c5c7b1",
    "https://github.com/cert-orangecyberdefense/cti/blob/main/smokedham/iocs",
    "https://medium.com/trac-labs/who-ordered-the-smokedham-backdoor-delicacies-in-the-wild-87f51e2e5bd2",
    "https://research.cert.orangecyberdefense.com/smokedham/smoking_out_an_affiliate.pdf",
    "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection",
    "https://www.virustotal.com/gui/file/3ebc0df2b92a39d1fb4491b7aaf6996425214ebe85e6243f443f1db087172f27/detection",
    "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
    "https://x.com/SquiblydooBlog/status/1993311260512075967",
    "https://x.com/g0njxa/status/2010485906466394343",
    "https://x.com/g0njxa/status/2027082406847709524",
    "https://x.com/g0njxa/status/2031034087801012435",
    "https://x.com/goldenjackel12/status/2013877434421072187"
  ],
  "related": [],
  "slug": "UNC2465",
  "timeline": [
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2026-08-07",
      "indicators": {
        "domain": [
          "advipscan.com",
          "amzslotplay.xyz",
          "frialerynetuha.com",
          "greenbase.it.com",
          "millpp.com",
          "musclebrite.com",
          "rvpro.app",
          "traviora.shop"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 15
      },
      "first_seen": "2026-08-06",
      "indicators": {
        "domain": [
          "accessbs.us",
          "cooperativebamkcafe.com",
          "eurobaustoff.it.com",
          "eurodelkredere.it.com",
          "keycornthegoldkey.us",
          "kimimena.com",
          "recover-mefile.online",
          "reflectface.com",
          "rvtoo.app",
          "rvtoo.com",
          "signaturedfj.us",
          "signaturedj.us",
          "signatureje.us",
          "usbsv.com",
          "voyanest.shop"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 15
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-08-04",
      "indicators": {
        "domain": [
          "iperiusremot.app",
          "iperiusremote.app",
          "iperiusremote.online",
          "jondoninc.com",
          "packagedwisdom.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-08-03",
      "indicators": {
        "domain": [
          "fuer-sie-eg.it"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 12
      },
      "first_seen": "2026-08-01",
      "indicators": {
        "domain": [
          "cooperativecollectivecafe.com",
          "cupertinoconstruction.com",
          "ede.it.com",
          "ek-retail.it.com",
          "pdf-gear.xn-customer-68f3.info",
          "pdf-gear.xn-customer-68f5.info",
          "sehopay.com",
          "shnopay.com",
          "signatureji.us",
          "snhopay.com",
          "xn-customer-68f3.info",
          "xn-customer-68f5.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 12
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-07-30",
      "indicators": {
        "domain": [
          "benavivez.com",
          "cheoasanarnnda.com",
          "cresterero.com",
          "pdf-gear.xn-customer-68f2.info",
          "xn-customer-68f2.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-07-29",
      "indicators": {
        "domain": [
          "arcyloriantech.com",
          "hunherbal.com",
          "urovitalmagyar.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 34
      },
      "first_seen": "2026-07-28",
      "indicators": {
        "domain": [
          "afmo.it",
          "amf-capital.it",
          "arz-darmstadt.it.com",
          "arz-service.it",
          "astem.it.com",
          "avond.it.com",
          "back-europ.it.com",
          "baeko.it.com",
          "beauty-alliance.it.com",
          "bewidata.it.com",
          "coba-osnabrueck.it.com",
          "dentagen.it.com",
          "die6.it.com",
          "economiaazi.com",
          "hunativ.com",
          "inrvsa.com",
          "junglebet.website",
          "kertelssugiaho.com",
          "lleraedosimuba.com",
          "magyarurocare.com",
          "meshvariantech.com",
          "pannonuroguide.com",
          "pdf-gear.xn-customer-67f9.info",
          "resilientmindsetportal.com",
          "rocrestere.com",
          "signmes.world",
          "swarthmorepubliclibrary.us",
          "tokqy.top",
          "tolanielesokon.com",
          "tutto-chiaros.com",
          "webauthisecure.us",
          "westmiflightacademy.us",
          "xn-customer-67f9.info",
          "xyaraieabryade.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 34
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2026-07-22",
      "indicators": {
        "domain": [
          "accoumtsclienntsarea.us",
          "autnhentcation.us",
          "danubiusgrowthlab.com",
          "fluxquantatech.com",
          "gis-arta.online",
          "infopiete.com",
          "pratica-mentes.com",
          "unispacetechsys.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 96
      },
      "first_seen": "2026-07-21",
      "indicators": {
        "domain": [
          "10bet.space",
          "aiagentanalytics.com",
          "analizainvestitii-ro.com",
          "areacleintsacounts.us",
          "areaclienntsaccoumts.us",
          "aureliaromfund.com",
          "authorlzeacsess.us",
          "authorlzesitte.us",
          "autnhentlcation.us",
          "babmbach.com",
          "balatonvitalworks.com",
          "baptissa.com",
          "bespokecufflinkjournal.com",
          "bingbong.website",
          "bucurestivantage.com",
          "buletineconomic.com",
          "businessfundwell.com",
          "byteforgenova.com",
          "carpatiareport.com",
          "carvalhl.site",
          "cemteracsess.us",
          "cemtercliemt.us",
          "cemtersitte.us",
          "cemterweb.us",
          "cleintsareaacounts.us",
          "clienntsareaaccoumts.us",
          "cooperativecaffes.us",
          "cooperativecreatives.com",
          "cooperativecreatives.us",
          "cooperativecreativs.com",
          "craneservicepa.com",
          "cromwellstorage.com",
          "cystocarehungary.com",
          "danubereview.com",
          "dashbourd.us",
          "datatools26.org",
          "deltacasino.website",
          "egeszsegtippek-magazin.com",
          "estnews-ro.com",
          "feedlister.com",
          "fluxquantorian.com",
          "getxenow.com",
          "gyogynovenyvilag24.com",
          "gzlarza.com",
          "henriiues.space",
          "henriquee.com",
          "hirekazegeszsegrol.com",
          "hungarovitalcenter.com",
          "it-quotidiana.com",
          "jurnaleconomic.com",
          "karpatwellnesslab.com",
          "mail.aussierealestate.net.au",
          "meshcipherlab.com",
          "michiganfostercarecloset.us",
          "mioriticholdings.com",
          "monitorulcapitalului.com",
          "narz-avn.it",
          "nodequantforge.com",
          "observatorfinanciar-ro.com",
          "onlinenweb.us",
          "paradoxmellow.com",
          "parsoraviant.com",
          "pietezi.com",
          "pnhuby.top",
          "pontuscarpathia.com",
          "portaul.us",
          "quadrumgroup.com",
          "rerluke.com",
          "romterravest.com",
          "rvtenterprise.com",
          "rvtoolenterprise.com",
          "rvtop.app",
          "rvtoptools.app",
          "shhiller.com",
          "sign-ms.online",
          "signaturedg.us",
          "sinssay.com",
          "stiridininvestitii.com",
          "tokmu.top",
          "transilvanequity.com",
          "valahinvestcore.com",
          "verifica-facile.com",
          "vita-novas.com",
          "vivere-meglio.com",
          "vmenterprise.app",
          "vmoneenterprise.app",
          "vmw.enterprises",
          "vmwone.app",
          "vmwone.enterprises",
          "vmwoneenterprise.app",
          "webacncess.us",
          "webauthseciure.us",
          "webauthsecvre.us",
          "webauthseicure.us",
          "webnaccenss.us",
          "zopanews.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 96
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-06-20",
      "indicators": {
        "domain": [
          "aipathstoday.com",
          "apps-and-grid-play.com",
          "bytevaranlabs.com",
          "deeporiumforge.com",
          "gridmellow.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2026-06-19",
      "indicators": {
        "domain": [
          "arcoriumforge.com",
          "atlasgrous.it.com",
          "brisktangent.com",
          "buchanancapitalpartners.com",
          "neonreport.com",
          "schnellportals.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-06-18",
      "indicators": {
        "domain": [
          "deepfluxorian.com",
          "oregonbathroomremodeling.com",
          "plays-to-fun-apps.com",
          "primhori.it.com",
          "tokke.top"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-06-17",
      "indicators": {
        "domain": [
          "aiagentledger.com",
          "corlopt.it.com",
          "francefinhelp.com",
          "meshorialquant.com",
          "meshorianforge.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 9
      },
      "first_seen": "2026-06-16",
      "indicators": {
        "domain": [
          "cipheriumlabs.com",
          "corden.it.com",
          "corevoryx.com",
          "nodequantixlab.com",
          "orangecountywaterheater.com",
          "pnohub.top",
          "unbiaseddaily.com",
          "verteglo.it.com",
          "willcountycriminaldefense.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-06-15",
      "indicators": {
        "domain": [
          "bayareafencecompany.com",
