# Copyright (c) 2014-2020 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://blog.talosintelligence.com/2018/06/my-little-formbook.html?m=1

drylipc.com
handanzhize.info
bddxpso.info
atopgixn.info
cretezzy.com
casiinoeuros.info
newraxz.com

# Reference: https://twitter.com/avman1995/status/1038285919219068928
# Reference: https://pastebin.com/6MRD35Pq

http://136.144.52.99
http://198.185.159.145
http://47.91.170.222
lotochain.com
n01.tech
ourcrazyveterans.com
sy-adm.com
yinuxw.info

# Reference: https://twitter.com/dms1899/status/1038276577254146049
# Reference: https://pastebin.com/4pDsDuxn

http://5.101.78.222
http://5.255.94.75
0day4today.com
commercekorea.net
magnagrecia.net
npromo.eu
southsidenewhomes.com

# Reference: https://twitter.com/voidm4p/status/1037294325091250177

handanzhize.info

# Reference: https://twitter.com/ps66uk/status/1036782703788605440

ghazicraft.com

# Reference: https://twitter.com/ps66uk/status/1036773879321190400

truemusclesnow.com

# Reference: https://twitter.com/ps66uk/status/1036773694243332096

sosmedplus.com

# Reference: https://twitter.com/ps66uk/status/1036781260516061184

newd4y.com/sp/

# Reference: https://twitter.com/malware_traffic/status/957956818906632192

boosterfx.com
cabel-ispoffers.market
conditionalmachines.com
derekblasberg.net
exoticlocale.com
idlevents.com
fhsdjhfsdkj.com
lynkieevents.com
mansiobbok.com
wshamg.com
yougethosted.com

# Reference: https://pastebin.com/bEqJKZfZ

peliculainfantiles.com
vanzundertconsulting.com

# Reference: https://twitter.com/nullcookies/status/1046929109811630081

derwamanojaz.com

# Reference: https://twitter.com/James_inthe_box/status/1046864076624646144

graimmer.com
ww7.keygirl.site

# Reference: https://twitter.com/pollo290987/status/1044947696451235840

high5fundraising.net
lechevalierorange.com
returnlostitem.com
sftpcomponent.net

# Reference: https://twitter.com/James_inthe_box/status/1044580953912266758

aldocompliance.com

# Reference: https://twitter.com/James_inthe_box/status/1044324089714724870

graimmer.com

# Reference: https://twitter.com/nullcookies/status/1046924081591988224

bharimatrasay.com

# Reference: https://twitter.com/James_inthe_box/status/1047488230763913216

d.coka.la/ORg1ie.jpg
d.coka.la/BI0asY.jpg
jgc.com.mx/dat/heavy.jpg
jgc.com.mx/dat/mila.jpg
nothernpridecommunications.net
mrawesomescloset.com

# Reference: https://twitter.com/James_inthe_box/status/1047846258239401986

graimmer.com
refractoriesdirectory.com

# Reference: https://twitter.com/dvk01uk/status/1107851408269824000

higcaf.com

# Reference: https://twitter.com/dvk01uk/status/1098070906029723649

symtual.com

# Reference: https://twitter.com/dvk01uk/status/1091013599018000386

funguythings.com

# Reference: https://twitter.com/dvk01uk/status/1089807824731947009

humanytc.com

# Reference: https://twitter.com/dvk01uk/status/1089748801571700737

zinrop.com

# Reference: https://twitter.com/James_inthe_box/status/1108064849651601408

melendyou.com/rm/

# Reference: https://twitter.com/James_inthe_box/status/1110579161884577792

liongrooming.com

# Reference: https://twitter.com/makflwana/status/1068015579586453504
# Reference: https://pastebin.com/TurChwaE

jeycop.com
scubaarabia.com
journeystudentcamp.com
niger-online.com
simplegreenhabits.net
essayontime.science
frankandmidori.com
525pwz.info
check-or-wreck.com
purdomlnc.com

# Reference: https://twitter.com/dvk01uk/status/1118565721892634624

slideus.com

# Reference: https://twitter.com/pancak3lullz/status/1092534221783158784

mitafa.com
seajayssailing.com
327503788.com
michkatravel.com
recoil.world
lianglinyiyou.com
full-art.com
despasito.net
23o95.com
cultivatingimmaturity.win
dtrchampions.com

# Reference: https://twitter.com/pancak3lullz/status/1092434571889688576

w3c.ink
idreamstartup.com
tiaohuobuy.com
droptxt.com
demopex.com
thebodyshelinglogic.com
millcms.com
artframephotography.com
whitelodgingcollege.com

# Reference: https://twitter.com/pancak3lullz/status/1083019107568619521

goodies.biz
win603.com
microbreweriesassociation.com
xn--hck5aza9o8c.site
orangefirestarter.com
mmareligion.com
elhomegifts.com
mecharniser.com
xinghuategang.com

# Reference: https://twitter.com/pancak3lullz/status/1121108516637433859

/h383/?CneDl=

# Reference: https://twitter.com/pancak3lullz/status/1034149890983641089

/eu/?Lh54A=

# Reference: https://twitter.com/malware_traffic/status/1080623037471432704

/hx310/?JreXz=

# Reference: https://twitter.com/pollo290987/status/1082400417370251268

/private/?Uv1x=

# Reference: https://twitter.com/pollo290987/status/901090998343929859

click-ticke.site

# Reference: https://twitter.com/Antelox/status/895299149284999168

wow-tracking.site

# Reference: https://twitter.com/luc4m/status/1124220235656118272

arsimport.com
iniwhmya.com
molakalyva.com

# Reference: https://twitter.com/dvk01uk/status/1125703826890199040

mecharniser.info/ni8/

# Reference: https://twitter.com/luc4m/status/1126043316305506304

alabamaseosolutions.com
foodome.net
humanytc.com
shopnow1.com
wealths.us
zjydl.com

# Reference: https://app.any.run/tasks/5582d288-8fef-456e-be79-a8d80d1df829

rachelkinseyforcongress.com

# Reference: https://twitter.com/dvk01uk/status/1120628599793553408

tiboxe.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1128996781054996480
# Reference: https://app.any.run/tasks/c0094589-70db-4cbe-a7de-f1a08b79168f/

