# Copyright (c) 2014-2021 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: roamingmantis, xloader, fakecop, fakenocam, fakespy, moqhao, xighost

# Reference: https://securelist.com/roaming-mantis-uses-dns-hijacking-to-infect-android-smartphones/85178/

haoxingfu01.ddns.net
shaoye11.hopto.org

# Reference: https://securelist.com/roaming-mantis-part-iv/90332/
# Reference: https://otx.alienvault.com/pulse/5ca537055fe8d2200c37306e
# Reference: https://blog.trendmicro.com/trendlabs-security-intelligence/new-version-of-xloader-that-disguises-as-android-apps-and-an-ios-profile-holds-new-links-to-fakespy/
# Reference: https://blog.trendmicro.com/trendlabs-security-intelligence/a-look-into-the-connection-between-xloader-and-fakespy-and-their-possible-ties-with-the-yanbian-gang/
# Reference: https://securityaffairs.co/wordpress/83317/breaking-news/xloader-6-twitter.html
# Reference: https://twitter.com/NaomiSuzuki_/status/1139099288682635264
# Reference: https://twitter.com/sepi140/status/1144053834894864387
# Reference: https://twitter.com/ninoseki/status/1194033007008444418

ffakecg.com
files.spamo.jp
759383.com
711231.com
923525.com
923915.com
975685.com
1.169.203.48:28855
1.171.156.182:28844
104.160.191.190:8822
114.43.155.227:28855
118.168.130.236:28855
125.227.174.35:28855
171.244.33.162:28844
220.136.39.1:28855
220.136.47.169:28855
220.136.49.137:28855
61.230.204.87:28833
61.230.204.87:28855
61.230.205.122:28833
61.230.205.122:28844
61.230.205.122:28855
61.230.205.132:28833
61.230.205.132:28844
61.230.205.132:28855
61.230.204.87:28844
61.230.210.228:28855
http://38.27.99.11/xvideo/

# Reference: https://twitter.com/ninoseki/status/1115061669929992192

softbank-b.com
id-auone.com

# Reference: https://twitter.com/naomisuzuki_/status/1104603448580833281

174.139.10.106:81

# Reference: http://vxcube.com/tools/domain/nttdocomo-ki.com/relate_iocs

softbank-c.com

# Reference: http://vxcube.com/tools/domain/softbank-c.com/relate_iocs

a-sagawa.com

# Reference: https://twitter.com/JayTHL/status/1145181603259387904
# Reference: https://twitter.com/NaomiSuzuki_/status/1144905331337768961
# Reference: https://www.virustotal.com/gui/ip-address/23.234.51.104/relations
# Reference: https://www.virustotal.com/gui/ip-address/104.143.94.206/relations
# Reference: https://twitter.com/NaomiSuzuki_/status/1145172884379193344
# Reference: https://www.virustotal.com/gui/ip-address/104.194.219.46/relations
# Reference: https://www.virustotal.com/gui/ip-address/23.234.51.106/relations
# Reference: https://twitter.com/NaomiSuzuki_/status/1144461927193513985
# Reference: https://www.virustotal.com/gui/ip-address/104.143.94.203/relations
# Reference: https://www.virustotal.com/gui/ip-address/104.143.94.204/relations
# Reference: https://www.virustotal.com/gui/ip-address/23.234.51.110/relations
# Reference: https://www.virustotal.com/gui/ip-address/23.234.51.111/relations
# Reference: https://www.virustotal.com/gui/ip-address/23.234.51.113/relations
# Reference: https://www.virustotal.com/gui/ip-address/23.234.51.114/relations
# Reference: https://www.virustotal.com/gui/ip-address/23.234.51.119/relations
# Reference: https://www.virustotal.com/gui/ip-address/23.234.51.121/relations
# Reference: https://www.virustotal.com/gui/ip-address/23.234.51.127/relations
# Reference: https://www.virustotal.com/gui/ip-address/23.234.51.128/relations
# Reference: https://twitter.com/NaomiSuzuki_/status/1141595796762050560
# Reference: https://www.virustotal.com/gui/ip-address/66.11.117.67/relations
# Reference: https://www.virustotal.com/gui/ip-address/66.11.117.68/relations
# Reference: https://www.virustotal.com/gui/ip-address/66.11.117.69/relations
# Reference: https://www.virustotal.com/gui/ip-address/66.11.117.70/relations
# Reference: https://twitter.com/NaomiSuzuki_/status/1141332232214175744
# Reference: https://www.virustotal.com/gui/ip-address/45.58.61.5/relations
# Reference: https://www.virustotal.com/gui/ip-address/23.234.51.253/relations
# Reference: https://www.virustotal.com/gui/ip-address/23.234.51.75/relations
# Reference: https://twitter.com/NaomiSuzuki_/status/1140486071915962368
# Reference: https://www.virustotal.com/gui/ip-address/174.139.49.108/relations
# Reference: https://www.virustotal.com/gui/ip-address/67.229.196.130/relations
# Reference: https://www.virustotal.com/gui/ip-address/67.229.196.131/relations
# Reference: https://www.virustotal.com/gui/ip-address/67.229.196.132/relations
# Reference: https://www.virustotal.com/gui/ip-address/67.229.196.133/relations
# Reference: https://www.virustotal.com/gui/ip-address/67.229.196.134/relations
# Reference: https://www.virustotal.com/gui/ip-address/67.229.228.67/relations
# Reference: https://www.virustotal.com/gui/ip-address/67.229.228.68/relations
# Reference: https://www.virustotal.com/gui/ip-address/67.229.228.69/relations
# Reference: https://www.virustotal.com/gui/ip-address/67.229.228.70/relations
# Reference: https://www.virustotal.com/gui/ip-address/185.114.225.121/relations
# Reference: https://www.virustotal.com/gui/ip-address/192.236.200.43/relations
# Reference: https://www.virustotal.com/gui/ip-address/192.236.200.44/relations
# Reference: https://www.virustotal.com/gui/ip-address/192.236.200.46/relations
# Reference: https://twitter.com/NaomiSuzuki_/status/1145647256122482689
# Reference: https://twitter.com/NaomiSuzuki_/status/1145676619920470016
# Reference: https://twitter.com/NaomiSuzuki_/status/1147414997141577728
# Reference: https://twitter.com/NaomiSuzuki_/status/1147504563584294912
# Reference: https://twitter.com/NaomiSuzuki_/status/1150663929351135232
# Reference: https://twitter.com/NaomiSuzuki_/status/1150758062589743104
# Reference: https://twitter.com/NaomiSuzuki_/status/1132842777564180480
# Reference: https://twitter.com/NaomiSuzuki_/status/1151749950616698881
# Reference: https://twitter.com/NaomiSuzuki_/status/1151714965964906496

fril-jp.xyz
a-sagawa.cn
r-softbank.com
s-softbank.com
t-softbank.com
u-softbank.com
w-softbank.com
y-softbank.com
z-softbank.com
104.143.94.203:81
104.143.94.204:81
104.143.94.205:81
104.143.94.206:81
104.194.219.43:81
104.194.219.44:81
104.194.219.45:81
104.194.219.46:81
137.175.79.26:81
174.139.49.108:81
174.139.49.109:81
185.114.225.121:81
192.236.200.42:81
192.236.200.43:81
192.236.200.44:81
192.236.200.46:81
45.12.206.233:81
45.58.61.5:81
45.83.140.132:81
51.68.251.30:81
66.11.117.67:81
66.11.117.68:81
66.11.117.69:81
66.11.117.70:81
67.229.165.163:81
67.229.196.130:81
67.229.196.131:81
67.229.196.132:81
67.229.196.133:81
67.229.196.134:81
67.229.228.67:81
67.229.228.68:81
67.229.228.69:81
67.229.228.70:81
89.35.39.233:81

# Reference: https://twitter.com/NaomiSuzuki_/status/1148443453438611456
# Reference: https://twitter.com/NaomiSuzuki_/status/1149671856288305152
# Reference: https://twitter.com/NaomiSuzuki_/status/1150281094308044800
# Reference: https://twitter.com/NaomiSuzuki_/status/1190135139260518400
# Reference: https://twitter.com/NaomiSuzuki_/status/1192285001309573121

security[a-z]{3}\-[a-z]{3,5}\.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1142112093765697536

softbank-if.com

# Reference: https://www.virustotal.com/gui/domain/myau-it.com/relations

myau-it.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1152594740681924608

sagawa.online

# Reference: https://twitter.com/ninoseki/status/1153560258385600513

myau-pk.com

# Reference: https://twitter.com/papa_anniekey/status/1153275407107416064

id-securitys.com
myauaz.com

# Reference: https://twitter.com/ninoseki/status/1154187270443769856

myau-tk.com
mysoftbank-yd.com

# Reference: https://twitter.com/ninoseki/status/1155341234933682177

myau-iv.com

# Reference: https://twitter.com/ninoseki/status/1156053482400432129

myau-iej.com

# Reference: https://twitter.com/ninoseki/status/1158253859388526594

220.136.221.176:28866
220.136.221.176:38876

# Reference: https://twitter.com/ninoseki/status/1160454983885574145

starspacegames.com

# Reference: https://twitter.com/ninoseki/status/1160459178449625088

lhbd666.com
六合宝典666.com
xn--666-xw1e1b58vhor.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1160890581180014595

a.bb-bb.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1164491384939696128

a111a.top

# Reference: https://twitter.com/ninoseki/status/1165139382166147073

6666.sk
hd7669.com
jx668.com
bnbnyou.com
98238001.com
gqs1.com
yhkjjm.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1166964963501432832

a12c.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1167721457251569666

a12b.top

# Reference: https://twitter.com/ninoseki/status/1167670614968164355

88mu.cc
5975h.cc

# Reference: https://twitter.com/papa_anniekey/status/1171239626205302784
# Reference: https://twitter.com/NaomiSuzuki_/status/1168455483767738368
# Reference: https://twitter.com/NaomiSuzuki_/status/1168782925057290240
# Reference: https://twitter.com/NaomiSuzuki_/status/1169158271141326850
# Reference: https://twitter.com/papa_anniekey/status/1169138764033265674
# Reference: https://twitter.com/NaomiSuzuki_/status/1169520889152425984
# Reference: https://twitter.com/NaomiSuzuki_/status/1169885475089203201
# Reference: https://twitter.com/NaomiSuzuki_/status/1170316840851005441
# Reference: https://twitter.com/NaomiSuzuki_/status/1170624787258867712
# Reference: https://twitter.com/NaomiSuzuki_/status/1170943660994654208
# Reference: https://twitter.com/NaomiSuzuki_/status/1171333123168059392
# Reference: https://twitter.com/papa_anniekey/status/1171239629447520263
# Reference: https://twitter.com/NaomiSuzuki_/status/1154324406413352960

a123a.top
b123b.top
c123c.top
d123d.top
e123.top
e123e.top
f123f.top
g123g.top
h123h.top
i123i.top
j123j.top
k123k.top
l123l.top
m123m.top
n123n.top
o123o.top
p123p.top
q123q.top
r123r.top
s123t.top
t123t.top
u123u.top
v123v.top
w123w.top
x123x.top
y123y.top
z123z.top