          "fluxiverianlabs.com",
          "parsoriumtech.com",
          "soliste.it.com",
          "texashardwoodfloor.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2026-06-09",
      "indicators": {
        "domain": [
          "bestgames-play.com",
          "creditanova.com",
          "crestpoints.it.com",
          "lorettostorage.com",
          "ocalatreeservices.com",
          "play-best-games.online",
          "sofort-gelds.com",
          "trailerflorida.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-06-08",
      "indicators": {
        "domain": [
          "exosomegene.com",
          "finanziahubs.com",
          "meshoramor.com",
          "norseware.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 30
      },
      "first_seen": "2026-06-07",
      "indicators": {
        "domain": [
          "08f0.proxy-edge-c5f.workers.dev",
          "178.159.43.206.sslip.io",
          "api.rvtoolacs.online",
          "app-server.comof72509.workers.dev",
          "cdn-ae.azureedge.net",
          "cdn-app-software-3425.tech",
          "cdn-app-software-67423.store",
          "cdn-web-app-10.site",
          "cdn-web-app-10.tech",
          "comof72509.workers.dev",
          "dash-server2.servertech02.workers.dev",
          "dev.rvtoolacs.online",
          "devopstechnologies.site",
          "fastpanel116864.hostkey.in",
          "keystore-explorer.site",
          "moorabanco-ad.com",
          "moraabanco-ad.com",
          "morabanco-ad.com",
          "sejilod7488888.workers.dev",
          "server-software-cdn.azureedge.net",
          "server-software.azureedge.net",
          "servertech02.workers.dev",
          "soft-dns-999.tech",
          "soft-dns-999001.store",
          "soft-dns.sejilod7488888.workers.dev",
          "sys-log-7qw.workers.dev",
          "vm5042999.1nvme.had.wf",
          "white-salad-4c7f.sys-log-7qw.workers.dev",
          "za-serverhub.online",
          "za.rvtoolvm.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://research.cert.orangecyberdefense.com/smokedham/smoking_out_an_affiliate.pdf",
        "https://github.com/cert-orangecyberdefense/cti/blob/main/smokedham/iocs"
      ],
      "total": 30
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2026-06-07",
      "indicators": {
        "domain": [
          "capitalrios.com",
          "cashlatvia.com",
          "dexorith.com",
          "kalosintelligence.com",
          "nexovryn.com",
          "solventas360.com",
          "utahpoolsandspas.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 16
      },
      "first_seen": "2026-06-06",
      "indicators": {
        "domain": [
          "akaccessories.com",
          "apexvideoproduction.com",
          "deepcipherquanta.com",
          "exomegene.com",
          "jensenprinting.com",
          "mikestonegoldcard.com",
          "nexasforges.it.com",
          "pablackcar.com",
          "phoenixpigeonremoval.com",
          "polarscres.it.com",
          "preschoolorlando.com",
          "pulsirox.com",
          "reco-deet.online",
          "seattlebathtub.com",
          "universaleduet.com",
          "wristbandalarm.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 16
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2026-06-05",
      "indicators": {
        "domain": [
          "bayareawaterheater.com",
          "bytorianforge.com",
          "cedarspoint.it.com",
          "elevatsys.it.com",
          "fluxoraviantech.com",
          "marbellavacations.com",
          "meridiasolution.it.com",
          "pressurewashingalabama.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2026-06-04",
      "indicators": {
        "domain": [
          "breonros.it.com",
          "bridgetontowing.com",
          "lairatech.it.com",
          "orlandoweddingfilms.com",
          "reader-doc.digital",
          "shoepay.io",
          "sign-mess.digital"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-06-03",
      "indicators": {
        "domain": [
          "alterasgroup.it.com",
          "buyitallnow.com",
          "garagedoorscentralflorida.com",
          "thenarcjournal.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-06-02",
      "indicators": {
        "domain": [
          "arcylianquanta.com",
          "austinportapotty.com",
          "drenslio.it.com",
          "nodevarianlabs.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2026-06-01",
      "indicators": {
        "domain": [
          "bloodgroupcrib.com",
          "chiroaz.com",
          "claytonpestcontrol.com",
          "contextualdesigns.com",
          "privatedetectivetampa.com",
          "trendoragame.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-05-31",
      "indicators": {
        "domain": [
          "valiantwealthmanagement.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 9
      },
      "first_seen": "2026-05-30",
      "indicators": {
        "domain": [
          "auroraagencies.com",
          "fenceidaho.com",
          "indianatowingservice.com",
          "jpmdswap.com",
          "michigansecurityguard.com",
          "moltsavvy.com",
          "moverssocal.com",
          "sandboxfinancialpartners.com",
          "travelfountain.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2026-05-28",
      "indicators": {
        "domain": [
          "atlpropertymanagers.com",
          "austinbariatrics.com",
          "huttonagency.com",
          "luminousfinancialgroup.com",
          "newmexicomartialarts.com",
          "nxvmss.com",
          "nxvmss.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 10
      },
      "first_seen": "2026-05-27",
      "indicators": {
        "domain": [
          "allbestselling.com",
          "bargainlenders.com",
          "cipherquantix.com",
          "fishingguidesmiami.com",
          "fluxontra.com",
          "getetenos.com",
          "lufkintowing.com",
          "play-best-games.website",
          "plumbingservicestucson.com",
          "shopayse.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2026-05-26",
      "indicators": {
        "domain": [
          "apexorix.com",
          "cipheriumforge.com",
          "dexontra.com",
          "findoffering.com",
          "meshoverian.com",
          "onbrandwriting.com",
          "vip-best-games.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-05-25",
      "indicators": {
        "domain": [
          "bytonrian.com",
          "camarillotowing.com",
          "sparklingsenior.com",
          "tokhu.top",
          "usbouldering.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2026-05-24",
      "indicators": {
        "domain": [
          "einfacheonlineanfrage.com",
          "equipmentohio.com",
          "fluxoderia.com",
          "fluxoriumlabs.com",
          "miamiposters.com",
          "parsovaled.com",
          "parsovianlogic.com",
          "pulsexor.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 13
      },
      "first_seen": "2026-05-23",
      "indicators": {
        "domain": [
          "20.rvtoolsme.com",
          "24.rvtoolsgo.com",
          "5n.rvtoolsrun.com",
          "brandhighland.com",
          "faithful-sigh.com",
          "kalosrobotics.com",
          "kokoro-travel.org",
          "meshquantumlab.com",
          "parsemesh.com",
          "squaredinc.com",
          "txartificialturf.com",
          "yv.rvtoolas.com",
          "zs.s3bravser.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 13
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-05-22",
      "indicators": {
        "domain": [
          "1r.rvtoolsed.com",
          "h3.horpetsecurity.com",
          "oregonpianos.com",
          "spacepile.com",
          "tokgo.top"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 14
      },
      "first_seen": "2026-05-21",
      "indicators": {
        "domain": [
          "12.workbencn.com",
          "2b.rvtoolsit.com",
          "afd-esign.info",
          "angryip.cloud",
          "arcfetch.com",
          "ay.hornetsecuty.com",
          "electdev.com",
          "fluxileir.com",
          "horizonenterprise.app",
          "paprastas-sprendimas.com",
          "quantafys.com",
          "tokfi.top",
          "update.rvtoolsl.com",
          "w5.rvtooks.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 14
    },
    {
      "counts": {
        "domain": 9
      },
      "first_seen": "2026-05-20",
      "indicators": {
        "domain": [
          "40.workbencse.com",
          "4l.rvtoolslab.com",
          "fluxelyx.com",
          "orlandoapt.com",
          "rychlereseni.com",
          "subito-fatto.com",
          "vert-feu.com",
          "workbencse.com",
          "yx.rvtooli.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2026-05-19",
      "indicators": {
        "domain": [
          "2w.s3abrowser.com",
          "agora-mesmo.com",
          "alfrog.com",
          "flexiblemoeglichkeiten.com",
          "s3abrowser.com",
          "slgnal.online",
          "workbenc.com",
          "y0.workbenc.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 22
      },
      "first_seen": "2026-05-18",
      "indicators": {
        "domain": [
          "1v.rvtootsad.com",
          "21.rvtoolsen.com",
          "2a.rvtoolso.info",
          "2j.rvtoolsup.com",
          "4t.rvtoolsacs.com",
          "54.rvtoolsone.com",
          "58.rvtoolsmax.com",
          "datagrip-logic.com",
          "hostupdate.site",
          "hyperlora.com",
          "nexiqora.com",
          "nick.hostupdate.site",
          "pacs4less.com",
          "pnhubz.top",
          "s.workbanch.com",