/ca/?U4kp=

# Reference: https://twitter.com/malware_traffic/status/1130450003422351360

/ha/?1b=

# Reference: https://twitter.com/dms1899/status/1138414720199864320

mypeeps.ninja  
yuchuanjz.com  
tasmanuka.online  
perryleycraftgin.com  
ttklyn.com  
pipiguan.com  
kw7ob.com

# Reference: https://twitter.com/James_inthe_box/status/1138478169755754496

explorenoblesvillehomes.com
prytherchforcouncil.com

# Reference: https://twitter.com/luc4m/status/1140979690758262784

tlkcloudem.com

# Reference: https://twitter.com/JayTHL/status/1141056334244253698

promotionzynovawillzerodacontinuegood.duckdns.org

# Reference: https://twitter.com/Racco42/status/1141672784357146624

desklink.duckdns.org

# Reference: https://twitter.com/killamjr/status/1131368397617475584

joeing.duckdns.org

# Reference: https://twitter.com/luc4m/status/1143815529079156738

srcalci.com 
paxfulk.com 
ajexin.com 
gmcpr.net 
shots.golf 
artnfoods.guru 
biocombustiveis.com 
phpcoding.life 
ncfgmm.com

# Reference: https://twitter.com/James_inthe_box/status/1146183202467303424

virtuoussnowball.com

# Reference: https://twitter.com/reecdeep/status/1149224578532741120

hsctsu.com
srilankika.com
westernenergymedicine.info
xn--5nq67dt91acob217ad91b.com
xn--fhqv52e1ueg8n.com

# Reference: https://twitter.com/1ZRR4H/status/1149282913751617536

vfxwarrior.com
protocol.life
15churchroad.com
djcreview07.com

# Reference: https://twitter.com/hexlax/status/1150113306545467393

regular123.com

# Reference: https://twitter.com/hexlax/status/1150744858132451328

mecharniser.com
shaxob.com
shaxob.com

# Reference: https://twitter.com/James_inthe_box/status/1154398293524271104

24648040.ngrok.io

# Reference: https://twitter.com/dms1899/status/1165009802470277120

241369.com
apachedrone.com
beziehungswerk.net
regular123.com
sadathetoure.com
telnyc.com
the-brand-nursery.com
trendteasindia.com

# Reference: https://twitter.com/dms1899/status/1165762759738437632

aagangirlshostal.com
bbo6331.com
crossfitktresrios.com
darts-bar-nova.com
dclogisticsbrasli.com
fanfantxt.com
haiju365.com
longlifebaba.com
sixfiguresuccessmastery.com
somosvip365.com
starfleetcartography.com
sukfat.com
yj.ink

# Reference: https://twitter.com/dms1899/status/1165742047539662850

americangypsealife.com
andareavela.online
dpthkee.com
espritmoteur.com
fawazalhokairfashions.com
get-housesecurity.sale
jeyucite81.win
kzxuqf8w7.biz
mbk.partners
olivianaphotography.com
woodlandsdogretreat.com

# Reference: https://twitter.com/reecdeep/status/1166255171200004100

alptraumaclinic.com
amobad.com
artilary.com
artistsandcreatives.com
beyhanbilisim.com
hunde-betreuung.com
mecharniser.com
pixelorlando.com
ronicooper.com
scjieniu.com
superbotany.com
khosravanigroup.net
tc521.net
pen6.net

# Reference: https://twitter.com/reecdeep/status/1168937433171484676

eprivacyguards.com
nimble.report
shinrigaku-riron.com
xn--gdka3eubcx5ge.com
sukfat.com

# Reference: https://twitter.com/smica83/status/1169553710999060481

joyhoundinc.com 
margaretminguy.com 
racooncity.net 
seastarways.com 
szahjw.com 
tp-hostel.com
travelersintheworld.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1172122495652155392

selforall.info
haddadunited.com

# Reference: https://twitter.com/coderippers/status/1156857536026484736

burkwp.com

# Reference: https://twitter.com/James_inthe_box/status/1173953038098128896

starttoto.com

# Reference: https://twitter.com/malwaremustd1e/status/1175779000687325186

beautyzonebyheidi.com
ristorantepagus.com
sensingbridge-platform.com

# Reference: https://twitter.com/dvk01uk/status/1178696483522191360
# Reference: https://app.any.run/tasks/3b84770f-b06e-47c8-b193-9be3c4c7a6bf/

dealskabaap.com
drrichardorlandi.com
ferienwohnung-dodel.com
geohoof.com
identityapparelonline.com
kxmphs.com
romanoimoveis.com
superadminapp.com
termesahiltaksi.com
veroxin.com

# Reference: https://twitter.com/luc4m/status/1179413765147807744

7thgenerationrabble.com

# Reference: https://twitter.com/luc4m/status/1181880797399326721

cvasajhsjkls00pro.co.uk

# Reference: https://app.any.run/tasks/d933e54f-4a1b-431d-ac1a-46b1f7dbe792/

alphlinic.com
atlantisads.com
apps-tv.com
cheapmonclerjacketsoutlets.com
edmov.com
eurodisfraz.com
hhtdhg.com
nieuwtij.com
pelvicheartspiritalchemy.com
skylod.com
xiaolinjia.com
xn--dll-8n0e103b.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1186906425836081153

100rupeeeliquid.com
allixanes.com 
cattybcreative.com
fastbatterysystems.com
lokmazel.com 
moonchildenterprises.com 
pi2023.com

# Reference: https://twitter.com/wwp96/status/1187064601327919104

guzelkaybettik.com
podwath.com
dairobby.com
danielemenchetti.com

# Reference: https://twitter.com/wwp96/status/1189234871291564035

cartedevisitegratuite.net
palsgraphor.com
veroxin.com
ferreiralove.com

# Reference: https://pastebin.com/29uSdMAk

cancertreatmenttransport.com
chuangshunchem.com
garthhassel.com
golaminators.com
hairminders.com
kovaxy.com
mizorl.com
moraxy.com
rwinzresearch.com

# Reference: https://twitter.com/wwp96/status/1191014781911736321

camexpertangkor.com

# Reference: https://app.any.run/tasks/c0597f3d-f31a-40f8-85e1-b0a8eb3af899/

926cb.com
molestuk.com
shabbirinstruments.com

# Reference: https://app.any.run/tasks/aa6bc7f8-a986-4a33-9595-fff5ac5a0c62

cmioffices.com

# Reference: http://tracker.viriback.com/dump.php (# 2019-11-04, Formbook)

emizard.com
hoscury.com
monkalef.com
oyishu.com
pursemtb.com
scaker.com
shaxob.com

