# Copyright (c) 2014-2020 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: BeamWinHTTP, ElectrumDoSMiner

# Reference: https://twitter.com/P3pperP0tts/status/1122089616360734720
# Reference: https://app.any.run/tasks/1d382767-1032-41bd-9a0c-4c3f31c44646
# Reference: https://blog.malwarebytes.com/cybercrime/2019/04/electrum-ddos-botnet-reaches-152000-infected-hosts/
# Reference: https://www.virustotal.com/gui/ip-address/178.159.37.113/relations
# Reference: https://www.virustotal.com/gui/ip-address/188.214.135.174/relations
# Reference: https://www.virustotal.com/gui/ip-address/194.63.143.226/relations
# Reference: https://www.virustotal.com/gui/ip-address/217.147.169.179/relations

btcore.ddns.net
tardis.bauerj.eu
t-trade.net

http://178.159.37.113
http://188.214.135.174
http://194.63.143.226  
http://217.147.169.179

# Reference: https://www.virustotal.com/gui/file/e3b5afe690494adbeca6ec4a833060740d43e7a9d852355ef19e3cb43c90612f/detection

2azzarita.hopto.org
azzarita.hopto.org
bitc0ins.nl
bitcoin-server.cf
borato10.hopto.org
electrum-lightning.cappux.com
electrum-server.ninja
electrum.anduck.net
electrum.coineuskal.com
electrum.coinop.cc
electrum.coinucopia.io
electrum.dragonzone.net
electrum.eff.ro
electrum.festivaldelhumor.org
electrum.happyforever.com
electrum.hodlister.co
electrum.hsmiths.com
electrum.leblancnet.us
electrum.mindspot.org
electrum.noinput.xyz
electrum.nute.net
electrum.peleion.com
electrum.petrkr.net
electrum.profitbitcoin.com
electrum.qtornado.com
electrum.scumm.it
electrum.villocq.com
electrum.vom-stausee.de
electrum2.villocq.com
electrumhsmiths.hodlister.co
electrumx-core.1209k.com
electrumx.bot.nu
electrumx.ddns.net
electrumx.ftp.sh
electrumx.hopto.org
electrumx.schmoock.net
electrumx.soon.it
electrumx.strangled.net
elx2018.mooo.com
enode.duckdns.org
enodeduckdns.org
erbium1.sytes.net
qmebr.spdns.org

# Reference: https://www.virustotal.com/gui/file/c6eb5cf260e9e24f64b2def82330fb7119e15033f41da6c7f6ab924c73fd11ef/detection

electrum.taborsky.cz
tomscryptos.com

# Generic trails

/serviceaddresses.php
/pingtransaction.php
/pingsub.php