          "siliconvalleyvet.com",
          "tokcu.top",
          "workbecn.com",
          "y.workbeneh.com",
          "y0.workbecn.com",
          "yoforge.com",
          "yr.rvtoolc.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 22
    },
    {
      "counts": {
        "domain": 14
      },
      "first_seen": "2026-05-16",
      "indicators": {
        "domain": [
          "1s.rvtoolsai.com",
          "20.rvtoolse.info",
          "24.rvtoolis.info",
          "5b.rvtoolsbox.com",
          "iwervoex.icu",
          "luxebilliards.com",
          "neowernest.icu",
          "prnhub.top",
          "pulsynex.com",
          "unwerpad.icu",
          "utahposters.com",
          "z9.rvtoolso.com",
          "zd.rvtoolss.com",
          "zt.s3brawser.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 14
    },
    {
      "counts": {
        "domain": 18
      },
      "first_seen": "2026-05-15",
      "indicators": {
        "domain": [
          "1yeralti.com",
          "20.rvtoolsaq.com",
          "3g.s3brovvser.com",
          "3p.workbenche.com",
          "arcparse.com",
          "arizonastables.com",
          "corevantaq.com",
          "dr.hornetsecuety.com",
          "evolutionpestcontrol.com",
          "gq.harnetsecurlty.com",
          "harnetsecurlty.com",
          "impulsolatinohn.com",
          "plainscops.it.com",
          "soluzionerapide.com",
          "top-play-games.com",
          "ui.s3browserenterprise.app",
          "wc.rvtouls.com",
          "z6.rvtoolsl.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 18
    },
    {
      "counts": {
        "domain": 12
      },
      "first_seen": "2026-05-14",
      "indicators": {
        "domain": [
          "1v.rvtoollsa.com",
          "22.rvtoolsik.com",
          "27.rvtoolsax.com",
          "angryenterprise.app",
          "cullendersbarnacles.quest",
          "dy.hornetseculty.com",
          "g.rv-tools.info",
          "neorev.it.com",
          "oililyideologized.quest",
          "rvtoolsik.com",
          "testmindset.com",
          "vmrentertrise.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 12
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-05-13",
      "indicators": {
        "domain": [
          "movobility.com",
          "tweehandwork.quest"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2026-05-12",
      "indicators": {
        "domain": [
          "aihyperepoch.com",
          "axonesubrogation.quest",
          "ideogramy.com",
          "oililychoreas.quest",
          "poiiier.icu",
          "viguor.com",
          "vortiqra.com",
          "wildview18.top"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-05-11",
      "indicators": {
        "domain": [
          "connecticutcre.com",
          "krypkryphora.com",
          "magiciansd.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 10
      },
      "first_seen": "2026-05-10",
      "indicators": {
        "domain": [
          "casnellano.icu",
          "devolutions-fieldcraft.com",
          "fluxiqa.com",
          "macchetti.icu",
          "rrenier.icu",
          "southwestchevy.com",
          "toretti.icu",
          "velqonix.com",
          "viretrix.com",
          "zelovanta.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 16
      },
      "first_seen": "2026-05-09",
      "indicators": {
        "domain": [
          "aiepochepixels.com",
          "cloudbillers.com",
          "crankous-plumosity.website",
          "dexentraq.com",
          "dexovanta.com",
          "jourjan.icu",
          "krylentra.com",
          "kryptrona.com",
          "letreton.icu",
          "noviqora.com",
          "pdfdocred.digital",
          "rvtools-optimization.com",
          "thibaalt.icu",
          "xentriqa.com",
          "zelontra.com",
          "zynelith.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 16
    },
    {
      "counts": {
        "domain": 16
      },
      "first_seen": "2026-05-08",
      "indicators": {
        "domain": [
          "ailogicfetch.com",
          "cipherlix.com",
          "devolutions-sysarch.com",
          "dexelora.com",
          "gammoned-dopier.website",
          "joubert.icu",
          "lunatrixo.com",
          "pawrobot.com",
          "plyzorva.com",
          "quorynex.com",
          "stickman-farcers.com",
          "vireloraq.com",
          "vorlentra.com",
          "xenoluxa.com",
          "zylariq.com",
          "zyphentra.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 16
    },
    {
      "counts": {
        "domain": 10
      },
      "first_seen": "2026-05-07",
      "indicators": {
        "domain": [
          "airastbercore.com",
          "dbeaver-dba-foundation.com",
          "dede1000x.com",
          "devolutions-rdm.click",
          "mornava.com",
          "overbrowses-carboniferous.com",
          "rvtools-kernelops.com",
          "rvtools-registry.com",
          "social-ventures.it.com",
          "totalists-syndrome.website"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 12
      },
      "first_seen": "2026-05-06",
      "indicators": {
        "domain": [
          "ainewlevelwealth.com",
          "aispeechroute.com",
          "atxauction.com",
          "bennyshvac.com",
          "dbeaver-architect-hub.com",
          "dbeaver-failover.com",
          "flywerd.it.com",
          "gleization-leptospiroses.website",
          "plumosity-gammoned.website",
          "s3browserenterprise.app",
          "vmwareenterprize.app",
          "vmwenterprise.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 12
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2026-05-05",
      "indicators": {
        "domain": [
          "auroragutters.com",
          "cameranextpro.com",
          "dbeaver-protocol.com",
          "playzones-hub.com",
          "s3browserenterprize.app",
          "septictankservicing.com",
          "signalprivat.digital",
          "spin-vault.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2026-05-04",
      "indicators": {
        "domain": [
          "aiimagelayer.com",
          "devolutions-rdm.online",
          "lucky-portal.com",
          "panotarypublic.com",
          "rvtoolis.info",
          "rvtoolso.info",
          "rvtoolz.info",
          "securecrt-configledger.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 22
      },
      "first_seen": "2026-05-03",
      "indicators": {
        "domain": [
          "actblues.net",
          "adrilex.digital",
          "aideepflux.com",
          "brightenforge.com",
          "chvent.com",
          "co-part-offset.live",
          "dbeaver-db.com",
          "dbeaver-schema.com",
          "dbeaver-sqlops.com",
          "devolutions-center.com",
          "dogtrainingdfw.com",
          "fareharbores.com",
          "freeagenlt.com",
          "fresagent.com",
          "gfilimtonkas.de",
          "grubshubs.com",
          "heidisql-studio.com",
          "hotnewsreels.com",
          "okcbusinessbrokers.com",
          "rvtools-dataops.com",
          "thesexmart.com",
          "ubelivery.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 22
    },
    {
      "counts": {
        "domain": 1154
      },
      "first_seen": "2026-05-02",
      "indicators": {
        "domain": [
          "45perhour.org",
          "7stories.sbs",
          "91movs.com",
          "9xstream.live",
          "aapanel34768.hostkey.in",
          "abstractest-hydroski.site",
          "academytradeai.com",
          "acquasicuras.com",
          "actbluecs.com",
          "adionetjrei.shop",
          "aexnp.com",
          "afeherbopenuk.com",
          "agronomywork.info",
          "aiadvancedreasoning.com",
          "aialgocamp.com",
          "aialgocore.com",
          "aialgodrive.com",
          "aialgoflow.com",
          "aialgofusion.com",
          "aialgohash.com",
          "aialgorithmforge.com",
          "aialgorithmicforge.com",
          "aialgorithmicpath.com",
          "aialgosense.com",
          "aialgosphere.com",
          "aianalyticengine.com",
          "aianalyticmesh.com",
          "aiautomationframework.com",
          "aiautonomycore.com",
          "aibigdatamap.com",
          "aibotscale.com",
          "aibrainatelier.com",
          "aibrainframe.com",
          "aibrainlogicc.com",
          "aibrainmatrixed.com",
          "aibrainyard.com",
          "aibuildersguild.com",
          "aibuildnet.com",
          "aibuildspark.com",
          "aibytepad.com",
          "aicalcengine.com",
          "aichatbeam.com",
          "aichatfuse.com",
          "aichattask.com",
          "aichippad.com",
          "aicloudcamp.com",
          "aicloudlayer.com",
          "aicloudreactor.com",
          "aicloudthread.com",
          "aicodealpha.com",
          "aicodebeam.com",
          "aicodebrain.com",
          "aicodefoundry.com",
          "aicodeport.com",
          "aicognexora.com",
          "aicognistack.com",
          "aicognitiongrid.com",
          "aicognitiveforge.com",
          "aicognitiveframework.com",
          "aicognivaults.com",
          "aicomputedgrid.com",
          "aiconsciousgrid.com",
          "aicontentarc.com",
          "aicoremodels.com",
          "aicortexlayer.com",
          "aicortexnexus.com",
          "aicyberbyte.com",
          "aicybercraft.com",
          "aicyberimatrix.com",
          "aicybernode.com",
          "aicyberpath.com",
          "aicyberscale.com",
          "aidadynamics.com",
          "aidatabay.com",
          "aidataclustering.com",
          "aidatafathom.com",