# Reference: https://twitter.com/ninoseki/status/1168498290859507713
# Reference: https://twitter.com/ninoseki/status/1168692529937567744

http://172.247.209.5
http://23.224.190.99

# Reference: https://twitter.com/ninoseki/status/1172412415834611713

myaccount-w.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1174222105141010437

a234a.top
b234b.top
c234c.top
d234d.top
e234e.top
f234f.top
g234g.top
h234h.top
i234i.top
j234j.top
k234k.top
l234l.top
m234m.top
n234n.top
o234o.top
p234p.top
q234q.top
r234r.top
s234t.top
t234t.top
u234u.top
v234v.top
w234w.top
x234x.top
y234y.top
z234z.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1177142538022477824

a345a.top
b345b.top
c345c.top
d345d.top
e345e.top
f345f.top
g345g.top
h345h.top
i345i.top
j345j.top
k345k.top
l345l.top
m345m.top
n345n.top
o345o.top
p345p.top
q345q.top
r345r.top
s345t.top
t345t.top
u345u.top
v345v.top
w345w.top
x345x.top
y345y.top
z345z.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1185808968980938752

a456a.top
b456b.top
c456c.top
d456d.top
e456e.top
f456f.top
g456g.top
h456h.top
i456i.top
j456j.top
k456k.top
l456l.top
m456m.top
n456n.top
o456o.top
p456p.top
q456q.top
r456r.top
s456t.top
t456t.top
u456u.top
v456v.top
w456w.top
x456x.top
y456y.top
z456z.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1189438789845782529

a567a.top
b567b.top
c567c.top
d567d.top
e567e.top
f567f.top
g567g.top
h567h.top
i567i.top
j567j.top
k567k.top
l567l.top
m567m.top
n567n.top
o567o.top
p567p.top
q567q.top
r567r.top
s567t.top
t567t.top
u567u.top
v567v.top
w567w.top
x567x.top
y567y.top
z567z.top
a678a.top
b678b.top
c678c.top
d678d.top
e678e.top
f678f.top
g678g.top
h678h.top
i678i.top
j678j.top
k678k.top
l678l.top
m678m.top
n678n.top
o678o.top
p678p.top
q678q.top
r678r.top
s678t.top
t678t.top
u678u.top
v678v.top
w678w.top
x678x.top
y678y.top
z678z.top
a789a.top
b789b.top
c789c.top
d789d.top
e789e.top
f789f.top
g789g.top
h789h.top
i789i.top
j789j.top
k789k.top
l789l.top
m789m.top
n789n.top
o789o.top
p789p.top
q789q.top
r789r.top
s789t.top
t789t.top
u789u.top
v789v.top
w789w.top
x789x.top
y789y.top
z789z.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1181460727422275584

pkn3.com
yas89.com

# Reference: https://twitter.com/papa_anniekey/status/1183609041374703616

appp.men

# Reference: https://twitter.com/NaomiSuzuki_/status/1187619101914451968

kma28.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1188356983881007104

cmp357.com

# Reference: https://twitter.com/ninoseki/status/1191975992648187904

wpk35.com
202.36.56.16:28846

# Reference: https://twitter.com/NaomiSuzuki_/status/1197538545654624256

bc567b.top

# Reference: https://twitter.com/ninoseki/status/1199838741503692800

tks35.com

# Reference: https://twitter.com/ninoseki/status/1200548112160284672
# Reference: https://twitter.com/ninoseki/status/1201012987307253761

au-lo.com
au-lu.com
nttdocomo-lu.com

# Reference: https://twitter.com/malwaretracekr/status/1200331449414512640

21as61.club
6s55s.xyz

# Reference: https://twitter.com/malwaretracekr/status/1200367115875667968

3asd1f1h.monster
9s66f.xyz

# Reference: https://twitter.com/malwaretracekr/status/1199652183743950848

6s444.club
9s6g2.xyz

# Reference: https://twitter.com/Steam_Nostalgia/status/1198566148742103042

9s54h.club
9s55h.xyz

# Reference: https://twitter.com/ninoseki/status/1203938633905868801

au-ls.com
epos-ua.com

# Reference: https://twitter.com/ninoseki/status/1204971169658523649
# Reference: https://www.virustotal.com/gui/ip-address/1.171.162.250/relations
# Reference: https://www.virustotal.com/gui/ip-address/128.14.128.29/relations

1.171.162.250:33669
http://1.171.162.250
http://128.14.128.29
hanbokeji.cn

# Reference: https://twitter.com/ninoseki/status/1205096394991620096

asdf4y.xyz

# Reference: https://www.botconf.eu/wp-content/uploads/2019/12/B2019-Ishimaru-Niseki-Ogawa-Mantis.pdf

http://60.249.191.166
1.171.162.250:28844
45.32.29.33:11257

# Reference: https://twitter.com/ninoseki/status/1206885652119224320

jp-bankq.com

# Reference: https://twitter.com/ninoseki/status/1207532639814467585

au-xa.com
bank-securityw.com

# Reference: https://twitter.com/ninoseki/status/1208011887411023872

hsu3sg.xyz

# Reference: https://twitter.com/ninoseki/status/1208577085423308800

sty38.com

# Reference: https://www.virustotal.com/gui/ip-address/198.44.226.31/relations

198.44.226.31:80

# Reference: https://twitter.com/ninoseki/status/1210521775320137729

36ss5g.xyz

# Reference: https://twitter.com/NaomiSuzuki_/status/1211540720563056640

au-xk.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1211183970043351041

au-xj.com

# Reference: https://twitter.com/io_sono_io_IT/status/1211919119836008448

au-xl.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1213064251775913984

au-xz.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1213399806883688448

au-xc.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1213761825352769536

au-xv.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1214140751296094208

au-xb.com

# Reference: https://twitter.com/ninoseki/status/1214748400588976128

au-xn.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1214830731911819266

au-xm.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1215536457508515840

au-os.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1215900594365296641

au-od.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1216256911399473154

au-of.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1217679373035130886

au-ok.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1217321649353019396

au-oj.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1218051566801784833

au-pk.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1218418305607749632

au-pw.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1218777939187093504

au-tqa.com

# Reference: https://twitter.com/ozuma5119/status/1215602022382047233
# Reference: https://otx.alienvault.com/pulse/5de7e1b56675ecc611a42504

support-01.info

# Reference: https://twitter.com/ninoseki/status/1197704676788985858
# Reference: https://www.virustotal.com/gui/ip-address/23.244.168.81/relations
# Reference: https://www.virustotal.com/gui/ip-address/23.245.238.121/relations

awn046.cn
bhe371.cn
dck347.cn
iya309.cn
mmp969.cn
tlt283.cn
vbe398.cn
zaf342.cn

# Reference: https://securelist.com/roaming-mantis-part-v/96250/
# Reference: https://otx.alienvault.com/pulse/5e580418c9e4bda93c1a013f

bk-securityo.com
jp-bankq.com

# Reference: https://twitter.com/ninoseki/status/1233167156163960832/photo/2

99qzw.com

# Reference: https://www.virustotal.com/gui/domain/cat-tw.top/relations

cat-tw.top

# Reference: https://twitter.com/papa_anniekey/status/1239430027768254466
# Reference: https://www.virustotal.com/gui/ip-address/216.198.66.107/relations

post-a.top
post-ch.top
upsp-us.top

# Reference: https://twitter.com/papa_anniekey/status/1196688209779908609

sagawae-xp.gnway.cc
sagawa-exp.gnway.cc
sagawajp.gnway.cc
sagawar.gnway.cc
sagawexp.gnway.cc

# Reference: https://twitter.com/papa_anniekey/status/1182330797887381504

post-c.top

# Reference: https://twitter.com/dhana93884812/status/1179719975046541313

kuronekoyamat.com

# Reference: https://twitter.com/ninoseki/status/1105743867725246464

saga-wa.jp

# Reference: https://twitter.com/ninoseki/status/1102147510728941568

sa-sagawa.com

# Reference: https://twitter.com/ninoseki/status/1244554701355372544

post-a.top
post-ch.top
swiz.club

# Reference: https://twitter.com/ReBensk/status/1169166828427309056

107474h.com
512000.top

# Reference: https://twitter.com/ReBensk/status/1168935195397017600

yuanchuang0088.com

# Reference: https://twitter.com/LukasStefanko/status/1253663677653438466

y-f.top

# Reference: https://twitter.com/ninoseki/status/1253965276678254594

nzpost-co.com

# Reference: https://www.virustotal.com/gui/ip-address/154.13.28.213/relations

http://154.13.28.213

# Reference: https://www.virustotal.com/gui/domain/royalmaill.top/relations

royalmaill.top

# Reference: https://www.virustotal.com/gui/domain/royamai.top/relations

royamai.top

# Reference: https://www.virustotal.com/gui/ip-address/216.198.66.107/relations

216.198.66.107:81

# Reference: https://twitter.com/ninoseki/status/1254654834315153408

smbccoj.pl

# Reference: https://twitter.com/NaomiSuzuki_/status/1255054752649375744

hasbetsx.tumblr.com

# Reference: https://twitter.com/ninoseki/status/1255081274760257538

genmaa.club

# Reference: https://twitter.com/NaomiSuzuki_/status/1255464330499416066

hsbpp.tumblr.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1255753578381111296

haxsp.tumblr.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1256103577237417985

hsneg.tumblr.com

# Reference: https://dev.re.kr/21 (Korean)

starbank-kb.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1256864750878654464

hptbs.tumblr.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1257242769937985536

rpxxs.tumblr.com

# Reference: https://twitter.com/malwaretracekr/status/1257923672808943617

hsnebgs.tumblr.com

# Reference: https://twitter.com/malwaretracekr/status/1257019568381235200
# Reference: https://www.virustotal.com/gui/ip-address/154.209.18.111/relations

cj-sep.com
cj-seq.com
cj-ser.com
cj-set.com
cj-sew.com
cj-sey.com
kr-hp.com

# Reference: https://twitter.com/ninoseki/status/1257468685758824448
# Reference: https://www.virustotal.com/gui/ip-address/154.223.51.111/relations

154.223.51.111:28866

# Reference: https://twitter.com/NaomiSuzuki_/status/1259808122295644160

rewrer.ddns.net

# Reference: https://twitter.com/NaomiSuzuki_/status/1260112681203167232

daswe.chickenkiller.com
sdawqe.myddns.rocks

# Reference: https://www.virustotal.com/gui/ip-address/154.223.144.251/relations

dsfsfew.duckdns.org
fgrrek.ddns.net

# Reference: https://twitter.com/ninoseki/status/1261124943854485504
# Reference: https://twitter.com/NaomiSuzuki_/status/1261196866739245057
# Reference: https://twitter.com/NaomiSuzuki_/status/1261232751182622721
# Reference: https://www.virustotal.com/gui/ip-address/154.202.14.80/relations

japan-001.xyz
jnb-sh.com
jnb-sk.com
jnb-sp.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1261553440645279745

smbc-wa.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1266615370292453376

smbc-wv.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1268463902297186305

smbc-pa.com

# Reference: https://twitter.com/malwaretracekr/status/1264800587645779969

103.93.79.200:9418
http://116.89.240.171
i-cloudsbox.com

# Reference: https://twitter.com/ninoseki/status/1268839497598267392

jnb-ma.com

# Reference: https://twitter.com/malwaretracekr/status/1268867896140165120

meryse.net
tablew.net

# Reference: https://twitter.com/NaomiSuzuki_/status/1270243219716968448

jnb-md.com

# Reference: https://twitter.com/KesaGataMe0/status/1419901582322200578

nttdoc.info
smbc-co.live
smt-docomo.top
smt-ntt.club
smt-ntt.icu
smt-nttd.shop
smt-nttd.top
smt-doc.com