# Reference: https://pastebin.com/xwT2gAgE

3hilltopstudio.com
bgtr.cymru
facetheday.net
gmopets.com
hottennisjp.win
imizin.review
mnuvmg.info
regiusgames.com
tweakboxapp.info
xn--oru96d1wax98e.net

# Reference: https://twitter.com/58_158_177_102/status/1192332316917432321

bagelandcheese.com

# Reference: https://twitter.com/reecdeep/status/1161233442337697793
# Reference: https://app.any.run/tasks/4a4785fe-5b8c-4a36-83ef-ea6500a72df1/

2750tinsleydr.com

# Reference: https://twitter.com/wwp96/status/1193993959074402304
# Reference: https://app.any.run/tasks/35861fd2-8962-404d-a03a-6b90f2a83dad/

chungcuhanoihay.com
cubeandwater.com
deltavisiontv.com
flycoz.com
lateliercreatifdemarie.com

# Reference: https://app.any.run/tasks/954e589c-6906-4e99-9459-65a5770327ab

hitechhomepaintnyc.com
luxogloppeliving.com
balajiphotogallery.com
prlncess-hotels.com

# Reference: https://twitter.com/0xCARNAGE/status/1201194262093807616

beartraditionalkayaks.com
d55consulting.com
my-kit.net
nitsannthit.com
quickful.com
samperd.com
wk616.com
ympublishing.com

# Reference: https://twitter.com/ANeilan/status/1201346143155822592
# Reference: https://www.hybrid-analysis.com/sample/945c63a512d9d62583783329cd83d2872e250fba3c40d5fe0e36483a5a831a9a/5de484aa3f6a1d32720f2eee

norvicshippnig.com

# Reference: https://any.run/malware-trends/formbook (Note: as seen on 2019-12-04)

beauty-fullbox.com
idmicoffee.com
skylod.com
gazoly.com
gridadvisorsllc.com
corvinuscrypto.com
spillthegreens.com
bees11congress.com
atlantisads.com

# Reference: https://twitter.com/ViriBack/status/1202305799445504000

allixanes.com
casineuros.info

# Reference: https://app.any.run/tasks/5ded2851-08b2-4fe1-a34c-45daf448e8e2/

artgrowth.fund
fixref4.com
hotrugged.com
insidereaganmanx.com
institutdebeautechablis.com
jscheide.com
jevmod.com
presence-digitale.net
shopforbabys.com
sluas.com

# Reference: https://pastebin.com/7Ak2nP2T

domferz.com
emmajcoombe.com
ido-expo.com
italianato.com
nwsouthroad.com
thankslotto.com
wasserschaden-hero.com
wellmadecostumes.com
xosuno.com

# Reference: https://www.virustotal.com/gui/file/78377897d8c6ccd0f4e59ddf94db67b2489a4010fe404659f61ebeb91a037a49/detection

fisciapp.com
pinkiavenue.com
061man.com
nongda.group
kuotacell.com
clinica-financiera.com
wellmadecostumes.com

# Reference: https://twitter.com/James_inthe_box/status/1206944999499108353

millerjeanne.com

# Reference: https://twitter.com/wwp96/status/1207739801002291200
# Reference: https://app.any.run/tasks/0e337885-db1f-412b-aa9b-1c6f75eefe17/

meinvcaita.com
mipscenter.com

# Reference: https://twitter.com/wwp96/status/1210228386687279115

find-a-job-online.info
hextor.win
middlemalta.win
otomarco.net
sabyestreetfoods.com

# Reference: https://twitter.com/wwp96/status/1210602703279276032

earlymorningmama.com
hjlh888.com
thexfactorfoundation.com

# Reference: https://app.any.run/tasks/fe87d214-5fab-400a-ae93-7319483ea313/

covzin.com
2220027.com
jxck1688.net
www139706.com

# Reference: https://app.any.run/tasks/5d2b1a42-3931-4381-8f18-17b089100399/

ibelieveinbrazil.com
communityhealthypharmacy.com
raveltalent.com
lapuphealth.com
pornurlz.com
t4z4f7p34y.com
0g6fivegive.men
bemaaultosport.com

# Reference: https://pastebin.com/E6yzi5hz

adventuredogs.tours
brokerofficial-fraud.com
darkwhitechocolate.com
liuhongli.com
yashodankalpataru.com
yummymornings.com

# Reference: https://app.any.run/tasks/15ee6c31-b975-4f9f-ba1d-2f950f82e468/

bazmeadab.com

# Reference: https://twitter.com/James_inthe_box/status/1214176338040410112
# Reference: https://pastebin.com/XMTxaQ02

creativeheadfirst.com
kabsolug.com
stopczynski.com

# Reference: https://app.any.run/tasks/230ffb09-b135-4144-86a7-595110c4786d/

635bifa.com
amoorematrix.com
chemmaths.com
greatsavingsandmore.com
mizorl.com
pinksuper.net

# Reference: https://app.any.run/tasks/de247fe2-7b3a-4c45-b0b1-0be67319bcae/

swfltropicaladventures.com
sindomac.com
jingxiu188.com

# Reference: https://twitter.com/wwp96/status/1214936414749646849

chinabaumatic.com
dealermerchantaccounts.com
mizorl.com
xoso168.com

# Reference: https://twitter.com/wwp96/status/1214935400445358080

chinaplandexpo.com
nuestrojacalito.com
southerntexastitle.com

# Reference: https://pastebin.com/piCYtiS8

beattheburnout.com
harryhdesign.com
integralhome.net
kabsolug.com
mocowhalo.com
stage5klinger.info