          "aidataprime.com",
          "aidatasflux.com",
          "aideepanalytics.com",
          "aideepboard.com",
          "aideepdeck.com",
          "aideepreasoning.com",
          "aideepspark.com",
          "aidigitalmesh.com",
          "aievolvelogic.com",
          "aifuturewave.com",
          "aigainforge.com",
          "aigenorbit.com",
          "aigripe.com",
          "aihyperpulse.com",
          "aiimageflux.com",
          "aiinsighttgrid.com",
          "aiintellifuse.com",
          "ailabsync.com",
          "ailayergrid.com",
          "ailearnstack.com",
          "ailogiccanvas.com",
          "ailogicframe.com",
          "ailogicmatrix.com",
          "ailogicmesh.com",
          "ailogicnest.com",
          "ailogicpod.com",
          "ailogicscale.com",
          "ailogicvault.com",
          "aimatrixbeam.com",
          "aimatrixcast.com",
          "aimatrixcore.com",
          "aimediabox.com",
          "aimediapath.com",
          "aimetanode.com",
          "aimindbuilders.com",
          "aiminddock.com",
          "aimindgenesis.com",
          "aimodeldrift.com",
          "aimodelrun.com",
          "aimodelworks.com",
          "aineuralcascade.com",
          "aineuralfabric.com",
          "aineuralforge.com",
          "aineuralinference.com",
          "aineuralline.com",
          "aineurallnet.com",
          "aineuralnex.com",
          "aineuralpath.com",
          "aineuralpulse.com",
          "aineuralquery.com",
          "aineuralscribe.com",
          "aineurodeck.com",
          "aineurofluxion.com",
          "aineurogenesis.com",
          "aineuroloop.com",
          "aineuronspark.com",
          "ainexorasystem.com",
          "ainexusgear.com",
          "ainexuspoint.com",
          "ainexussync.com",
          "aio-streamer.live",
          "aio18app.live",
          "aioptimizecore.com",
          "aiparadigmmodel.com",
          "aipatternscan.com",
          "aipixelepoch.com",
          "aipixelflow.com",
          "aipredictai.com",
          "aipredictivecode.com",
          "aipredictivecore.com",
          "aipredictivesystem.com",
          "aiprocessnexus.com",
          "aiprocessvault.com",
          "aiprompttask.com",
          "aiprotocolmesh.com",
          "aiqantumsynapse.com",
          "aiquantaforge.com",
          "aiquantumlogic.com",
          "aiquantumorbit.com",
          "aiquantumrelay.com",
          "aiquantumweave.com",
          "airoboticsdata.com",
          "airoboticslogic.com",
          "airobotmind.com",
          "airsoftware.asia",
          "aisecureframework.com",
          "aisecureprocessing.com",
          "aisemanticnexus.com",
          "aisensedock.com",
          "aisentientgrid.com",
          "aisignalengine.com",
          "aismartccore.com",
          "aismartchassis.com",
          "aismartcortex.com",
          "aismartdirectionflow.com",
          "aismartfabric.com",
          "aismartlogic.com",
          "aismartmark.com",
          "aismartmindsystem.com",
          "aismartplatforms.com",
          "aismartpod.com",
          "aisolutioncore.com",
          "aisolvenet.com",
          "aisvectorflowen.com",
          "aisynapseboost.com",
          "aisynapseecho.com",
          "aisynapseedge.com",
          "aisynapselab.com",
          "aisynapsematrix.com",
          "aisynapsenet.com",
          "aisynapticforge.com",
          "aisynthesisno.com",
          "aisynthesisnodes.com",
          "aisynthevora.com",
          "aisysprofileage.com",
          "aitechyard.com",
          "aitensorcore.com",
          "aitensorgrid.com",
          "aitensorvault.com",
          "aitestcore.com",
          "aitextscale.com",
          "aivectorflow.com",
          "aivectornexis.com",
          "aivisioneye.com",
          "aivisionhost.com",
          "aivisionpoint.com",
          "aivoicehash.com",
          "aiwealthfirstmain.com",
          "aksecurityandlocksmith.org",
          "albertaservice.net",
          "albertaservices.org",
          "alldocreader.ink",
          "alpine-quest.live",
          "ancora-shop.com",
          "angelliost.com",
          "apaalieo.com",
          "apaileo.shop",
          "apaliieo.com",
          "apallieo.com",
          "aplicado24tv.stream",
          "app-cdn-software-gza4gebuf3cqd8h6.z03.azurefd.net",
          "app-grand-win.website",
          "app-hypeliquid.xyz",
          "app.alldocreader.ink",
          "app.iptv24.live",
          "app.mediahubtv.live",
          "app.personaltv.live",
          "app.porn-aio.live",
          "app.tikltok18.live",
          "app.tiktko18.live",
          "app.tiltok18.live",
          "app.tv-aio.live",
          "app.watch-aio.live",
          "appalleo.com",
          "appcraft-academy.com",
          "aquazdroj.club",
          "aquilenthes.info",
          "armada-club-top.website",
          "armada-games-app.website",
          "armada-grand-win.website",
          "artisanskillsacademy.com",
          "arvatomedia.com.de",
          "arvelionis.com",
          "assche.com",
          "astem-de.it.com",
          "astronexus.pro",
          "atlantaitsolutions.com",
          "atomlcwallet.us",
          "audioassisten.com",
          "autocarsvehicles.live",
          "autoglasguercam.com",
          "automotiveblog.club",
          "autophorie.blog",
          "autovehicles.live",
          "baltimorepsychic.com",
          "barnecnoble.com",
          "bayleaf.icu",
          "bayleafkits.top",
          "bbi-esign.info",
          "beehtelar.shop",
          "beekeeperstudio.softwarep2p.com",
          "best-mine-site.website",
          "bestcasinoroom.com",
          "blariba.com",
          "blazehollow.com",
          "blitzblox.com",
          "blluewine.com",
          "blorfizan.cyou",
          "blowout-palefaces.website",
          "botelcopay.com",
          "botelcopay.icu",
          "botelcopay.info",
          "botelcopay.net",
          "botelcopay.online",
          "botelcopay.run",
          "braxitrade.info",
          "braynebays.com",
          "breitenbern.shop",
          "bridgenexis.com",
          "brightflowz.org",
          "brightlabsz.com",
          "brightlfunds.com",
          "browser-tv.live",
          "bunbun-fishing.org",
          "burnout-pravention.com",
          "buycanclear.com",
          "buymolle.com",
          "caffedigitale.com",
          "calmgroves.com",
          "cantharides-obscene.website",
          "carereroom.pro",
          "carlifeyamato.com",
          "carnieal.com",
          "carrierbrokeragreements.us",
          "casino-vitoria.ink",
          "casinobonusranking.com",
          "casualjuegosportal.net",
          "celestes-occasion.website",
          "centrises.com",
          "chain-analys.eu.com",
          "chainbork.com",
          "chaosbloomcheck.com",
          "chargesmartuk.com",
          "chatusability.com",
          "chatuxlab.com",
          "cheapsigscanada.com",
          "cherniymehmet.com",
          "chickensroad.ink",
          "chicopeetowing.com",
          "chinohillstowing.com",
          "cinchona-congruence.site",
          "cinematographymastery.com",
          "claysoultrue.pro",
          "climasubito.com",
          "cloudsurferway.com",
          "cloudwhispercheep.com",
          "club-play-grand.website",
          "club-vegas-casino.ink",
          "cmcmarkets.promo-links.com",
          "cocuscompany.com",
          "code-wallets-de.com",
          "cognopix.com",
          "compassgrowpat.com",
          "contorion-uk.com",
          "controle-universal.fit",
          "crafteddreams.net",
          "craftycuddle.com",
          "crazy-app.best",
          "crazy-app.ink",
          "creativewritingretreats.com",
          "crown-advisor.com",
          "crredixas.com",
          "cryptazal.icu",
          "cryptofinance.com.de",
          "csdob.com",
          "cyberrec.shop",
          "cybershield-academy.net",
          "d-extrax.com",
          "daddled-overgirds.website",
          "daddled-uncinariasis.website",
          "daiwa-cycle.pro",
          "danrodphotos.com",
          "database-dbeaver.com",
          "database-heidisql.com",
          "dataops-center.com",
          "datovenza.com",
          "dawnsparknever.com",
          "dbeaver-ce.com",
          "dbeaver-center.com",
          "dbeaver-connect.com",
          "dbeaver-datamesh.com",
          "dbeaver-dataops.com",
          "dbeaver-join.com",
          "dbeaver-munster.com",
          "dbeaver-project.com",
          "dbeaver-sqlhub.com",
          "dbeaver-workspace.com",
          "dbeaver.dataops-center.com",
          "dbeaver.schema-harbor.com",
          "dbeaver.softwarep2p.com",
          "dealsauctions.com",
          "deep-mine-app.site",
          "delvonax.cyou",
          "demapas.com",
          "denizened-blowout.website",
          "der-postillon.org",
          "devolutions-adminops.com",
          "devolutions-endpoint.com",
          "devolutions-governance.com",
          "devolutions-itdesk.com",
          "devolutions-manager.com",
          "devolutions-stack.com",
          "devolutions-subnetlab.com",
          "devolutions.rd-manager.com",
          "devolutions.workgridlab.com",
          "devolutionscontrolroom.com",
          "dexscreeners.cloud",
          "dexscreeners.ink",
          "dexscreeners.life",
          "dexscreeners.pics",
          "dexscreeners.sbs",
          "dexscreeners.shop",
          "dicknns.shop",
          "digitalsystemprofit.com",
          "dirtyca.top",
          "dirtyup.top",
          "dirtyus.top",