# Reference: https://twitter.com/KesaGataMe0/status/1420276787360145410

smbc.life

# Reference: https://twitter.com/KesaGataMe0/status/1420277166676135940

mufgdcep.com

# Reference: https://twitter.com/KesaGataMe0/status/1420277672450564097

nttdocomo.buzz

# Generic trails

^[a-z]{1}\-[a-z]{1,3}\.top$
^[a-z]{2}\-[a-z]{2,3}\.(top|club)$
www\.[a-z]{1}\-[a-z]{1,3}\.top$
www\.[a-z]{2}\-[a-z]{2,3}\.(top|club)$
apple\-icloud\.[a-z]{3}\-japan\.com
\b(au|cat|aegin|aiful|amazon|bkuses|bnk|cadillac|cegin|cfng|chengdu|cloudsbox|correos|dachang|davk|dkpos(r|t)|docmojp|docomo|epos|gdaida|gdc|guang|faa|hkpost|inuires|jibun|jnb|jpnbk|jpot|jppost|kinggate|kuroneko|kuronekoyamato|lakealsa|mailsa|manga|mizuho|mooma|myau|mydocomo|mu[fgwz]{1,3}|jibun|jpjt|neabk|nbetbk|nebbk|netbk|netatar|netctar|njfp|nittsu|nnissen|nttdocomo|b?post|post[e,i]|postfi|post-?nord|postonrd|postch|qiangmei|rakuten|nzpost|sa(g|w)a(g|w)a|samurai|sasekr|sepost|sgw|shizuokacity|sing-?post|smbc|smtb|smyoga|soiwgaw|srnbc|i?soft{0,1}b(a|o)nk|starbank|suyan|upsp|wygm|xinheli|yamato|yang|ydc|yunice|yxhs)\-[a-z0-9]{1,4}\.(buzz|cn|co|club|com|icu|live|me|one|shop|top|xyz)$
\b[a-z0-9]{1,3}\-(aegin|aiful|amazon|bkuses|bnk|cadillac|cegin|cfng|chengdu|cloudsbox|correos|dachang|davk|dkpos(r|t)|docmojp|docomo|epos|gdaida|gdc|guang|faa|hkpost|inuires|jibun|jnb|jpnbk|jpot|jppost|kinggate|kuroneko|kuronekoyamato|lakealsa|mailsa|manga|mizuho|mooma|myau|mydocomo|mu[fgzw]{1,3}|jibun|jpjt|neabk|nbetbk|nebbk|netbk|netatar|netctar|njfp|nittsu|nnissen|nttdocomo|nzpost|b?post|post[e,i]|postfi|post-?nord|postonrd|postch|qiangmei|rakuten|sa(g|w)a(g|w)a|samurai|sasekr|sepost|sgw|shizuokacity|sing-?post|smbc|smtb|smyoga|soiwgaw|srnbc|i?soft{0,1}b(a|o)nk|starbank|suyan|upsp|wygm|xinheli|yamato|yang|ydc|yunice|yxhs)\.(buzz|cn|co|club|com|icu|live|me|one|shop|top|xyz)$
/apk_b.php
/phoneyzm.php
/sg/phone.php

# APK trails

/apnlodswd.apk
/bbvezcscub.apk
/C2021317.apk
/chatting.apk
/chromeapp.apk
/citibank.apk
/Correos.apk
/Correos-0.apk
/Correos-1.apk
/Correos-2.apk
/Correos-3.apk
/Correos-4.apk
/Correos-5.apk
/Correos-6.apk
/Correos-7.apk
/Correos-8.apk
/Correos-9.apk
/cyber.apk
/DHL_Paket.apk
/Die-Post.apk
/DiePost.apk
/depost.apk
/diepost.apk
/docomo.apk
/dYyTgV.apk
/fakespy.apk
/fedex.apk
/funkybot.apk
/fwauwzlwq.apk
/G2021317.apk
/Goole_Service.apk
/Google%20Play.apk
/gp0330.apk
/japanpost.apk
/jppost.apk
/jt.apk
/KB.apk
/KB2.0.apk
/kbmqvdwflf.apk
/kbstar.apk
/kuronekoyamato.apk
/lineck.apk
/mabich.apk
/mfinqpnyimml.apk
/miruhlmrz.apk
/moa.apk
/mzykzru.apk
/nqfjfypfmj.apk
/nttdocomo.apk
/NTTsecurity.apk
/ohlrvyz.apk
/OmaPosti.apk
/photo.apk
/post.apk
/poste.apk
/Posti.apk
/PostNord.apk
/pqmahywx.apk
/qmfinqpnyimml.apk
/qkbdkhsxcdrqwiasmdo.apk
/royal.apk
/RoyalMail.apk
/sagawa.apk
/sagawa1.apk
/sagawa0.0.0.apk
/sagawa3.5.9.apk
/sagawa3.6.2.apk
/sbqdkw.apk
/sguard.apk
/shinhan.apk
/SingPost.apk
/smartcat.apk
/Swiss%20Post.apk
/uuocrteytw.apk
/chrome.apk
/chrome_bate.apk
/chrome1.0.7.apk
/yamato.apk
/yjkrtyjhe.apk
/zIMh1.apk
/음성지원.apk
/갤러리.apk
/ファイル名不定.apk

# Rogue DNS servers

# Reference: https://securelist.com/roaming-mantis-part-iv/90332/
# Reference: https://twitter.com/ninoseki/status/1106842790351106048
# Reference: https://twitter.com/ninoseki/status/1150379897820332032
# Reference: https://twitter.com/ninoseki/status/1127109264877600768
# Reference: https://drive.google.com/file/d/12TaMKqqjkr_r3iq3LbPcGc6LKv2k1Hmw/view
# Reference: https://twitter.com/ninoseki/status/1156038231172894721
# Reference: https://twitter.com/ZeroCERT/status/1118840257334525952
# Reference: https://www.facebook.com/zerocert/posts/1143176292521769 (Korean)
# Reference: https://twitter.com/ninoseki/status/1230280519771774976

1.53.252.164:53
1.53.252.215:53
1.53.252.213:53
1.53.252.214:53
1.171.160.155:53
1.171.166.13:53
1.171.175.119:53
1.171.46.86:53
118.30.28.38:53
118.30.28.39:53
118.168.200.231:53
125.212.235.130:53
125.212.235.131:53
128.14.6.12:53
128.14.6.13:53
171.244.3.110:53
171.244.3.111:53
171.244.33.114:53
171.244.33.116:53
220.136.110.179:53
42.112.35.45:53
42.112.35.46:53
42.112.35.47:53
42.112.35.48:53
42.112.35.49:53
42.112.35.50:53
42.112.35.51:53
42.112.35.52:53
42.112.35.53:53
42.112.35.54:53
42.112.35.55:53

# Reference: https://twitter.com/ninoseki/status/1144557737516232705

118.30.28.38:53
118.30.28.39:53

# Reference: https://twitter.com/ninoseki/status/1157110166086569985

185.205.210.23:53

# Reference: https://twitter.com/ninoseki/status/1128573489667907586

162.241.224.56:53

# Reference: https://twitter.com/ninoseki/status/1104181886824243200

65.181.123.142:53
65.181.123.143:53

# Reference: https://twitter.com/ninoseki/status/1055224900829491200

185.70.186.4:53
185.70.186.7:53

# Reference: https://twitter.com/ninoseki/status/1055226103143501824

108.167.151.156:53
31.220.57.5:53

# Reference: https://twitter.com/ninoseki/status/1073152249969336320

144.217.223.218:53
35.247.250.124:53

# Reference: https://twitter.com/ninoseki/status/1047697757731864576

18.191.81.137:53

# Reference: https://twitter.com/ninoseki/status/1161151559100588032

158.69.94.9:53

# Reference: https://twitter.com/ninoseki/status/1164163472445173760

38.91.106.137:53
54.226.200.196:53

# Reference: https://twitter.com/ninoseki/status/1202216201700757504

185.243.114.216:53

# Reference: https://twitter.com/ninoseki/status/1236440221194969089

118.30.28.40:53
118.30.28.41:53
125.212.235.130:53
125.212.235.131:53
125.212.235.132:53
125.212.235.133:53

# Reference: https://twitter.com/ninoseki/status/1246006041965281281

185.232.65.172:53
185.232.65.173:53
185.232.65.174:53
185.232.65.175:53
185.232.65.176:53
185.232.65.177:53

# Reference: https://twitter.com/ninoseki/status/1447107511761342465

192.51.188.29:53

# Reference: https://twitter.com/malwaretracekr/status/1265526201680084992

kr-dys.com
kr-nek.com

# Reference: https://gist.github.com/ninoseki/6e9dd5fa696072104f4c40234df0e534

czwhb.top
die-r.top
die-s.top
hy2366.xyz

# Reference: https://twitter.com/malwaretracekr/status/1270364778087604226

61.227.116.125:30

# Reference: https://twitter.com/ninoseki/status/1271101086649053184

pengkt.xyz

# Reference: https://twitter.com/malwrhunterteam/status/1270000830616387585
# Reference: https://www.virustotal.com/gui/file/b934e27efc3828728d72bd53d79e3229db23a2b26c28b2e42bb972c14580fc9a/detection

172.67.176.17:2095
pandora-app.net

# Reference: https://www.virustotal.com/gui/file/a9092601822dd6e066e7c78c80d2b78a488636af620ad12f04be3c8d8070eed7/detection

104.24.120.191:2095
jhyapp.org

# Reference: https://twitter.com/bl4ckh0l3z/status/1323566117718163456

23.160.194.191:2095
23.160.194.193:2095
kr.jhyapp.org
kr.pandora-app.net

# Reference: https://twitter.com/ninoseki/status/1271629089699278849
# Reference: https://www.virustotal.com/gui/file/d9ae18085ac7ec9848eecc94d8d98abaf223167e06f3b14a62cebd12208af321/detection

http://23.160.194.193
104.18.39.24:2095

# Reference: https://twitter.com/ReBensk/status/1272448679169925125
# Reference: https://www.virustotal.com/gui/ip-address/103.126.100.18/detection

http://103.126.100.18

# Reference: https://twitter.com/malwrhunterteam/status/1272461966368522240
# Reference: https://twitter.com/NtSetDefault/status/1272495545437782017
# Reference: https://www.virustotal.com/gui/file/619566e1e1892d9b0fb653c8be2708d3ead670e4dc7d4011b9c6c35d59f65154/detection
# Reference: https://www.virustotal.com/gui/file/b934e27efc3828728d72bd53d79e3229db23a2b26c28b2e42bb972c14580fc9a/detection
# Reference: https://www.virustotal.com/gui/domain/jhy.wmsquare.store/relations

http://102.129.249.124
104.18.38.24:2095
104.24.121.191:2095
23.160.193.181:2095
23.160.194.142:2095
23.160.194.144:2095
wmsquare.store
tribiko.club