# Reference: https://twitter.com/wwp96/status/1216790704007065600

mizorl.com
nymsf.com
promptpayplus.com

# Reference: https://app.any.run/tasks/1f46c9ed-e5d5-421b-8965-39d1536f02bf/

crosswalkclo.com
mydnrip.com

# Reference: https://app.any.run/tasks/4ef08030-7831-4eff-aa3e-7d151ccc231e/

nrojano.com
luckyluxuryhomes.com
quidoz.com
videntesmadrid.com
britelens.com

# Reference: https://pastebin.com/Tz5Kaup2
# Reference: https://twitter.com/FewAtoms/status/1221057533625819136

windowsdefendersecurefilesofficesnetwork.duckdns.org
windowsdefenderserversecuresofficew.duckdns.org
windowsdefenderserversecureserver.duckdns.org
windowsdefenderserversecurity.duckdns.org
windowsdefendersecuirtysystem.duckdns.org
windowsdefendergatewayweb.duckdns.org
windowsdefenderprotection.duckdns.org
bbo7376.com
lounge-fumi.com
luminaryproductions.com
msp29-05.com
ahjqny.net
aslihansaygili.com
highvaluenames.com
iambookworks.com
josephinegreenz.com
oscarwrong.com
47bh.com
51airuyi.com
kapai360.com
chengkeff.com
cjproducts.biz
differently.us
jcbbi.com
3i-j-f6rr.com
s8va.com
couplesense.net
kingdomofspace.com
nnnhg.com
openrprise.net
pojokpas.com
theexchangere.com
werberoboter.com
mccannproduction.com
afjkz.com
baodian.ink
gridhopper.net
howeitservices.com
keralahills.com
peufclothing.com
pursemtb.com

# Reference: https://twitter.com/b4rtik/status/1219924865643438080
# Reference: https://app.any.run/tasks/1b0fdc77-aa65-4b35-8d97-4f85d93d992f/

conorhennessy.com
crowdedfuture.com
ariestikto.com
emergentfamily.com
dhnfv.loan
yourdreamhunter.com
eb1579.com
nercox.com
prepareforyourretirement.com
nextmobility.news
ahcdentaled.com
actigy.com
hirexr.com
chefkennethclay.com

# Reference: https://twitter.com/James_inthe_box/status/1220381091988529153
# Reference: https://app.any.run/tasks/e26f7e65-482e-40fe-8423-38c1ba03b09d/

windowsdefenderserversecuresofficeiq.duckdns.org
joeing.rapiddns.ru
hd5088.com
13622days.com
moz-cafe5thst.com

# Reference: https://www.virustotal.com/gui/file/67bac2e45fce51b88afbf7215a1ea27fbbea871279b29d293e1e7423c297c134/detection

frehan.com
mutlulukicindahacokkadikoy.com

# Reference: https://twitter.com/wwp96/status/1222229357181140992

healthyroot.net
mp3kaka.com
msdcong.com
reloadexplode.com
syslinctalk.com
westsidewifi.com

# Reference: https://twitter.com/James_inthe_box/status/1222544907358720000

windowsfirewallsecurityauthorise.duckdns.org

# Reference: https://twitter.com/wwp96/status/1222625150438453250

mandat.online
saseolocal.com
cryptostrongbox.com
nyoxibwer.com
resistmagazine.com

# Reference: https://twitter.com/wwp96/status/1222642415405871104

civilinspector.com
dremtnw.com

# Reference: https://twitter.com/wwp96/status/1223326386234044416

zdmania.com
realcapemay.com
joxiny.com
qgptgj.com
ridingpassion.com
catbaoceancruises.com
374cb.com

# Reference: https://twitter.com/wwp96/status/1223330896931106822

whatsonprimevideo.com
whwgkj.com
gztla.com
liturgyofthebrokenhearted.com

# Reference: https://twitter.com/wwp96/status/1224412305577869312

fabinx.com
thevendredi.com
americanmotorwerks.com
iraqios.com
verkaufsfunnel.com
thebroadcastblueprint.com

# Reference: https://twitter.com/wwp96/status/1224430085064753158

tcszht.com
nyoxibwer.com
lslhm.com
changelly.store
kang-120.com

# Reference: https://twitter.com/wwp96/status/1224431371751325696

pinoconsulting.net
trn-harbour.com

# Reference: https://app.any.run/tasks/02addc72-ea33-443b-b3ae-f4d72ef11ee6/

skylerfarm.com

# Reference: https://twitter.com/wwp96/status/1224707855116382210

petrankampaamo.com
parknroll.biz
nyoxibwer.com
emtark.com
hemingway.site

# Reference: https://twitter.com/wwp96/status/1224785418991947781

pinoconsulting.net
colonnashipwest.com
trn-harbour.com

# Reference: https://twitter.com/wwp96/status/1224784499294248966

fenglingad.com
lux.institute
tradingforexjourneys.com
outsidegraphics-cs.com
dottortech.com
rfpartnernetwork.com

# Reference: https://twitter.com/wwp96/status/1224781167615975424

ukraivin.net
sachmoi.info
allworxx.com
ownbitcoin.net
dremtnw.com
theclyo.com
cleanyourdesktop.com

# Reference: https://twitter.com/wwp96/status/1225529957935390720

madisonroseholtze.com
softlanders.com
bluecottonhome.com
apachedrone.com
regular123.com
divineandrefined.com

# Reference: https://twitter.com/wwp96/status/1226920846255689730

hypochrome.com
yansixiang.com
skateroads.com
benh-lau.com
mansiobok.com
thebeseenproject.com
nationalcaretrust.com

# Reference: https://app.any.run/tasks/ad0cfeed-aeb4-4757-bd46-db615025bf05/

qingxunmao.com
rzjie.net
softgelatobusiness.com
morita-m.info
lovelyfeed.com
vanistihdam.com
jjuecorp.com
cvvpp.info
befindnewcarhub.live
xn--9d0bt6kvvhi2dq06a.com

# Reference: https://app.any.run/tasks/9fafc927-138c-4dcd-978c-6e0d3cb4937e/

liexiaoyu.com
gazoly.com
ihrpro.info
mycoins.online
keautotech.com
xiaoqiug.com
tialpha.net
ghostwood.coffee
washingtonwarrior.com

# Reference: https://app.any.run/tasks/57365b94-44cd-4994-b49b-95f6d9542ee1/

chnwsdyglobalwealthandreinforcementagenc.duckdns.org
know-how-products.com
smfinanse.com
lost-cats.com
greenpathconstructionllc.info
livreslive.online
seedsofgreen.net
taoyishun.com
tahoe777.com
gzakyy.com

# Reference: https://twitter.com/wwp96/status/1227989980724826114

nfocorpventures.com
zhangshazngmingzhu.com
josieandmichael.com
ionamin-international.com
blackgirlmagicschool.com