          "discoveryrails.com",
          "diversionarcade.net",
          "dividexusstel.digital",
          "doglep.com",
          "download-tightvnc.com",
          "download.rvtools-dev.com",
          "download.rvtools-skillcamp.com",
          "dowojnes.com",
          "draxafied.cyou",
          "dreamchaserpeak.com",
          "dreamrupturevice.com",
          "dreamspinhub.com",
          "dreamweavegrey.com",
          "drexano.de",
          "driftpixelmonster.com",
          "duskblazeworld.com",
          "e-gradanis.info",
          "e-hzz.info",
          "e-hzz.world",
          "e-hzzo.digital",
          "e-hzzo.homes",
          "e-porezn.digital",
          "e-porezn.org",
          "e-porezn.world",
          "e-porezna.homes",
          "e-porezna.org",
          "e-porezna.world",
          "e-poreznas.digital",
          "e-porezno.digital",
          "e-zdrav.org",
          "e-zdravlj.digital",
          "e-zdravlj.info",
          "e-zdravlje.info",
          "e-zdravlje.life",
          "e-zdravlje.today",
          "e-zdravljes.digital",
          "echofallsr.com",
          "echofallsupport.com",
          "ecohomelive.org",
          "ecorecip.shop",
          "ecovoltkit.shop",
          "eds-go.life",
          "eds-life.life",
          "eds-on.life",
          "eds-online.icu",
          "eduglen.com",
          "edulustra.com",
          "edutrelix.com",
          "egradani.icu",
          "electricshop.org",
          "eletrue.com",
          "elite-games-ltd.website",
          "elite-play-base.website",
          "enem-inep2025.com",
          "entretenimientoplay.net",
          "eporezna.info",
          "eporezna.world",
          "esanewablogo.com",
          "etsena.eu.com",
          "evans-esign.info",
          "evolutionblends.com",
          "evolyraz.com",
          "expatpower.com",
          "expresss-fin.com",
          "ezdravlj.info",
          "ezdravlje.digital",
          "ezdravlje.org",
          "fabsaintsimons.org",
          "falor75.com",
          "falserollplay.com",
          "fast-play-city.site",
          "fenlira.de",
          "fileseekslay.pro",
          "filezilla-app.com",
          "filezilla-workspace.com",
          "filmoperatorschule.com",
          "filodarte.net",
          "finanseller.com",
          "finex-pert.com",
          "fingrowe.com",
          "finnarco.com",
          "finsolis.shop",
          "fintherix.com",
          "fiotidasorte2025.com",
          "firstbaze.com",
          "fisheryguide.org",
          "fiveback.xyz",
          "fivebackgift.io",
          "fivebackgiftus.com",
          "fiviebelow.com",
          "fl-studio-mobile.fit",
          "flairfootballs.com",
          "flameechosaber.com",
          "fleksskell.ink",
          "flightradar-canada.com",
          "florovex.com",
          "fluxiroz.com",
          "fokuspyna.com",
          "fokussperk.com",
          "fortcampbellausa.com",
          "freaegent.com",
          "friloktertys.de",
          "frostveilslay.com",
          "frostysmiles.com",
          "fuleroidos.de",
          "fuzionssolens.it.com",
          "fuzoyesos.de",
          "gadgman.ink",
          "game-city-ltd.site",
          "gamorz.com",
          "gates-olympus.live",
          "gauleteres.de",
          "gbdiystore.art",
          "gcrda.com",
          "geliopetry.de",
          "gersolaoe.de",
          "getreceived.com",
          "getting-keepass.com",
          "giftcardmallmygiftac.com",
          "giftcardmallmygiftai.com",
          "giftcardmallmygiftf.com",
          "giftcardmallmygiftss.com",
          "giftcardmallmygiftsus.com",
          "giftcardmallmygiftus.com",
          "giftcardmallus.com",
          "giftcardsecure.com",
          "giftcodemygift.xyz",
          "gijeqiko.de",
          "glavonix.info",
          "glaxtonia.info",
          "glidepilotjp.com",
          "global-games-ltd.website",
          "global-iptv-china.live",
          "global-iptv-japan.live",
          "global-iptv-korea.live",
          "glow-skinstore.com",
          "glowreignmost.com",
          "gloxtram.info",
          "glucometrwellness.com",
          "go-play-ltd.site",
          "godlessnesses-game-city.website",
          "gogisich.shop",
          "gold-game-apps.site",
          "gold-iptv-portugal.live",
          "gold-mine-app.site",
          "goshipppo.com",
          "gospffuf.com",
          "gothepuff.com",
          "gradani.digital",
          "graphicin.com",
          "grok-assistente.live",
          "grubfoaub.com",
          "grubphub.com",
          "gruihub.com",
          "grulbhub.com",
          "grusthub.com",
          "hair-clipper.icu",
          "handwerkzeit.com",
          "harborfreihgt.net",
          "harrybradley.com",
          "hartmarn.shop",
          "hauswaermepumpe.com",
          "havenlys.com",
          "heatfuturenow.com",
          "heavychest.com",
          "heeev.com",
          "heidisql-app.com",
          "heidisql-center.com",
          "heidisql-connect.com",
          "heidisql-db.com",
          "heidisql-project.com",
          "heidisql-queryladder.com",
          "heidisql-schema.com",
          "heidisql-workbench.com",
          "heidisql.database-lists.com",
          "heimatjetzt.com",
          "heritage-interiiors.com",
          "hexenabenteuer.com",
          "hodkhewicz.shop",
          "hohnston.shop",
          "hongkongfocus.com",
          "honorivalearn.com",
          "hootsuite.promo-links.com",
          "hopeplayeaux.com",
          "hplpert.shop",
          "hrs-store.com",
          "hyperliqiud.cc",
          "hypohq.com",
          "iaclaude.com",
          "ibispaint.ink",
          "icelap.com",
          "ideyakraaft.com",
          "illinoismerchantservices.com",
          "immovablenesses-wishfulnesses.website",
          "impulso-familiar.com",
          "imputation-daddled.website",
          "imputation-regretful.website",
          "independentuknews.com",
          "infomediabeen.top",
          "infusiya.com",
          "inscricao-enem2025.com",
          "inteero.org",
          "inteligente-iptv.live",
          "intellectforge.com",
          "interviewakademiedeutschland.com",
          "interviewerbest-de.com",
          "intex360.com",
          "iptv-pt.live",
          "iptv-smart.ink",
          "iptv-tugao.live",
          "iptv-xtream.live",
          "iptv24-app.online",
          "iptv24.live",
          "ital-secure.com",
          "italia-interviewers.com",
          "itasobres.com",
          "iterm2.fabsaintsimons.org",
          "itmurrieta.com",
          "japanesale.icu",
          "jaskolski.shop",
          "jeeplandgrow.pro",
          "jeremywray.com",
          "jogar-cassino.live",
          "joinmorteseek.com",
          "jokerlandia.pro",
          "jokers-club-app.online",
          "jongbloedwheels.com",
          "jpbluesalter.top",
          "jponeclean.icu",
          "juegosocialhub.net",
          "juisekingd.com",
          "junexley.digital",
          "kaatzer.shop",
          "kaizenflowtrade.com",
          "kamerakunstakademie.com",
          "kaneko-optical.info",
          "kanta-suomi.info",
          "kanta.info",
          "keepass-client.com",
          "kelulurn.com",
          "keston-carcare.com",
          "kievstar.digital",
          "kikuchikara-jp.com",
          "kiroxpath.com",
          "kitchekinetic.com",
          "klivontra.icu",
          "knowarya.com",
          "knoweriq.com",
          "knowledgejumps.com",
          "kosquex.fit",
          "landioverday.com",
          "landloverday.com",
          "lchmeler.shop",
          "leafdriftlandys.com",
          "learnarabroostz.com",
          "learndriftz.com",
          "learnkomm.com",
          "learnoxaorira.com",
          "learnzypp.com",
          "legacydate.com",
          "lernkompass-de.com",
          "lestrangelondon.work",
          "letssignjapan.com",
          "liberolavoro.com",
          "libracontrol.com",
          "lifewarehouses.com",
          "linkbioda.com",
          "liqvorax.de",
          "live-fun.ink",
          "lnastcart.com",
          "lnstcard.com",
          "lnstecart.com",
          "logpayset.pro",
          "ltngworth.icu",
          "lumensavesolar.com",
          "lumverse.shop",
          "lunarwhisper.world",
          "lunettes-selection-de.com",
          "lurnexpulse.com",
          "lusthack.com",
          "macejkovic.shop",
          "maisondu-bois.com",
          "majimaya.org",
          "manabi-michi.com",
          "markden.com",
          "masjidimamalias.com",
          "mavorapath.com",
          "maxgenhoupe.pro",
          "md-ahk.com",
          "mediahubtv.live",
          "mediaifnosocia.icu",
          "mega-app-games.website",
          "mega-play-hub.site",
          "mel-peludinhos.com",
          "memeclip.org",
          "mentoxapath.com",
          "meritkings.org",
          "mesitunel.it.com",
          "methodunit.fun",
          "metric-harbor.com",
          "midnightridergrey.com",
          "mikoflow.org",
          "mim-iptv.live",
          "mindaicademia.com",
          "mindarablock.com",
          "mindevarafluxis.com",
          "mindexiscorez.com",
          "mindospherex.com",
          "mindzocore.com",
          "mine-gold-play.site",
          "minidoxiepups.com",
          "mirae-patho.com",
          "missyork.com",
          "misterorgan.com",
          "mistertradeai.com",
          "mistfoldteddy.com",
          "mixenaz.com",
          "mobaxterm-app.com",
          "mobaxterm-terminal.com",
          "mobaxterm.console-workspace.com",