# Reference: https://twitter.com/ninoseki/status/1255794508173701121

test-b50fd.firebaseio.com

# Reference: https://twitter.com/malwrhunterteam/status/1271058195344220162

http://111.251.77.22

# Reference: https://twitter.com/malwrhunterteam/status/1277681383268286469
# Reference: https://www.virustotal.com/gui/file/ecdc73645331d992820450f2b1350b78020d2de342a1556f66213e0d264cadb3/detection

61.218.32.17:8888
grd77.com

# Reference: https://twitter.com/malwaretracekr/status/1352981881822670849
# Reference: https://www.virustotal.com/gui/file/e6818b120babd15f2446c8a5595f98b5a7303033ad8ab0efa752e2bb8a6f0796/detection
# Reference: https://www.virustotal.com/gui/file/42865fbaa2eb7ffd8a9593debe98280f1b5c1286158cb924800cd7616e1dd4ff/detection
# Reference: https://www.virustotal.com/gui/file/ca4906ae9753abba5f3c5f83530f90374fc09463bee6329be725b6797b8a398f/detection

104.24.98.12:2095
172.67.221.238:2095
apiserver.zzfyp.com
app.zzfyp.com

# Reference: https://twitter.com/malwaretracekr/status/1272785015353438209

http://102.129.249.140

# Reference: https://www.virustotal.com/gui/file/87d68132a8c485b9c82343bed5fb8a1d60476cd3158326992578d3b64b692aef/detection

172.67.137.236:2095

# Reference: https://twitter.com/bl4ckh0l3z/status/1339896917879361539

104.18.36.215:2095
104.18.37.215:2095
104.24.99.12:2095
172.67.167.218:2095
aladiner.org
ala.aladiner.org
pandora.zzfyp.com
apiserver.pandora-app.net
appserver.pandora-app.net
one.pandora-app.net
cyber.zzfyp.com

# Reference: https://www.virustotal.com/gui/ip-address/185.244.149.202/relations

biesi.club
ilogen.top
jppost-cji.top
jppost-se.com
kuronekoamato.com
nittsu-si.com

# Reference: https://twitter.com/ninoseki/status/1273474063743115266
# Reference: https://twitter.com/sepi140/status/1273462572742836224

jnb-cac.com
sbi-cad.com

# Reference: https://twitter.com/papa_anniekey/status/1273878497014902784

154.13.28.138:81

# Reference: https://twitter.com/malwaretracekr/status/1274965504961069056

1.174.179.53:30
shinhanbank.kro.kr

# Reference: https://twitter.com/ReBensk/status/1274996257296191489

http://102.129.254.192
http://191.101.227.100
http://191.101.227.101
http://191.101.227.102
http://191.101.227.103

# Reference: https://twitter.com/NaomiSuzuki_/status/1275776784634531840

japantbk.com
kuronamtot.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1263772125652873219
# Reference: https://twitter.com/NaomiSuzuki_/status/1276530383002058752

npagon.com
smbtco.com

# Reference: https://www.virustotal.com/gui/ip-address/13.124.168.162/relations

cczv.top
xfydy.top

# Reference: https://www.virustotal.com/gui/file/d35c70b5ae6ccebfc16d6da5c50cb8ebcef3c954836693d6ffe04919c4ea9679/detection

zzkkhe.top

# Reference: https://twitter.com/ninoseki/status/1277229153780068352
# Reference: https://www.virustotal.com/gui/ip-address/195.123.228.46/relations

fa-r.top
ruguo1.top

# Reference: https://www.virustotal.com/gui/ip-address/195.123.225.152/relations

biesi.club
haisi1.top
liankt.club
meix.club
pguo.club
swiz.club

# Reference: https://www.virustotal.com/gui/ip-address/82.118.21.83/relations

http://82.118.21.83

# Reference: https://www.virustotal.com/gui/ip-address/103.126.100.18/relations

http://103.126.100.18
deutschepost.top
die-0.top
die-1.top
die-2.top
die-3.top
die-4.top
die-5.top
die-6.top
die-7.top
die-8.top
die-9.top
die-a.top
die-b.top
die-c.top
die-d.top
die-e.top
die-f.top
die-g.top
die-h.top
die-i.top
die-j.top
die-k.top
die-l.top
die-m.top
die-n.top
die-o.top
die-p.top
die-q.top
die-r.top
die-s.top
die-t.top
die-u.top
die-v.top
die-w.top
die-x.top
die-y.top
die-z.top
laposet.top
poste-m.com
postnl.top
royal-mail.top

# Reference: https://twitter.com/ninoseki/status/1278906744152813568
# Reference: https://www.virustotal.com/gui/ip-address/103.126.100.31/relations

http://103.126.100.31
poczta-polska.top

# Reference: https://twitter.com/ninoseki/status/1280389567233683456
# Reference: https://gist.github.com/ninoseki/95b57dba36c7d12119b5db9c21db97b4

smbcdr.com

# Reference: https://twitter.com/io_sono_io_IT/status/1281430992046051328

jibun-contact.com

# Reference: https://twitter.com/bl4ckh0l3z/status/1281894878201479169

58.82.242.61:28844

# Reference: https://twitter.com/ninoseki/status/1284451124372598784
# Reference: https://twitter.com/ninoseki/status/1284454492755292161
# Reference: https://www.virustotal.com/gui/ip-address/103.26.204.158/relations

cika.tokyo
boyzcok.com
kuryamato.com
sevenbzk.com
sevenqbk.com
sevenubk.com

# Reference: https://twitter.com/ozuma5119/status/1284190952739889152

kawamatat.com

# Reference: https://www.virustotal.com/gui/ip-address/47.254.156.203/relations

jibun-contact.com
raktuencards-contact.com
rakuten-jp-card.com
rakuten-support.com
rakutencard-contact.com
rakutencard-support.com
rakutencards-center.com
rakutencards-contact.com

# Reference: https://twitter.com/papa_anniekey/status/1291236111889526784
# Reference: https://www.virustotal.com/gui/ip-address/43.245.198.134/relations

fa-r.top
pot-i.top

# Reference: https://twitter.com/ninoseki/status/1292255991480725504
# Reference: https://www.virustotal.com/gui/ip-address/103.126.100.9/relations

http://45.137.183.50
postnord.top

# Reference: https://twitter.com/KesaGataMe0/status/1292727294209847296

cs-account-repair-info-softbank.com
isoftbank-japan.com
isoftbank-jp.com
softbanknetwork.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1293100947732754432

net-aegin.com

# Reference: https://twitter.com/papa_anniekey/status/1293089134819434496

http://195.123.224.42

# Reference: https://www.virustotal.com/gui/ip-address/45.128.145.17/relations

wnfoq.club

# Reference: https://twitter.com/malwrhunterteam/status/1294324310648266752

http://111.251.75.90

# Reference: https://twitter.com/NaomiSuzuki_/status/1295990687893053440

pot-0.top
pot-1.top
pot-2.top
pot-3.top
pot-4.top
pot-5.top
pot-6.top
pot-7.top
pot-8.top
pot-9.top
pot-a.top
pot-b.top
pot-c.top
pot-d.top
pot-e.top
pot-f.top
pot-g.top
pot-h.top
pot-i.top
pot-j.top
pot-k.top
pot-l.top
pot-m.top
pot-n.top
pot-o.top
pot-p.top
pot-q.top
pot-r.top
pot-s.top
pot-t.top
pot-u.top
pot-v.top
pot-w.top
pot-x.top
pot-y.top
pot-z.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1296343216619315202

netatar-co.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.21/relations

rj-l.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.38/relations

sf-sg.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.40/relations

yx-yl.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.65/relations

fan-si.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.96/relations

ys-pack.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.109/relations

jpjt-tc.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.112/relations

cc-smyoga.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.128/relations

sz-gdc.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.132/relations

pub-edu.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.146/relations

hk-faa.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.167/relations

gdaida-cnc.com
usa-fh.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.171/relations

hitachi-bx.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.178/relations

ydc-ic.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.182/relations

mooma-cake.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.183/relations

sz-xinheli.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.186/relations

yunice-hk.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.194/relations

cn-dachang.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.197/relations

kee-yang.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.198/relations

wei-mob.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.209/relations

sh-qiangmei.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.213/relations

ht-cadillac.com
hch-link.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.216/relations

yun-guang.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.222/relations

sdf-p2b.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.223/relations

aa-financial.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.229/relations

led-a.com
led-b.com
led-c.com
led-d.com
led-e.com
led-f.com
led-g.com
led-h.com
led-i.com
led-j.com
led-k.com
led-l.com
led-m.com
led-n.com
led-o.com
led-p.com
led-q.com
led-r.com
led-s.com
led-t.com
led-y.com
led-v.com
led-w.com
led-x.com
led-y.com
led-z.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.232/relations

jh-chengdu.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.236/relations

tyx-ic.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.247/relations

our-js.com
xm-zjl.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.138.253/detection

gsp-gd.com

# Reference: https://www.virustotal.com/gui/ip-address/23.83.139.2/relations

dk-njfp.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1297400535130296320

kuroneko-0.top

# Reference: https://twitter.com/ninoseki/status/1297850808071929856
# Reference: https://www.virustotal.com/gui/ip-address/45.254.25.48/relations
# Reference: https://twitter.com/ninoseki/status/1301440752518529024

http://45.254.25.48
post-nord-se.top
postnord-se.top
postonrd-se.top
sing-post.top

# Reference: https://twitter.com/papa_anniekey/status/1296221559955132416

bpost.club

# Reference: https://twitter.com/seckle_ch/status/1294900313221193728
# Reference: https://twitter.com/papa_anniekey/status/1296606960486191107

http://103.126.100.9
correos.top
correos-cl.top

# Reference: https://twitter.com/malwrhunterteam/status/1297931754892931073
# Reference: https://www.virustotal.com/gui/ip-address/2.58.228.145/relations

http://2.58.228.145
hkpost.top
post-nord.club
singpost.club
singpost.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1298182471679279105

net-bkuses.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1298521435363713024

netupdata.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1298533892324958209

narsone.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1298897364443262976
# Reference: https://www.virustotal.com/gui/ip-address/210.1.226.47/relations

caleii.kokoweill.vip
us028.kokoweill.vip
waishic.suulook.info

# Reference: https://twitter.com/NaomiSuzuki_/status/1299217963879284736

netsmsgo.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1300314361018249216

netogasa.com

# Reference: https://twitter.com/malwrhunterteam/status/1300519164398964737

http://191.101.14.190

# Reference: https://twitter.com/malwrhunterteam/status/1300877197104775169

http://191.96.60.64
http://191.96.60.65
http://191.96.60.66
http://191.96.60.67
http://191.96.60.68
http://191.96.60.69
http://191.96.60.70
http://191.96.60.71