# Reference: https://twitter.com/wwp96/status/1228050542238326788

dbprimery.com
mamaheartandhomeblog.com
slacktracks.info
madkrazyworld.com
salienttraining.com

# Reference: https://app.any.run/tasks/18d33a1b-b272-4f3a-b1f8-7743b7282dd9/

0g1ninefall.men
5799j.com
9660123.com
acbce.com
airpopgrip.com
claimookup.com
dinu.ltd
downesbuildco.com
heartpotatoes.com
hpnairportinfo.com
jackedsonadamsarts.info
koozest.com
minjian-edu.com
mz779.com
regular123.info
the-littlemenu.com
tnt-tunnel.com

# Reference: https://twitter.com/Jouliok/status/1228271357995180033
# Reference: https://app.any.run/tasks/69ab10fe-4ddd-420a-8f8b-39b240c313d9/

23oakgrove-malverneast.com
6oclocksupperclub.com
dovfaq.com
dynamicmovementmassage.com
editionlevel.services
fichamed.com
gsjhzs.com
humanityinneedcharity.net
kel1erindia.com
lostrabajosylosdias.com
trybestinteligen.world
valdezoktoberfest.com
wildfolkcreations.com

# Reference: https://otx.alienvault.com/pulse/5e468cf0019b4ecbc557f209

7565657.com
908763.com
barrolahl.com
bhjksc.com
bowriverrustic.com
canhocaocaplavidaplus.net
chenyirail.com
christopher-cloos.com
discerningdomains.com
goodsystem4updating.win
josieandmichael.com
manguifajas.com
mjarvis247.com
msdcong.com
naturegang.com
phoenixtalons.net
tzxymygs.com
unsdgs-ottawauniversity.com
zhangshazngmingzhu.com

# Reference: https://twitter.com/wwp96/status/1228366299048431618

ulxery.com
jackhaworthmortgage.com
stairsstickers.com
flutterbags.com
phaypro.com
thermalguardfoam.com
seniordaters.com

# Reference: https://twitter.com/wwp96/status/1228355644547309573

594cb.com
glamotr.com
khanebazi.com
saudirana.com
siarelco.com

# Reference: https://app.any.run/tasks/78ad3a12-6d82-46a8-9035-cecdf8b23e6f/

ribbonlogistics.com
brighidreppertdesign.com
szbestvision.com
ungtekno.com
produitsbio.net
quidoz.com
asdfcard.com
huanglingmianfen.com
thesalsakitchen.com
marcelorey.com
deadbeatcosmetics.com
lucasws.com
enesodaci.com
haierjiebest.com

# Reference: https://twitter.com/cyber_gato_malo/status/1227997377807691777

simonzjewelry.com
naturegang.com
bjhmsp.com
moralloki.com

# Reference: https://twitter.com/reecdeep/status/1229390645355261953
# Reference: https://app.any.run/tasks/c9bb2639-adbe-40b9-b066-8e39cf1f1522/

yuanzhitang.com
aab1.top
ldot.ltd
lhdhwpc.com
oneillfilms.com
lwqkssdz.com
nigi.ltd
northbridgeweb.com
pressurebattery.technology

# Reference: https://twitter.com/wwp96/status/1229806436403830784

daditbetter.com
glamotr.com
rxqp1.com

# Reference: https://twitter.com/wwp96/status/1229846047066927105

osplans.com
mediconthemove.com
iamkantha.com
gpiventures.com
flutterbags.com
sandcherrystables.com
ulxery.com

# Reference: https://twitter.com/notajungman/status/1230210986554134528
# Reference: https://app.any.run/tasks/8b09a8cf-d3f8-4ffe-9b20-c35ba8622110/

3i-lnfotech.com
bmsay.xyz
cmsay.xyz
erasmus-france.com
etliekmekkonya.net
gnamall.com
itisdue.com
koukoudaikou.com
laffsaturday.info
mcats2379.com
oku.world
patientsportstips.com
pervade.info
rdllb.info
samiceramic.com
us1china.com
xn--3e0bv81a2rhx9e.com
zhejiangft.com

# Reference: https://twitter.com/wwp96/status/1230224137534214144

dronv.com
graememitchley.com
mobileadscontrol.com

# Reference: https://app.any.run/tasks/1909e9e2-6ac6-474a-8589-5a0051e662da/

michaelsdbablog.com

# Reference: https://app.any.run/tasks/b4adadc1-a270-4da7-9882-fb66ce7e03ca/

vertikutierer24.info
caryxo.com
uniquecutters.com
tatatusupports.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1230862696024858625
# Reference: https://app.any.run/tasks/b7bb5802-1357-4ec9-aeff-e023c9c5acb9/

njagongsik.com
lytcjz.com
radark.company
iphonextrade.com
ysitem.com
gyeswu.info
quanziplus.com

# Reference: https://app.any.run/tasks/ed82b375-be11-4ecd-ab76-b86d11c9ed83/

based789.top
ctrip.chat
doingjobs.com

# Reference: http://tracker.viriback.com/dump.php (# 2020-02-23, Formbook)

emizard.com
hoscury.com
kabsolug.com
monkalef.com
oyishu.com
pursemtb.com
scaker.com
shaxob.com

# Reference: https://twitter.com/James_inthe_box/status/1231962545222647809

msofficeinternatiinalfilecloudtransfer.duckdns.org

# Reference: https://app.any.run/tasks/098ba1ab-160a-4270-88f2-976134f289e1/

theking.kim
kinakogohan.com
testingtimes.info
ulxery.com
xn--gzra.com
paintmywedding.net
healtphere.net
specialityhomes.com
jacobgb24.info
wqsfc.info
hidrosalud.life
ticketcerto.com

# Reference: https://app.any.run/tasks/aa5e7383-71e7-450f-94e6-8fd7e1350c4b/

riverdalestandard.com
cncsurplusparts.com
estrellahuang.com
023yuechang.com
ricard-sameofficeial.com
ulxery.com
genxewm.com
hqygyg.com
sachthudo.com
kinakogohan.com
zjvod.info
pigeche.com