          "mobaxtermatlas.com",
          "mobaxtermdesk.com",
          "mobile-game-city.website",
          "mobilescoding.de",
          "model-engineer.family",
          "molassist.com",
          "monbonvivant.com",
          "moneyfinla.com",
          "moneyresor.com",
          "monitoreffect.com",
          "monsieurs-paris.com",
          "monstergrowdeep.pro",
          "moonwhisperhaze.com",
          "moonwhisperlake.com",
          "moretti-menswear.com",
          "motorverso.org",
          "moxabazco.info",
          "moxabrain.info",
          "moxantria.cyou",
          "moxatrade.info",
          "moxatrend.icu",
          "msperformance.org",
          "musicolet.live",
          "myeks.com",
          "mygift-myonlymail.com",
          "myndlyft.org",
          "myndpusha.com",
          "mytoolshed.club",
          "nailsope.com",
          "nelmods.com",
          "neonwhisperbay.com",
          "neonwrathnice.com",
          "neosolage.shop",
          "nepensens.org",
          "net-optimizer.ink",
          "nettoyaget.com",
          "netzzecho.de",
          "neuralsboost.com",
          "nevadaslp.com",
          "newhopechiro.com",
          "nexiratrack.com",
          "nexityz.com",
          "nextrollen.com",
          "nightgleamclays.com",
          "ninajkitchen.com",
          "ninjasharsk.com",
          "ninjenkitchen.com",
          "nmap-scanner.com",
          "nmap.softwarep2p.com",
          "nordicfriendly.com",
          "norvaxiss.com",
          "novaryns.org",
          "novexagroups.com",
          "nymcu-us.com",
          "nymcu-usa.com",
          "oceaneyedpray.com",
          "ocoeeflooring.com",
          "octorate.homes",
          "offensive-microphylls.website",
          "oma-kanta.info",
          "omakanta.today",
          "omex-tv.live",
          "omnilumity.shop",
          "omnirecipist.shop",
          "omniscaryahaven.com",
          "omnivolt.shop",
          "orca-spa.click",
          "orthonormal-versos.site",
          "osinsii.shop",
          "otp-performance.info",
          "otp-planner.digital",
          "otp-planner.info",
          "otp-platform.digital",
          "otp-provider.digital",
          "ottawacriminaldefencelawyer.com",
          "overgirds-stalwart.website",
          "ox-fanzine.org",
          "oyunlar.fun",
          "pacote-premium.pics",
          "panpacs.com",
          "pathvera.org",
          "paycrenta.com",
          "paylumon.shop",
          "payservicespro.com",
          "payshopp.net",
          "payvoltize.shop",
          "pdf-fuel.fit",
          "pensionikesk.life",
          "pensionikeskus.life",
          "perceptiveasi.com",
          "peregrineclothing.co",
          "personal-iptv.live",
          "personal-tv.live",
          "personaltv.live",
          "phantomtuning.org",
          "photo2-app.fun",
          "pizaiolo.icu",
          "pizaiolo.shop",
          "pizza73-ca.shop",
          "pizzaiiola.top",
          "pizzaiiolo.top",
          "pizzailo.shop",
          "pizzaiola.icu",
          "pizzaiola.top",
          "pizzaiolla.icu",
          "pizzaiolla.shop",
          "pizzaiolla.top",
          "pizzaiollo.icu",
          "pizzaiollo.shop",
          "pizzaiollo.top",
          "pizzaiolo.cyou",
          "pizzaiolo.top",
          "pizzaloio.shop",
          "pizzalolo.cyou",
          "pizzalolo.icu",
          "pizzalolo.shop",
          "pizzalolo.top",
          "pizzapilzza.top",
          "pizzaplza.top",
          "playstillway.com",
          "plexatrim.info",
          "plubgbstore.com",
          "plzzaiolo.shop",
          "pms-manage.us",
          "pms-setup.us",
          "pochstudio.info",
          "poeritosanik.icu",
          "polemicized-godlessnesses.website",
          "polyvids.com",
          "porezna-technology.digital",
          "porezna.homes",
          "porezna.today",
          "porezna.world",
          "porn-aio.live",
          "portalvridge.com",
          "potentility.com",
          "power-bank.digital",
          "powerblink.com",
          "powerfulbrain-hub.com",
          "pravontix.info",
          "praxcloud.icu",
          "presta-facil-cr.com",
          "prime-city-games.site",
          "prime-game-zone.website",
          "prime-gaming-app.website",
          "pro-neustart.com",
          "promo-links.com",
          "propelwisemedia.com",
          "prorecnest.shop",
          "prosacro.shop",
          "prosolery.shop",
          "prosolis.shop",
          "ptns-sp.org",
          "purecanopywong.com",
          "putty-info.com",
          "qa-testing-academy.com",
          "qintelai.com",
          "qualborex.info",
          "quanteroza.com",
          "qubahar.com",
          "quelamira.info",
          "quietgroveover.com",
          "quilzaven.icu",
          "quixamora.info",
          "racedeepseek.pro",
          "racertrickwill.com",
          "radio-portugal.live",
          "radiohead.world",
          "rangermeow.com",
          "rapidonline.org",
          "readera-ebook.info",
          "rebgale.com",
          "rebgalenews.com",
          "redlinetuning.org",
          "reelsqueen.com",
          "reise-mobiltechnik.com",
          "remodeal.com",
          "render3dai.com",
          "resterd.it.com",
          "revitalsolutions.com",
          "revolution-say.pics",
          "rich-mine-games.site",
          "risevioz.com",
          "riverbendpacks.com",
          "royal-play-apps.site",
          "royalscarribbean.com",
          "royalts-app.com",
          "royalts-console.com",
          "royalts-remoteops.com",
          "runolfsfon.shop",
          "ruqwazen.de",
          "rustore.rvtouls.com",
          "rvtools-pipeline.com",
          "rvtools-reference.com",
          "rvtools.metric-harbor.com",
          "rvtools.softwarep2p.com",
          "rvtools.vmwarevelocity.com",
          "sailvatore.icu",
          "sailvatore.shop",
          "sakura-travel.org",
          "salavatore.icu",
          "salavatore.shop",
          "salavattore.shop",
          "salemajeri.icu",
          "salfhlal.com",
          "salivatore.cyou",
          "salivatore.icu",
          "salivatore.shop",
          "sallvatore.cyou",
          "sallvatore.site",
          "sallvatore.store",
          "sallvattore.online",
          "sallvattore.shop",
          "sallvattore.site",
          "sallvattore.store",
          "salvattore.icu",
          "salvattore.shop",
          "salvattores.top",
          "sapceagent.com",
          "satoricraftbox.com",
          "saxo.promo-links.com",
          "scentgold.com",
          "schema-harbor.com",
          "scorespend.com",
          "scuolaoperator.com",
          "secrid-de.com",
          "securecrt-app.com",
          "securecrt-console.com",
          "securecrt-terminalops.com",
          "securecrt.session-ops.com",
          "securecrtrunbook.com",
          "sellvarions.com",
          "sendpap.com",
          "sensational-slots.ink",
          "servicesml.com",
          "session-center.com",
          "session-ops.com",
          "shadowbloombay.com",
          "shadowbloomever.com",
          "shadowdancerplay.com",
          "shaimabeauty.shop",
          "shaoppay.com",
          "sharkniaenja.com",
          "shintralearno.com",
          "shjopay.com",
          "shlop.app",
          "sholpay.com",
          "shopapp.cc",
          "shopeay.com",
          "shoppau.com",
          "shopperapp.net",
          "shosppay.com",
          "shrink-say.pics",
          "shrseninjas.com",
          "sibstarpro.com",
          "signal-online.digital",
          "signalonline.digital",
          "silverhazesoup.com",
          "skaldapath.com",
          "skillforge-academy.org",
          "skillignix.com",
          "skillpathlyn.com",
          "skyshiftnever.com",
          "slash-agency.org",
          "slayvortexdays.com",
          "smartdent-lab.com",
          "smartgpuai.com",
          "smartgrowx.com",
          "smartheatswitchs.com",
          "smartlinetech.co.uk",
          "smarttecnica.com",
          "snapriase.com",
          "snarvadir.cyou",
          "sneaxbird.icu",
          "snugaldor.icu",
          "snuxtrade.info",
          "solboundlandys.com",
          "solerisparimo.com",
          "solscaner.app",
          "soluciones-yas.com",
          "somerestlike.com",
          "sonnyanglusa.com",
          "speakingmastershool.com",
          "spraygraund.com",
          "spycygen.store",
          "staoton.shop",
          "star-play-mobile.site",
          "starcrushworry.com",
          "stardriftshift.com",
          "starjumperlake.com",
          "starrfy.com",
          "statryxo.com",
          "stellar-concept.site",
          "stimme-wirkung.de",
          "store-mauchs.com",
          "stores-fine23.com",
          "streakslouk.com",
          "streamhub-tv.live",
          "streamtv-hub.live",
          "studiport.com",
          "studylexz.com",
          "studysinsight.com",
          "studyviax.com",
          "sunsetkissed.com",
          "sunshinesnotes.com",
          "super-game-city.website",
          "sydelsierra.com",
          "synaxopath.de",
          "synrecipum.shop",
          "tagesechode.com",
          "taiwan-interviewers.com",
          "talentsmomentum.com",
          "tamaautoservice.com",
          "tastylikeleaves.com",
          "taycharon.com",
          "teamalliant.com",
          "tech-novapro.com",
          "techelitegb.com",
          "techrecory.shop",
          "techvoltpad.shop",
          "thafarmrsdog.com",
          "the-digital-news.com",
          "thefarmorsdog.com",