# Reference: https://twitter.com/NaomiSuzuki_/status/1300701353971388416

jbnkloading.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1301074459953041408

uploadjnb.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1301109481716158469

jnbloding.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1301433330856992768

kjnbnew.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1301464374314373122

jbnkuser.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1301467212453048320

jnplogin.com
jpnuploads.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1301775350003691520

lglistjnb.com
mjnbkok.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1301841613254209537

loadingjnb.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1302150235079110657

uplodjnbuser.com
userjnbok.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1302874839523274755

kingusersone.com
masterjnbs.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1303034998409187329

myupdateuser.com
myuserkey.com

# Reference: https://twitter.com/malwrhunterteam/status/1304040379856101378

114.26.156.143:30

# Reference: https://twitter.com/ninoseki/status/1308718842613387264
# Reference: https://twitter.com/bl4ckh0l3z/status/1308314801236516864

2.58.230.243:8888
xighost1.com
jasnomanapa.com
jvensevenbk.com
kiwordbnk.com
ksjkseven.com
labangjbns.com
masrnbpasoo.com
nartsokb.com
natojknsp.com
sevenuseup.com

# Reference: https://twitter.com/malwaretracekr/status/1310111491853488128
# Reference: https://www.virustotal.com/gui/ip-address/111.252.119.166/relations

kjm.wtwov.me
mem.nisocn.me

# Reference: https://twitter.com/NaomiSuzuki_/status/1311316959049347073

pt-0.top
pt-1.top
pt-2.top
pt-3.top
pt-4.top
pt-5.top
pt-6.top
pt-7.top
pt-8.top
pt-9.top
pt-a.top
pt-b.top
pt-c.top
pt-d.top
pt-e.top
pt-f.top
pt-g.top
pt-h.top
pt-i.top
pt-j.top
pt-k.top
pt-l.top
pt-m.top
pt-n.top
pt-o.top
pt-p.top
pt-q.top
pt-r.top
pt-s.top
pt-t.top
pt-u.top
pt-v.top
pt-w.top
pt-x.top
pt-y.top
pt-z.top

# Reference: https://twitter.com/ninoseki/status/1312999198954979328
# Reference: https://www.virustotal.com/gui/ip-address/45.254.25.174/relations

a-posti.top
a-singpost.top
g-amazon.top
h-amazon.top
i-amazon.top
j-amazon.top
k-amazon.top
l-amazon.top
n-amazon.top
p-post.top
polska-poczta.top

# Reference: https://twitter.com/malwaretracekr/status/1313730925243506688

jasnomanapa.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1315517783917043713
# Reference: https://www.virustotal.com/gui/ip-address/210.1.226.67/relations

jpot-a.top

# Reference: https://twitter.com/malwrhunterteam/status/1315964118730452992

my-sing-post.top

# Reference: https://www.virustotal.com/gui/ip-address/45.254.26.254/relations

singpost.xyz

# Reference: https://twitter.com/papa_anniekey/status/1090808731393155072

kuroekoyamato.com
kuronekoyamao.com

# Reference: https://twitter.com/ninoseki/status/1317416183948169216

lianjiea1.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1318479279135498240
# Reference: https://www.virustotal.com/gui/ip-address/210.1.226.124/relations

jpot.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1321043303870021641
# Reference: https://www.virustotal.com/gui/ip-address/210.1.226.124/relations

royamai.top
royalmaill.top
fa-a.top
fa-b.top
fa-c.top
fa-d.top
fa-e.top
fa-f.top
fa-g.top
fa-h.top
fa-i.top
fa-j.top
fa-k.top
fa-l.top
fa-m.top
fa-n.top
fa-o.top
fa-p.top
fa-q.top
fa-r.top
fa-s.top
fa-t.top
fa-u.top
fa-v.top
fa-w.top
fa-x.top
fa-y.top
fa-z.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1324637891679588353

sbi-xxa.com

# Reference: https://twitter.com/malwrhunterteam/status/1325146284412588033

singpost-a.me

# Reference: https://twitter.com/malwrhunterteam/status/1326176669955186688

sepost-m.top

# Reference: https://twitter.com/hatching_io/status/1326201275575365632
# Reference: https://tria.ge/201110-w7asqy581x/behavioral1
# Reference: https://www.virustotal.com/gui/domain/y4wgres.blogspot.com/relation

y4wgres.blogspot.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1327132997057961992

alwayssss.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1327312524081983489

net-b-k-.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1328264962347724801

candyalways.com

# Reference: https://twitter.com/malwrhunterteam/status/1328670638337298434
# Reference: https://twitter.com/bl4ckh0l3z/status/1328674239013138433
# Reference: https://www.virustotal.com/gui/file/655bb56019f38108e3d0e5cf226a0b3ca00fefdeaefd54815690ffbbfdb5c1f2/detection

http://61.219.255.42
519519ba.com

# Reference: https://www.virustotal.com/gui/domain/ukrtd.top/relations

ukrtd.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1336562514381864961

lakealsa-vb.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1339145289563664385

aeonvi.com
smtb-kkl.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1339835617056702464

jp-davk.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1340188289236496385

ji-bnk.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1342170740905275392

jibunae.com
jibunau.com
jpaud.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1332226978770866177

my-aiful.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1342773862618918912

jiuncx.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1342960222789201926

jiaupc.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1343463993952751616

aujpd.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1343824479592402946

aubznk.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1343941796481490947

auenl.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1344360387328708609

audoe.net

# Reference: https://twitter.com/NaomiSuzuki_/status/1345973660654268417

jpadu.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1346338373024112640

aeenm.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1346713912054435841

aenbv.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1347065351972917248

aeomnv.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1347145290600439813

aeokc.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1347466695988842501

aeoyhl.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1347612398052495360

aeodr.com
aeovn.com
aeoxi.com
aeoyhl.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1348620522519633921

aeoob.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1353593696378179584

aeoxe.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1347814698125717505

shialc.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1349236870471827456

jpot.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1349268409939156993

aeomt.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1349634849989042177

aeomg.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1349987680797429763

aeomh.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1349271177433239554

jpaeo.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1350128822499241984

aeomc.com
aeomk.com
aeomz.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1350342982013108228

auznw.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1351078435960070156

aeoxq.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1351429548802412546

aeockr.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1351800157877125120

aeozk.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1352152630659715072

aeozl.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1352499949607428096

aeozd.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1352893124993896448

aeozh.com

# Reference: https://twitter.com/KesaGataMe0/status/1353920206729437189

aeoxu.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1344190293420113921

91.188.223.70:83

# Reference: https://www.virustotal.com/gui/file/39d83fb5c0bee06716db8cba04cd03c2a2fedbf1b7682aee02445bcc1a1979fd/detection

112.213.127.149:83

# Reference: https://www.virustotal.com/gui/file/0539c37e69e1daa5b4056411720da4a2df113fb4c11ac80414bf2ba471fe1ea6/detection

112.213.127.142:83
112.213.127.143:83
112.213.127.152:83
115.28.133.249:33338
142.111.237.169:83
218.200.227.123:90

# Reference: https://www.virustotal.com/gui/file/1920fd8561d199d56870197b2c15a88bc631199aa4400024f6c9415ab1e2689b/detection

112.213.127.190:83

# Reference: https://www.virustotal.com/gui/file/d24b5746816cf553b5400514845e5e4036b80cd2f2ae2246a1313549b602a9f5/detection

121.54.175.224:82

# Reference: https://www.virustotal.com/gui/file/88326385765641c782bfc65bafa9afc73336108068d0506b8ba36d5202ba0ef3/detection

112.213.127.224:93

# Reference: https://www.virustotal.com/gui/file/5545ab8475bf7b7c2140015496ed6dd01670fad2c374317d972dd93cbaaa1211/detection

162.210.36.4:83
/urlyinyue.php

# Reference: https://www.virustotal.com/gui/file/37a9d6634f6e6d87425f3570356587762258602cd754019c5e432e94ba0c6722/detection

104.253.107.54:83
112.213.127.246:83

# Reference: https://www.virustotal.com/gui/file/d905037eb305246033a5f1d5a0cfc90246cc684f55b52a3bdf5eb41adad5869c/detection

112.213.127.144:83
112.213.127.191:83
45.39.215.119:83

# Reference: https://www.virustotal.com/gui/file/99400c01f3fb7ca8d086af071fcb2348b1213cee076cf0ac6fd9fa337cdaaae7/detection

154.201.127.135:83

# Reference: https://www.virustotal.com/gui/file/e8c7221036d1078c5a7c33518219979d41a06c8840e3e98d4b9588d3d66a4529/detection

107.165.116.131:83
160.153.136.3:83
23.83.104.102:83

# Reference: https://twitter.com/NaomiSuzuki_/status/1349654767945936896

kuronekoyamato-b.top

# Reference: https://twitter.com/malwrhunterteam/status/1344001614248599552
# Reference: https://www.virustotal.com/gui/ip-address/8.209.78.112/relations

correos-apli.com
correos-apli.net
correos-apli.org
correos-app.com
correos-app.icu
correos-app.top
correos-cdn.com
correos-new.top
correos-track.com
correos-track.top
correosapp.center
correosapp.click
correosapp.co
correosapp.download
correosapp.help
correosapp.space
correosapp.top
poczta-app.top
/ES31402242/

# Reference: https://twitter.com/malwrhunterteam/status/1341432641195798534
# Reference: https://www.virustotal.com/gui/ip-address/199.192.26.26/relations
# Reference: https://www.virustotal.com/gui/ip-address/91.134.240.39/relations
# Reference: https://www.virustotal.com/gui/file/f790fe0a3542868ec41f16657f022c084e25eabc353b0174e5fd748a2cdfc6ba/detection

android-update.link
correos-app.shop
correos.icu
correos.link
correos.world

# Reference: https://www.virustotal.com/gui/ip-address/47.254.133.122/relations
# Reference: https://www.virustotal.com/gui/ip-address/8.208.97.237/relations

correos-a.com
correos-api.com
correos-b.com

# Reference: https://twitter.com/phishunt_io/status/1351094430518947845

correos-1.com
correos-2.com
correos-3.com

# Reference: https://twitter.com/malwaretracekr/status/1349657453550473218

http://61.231.27.77

# Reference: https://twitter.com/NaomiSuzuki_/status/1349674757000597505

appidsecurity.info
iiuvv.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1350001389062168583

rakutensupport.info
vjiir.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1351119109128392709

securityjp.info
viofrr.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1351512086979903488

jpsecurity.info

# Reference: https://twitter.com/NaomiSuzuki_/status/1351512089014112258

jappnve.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1350880316026589185
# Reference: https://twitter.com/NaomiSuzuki_/status/1350880320367722496/photo/1

contactjp.info
xkdee.com
/anzhuourl1.txt
/anzhuourl10.txt
/anzhuourl2.txt
/anzhuourl3.txt
/anzhuourl4.txt
/anzhuourl5.txt
/anzhuourl6.txt
/anzhuourl7.txt
/anzhuourl8.txt
/anzhuourl9.txt