# Reference: https://app.any.run/tasks/b80a84c7-35a1-4308-b688-2f85cfd29297/

thuyhoangcoto.com
viwdfw.info
anastasiasfantasy.com
bdplaza.com
athinasailing.com
nyoxibwer.com
js-no-tec.com
kanglaotou.com
focus-ecommerce.com
cheap-clothes-for-women.site
markmackoart.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1232295249306845185

allixanes.info
apuestactiva.com
boozebird.com
crosbybowsercoleman.com
cryptozia.com
knowledgedrum.com
mymandan.com
shirtsformanagers.com
silverhill.net
sundogsupply.com
sxmbh.co
upstatecardprocessing.com

# Reference: https://twitter.com/wwp96/status/1232410976147922944

homesecuritysystemsny.com
medd.site
czhyzy.com
ulxery.com
technologyspoon.com
glasgowcourtslawyers.info

# Reference: https://twitter.com/wwp96/status/1232409688110718977

affectcbd.com
hzcmhm.com
mscgrroup.com
thumdyn.com
wlmqmbwx.com

# Reference: https://twitter.com/wwp96/status/1232395733900374017

canada49ac.com
dev-ops.us
onechere.com

# Reference: https://app.any.run/tasks/f27ab2f5-f0d3-47e1-9081-5964e9a05b4e/

477ope.com
150gpa.com
shukastu.com
caryxo.com
37collingwoodst.com
xolcoin.com

# Reference: https://app.any.run/tasks/448d9f9b-af58-4a95-a317-77e4f6d86dd3/

mudanyadaotel.com
conmdemamen.com
sgcpic.com
caryxo.com
150gpa.com
codeedge.net
leletaovip.com
zaco.top
barrio-libro.com

# Reference: https://app.any.run/tasks/cf45229c-410d-499a-8577-927c5c33bfa5/

carrotaller.com
1523sussextpke.info
enpuntoni.com
830manbet.com
alkcz.link
republlcco.com
worstig.com
provinciaricaurte.com
vwabo.info

# Reference: https://twitter.com/1ZRR4H/status/1232441079837777920

snbnamibia.com

# Reference: https://app.any.run/tasks/9b6cfba3-3edf-4044-b6d0-90690afa5cda

fitgime.com
allixanes.info
ugot2b.com

# Reference: https://twitter.com/killamjr/status/1233714210816704512

americancloudfiletransferprogramin.duckdns.org

# Reference: https://twitter.com/wwp96/status/1234505353527689218

modernboot.com/h2o/
decormagz.com/h2o/
elomafus.com/h2o/
amitywomenspt.com/h2o/
agitatorfactory.com/h2o/

# Reference: https://twitter.com/wwp96/status/1234512894588575744

auroraexpres.com/m5g/
sluttychefs.com/m5g/
resplendentsoul.com/m5g/
jxpingji.com/m5g/
angryfatman.com/m5g/
singlechimp.com/m5g/
mainahao.com/m5g/

# Reference: https://twitter.com/wwp96/status/1234523991739596801

worstig.com/kx9/
carrotaller.com/kx9/
worstig.com/kx9/
christinamjkim.com/kx9/
guidaalluso.com/kx9/

# Reference: https://twitter.com/wwp96/status/1234511070146027527

quidoz.com/r30/
9227kkk.com/r30/
sellanews.com/r30/
gominou.com/r30/
woodruna.com/r30/
andlynweb.com/r30/
tributenora.com/r30/
casaboquete.com/r30/

# Reference: https://twitter.com/wwp96/status/1234926865556606978

carrotaller.com/kx9/
showshow.club/kx9/
guidaalluso.com/kx9/
foodindia-bysial.com/kx9/
sebengriffin.com/kx9/
christinamjkim.com/kx9/

# Reference: https://twitter.com/wwp96/status/1234931238076657665

vinoblay.com/tx3/
sexualitymenshop.com/tx3/
healingherds.com/tx3/
ricsawproperties.com/tx3/

# Reference: https://twitter.com/wwp96/status/1235242516825415687
# Reference: https://app.any.run/tasks/081940ee-da4b-4466-bd9b-66a6aeb1268c/

psychesiren.com/j9t/
bigdickfuckgay.com/j9t/
7565657.com/j9t/
zhangshazngmingzhu.com/j9t/
vulcan-mania.com/j9t/
momvibez.info/j9t/
ionamin-international.com/j9t/

# Reference: https://app.any.run/tasks/119740cc-d4b5-46b1-94dd-6090a2d07f6d/

americancloudfiletransferexcelfile.duckdns.org

# Reference: https://app.any.run/tasks/ce4cc99b-3e9f-437d-bdc2-e15229b8ae73/

shgshgsndy6nationalindustrialgoogleklm.duckdns.org

# Reference: https://twitter.com/wwp96/status/1235249891904978946
# Reference: https://app.any.run/tasks/41796c37-40c8-49a5-8581-66a24fdf2f5c/

fulltimepreschool.com/q0s/
trianting.com/q0s/
gpiventures.com/q0s/
shipinluoliao.com/q0s/
flutterbags.com/q0s/
lefongplaza.com/q0s/
ulxery.com/q0s/

# Reference: https://twitter.com/wwp96/status/1235585908637868032

proofresearch-germany.com/e8p/
import945.com/e8p/
4lcoin.com/e8p/
combscollisioninc.com/e8p/
xn--s80b57jcsde6fcyau51f.com/e8p/

# Reference: https://twitter.com/wwp96/status/1235950654524448774

costabravadoctors.com/ot2/
eventierspace.com/ot2/
naturehealingshop.com/ot2/
asyule225.com/ot2/
lazydoona.com/ot2/
vlemi.com/ot2/
norjax.com/ot2/
triom.tech/ot2/

# Reference: https://twitter.com/wwp96/status/1235968366680117249

classiccurtainskent.co.uk/kx9/
enpuntoni.com/kx9/
breakapp-view.com/kx9/
worstig.com/kx9/
thepilltheplay.info/kx9/
myattendance.today/kx9/

# Reference: https://twitter.com/wwp96/status/1236013793290878976

amistadcristianairapuato.net/zy8/
sousvidemasters.com/zy8/
parosbet.com/zy8/
dronv.com/zy8/
dgsellsrealestate.com/zy8/
fjellburet.com/zy8/
prboatrentals.com/zy8/