          "thefiarmersdog.com",
          "thefield.club",
          "theine-overall.website",
          "thewrightlegal.com",
          "thfarmrsdog.com",
          "thinkstrac.de",
          "thirtysixstore.work",
          "thisthingofours.org",
          "threivemarket.com",
          "thriftycard.shop",
          "thrillforgenight.com",
          "thrivemakret.com",
          "thrivemerket.com",
          "thrivemurket.com",
          "thrlwemarket.com",
          "thunderlaught.com",
          "tight-vnc.com",
          "tightvnc-center.com",
          "tightvnc-courseware.com",
          "tightvnc-ops.com",
          "tightvnc.session-center.com",
          "tik-app.ink",
          "tik-app.org",
          "tikltok18.live",
          "tiktko18.live",
          "tiltok18.live",
          "timocorn.com",
          "tirnocorn.info",
          "titok-app.live",
          "tjpull.com",
          "tkmathsacademy.com",
          "tokacarameis.com",
          "tokaikisen.club",
          "tokrwards.com",
          "tons-kohl.site",
          "toolstoreuk.live",
          "top-game-world.website",
          "top-play-app.site",
          "top-play-studio.site",
          "top-tuning.org",
          "topaz-belive.site",
          "toyo-sasaki.info",
          "tradingview-app.com",
          "traidecode.com",
          "trainloftz.com",
          "trainnestz.com",
          "trainyxa.com",
          "treeshadowmonster.com",
          "trendorabhs.com",
          "trendorabnko.com",
          "trendorabtkom.com",
          "trendoramario.com",
          "trendorataraf.com",
          "trezqifo.de",
          "trinktiger.com",
          "trolley-swipe.pics",
          "truenews1.com",
          "trx-rent.com",
          "tu-salvavidas.com",
          "tubings-bonaci.site",
          "turelarnalernix.com",
          "tuser-vicio.com",
          "tv-aio.live",
          "tv-navegador.live",
          "tylarlink.com",
          "tylioners.com",
          "tylorvex.de",
          "tyronpath.com",
          "uk-sibstar.com",
          "ukcampsite.reviews",
          "ukcarpfishing.org",
          "ultra-game-vault.website",
          "ultra-play-ltd.site",
          "uni-tv.live",
          "unionclothing.fit",
          "unitv-ca.live",
          "universalupdcode.com",
          "update.rvtouls.com",
          "update.rvvtools.com",
          "urban-play-city.site",
          "urbanindustry.org",
          "vaultopsacademy.com",
          "vedic-uk.com",
          "velmorahubs.com",
          "velmoraqq.com",
          "velvetstrikehipe.com",
          "veresen.com",
          "vexinakyn.com",
          "vexlanix.com",
          "vexnatira.com",
          "vibesurgeclay.com",
          "vicarageartfully.pics",
          "vip-play-center.website",
          "visitpandys.com",
          "visualstorycraft.com",
          "vivanotizie.com",
          "vivantestudio.com",
          "volksreport.com",
          "vrfuckablegirls.live",
          "vrfuckdolls.live",
          "vurmafied.cyou",
          "vuxtamira.icu",
          "vynqore.com",
          "walletcounselor.com",
          "wanderlust-journeys.org",
          "watch-aio.live",
          "weallmarket.com",
          "wear-london.cloud",
          "wildemberborn.com",
          "wildfireheart.com",
          "windcarveolive.com",
          "winstonsofyork.world",
          "wizardmerge.com",
          "works-forge.com",
          "worldseafishing.org",
          "wuckeet.shop",
          "wysoria.com",
          "xonilqup.de",
          "xtream-tv.live",
          "youfreedomspinws.com",
          "yudokoro.com",
          "zdravljes.digital",
          "zeemann.shop",
          "zen-iptv.live",
          "zestplay.pro",
          "zolunqer.de",
          "zowimcode.com",
          "zyntricaz.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 1154
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-05-02",
      "indicators": {
        "domain": [
          "rvtools-capacityops.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2031034087801012435"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-04-26",
      "indicators": {
        "domain": [
          "rvtoolse.info",
          "rvtoolsen.com",
          "rvtoolson.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-04-25",
      "indicators": {
        "domain": [
          "rvtoolsi.info",
          "rvtoolson.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-04-22",
      "indicators": {
        "domain": [
          "rvtootsad.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://research.cert.orangecyberdefense.com/smokedham/smoking_out_an_affiliate.pdf",
        "https://github.com/cert-orangecyberdefense/cti/blob/main/smokedham/iocs"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-04-21",
      "indicators": {
        "domain": [
          "rvtooik.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://research.cert.orangecyberdefense.com/smokedham/smoking_out_an_affiliate.pdf",
        "https://github.com/cert-orangecyberdefense/cti/blob/main/smokedham/iocs"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-04-20",
      "indicators": {
        "domain": [
          "rvtootsacad.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 94
      },
      "first_seen": "2026-04-15",
      "indicators": {
        "domain": [
          "aapanel116864.hostkey.in",
          "admin.rvtoolacs.online",
          "alert-router-b3a.workers.dev",
          "angryipa.com",
          "angryipac.com",
          "angryipac.net",
          "angryipsc.com",
          "api-gateway-a3f.workers.dev",
          "app.sync-engine-d8b.workers.dev",
          "calm-haze-cdae.test-runner-4b7.workers.dev",
          "daniel-foster.workers.dev",
          "dark-bar-d282.nina-alvarez.workers.dev",
          "data-pipeline-9e4.workers.dev",
          "db-proxy-9b2.daniel-foster.workers.dev",
          "dbforges.com",
          "deram71445.workers.dev",
          "dev-web-serv.noroho5002.workers.dev",
          "dev1-server.sogal69343.workers.dev",
          "devartc.com",
          "devartes.com",
          "devartos.com",
          "devartq.com",
          "devartsi.com",
          "devolutions-rdm.com",
          "devolutions.space",
          "disk-7133.identity-svc-9mz.workers.dev",
          "diskqenios.com",
          "divine-glitter-cfb4.elena-morales.workers.dev",
          "edge-proxy-7kx.workers.dev",
          "elasticsa.com",
          "elasticse.com",
          "elasticso.com",
          "elena-morales.workers.dev",
          "eliasic.com",
          "emcocoftvare.com",
          "emcosoftwr.com",
          "feleasofit.com",
          "feleasot.com",
          "felenasofts.com",
          "felenasoftse.com",
          "floral-grass-3c6f.cowivat156.workers.dev",
          "identity-svc-9mz.workers.dev",
          "ingress-ctrl-7c9.workers.dev",
          "ispyconect.com",
          "ivms-4200.com",
          "kaxij51156.workers.dev",
          "kegemom113.workers.dev",
          "kibanal.com",
          "little-frog-2e65.kaxij51156.workers.dev",
          "lively-37b6.edge-proxy-7kx.workers.dev",
          "log-ingest-f1d.nina-alvarez.workers.dev",
          "mayisi1259.workers.dev",
          "mud.alert-router-b3a.workers.dev",
          "nina-alvarez.workers.dev",
          "noroho5002.workers.dev",
          "proxy-edge-c5f.workers.dev",
          "rapid.data-pipeline-9e4.workers.dev",
          "rem-cdn-server.mayisi1259.workers.dev",
          "robwaree.net",
          "robwares.com",
          "royaiapps.com",
          "royaiaps.com",
          "rv-tool.net",
          "rv-toolls.com",
          "rv-toolsa.com",
          "rv-toolso.com",
          "rvtoo1.com",
          "rvtoois.com",
          "rvtoolacs.online",
          "rvtoole.com",
          "rvtoolik.com",
          "rvtoolsaq.com",
          "rvtoolsme.com",
          "rvtoolsv.com",
          "rvtoolsz.com",
          "rvtoolvm.com",
          "rvtoolze.com",
          "s3brawser.com",
          "s3brovser.com",
          "s3brovvser.com",
          "scan-engine-a2d.workers.dev",
          "server-web-cdn.kegemom113.workers.dev",
          "sogal69343.workers.dev",
          "spyconect.com",
          "square-wave-65dd.api-gateway-a3f.workers.dev",
          "sunset.vault-proxy-5d3.workers.dev",
          "sync-engine-d8b.workers.dev",
          "test-runner-4b7.workers.dev",
          "thumaas.com",
          "thumaos.com",
          "vault-proxy-5d3.workers.dev",
          "webapp.ingress-ctrl-7c9.workers.dev",
          "webapp.scan-engine-a2d.workers.dev",
          "young-tooth-5980.deram71445.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://research.cert.orangecyberdefense.com/smokedham/smoking_out_an_affiliate.pdf",
        "https://github.com/cert-orangecyberdefense/cti/blob/main/smokedham/iocs"
      ],
      "total": 94
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-04-15",
      "indicators": {
        "domain": [
          "s3bravser.com",
          "vmback.com",
          "vmbacku.com",
          "vmbackups.com",
          "vmsbackup.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection",
        "https://research.cert.orangecyberdefense.com/smokedham/smoking_out_an_affiliate.pdf",
        "https://github.com/cert-orangecyberdefense/cti/blob/main/smokedham/iocs"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-04-08",
      "indicators": {
        "domain": [
          "workbeneh.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-04-07",
      "indicators": {
        "domain": [
          "workbenche.com",
          "workbencn.com",