# Reference: https://www.virustotal.com/gui/ip-address/198.54.117.199/relations

smbc-cardg.com
smbc-cardn.com
smbc-cardm.net
smbc-cardo.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1352198008570482688

applesjapan.info
civrr.com
post.civrr.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1352663016806916097

applemation.info
post.solomsn.com
solomsn.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1352942020847755266

accountjp.info
appleid.accountjp.info
post.postkp.com
postkp.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1353348758893826049

aiuebc.com
post.aiuebc.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1353707983046287362
# Reference: https://twitter.com/NaomiSuzuki_/status/1354065651476828160

accountsm.info
appcheckjp.info
appleid.accountsm.info
appleid.appcheckjp.info
post.sagvwa.com
sagvwa.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1355142280546447362

appiddjp.info
appleid.appiddjp.info
post.rdkke.com
rdkke.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1355058845786099713

aeoir.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1355144110412193793

japqn.com
post.japqn.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1354803685373538318

post.thocv.com
thocv.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1355411501641818114

aeoiw.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1355464659805949953

appsafejp.info
appleid.appsafejp.info
giioor.com
post.giioor.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1355773082208636932

appjpsafe.info
appleid.appjpsafe.info
ficds.com
posk.ficds.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1356147350549397507

aeoip.com
kijjh.com
sagawae.kijjh.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1356274975204724736

applijp.info
appleid.applijp.info
posk.vkiiu.com
vkiiu.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1356278646634266626

docomo-mo.com

# Reference: https://twitter.com/TeamDreier/status/1356354987178287107
# Reference: https://www.virustotal.com/gui/ip-address/45.254.25.105/relations

45.254.25.105:9527
dfhe5h.top
downsepose.top
d-sepost-down.top
f-sepost-down.top
singpost-n-down.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1356520955904884738

aeoio.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1356626124717973504

appleid.appcojp.info
appcojp.info

# Reference: https://twitter.com/NaomiSuzuki_/status/1356874801957138433

docomoya.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1356948328387235841

appuid.info
appleid.appuid.info
tpliv.com
post.tpliv.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1357019941870788608

aeois.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1357220574603350020

aeovd.com
eposcard.shop

# Reference: https://twitter.com/NaomiSuzuki_/status/1357223125818118144

eposcard.store

# Reference: https://twitter.com/NaomiSuzuki_/status/1357343280753647623

appleid.checkappid.info
checkappid.info
cioaq.com
posk.cioaq.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1357344682213167110

appleid.appuid.info
appuid.info
post.tpliv.com
tpliv.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1357964657433006083

aeovd.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1358426715811319810
# Reference: https://twitter.com/NaomiSuzuki_/status/1358735091623555072

applei.info
appleid.applei.info
ckerr.site
jposc.com
post.ckerr.site
post.jposc.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1364087253518094338

jnb-ije.com

# Reference: https://twitter.com/romonlyht/status/1364032777646039042

mufg-info.top

# Reference: https://twitter.com/500mk500/status/1364814772022222848

nsbhe.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1365551409576386560

jcb-co-jp-iss-mobile-open-edjdnntra.top

# Reference: https://twitter.com/ninoseki/status/1367457020056461316
# Reference: https://twitter.com/ninoseki/status/1367458944369651713
# Reference: https://www.virustotal.com/gui/file/8f8c29cc4aed04ca6ab21c3c44cca190a6023ce3273edb566e915fe703f9e18e/detection

165.3.93.6:6666
210302.top
210302bei.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1368602314911608835

jcb-co-jp-iss-mobile-open-edsjsra.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1368921271929430018

niceng.top
posk.niceng.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1369934108629987330

lineoe.com
manag.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1371527489302925316

jpostp.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1371531790083497984
# Reference: https://twitter.com/NaomiSuzuki_/status/1372129806389706753
# Reference: https://www.virustotal.com/gui/ip-address/23.251.62.2/relations

amazon-ded.top
jcb-co-jp-iss-mobile-open-enaab.top
jcb-co-jp-iss-mobile-open-enpa.top
jcb-co-jp-iss-mobile-open-enpsa.top
jcb-co-jp-iss-mobile-open-entrad.top
jcb-co-jp-iss-mobile-open-entrap.top
jcb-co-jp-iss-mobile-open-entrapa.top
kuronekoyamato-adg.top
kuronekoyamato-adw.top
kuronekoyamato-adz.top
postch-baw.top
postch-mobile.top
posti-fi-fad.top
posti-fi-fja.top
posti-fi-fjd.top
posti-fi-fjdadd.top
posti-fi-fjddd.top
posti-fi-fjwd.top
posti-fi-fsad.top
posti-fi-fsaq.top
sepost-fjfa.top
sepost-fjsa.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1371740723523981315

cvard.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1371886167835119621

cafrd.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1372125069212749831

cakrd.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1372228967168499715

aacdvv.com
cikva.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1372237102272835584

postjpc.com

# Reference: https://twitter.com/malwrhunterteam/status/1372290344654635017

cikvr.com
vrevreecc.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1373177561891491840

jlogine.com
jnbbki.com

# Reference: https://twitter.com/sysk1ll3r/status/1373325576983998472
# Reference: https://www.virustotal.com/gui/file/81188e14d5c6d385c05ee41426f7b9f668256b8aa06520e66ebcab3a0d6ff383/detection

xpak1.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1373913094842318850

cdavu.com
mufgike.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1375144531599912960
# Reference: https://twitter.com/NaomiSuzuki_/status/1380427529530470401
# Reference: https://twitter.com/NaomiSuzuki_/status/1381281035351064576

my-jcb-co-jp-dh.top
my-jcb-co-jp-dt.top
my-jcb-co-jp-dy.top
my-jcb-co-jp-ed.top
my-jcb-co-jp-vr.top
my-kcb-co-jp-la.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1375359314974568448

docomoeef.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1374320519290392577

docomokdq.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1376185527968296964

docomocoo.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1374348879609483266

kuronekoyamato-dwa.top
kuronekoyamato-dwag.top
kuronekoyamato-dqag.top
jcb-co-jp-iss-mobile-open-eab.top
jcb-co-jp-iss-mobile-open-ewab.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1374781876875882496
# Reference: https://twitter.com/NaomiSuzuki_/status/1381558291189309440
# Reference: https://twitter.com/NaomiSuzuki_/status/1382277615499714560
# Reference: https://twitter.com/NaomiSuzuki_/status/1383443024160563211
# Reference: https://twitter.com/NaomiSuzuki_/status/1385147441226256389
# Reference: https://twitter.com/NaomiSuzuki_/status/1385155607905259522
# Reference: https://twitter.com/NaomiSuzuki_/status/1385600419468959758
# Reference: https://twitter.com/NaomiSuzuki_/status/1385862756209885184

kuronekoyamato-da.top
kuronekoyamato-dj.top
kuroneko-yamato-ia.top
kuroneko-yamato-ij.top
kuroneko-yamato-iq.top
kuroneko-yamato-ml.top
kuroneko-yamato-yh.top
my-jcb-co-jp-da.top
my-jcb-co-jp-dd.top
my-jcb-co-jp-de.top
my-jcb-co-jp-lb.top
my-jcb-co-jp-lw.top
my-jcb-co-jp-vf.top
my-jcb-co-jp-vy.top

# Reference: https://www.virustotal.com/gui/ip-address/45.14.149.241/relations

myjcb-co-jp-ub.top
myjcb-co-jp-us.top
myjcb-co-jp-yg.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1375920694450511872

my-jcb-co-jp-dn.top
my-jcb-co-jp-dx.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1384206188774977540

my-jcb-lw.top
my-jcb-wl.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1384959047598854149

my-jcb-uj.top
my-jcb-yd.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1375723312874065925

fewfewfeewg.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1375915007540518913

docomogga.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1376440639328415747

docomojja.com
docomojjo.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1376514048682979330
# Reference: https://www.virustotal.com/gui/ip-address/195.123.238.49/relations
# Reference: https://www.virustotal.com/gui/ip-address/45.148.165.243/relations
# Reference: https://www.virustotal.com/gui/file/26ba8fb0baeb7aa7c1425ec11ccde858417fbe5bcea25a14da049c9e7fa4a4c7/detection
# Reference: https://www.virustotal.com/gui/file/cc4692627b0b5f55bede44261b84414b42971c318f9227b820ae8af65aace53d/detection
# Reference: https://www.virustotal.com/gui/file/8b0d573430bfadb9602dcf4aa67c52bbe5b41b4062d94088c4733c3ff860da90/detection

baoj.club
cenkt.club
cunkt.club
datkt.club
doukt.club
frenchkt.club
jikt.club
jinkt.club
kaikt.club
liankt.club
meix.club
pguo.club
weidt.club
xiankt.club
xinkt.club
yangdt.club
yongi.club
zhaokt.club
zhucc.club
zhangjinxiu1.top

# Reference: https://www.virustotal.com/gui/ip-address/23.251.62.212/relations

docomocop.com
docomojja.com
docomonon.com
docomonoz.com
docomoojn.com

# Reference: https://www.virustotal.com/gui/ip-address/23.224.171.168/relations

docomojjo.com
docomomic.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1377537502324486145

docomoufc.com
docomouna.com

# Reference: https://www.virustotal.com/gui/ip-address/216.127.183.156/relations

caidocomo.com
cindocomo.com
dcodocomo.com
dnfdocomo.com
docomocco.com
docomodon.com
docomojio.com
docomomco.com
docomomio.com
docomomjo.com
docomonio.com
docomonjo.com
docomoodn.com
docomoome.com
docomoonc.com
docomoufc.com
dondocomo.com
nntdocomo.com

# Reference: https://www.virustotal.com/gui/ip-address/216.127.183.149/relations

ckidocomo.com
dicdocomo.com
dyodocomo.com
mfudocomo.com
mindocomo.com
ocodocomo.com
untdocomo.com
cia-mu.com
cmnmufg.com
finmufg.com
mafmufg.com
mcfmufg.com

# Reference: https://www.virustotal.com/gui/ip-address/165.3.87.69/relations
# Reference: https://www.virustotal.com/gui/ip-address/193.34.49.189/relations
# Reference: https://www.virustotal.com/gui/ip-address/198.148.109.53/relations

amgdocomo.com
apkdocomo.com
aumdocomo.com
ckodocomo.com
coodocomo.com
fbidocomo.com
fekdocomo.com
gledocomo.com
iecdocomo.com
iendocomo.com
ifudocomo.com
imfdocomo.com
inedocomo.com
ipdocomo.com
ipodocomo.com
itcdocomo.com
itedocomo.com
iupdocomo.com
jjodocomo.com
jjpdocomo.com
kmodocomo.com
miudocomo.com
mlgdocomo.com
nocdocomo.com
omqdocomo.com
onodocomo.com
opndocomo.com
orodocomo.com
otpdocomo.com
ouodocomo.com
owidocomo.com
uccdocomo.com
ufidocomo.com
ufodocomo.com
uiodocomo.com
uiodoomo.com
ukodocomo.com
umfdocomo.com
uoudocomo.com
utcdocomo.com
utudocomo.com
uyddocomo.com
ydodocomo.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1379001673767526401

docomoca.com
docomomco.com
docomoome.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1379353591551459331

docomocco.com
docomonio.com

# Reference: https://www.virustotal.com/gui/ip-address/172.247.223.237/relations

impdocomo.com
pmcdocomo.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1393481174194917379

uds-docomo.com
ufc-docomo.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1377612176987459585

grgrggr.jp

# Reference: https://twitter.com/NaomiSuzuki_/status/1379342143001554944

lineci.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1380081076744245252

linecrv.com

# Reference: https://twitter.com/p0x53/status/1379497191673229313
# Reference: https://urlscan.io/search/#filename%3A%22runtime.ba8eeee32af1382c300e.js%22