# Reference: https://twitter.com/w3ndige/status/1237078724786479104
# Reference: https://app.any.run/tasks/9ee06ab6-2741-4547-bd64-3437c241b3cd/

officearchives.duckdns.org
sommernph.com

# Reference: https://twitter.com/wwp96/status/1237107769129553922
# Reference: https://app.any.run/tasks/7ec58842-7c33-4623-8c5a-6058074b45b9/

ssquid.net/mr02/
aoikyoutei.com/mr02/
cqyongs.com/mr02/
samuraisracing.com/mr02/
grievingly.com/mr02/
discountsclicks.info/mr02/
wanyaobxg.com/mr02/
808korean.com/mr02/

# Reference: https://twitter.com/wwp96/status/1237460282647199745
# Reference: https://app.any.run/tasks/6b3c7009-01ec-4739-9d54-9d2d8320d6a1/

junhao12131.com/r30/
milar.farm/r30/
kalpnacaters.com/r30/
quidoz.com/r30/
lumencos.com/r30/
andlynweb.com/r30/
trekofpersia.com/r30/
ilyakids.com/r30/

# Reference: https://twitter.com/wwp96/status/1237458425287712768
# Reference: https://app.any.run/tasks/4b7ada4b-f96d-4516-b9e3-54ef9dc4bf33/

sidinstitute.org/ri01/
whatareyousoafraidof.com/ri01/
trumpcoin.online/ri01/
me-mart.com/ri01/
discountsclicks.info/ri01/
longrunohm.com/ri01/
34lv.com/ri01/

# Reference: https://twitter.com/wwp96/status/1237466791322046464
# Reference: https://app.any.run/tasks/2b83d26c-b74f-4ed2-8929-5d9df254ddd0/

5554975.com/l89/
nercox.com/l89/
unicigar.com/l89/
raztrans.com/l89/
drousehair.com/l89/

# Reference: https://twitter.com/wwp96/status/1237477304009240576
# Reference: https://app.any.run/tasks/bd661e9c-92a8-4508-b3b0-1f8ecd380e55/

808korean.com/mr02/
discountsclicks.info/mr02/
ssquid.net/mr02/
planetmecharnical.com/mr02/
samuraisracing.com/mr02/
bulmmaf.com/mr02/
yibo.ltd/mr02/

# Reference: https://twitter.com/wwp96/status/1237485063366942722
# Reference: https://app.any.run/tasks/b0178458-4783-4cdc-bf95-0683c92e775f/

crokve.com
mix2025.net
midasrxpharmacy.info
kreasidesain.com
livelifeoutonalimb.com
linkseepay.com

# Reference: https://twitter.com/wwp96/status/1237487962566393858
# Reference: https://app.any.run/tasks/50b155ce-7d71-4f09-b3d6-6c6236722c9f/

aprils-website.info/r30/
sipenyuluh.com/r30/
buy-cyprus.com/r30/
appsdidi-secaccount.com/r30/
sellanews.com/r30/
fidem-consecuta.com/r30/
woodruna.com/r30/

# Reference: https://twitter.com/wwp96/status/1237802222991413258
# Reference: https://app.any.run/tasks/f4e1007c-482b-49b7-a972-abeabe34af29/

cutdream.com/kx9/
showshow.club/kx9/
christinamjkim.com/kx9/
myattendance.today/kx9/
guidaalluso.com/kx9/

# Reference: https://twitter.com/wwp96/status/1237794145940525057
# Reference: https://app.any.run/tasks/b3b3beef-bb19-4343-b078-7fb1e923873a/

leaseloveown.com/l0x/
bridalphotographystudio.com/l0x/
doverax.com/l0x/
ecomcollege.com/l0x/
teetailz.co.uk/l0x/

# Reference: https://twitter.com/JAMESWT_MHT/status/1238078045027794944
# Reference: https://app.any.run/tasks/69676e2c-6f89-463a-be79-1c26e03fc734/

ariafm.gr
flammaart.com
isome2018.com
opebet199.com

# Reference: https://twitter.com/malwrhunterteam/status/1239863667409276928

mastervisacloudesystemprtomicrosftwareus.duckdns.org

# Reference: https://www.virustotal.com/gui/file/be3cfbf10a732af9965dab5b769ef622233eeca26dc1a3e541326e7ce6788bab/detection