          "workbenech.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-03-28",
      "indicators": {
        "domain": [
          "rvtoolseu.com",
          "rvtoolsuk.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-03-24",
      "indicators": {
        "domain": [
          "rvtoollsa.com",
          "rvtoollsi.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-03-14",
      "indicators": {
        "domain": [
          "deguercuernavaca.mx"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-03-13",
      "indicators": {
        "domain": [
          "rvtoolsup.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-03-12",
      "indicators": {
        "domain": [
          "rvtoolsai.com",
          "rvtoolsbox.com",
          "rvtoolsit.com",
          "rvtoolsrun.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-03-10",
      "indicators": {
        "domain": [
          "hornetsecuety.com",
          "hornetsecuty.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 19
      },
      "first_seen": "2026-03-09",
      "indicators": {
        "domain": [
          "horizon-client-download.com",
          "remote-console-vmware.com",
          "rvtools-app.com",
          "rvtools-cloud.com",
          "rvtools-dell.com",
          "rvtools-download-dell.com",
          "rvtools-enterprise.com",
          "rvtools-install.com",
          "rvtools-inventory.com",
          "rvtools-kit.com",
          "rvtools-official.com",
          "rvtools-vmware.com",
          "rvtools-vsphere.com",
          "vmware-programs.com",
          "vmware-remote-console.com",
          "vmware-vsphere.com",
          "vmwarevsphere.com",
          "vsphere-client.com",
          "vsphere-client.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2031034087801012435"
      ],
      "total": 19
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-03-09",
      "indicators": {
        "domain": [
          "hornetsecurety.com",
          "hornetsecurty.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-03-06",
      "indicators": {
        "domain": [
          "rvtoolsmax.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-03-05",
      "indicators": {
        "domain": [
          "rvtoolsone.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-02-28",
      "indicators": {
        "domain": [
          "rvtoolls.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 44
      },
      "first_seen": "2026-02-27",
      "indicators": {
        "domain": [
          "beekeeperstudio-db.com",
          "beekeeperstudio.cc",
          "beekeeperstudio.co",
          "beekeeperstudio.pro",
          "beekeeperstudio.space",
          "beekeeperstudio.tech",
          "computerservicesource.com",
          "database-lists.com",
          "dbeaver-database.app",
          "dbeaver-database.cc",
          "dbeaver-database.cloud",
          "dbeaver-database.co",
          "dbeaver-database.com",
          "dbeaver-database.org",
          "dbeaver-database.pro",
          "dbeaver-database.tech",
          "dbeaver-database.us",
          "heidisql-enterprise.app",
          "heidisql-enterprise.cc",
          "heidisql-enterprise.cloud",
          "heidisql-enterprise.co",
          "heidisql-enterprise.com",
          "heidisql-enterprise.ltd",
          "heidisql-enterprise.org",
          "heidisql-enterprise.pro",
          "heidisql-enterprise.tech",
          "heidisql-enterprise.us",
          "heidisql.space",
          "nmap.space",
          "rv-tools.info",
          "rvtools-dev.com",
          "rvtools-skillcamp.com",
          "rvtools.link",
          "softwarep2p.com",
          "vmware-rvtools.app",
          "vmware-rvtools.cc",
          "vmware-rvtools.cloud",
          "vmware-rvtools.com",
          "vmware-rvtools.ltd",
          "vmware-rvtools.org",
          "vmware-rvtools.pro",
          "vmware-rvtools.tech",
          "vmware-rvtools.us",
          "vmwarevelocity.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 44
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-02-25",
      "indicators": {
        "domain": [
          "hornetseculty.com",
          "rvtooles.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-02-24",
      "indicators": {
        "domain": [
          "rvtoolc.info",
          "rvtooli.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2026-02-17",
      "indicators": {
        "domain": [
          "rvtoolaca.com",
          "rvtoolacs.com",
          "rvtoolses.com",
          "rvtoolsnet.com",
          "rvtoolsun.com",
          "rvvtools.com",
          "vchekac.com",
          "vchekacad.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 18
      },
      "first_seen": "2026-02-16",
      "indicators": {
        "domain": [
          "harnetsecuriity.com",
          "harnetsecurity.com",
          "horpetsecurity.com",
          "rvtoolaca.online",
          "rvtoolas.com",
          "rvtoolsacs.com",
          "rvtoolsax.com",
          "rvtoolsed.com",
          "rvtoolsgo.com",
          "rvtoolshq.com",
          "rvtoolsio.com",
          "rvtoolsl.com",
          "rvtoolslab.com",
          "rvtoolsnow.com",
          "rvtoolsnt.com",
          "rvtoolso.com",
          "rvtoolss.com",
          "rvtouls.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 18
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-01-22",
      "indicators": {
        "domain": [
          "etherial.groover.workers.dev",
          "groover.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/goldenjackel12/status/2013877434421072187",
        "https://www.virustotal.com/gui/file/3ebc0df2b92a39d1fb4491b7aaf6996425214ebe85e6243f443f1db087172f27/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 12
      },
      "first_seen": "2026-01-12",
      "indicators": {
        "domain": [
          "rv-tools.eu",
          "rvtoo1s.com",
          "rvtooles.com",
          "rvtoolis.com",
          "rvtoolit.com",
          "rvtoolsac.com",
          "rvtoolsacad.com",
          "rvtoolspro.com",
          "rvtoolspro.info",
          "rvtoolspro.online",
          "rvtoolsus.com",
          "rvtoolsusa.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/g0njxa/status/2010485906466394343",
        "https://x.com/g0njxa/status/2027082406847709524",
        "https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection",
        "https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection"
      ],
      "total": 12
    },
    {
      "counts": {
        "domain": 16
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "app-cdn.celixi6266.workers.dev",
          "cdn-app-server.vewojo9572.workers.dev",
          "cdn-app-web.piniyi9484.workers.dev",
          "ec2-app.lewoha7320.workers.dev",
          "ec2-server.bayaj19162.workers.dev",
          "ec2-server.gegodec527.workers.dev",
          "ec2-server.milago3967.workers.dev",
          "floral-paper-8eb1.pihara4672.workers.dev",
          "keystore-explorer.com",
          "mstore.framfarmers.co.uk",
          "server-web-cdn.dones86497.workers.dev",
          "server-web-cdn.mevame4224.workers.dev",
          "server-web-cdn.ravebo3233.workers.dev",
          "server-web-cdn.yevobod379.workers.dev",
          "server-web-cdn1.gekod80409.workers.dev",
          "web-app.dasik14289.workers.dev"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://gist.github.com/drb-ra/179e8e9beca45bc10feba97cf8c5c7b1"
      ],
      "total": 16
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "crimson-unit-2561.kopis56799.workers.dev",
          "ec2-server-noisy-band-0fe8.focapaj280.workers.dev",
          "server-cd2.bipewi2747.workers.dev",
          "server-web.sasex59966.workers.dev",
          "web-app.larij21770.workers.dev"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://medium.com/trac-labs/who-ordered-the-smokedham-backdoor-delicacies-in-the-wild-87f51e2e5bd2"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "app.pofelal314.workers.dev",
          "bapiyat727.workers.dev",
          "pofelal314.workers.dev",
          "ssl.bapiyat727.workers.dev"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/SquiblydooBlog/status/1993311260512075967",
        "https://app.any.run/tasks/a9391be5-4e71-4a95-9072-477f8afd906f/"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 22
      },
      "first_seen": "2024-11-25",
      "indicators": {
        "domain": [
          "cdn-server-1.xiren77418.workers.dev",
          "cdn-server-2.wesoc40288.workers.dev",
          "cdn-server-full.taros12579.workers.dev",
          "cdn-web-server1.techserver01.workers.dev",
          "cdn1.cowivat156.workers.dev",
          "cdn1.poyag17470.workers.dev",
          "dash-server.servertech03.workers.dev",
          "server-cdn.jawigaw383.workers.dev",
          "server-cdn.lafise2419.workers.dev",
          "server-cdn.lecoc56350.workers.dev",
          "server-cdn.sidoke9822.workers.dev",
          "server-cdn.virej10913.workers.dev",
          "server-cdn.xohahey822.workers.dev",
          "server-web-cdn.detocim498.workers.dev",
          "server-web-cdn.kagoli5215.workers.dev",
          "server-web-cdn.nefixeg373.workers.dev",
          "server-web-cdn.pixece7948.workers.dev",
          "server-web-cdn.rojotoc516.workers.dev",
          "server-web-cdn.vosax32455.workers.dev",
          "soft-base-01.ginigiy117.workers.dev",
          "soft-dns.sejilod748.workers.dev",
          "work-server-1.picalob750.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://medium.com/trac-labs/who-ordered-the-smokedham-backdoor-delicacies-in-the-wild-87f51e2e5bd2"
      ],
      "total": 22
    }
  ]
}