/runtime.ba8eeee32af1382c300e.js

# Reference: https://www.riskiq.com/blog/external-threat-management/yanbian-gang-malware-distribution/
# Reference: https://otx.alienvault.com/pulse/606f3b451543aa3bbf378a52
# Reference: https://www.virustotal.com/gui/file/491605b1f818b3966bdbeade82e410abe8fc6940d69f77c20f8a7e08f4e08c0b/detection
# Reference: https://www.virustotal.com/gui/file/67f5ba9c7095178391065cb7eaa9bbfaa7d9f4d8a4e9aaff507d346c5de50f18/detection

http://103.145.190.43
http://36.225.154.65
103.145.190.43:8978
/mobile/method1/
/mobile/method2/
/mobile/method3/
/mobile/method4/
/mobile/method5/
/mobile/method6/
/mobile/method7/
/mobile/method8/
/mobile/method9/
/mobile/method10/
/mobile/method11/
/mobile/method12/
/mobile/method13/
/mobile/method14/
/mobile/method15/
/mobile/method16/
/mobile/method17/
/mobile/method18/
/mobile/method19/

# Reference: https://www.virustotal.com/gui/ip-address/91.223.82.85/relations

lineckf.com

# Reference: https://twitter.com/m0br3v/status/1204412006209470464

nan-17277.cnhanzhong.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1388056470671953920

sagawa-exp.buzz
sagawa-express.buzz

# Reference: https://twitter.com/NaomiSuzuki_/status/1389586399523864581

sagawa-ex.buzz
sagawa-ex.icu

# Reference: https://twitter.com/NaomiSuzuki_/status/1388882295772225545

direct-smbc.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1389083136072445955

direct5-smbc.com

# Reference: https://www.virustotal.com/gui/ip-address/165.3.86.110/relations

rakuten-japan.info

# Reference: https://www.virustotal.com/gui/ip-address/165.3.87.71/relations
# Reference: https://www.virustotal.com/gui/ip-address/165.3.87.73/relations

promisecio.com
promiseimg.com
promisemvp.com

# Reference: https://twitter.com/malwrhunterteam/status/1390761665558368260
# Reference: https://twitter.com/bl4ckh0l3z/status/1392400143152996352
# Reference: https://www.virustotal.com/gui/file/a117e267fc0058ce2ca9a124ec4c775bfa919eddcb6000014b49fd5e7430b901/detection

103.159.80.18:9828

# Reference: https://www.virustotal.com/gui/ip-address/193.34.49.143/relations

ntydocomod.com

# Reference: https://twitter.com/KesaGataMe0/status/1394571972340707330

nttcodoco.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1394871488923066369
# Reference: https://twitter.com/NaomiSuzuki_/status/1395098036389376001
# Reference: https://www.virustotal.com/gui/ip-address/165.3.86.52/relations

docomoapk.com
docomoauoz.com
docomoiod.com
docomoiuc.com
docomomvp.com
docomooid.com
docomoopt.com
god-docomo.com
icu-docomo.com
ido-docomo.com
ieo-docomo.com
iod-docomo.com
ito-docomo.com
ivp-docomo.com
jjp-docomo.com
opn-docomo.com
pin-docomo.com
poq-docomo.com
ucc-docomo.com
ufc-docomo.com
ufo-docomo.com
uid-docomo.com
uoc-docomo.com
uvu-docomo.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1395087552864919553
# Reference: https://www.virustotal.com/gui/ip-address/94.242.58.10/relations

docoki.com
docomoapk.com
docomoauoz.com
docomocv.com
docomodf.com
docomoer.com
docomohj.com
docomoiod.com
docomojk.com
docomokl.com
docomomvp.com
docomooid.com
docomoopt.com
docomopa.com
docomosd.com
docomoxz.com
docomoyu.com
ndocomop.com
nttdoca.com
nttdocd.com
nttdocomoas.com
nttdocomoc.com
nttdocomocr.com
nttdocomoct.com
nttdocomoer.com
nttdocomom.com
nttdocomome.com
nttdocomomq.com
nttdocomon.com
nttdocomoo.com
nttdocomoop.com
nttdocomoqw.com
nttdocomoty.com
nttdocomoui.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1400486938096726018
# Reference: https://twitter.com/NaomiSuzuki_/status/1400929097090437120
# Reference: https://twitter.com/KesaGataMe0/status/1406633987280228352
# Reference: https://www.virustotal.com/gui/ip-address/45.14.150.222/relations

kuroneko-yamato-jc.top
m-manga.top
m-post-dz.top
my-plost-db.top
my-post-a.top
my-post-cf.top
my-post-le.top
post-fi-kv.top
postch-dv.top
postch-od.top
postch-ua.top
postch-uj.top
postch-yd.top
posti-fi-bs.top
posti-fi-eb.top
posti-fi-if.top
posti-fi-ir.top
posti-fi-kc.top
posti-fi-od.top
posti-fi-pm.top
posti-fi-uc.top
posti-fi-vp.top
sagawa-exp-ft.top
sagawa-exp-fz.top
sagawa-exp-oq.top
sagawa-exp-oz.top
se-post-fk.top
se-post-la.top
se-post-lm.top
singpost-ud.top
singpost-ur.top

# Reference: https://twitter.com/moglahoma/status/1399653843198087174

sawaga-to.xyz

# Reference: https://twitter.com/NaomiSuzuki_/status/1400932442110783489

sagawa-service.com
sagawa-service.icu

# Reference: https://twitter.com/051R15/status/1402430928748572675
# Reference: https://www.virustotal.com/gui/file/e609ac709a6b80b0ceb58c646735fc597db0483ff637e93acf9be028c07900d7/detection

http://103.147.12.89
36.228.84.58:60
/api/interfaceA

# Reference: https://www.virustotal.com/gui/ip-address/165.3.86.116/relations

apn-docomo.com
ios-docomo.com
xpr-docomo.com

# Reference: https://twitter.com/HQ610iwa/status/1401790782781071366

docomo.uyhj.xyz

# Reference: https://twitter.com/kuzeki_C/status/1403195987124916226

docomo.ne.ktjp.xyz

# Reference: https://twitter.com/NaomiSuzuki_/status/1403233643418427393

docokda.com

# Reference: https://www.virustotal.com/gui/ip-address/23.234.11.8/relations

mailsa-qee.com
qq-pc.top
qq-pe.top
qq-pg.top
qq-pm.top
qq-pq.top
qq-pt.top
qq-px.top
qq-py.top
qq-pz.top
qq-um.top
qq-yd.top
qwe-aso.top

# Reference: https://www.virustotal.com/gui/ip-address/23.234.11.7/relations

mailsa-qsg.com
mailsa-qsz.com
qw-qa.top
qw-wm.top

# Reference: https://www.virustotal.com/gui/ip-address/23.234.11.6/relations

azz-re.top
azz-ru.top
mailsa-qsh.com
mailsa-qsj.com
mailsa-qsk.com
mailsa-qsl.com
maisa-qqy.com
qe-pb.top
qe-ss.top
qe-ua.top

# Reference: https://www.virustotal.com/gui/ip-address/23.234.11.4/relations

qw-kb.top
qw-kc.top
qw-kd.top
qw-kg.top
qw-kk.top
qw-kn.top
qw-kz.top
qw-zd.top
qw-zp.top
qw-zr.top
qw-zu.top
qw-zw.top

# Reference: https://www.virustotal.com/gui/ip-address/23.234.11.3/relations

qw-uf.top

# Reference: https://twitter.com/ReBensk/status/1405193747575578626
# Reference: https://www.virustotal.com/gui/ip-address/191.101.44.60/relations

5yueapk-2.top
dnsapk.top
kuroneko-yamato-jc.top
m-post-dz.top
my-plost-db.top
my-post-a.top
my-post-cf.top
my-post-le.top
postch-dv.top
postch-od.top
postch-ua.top
postch-uj.top
postch-yd.top
posti-fi-bs.top
posti-fi-if.top
posti-fi-ir.top
posti-fi-kc.top
posti-fi-od.top
posti-fi-pm.top
sagawa-exp-ft.top
sagawa-exp-fz.top
sagawa-exp-oq.top
sagawa-exp-oz.top
se-post-la.top
singpost-ud.top
singpost-ur.top

# Reference: https://twitter.com/sS55752750/status/1405505608208498689
# Reference: https://pastebin.com/esEj0CM6

http://191.101.44.86
http://45.137.183.33
http://45.137.183.35
http://45.137.183.36
http://45.137.183.37
http://45.137.183.38
http://45.137.183.39
http://45.137.183.40
http://45.137.183.41
http://45.137.183.42
http://45.137.183.43
http://45.137.183.44
http://45.137.183.45
http://45.137.183.46
http://45.137.183.47
http://45.137.183.48
http://45.137.183.49
http://45.137.183.50
http://45.137.183.51
http://45.137.183.52
http://45.137.183.53
http://45.137.183.54
http://45.137.183.55
http://45.137.183.56
http://45.137.183.57
http://45.137.183.58
http://45.137.183.59
http://45.137.183.60
http://45.137.183.61
http://45.254.25.74
http://45.137.183.34
12apk.top
android2.top
cusaa.org.cn
lianjiea1.com
xapk1.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1405908435598667777

docomoo.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1405590284549775360

shizuokacity-cv.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1405217928165744642
# Reference: https://twitter.com/KesaGataMe0/status/1407673644860395522
# Reference: https://www.virustotal.com/gui/ip-address/87.120.36.215/relations

dfsfdsa.com
docokda.com
docolc.com
docoml.com
docontt.com
docomod.com
docomoe.com
docomoie.com
docomoip.com
docomoov.com
docomorr.com
docomou.com
docomouy.com
docomoy.com
docomozi.com
docomoze.com
docomozz.com
docomu.com

# Reference: https://twitter.com/KesaGataMe0/status/1406635534861041666

cr-inuires.com
cr-mugfz.com
cr-mugfz.xyz
cr-mugw.com

# Reference: https://twitter.com/KesaGataMe0/status/1406863622844731392

lkj-mufg.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1408055658751033350

nttdocomo.xyz

# Reference: https://twitter.com/NaomiSuzuki_/status/1410333806171549699

e-sagawa.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1410649027666800643

docomol.com
docomoui.com
ikvda.online
mcixad.com
xcdadc.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1410838588506337284
# Reference: https://twitter.com/KesaGataMe0/status/1410847120530173953

docomx.com
docomx.site
docomx.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1411195589790892033

docokd.fun
docokdc.fun

# Reference: https://www.virustotal.com/gui/ip-address/45.141.156.189/relations

docmos.xyz
docokd.online
docomovc.com
docomoz.buzz
docomoz.top
docomoz.xyz
docomu.top
docomu.xyz

# Reference: https://twitter.com/KesaGataMe0/status/1412002698203865088

nttdocomo-update.com

# Reference: https://www.virustotal.com/gui/ip-address/77.83.117.217/relations
# Reference: https://www.virustotal.com/gui/ip-address/87.120.36.21/relations
# Reference: https://www.virustotal.com/gui/ip-address/185.217.0.203/relations

dococcz.xyz
docoma.xyz
docomaa.xyz
docomab.xyz
docomac.xyz
docomad.xyz
docomae.xyz
docomaf.xyz
docomag.xyz
docomah.xyz
docomai.xyz
docomg.xyz
docomi.xyz
docomia.xyz
docomib.xyz
docomic.xyz
docomid.xyz
docomie.xyz
docomif.xyz
docomoje.site
docomojq.site
docomojr.site
docomojw.site
docomojy.site
docomoxa.xyz
docomoxb.xyz
docomoxc.xyz
docomoxd.xyz
docomoxe.xyz
docomoxf.xyz
docomoxg.xyz
docomoxh.xyz
docomoxi.xyz
docomoxj.xyz
docomoxk.xyz
docomoxl.xyz
docomoxm.xyz
docomoxn.xyz
docomoxo.xyz
docomoxp.xyz
docomoxq.xyz
docomoxr.xyz
docomoxs.xyz
docomoxt.xyz
docomoxu.xyz
docomp.xyz
docomq.xyz
docomr.xyz
docoms.xyz
docomsa.xyz
docomsb.xyz
docomsc.xyz
docomsd.xyz
docomse.xyz
docomsf.xyz
docomt.xyz
docomu.xyz
docomvac.xyz
docomvad.xyz
docomvae.xyz
docomvaf.xyz
docomvag.xyz
docomvah.xyz
docomw.xyz
docomx.xyz
docomxb.xyz
docomxc.xyz
docomxd.xyz
docomxe.xyz
docomxf.xyz
docomxg.xyz
docomy.xyz
docona.xyz
doconc.xyz
docond.xyz
docone.xyz
doconf.xyz
doconh.xyz
doconj.xyz
doconk.xyz
doconl.xyz
doconn.xyz
doconoad.site
doconoae.site
doconoai.site
doconoao.site
doconoap.site
doconoaq.site
doconoar.site
doconoas.site
doconoau.site
doconoay.site
doconooa.site
doconood.site
doconooe.site
doconoof.site
doconooi.site
doconooo.site
doconoor.site
doconoos.site
doconoou.site
doconoow.site
doconooy.site
doconp.xyz
doconq.xyz
doconr.xyz
docons.xyz
docont.xyz
doconti.xyz
doconu.xyz
doconw.xyz
docony.xyz
docooc.xyz
docoocd.xyz
docooce.xyz
docoocf.xyz
docoocg.xyz
docooch.xyz
docooci.xyz
docoocj.xyz
docoock.xyz
docoocl.xyz
docooco.xyz
docoocp.xyz
docoocq.xyz
docoocr.xyz
docoocs.xyz
docooct.xyz
docoocu.xyz
docoocw.xyz
docoocy.xyz
docooe.xyz
docooi.xyz
docooma.site
docoomb.site
docoomc.site
docoomd.site
docoome.xyz
docoomf.site
docoomg.site
docoomh.site
docoomi.xyz
docoomj.site
docoomk.site
docooml.site
docoomm.site
docoomn.site
docoomo.xyz
docoomp.xyz
docoomq.xyz
docoomr.xyz
docooms.site
docoomt.xyz
docoomu.xyz
docoomv.site
docoomw.xyz
docoomx.site
docoomy.xyz
docoomz.site
docoone.site
docooni.site
docoonq.site
docoonr.site
docoont.site
docoonu.site
docoonw.site
docoony.site
docooo.xyz
docooq.xyz
docoor.xyz
docoot.xyz
docoou.xyz
docoow.xyz
docooy.xyz
dooccom.site
ducomo.xyz

# Reference: https://www.virustotal.com/gui/ip-address/115.144.69.18/relations

api-softbank.com
sofbonk.com

# Reference: https://www.virustotal.com/gui/file/6598f6a0ff01e0804ba14d4dd850fee41b7f5bd6b6c2b8e5ce50453f25f7ab27/detection

104.21.39.208:2095
cpymap.biz
app.cpymap.biz

# Reference: https://twitter.com/mongol0602/status/1413809982387019786

sgh-system.com

# Reference: https://twitter.com/KesaGataMe0/status/1413838286754238466

nttdocomo.club
nttdocomo.ink
nttdocomo.live
nttdocomo.site
nttdocomo.wiki

# Reference: https://twitter.com/KesaGataMe0/status/1415582845637038085

sawaga-express.com

# Reference: https://twitter.com/KesaGataMe0/status/1415943664627449857

sawaga-secure.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1415613088573779971

sagawa-kc.top

# Reference: https://twitter.com/KesaGataMe0/status/1416976829122945025

sg-esp.com

# Reference: https://www.virustotal.com/gui/file/00ee5a85ca57abcca380f08af59d2f54b805aa2161c5ee6cf3e8db9235baa8da/detection

104.21.61.89:2095
jhymap.com
app.jhymap.com

# Reference: https://twitter.com/KesaGataMe0/status/1416859570035593218

nttddsomew.com
nttdocomosw.com
nttdogomjp.com
nttdoyomjp.com

# Reference: https://twitter.com/KesaGataMe0/status/1420309765763203078

epos-ccard.one

# Reference: https://twitter.com/KesaGataMe0/status/1420514666485145604

srnbc-card.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1421063804473860099

sgw-cdf.buzz

# Reference: https://twitter.com/NaomiSuzuki_/status/1421355982135779332

msswz.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1422093787518541830

msnettv.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1422109092663812101

nnissen-ncs.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1422444327121297408

tdden.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1422554927931461639

sgw-iit.shop
/sagaexpress.php

# Reference: https://twitter.com/NaomiSuzuki_/status/1422815454989479939

tskgn.com

# Reference: https://twitter.com/ninoseki/status/1423601061185703936
# Reference: https://twitter.com/teamcymru_S2/status/1423633486972432385
# Reference: https://www.virustotal.com/gui/file/42ce622309acaf30ff8e280bf0ae2a35f2dd949d0223d9f132977e545bd1a8e5/detection
# Reference: https://www.virustotal.com/gui/file/7ff3b3480ac88d6f51aa41f57582d7f61a57d141fbae8a4debb50e2b391d7ffc/detection

103.212.222.148:28843
103.249.28.207:28844
103.249.28.207:28846
103.249.28.207:28866

# Reference: https://www.virustotal.com/gui/ip-address/45.14.150.222/relations

kuroneko-yamato-jc.top
m-manga.top
m-post-dz.top
my-plost-db.top
my-post-a.top
my-post-cf.top
my-post-le.top
post-fi-kv.top
postch-dv.top
postch-od.top
postch-pc.top
postch-ua.top
postch-uj.top
postch-ux.top
postch-vi.top
postch-xt.top
postch-yd.top
postch-zj.top
posti-fi-am.top
posti-fi-bs.top
posti-fi-eb.top
posti-fi-ic.top
posti-fi-if.top
posti-fi-ir.top
posti-fi-is.top
posti-fi-jl.top
posti-fi-kc.top
posti-fi-lr.top
posti-fi-od.top
posti-fi-ov.top
posti-fi-pm.top
posti-fi-rh.top
posti-fi-uc.top
posti-fi-vp.top
posti-fi-vw.top
posti-fi-xf.top
sagawa-exp-ft.top
sagawa-exp-fz.top
sagawa-exp-ob.top
sagawa-exp-on.top
sagawa-exp-oq.top
sagawa-exp-oz.top
se-post-fk.top
se-post-la.top
se-post-lm.top
singpost-ud.top
singpost-ur.top

# Reference: https://twitter.com/malwrhunterteam/status/1422938799915642893
# Reference: https://www.virustotal.com/gui/file/9c075a12e2061d5fcc48823b3482c7aa7b7af3059a7ba8b35924bbfa6f25503d/detection

cgreen.cc

# Reference: https://twitter.com/malwrhunterteam/status/1422940188431503365
# Reference: https://www.virustotal.com/gui/file/e5b149b479753294aa5bc4ceb9280b01538d931dbd1120002997782e48c4e402/detection

919s.cn

# Reference: https://twitter.com/NaomiSuzuki_/status/1423165806926385157

faweaa.com

# Reference: https://www.virustotal.com/gui/ip-address/43.249.30.211/relations

sagawa-kb.top
sagawa-kc.top
sagawa-ks.top
sagawa-kt.top

# Reference: https://twitter.com/NaomiSuzuki_/status/1431495184370442241

mlper.com
vwdgt.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1430974013178748928

vywoc.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1430597425027112962

vaqop.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1430236435332829186

cewhg.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1430031440113135616

uydmk.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1428962456882147335

zeawz.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1428780854071873539

hevfw.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1428443953800507394

aswsx.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1428423162690105344

tsnea.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1428421196379353092

msazs.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1427680150666104832

shsxa.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1427318106188226594

sdfwx.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1426602056974962688

ywsuz.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1426238228907008000

ywsaz.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1425877122929676289

nheggs.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1425514121286492160

wetmk.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1425513905644707850

msnbee.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1424973457918283787

dqwes.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1424145936721141766

msnebs.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1424145634022465536

aswrd.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1425151502352404482

mufg-rpg.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1435481799161880578

nuerw.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1435315161477173253

xswry.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1435013386203381765

nxupv.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1434247519253327873

bgtre.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1434174743951732743
# Reference: https://twitter.com/harugasumi/status/1433937855290609670

cyocksacc.com
cyocksaco.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1433871541083643904

zefld.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1433504166769397774

vcdew.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1433137455767556101

byqbs.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1432760202449731584

trtbs.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1432584035755167747

nuhte.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1438235732435369984

vfker.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1438376087310848003

zawvf.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1438220324332392448

docomobs.xyz
docomobt.xyz
docomobu.xyz
docomobv.xyz
docomobw.xyz
docomobx.xyz
docomoby.xyz
docomobz.xyz
docomoca.xyz
docomocb.xyz
docomocc.xyz
docomocd.xyz
docomoce.xyz
docomocf.xyz
docomocg.xyz
docomoch.xyz

# Reference: https://twitter.com/NaomiSuzuki_/status/1445668027307937797

mdwyw.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1445447801563799558

asswh.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1445112381424635905

muvdp.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1444766444923744258

bgqry.com
xadwr.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1444073291786846209

bvfrt.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1443672148837470223

yhwnv.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1443284600109682690

fovvd.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1442919776934760451

rmsrg.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1442542469841780736

rgwhy.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1441857301866901510

bvcrr.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1441543618615857154

baqre.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1441177259964973059

mttyu.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1440826837811093505

bfopf.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1440419154998091785

zsewe.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1440056143687000065

gfqer.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1439323472002379776

zaqef.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1438968661360852993

cxwrg.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1437865464139378688

qsqde.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1437489798394966020

cewrt.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1436755417204289541

czwrw.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1436405459154456576

bgwer.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1436032455241191436

vxsaw.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1445987047089471490

zaqxr.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1445794387011653639

tjvzb.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1446359221302296583

efvwe.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1446707867990462470

vdsqe.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1449968067946037248

vzqer.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1450524415918108674

vfeww.com

# Reference: https://twitter.com/NaomiSuzuki_/status/1451606722515066887

vdert.com

# Reference: https://twitter.com/sysk1ll3r/status/1458938033269612544
# Reference: https://www.virustotal.com/gui/file/cea53d98563b3155da77c2ac6573f72c76f46908ac2f0514de1e331678086ce5/detection

61.97.248.5:28836