indexcalbromarisportallservices.duckdns.org

# Reference: https://app.any.run/tasks/83bd9eb8-7e5a-43af-b131-361590b336b5/

freehobbysolutions.com
moswanted.com
votravo.info

# Reference: https://twitter.com/FewAtoms/status/1240322356880576513

msofficewordfiletransfertotheadmintrue.duckdns.org

# Reference: https://twitter.com/Jouliok/status/1242187207588405248

tescohomegroseryandelectronicstday2store.duckdns.org

# Reference: https://github.com/silence-is-best/c2db#formbook

liuhe127.com

# Reference: https://twitter.com/JayTHL/status/1242196123848245248
# Reference: https://pastebin.com/raw/8qSuUVB4

1ameem.com
1billionhappy.com
1billionwell.com
5product.com
60apexchecks.com
60checks.com
6figurepayraise.com
abillionhappy.com
abillionwell.com
acton.in
actonlabs.in
ahcprheumatology.com
apexasset.io
apextech.biz
apextech.info
apexworld.io
apexworldlaunch.com
apexworldlaunch.tv
ashfaque.me
atefehjewellers.in
auracoolum.com.au
awakencharlotte.com
bellkrank.com
beonbeauty.co.uk
bestexoticdogs.com
brandon--sellers.com
bunkworks.co.uk
cakesque.com
caraconsulting.services
careandcompanion.co.uk
caribbeanwebfestival.com
classysun.com
classysun.info
classysun.net
clownpenis.solutions
colwellandcolwell.com
comfortzonemarketing.com
coronadocobshop.com
crystalindiainfra.com
danandrobbie.com
davidhareart.com
dealerships-suck.com
dianetyrrell.com
diyajewel.com
dotadois.com
drkswrks.com
dubaiexoticdogs.com
earn60apexchecks.com
earn60checks.com
earn60techchecks.com
epica.life
epicassets.info
epicassets.io
exoticmicrobullydogs.com
exoticmicrodogs.com
expertsat.io
fidatoo.in
finalclear.com
funerarianevarez.com
get60checks.com
getservices365.com
globonovo.com
gmshorses.com
golitech.com
goodygifter.com
goteamdeveloper.com
grandmascheesecakes.com
griotplus.com
harvestyourownhemp.com
haula.net
helo.life
heloworld.us
henready.co.uk
hilaryreading.com
houseprof.ca
iamallin.com
iamhappyandwell.com
ilearner.com.tw
incrediblykayla.com
iowabaseballranch.com
iqteamfreedom.com
iqzoom.us
isai4me.com
islandspect.com
isthisforme.com
isyys.net
janfitzpatrickhomes.com
jeremyroma.com
jointhecoinclub.com
jonicablog.com
kamanait.com
kimmys.com
kimmysrestaurant.com
kinderism.org
korling.de
labaccidenttheband.com
levatemediamarketing.com
lifetech.io
lilannie.com
livecryptostatus.com
magnabusinessconsulting.com
martinidewinter.com
matchmymatrimony.com
memeingoflife.com
middlewaremaniacs.com
mil-leon-clothing.com
milleonclothing.com
millionairebootcamp.io
mohanlakshmipathy.com
moist-towelettes.com
moneyiq.tech
mortgageclaimscentre.co.uk
mustbenyce.com
mybtcdeposit.com
mymoneyiq.io
nanghtikeaung.com
nashvilleeastrentals.com
natureswebb.ca
newchain.io
neweuphoria.com
newlotions.com
nicegirl.nyc
ninewestfinancial.com
nitramax.in
okayspark.com
ollie-wood.com
pennyfables.com
perilli.com
pharmdcareers.com
pippingstudio.com
primegusclub.shop
psychotherapyandcounsellingmelbourne.com
rashtraudhyog.com
reliefcbg.com
repdestroyer.com
repdestroyers.com
rerecall.com
rhumboogie.ws
richdeboer.com
rollingwithjoe.com
romasboutique.com
rubell.nyc
rubellmanagement.com
ruhiz.fashion
rushcode.in
secautotransport.com
shittlez.com
simonmiminis.com
solosugiero.com
steelecreekpresby.com
sunshinecoastmow.com.au
switchuations.life
taichibham.org
td.world
thaomoctrungdong.com
thebrainworkacademy.com
thebulldogpubgrille.com
thecottagepiecompany.co.uk
thedistractedwriter.com
theellisgroupholdings.us
therealworldchangers.com
theroommom.com
thesuccessalliance.in
tmpist.com
tnmedonline.xyz
topexoticdogs.com
totheranchandback.com
transforselogistics.in
trizle.com
tylascountrygarden.com
uberspace.co.in
umidaroma.com
urbnwarrior.com
vagastophostels.com
waldorfian.com
wisconsinmicrogreens.com

# Reference: https://app.any.run/tasks/847e1945-3b02-422f-8030-5722b20ffc44/

rogerssmarthealth.com
ahzike.com
sonnensteinwasser.com
alxbrtn.com

# Reference: https://www.virustotal.com/gui/file/6fe43863e02d4a6fb20cbb2c2ad39368abef81636f597da94f7234af2dea47e4/detection

0573sghp.com/sm02/
44exex.com/sm02/
discountsclicks.info/sm02/
istikhara786.com/sm02/
labo10.com/sm02/
lifflander.net/sm02/
piczum.com/sm02/
piknus.com/sm02/
selfieblast.com/sm02/
sluas.com/sm02/
ventouse-carrosserie.com/sm02/
wulkan-mania.com/sm02/

# Reference: https://www.virustotal.com/gui/file/ec7d04da5408d773d949a47cdbbe102b5548ca7358b8d6bf677c3033df5bf04f/detection

athlete50.com/cs2/
govaj.com/cs2/
htma.us/cs2/
jinshengintl.com/cs2/
movingtowardsmeaning.com/cs2/
shengdestone.com/cs2/
susapflug.com/cs2/
vaisnavalife.com/cs2/
yb77777.com/cs2/

# Reference: https://twitter.com/FewAtoms/status/1243249736662028288

systemserverrootmapforfiletrn.duckdns.org

# Reference: https://www.virustotal.com/gui/file/bc000ae8600c8e6fadceb92af23b0f929ec90ea9184675428f88c01b61af6c63/detection

2070pe.com/te/
crisngrt.com/te/
jlzbtx.com/te/
kranche.com/te/

# Reference: https://app.any.run/tasks/cc60c746-1cf8-4adf-8055-4964111c1c9f/

catalinacustomcreations.com/y8r/

# Reference: https://twitter.com/58_158_177_102/status/1245619205833031683
# Reference: https://otx.alienvault.com/pulse/5e8618aa07d72250efbcc853

grabascoop.com/e8p/

# Reference: https://www.virustotal.com/gui/file/c07e2d84c2f5cef7c52c89516cddb219451e2ca0a9bc8c2c98a438cd16db351f/detection

alarmaconhumo.com/zu/
episdenergy.com/zu/
kervax.com/zu/
lautrevision360.com/zu/
medialab-infos.com/zu/
nadirezeki.com/zu/
twfutures.com/zu/
viviselfie.com/zu/
xinheguoji.com/zu/
xinyanjiazheng.com/zu/

# Reference: https://www.virustotal.com/gui/file/616662d9be4b626c73d56cdd6ab4992dbe124de7ce8769630da99397087eea3f/detection

kervax.com/nu/
networkmarketinghq.com/nu/
zswei.com/nu/

# Reference: https://www.virustotal.com/gui/file/d31f7974458508d491e0840db4385c5a38731195cae24a891abb24bb4699c9b3/detection

cambridgehomeimprovements.com/nu/

# Reference: https://www.virustotal.com/gui/file/125a3d4bdb49a67bb4a9dfb6a7c3a09f82083392a76ea1b5cec87bb477ca6bda/detection

bowerbirdnest.com/nu/
mauritiusurlaub.com/nu/

# Reference: https://www.virustotal.com/gui/file/24a1fd76b3daece9142d9ec00807f9bf1bb15831bf72646f013464c8dd94acd1/detection

buildthemind.com/ej/
chuanyuemeili.com/ej/
goldmanjewelers.com/ej/
kervax.com/ej/
kevincurley.net/ej/
newconnectbiblestudy.com/ej/

# Reference: https://www.virustotal.com/gui/file/5d7a56e18e95592673a4c922d86375a168e695966502007cb6b67c1bcc0f16b8/detection

kervax.com
kervax.com/dy/
traumainformedlens.com/dy/
varolemlak.net/dy/

# Reference: https://www.virustotal.com/gui/file/7e756510a7ed412001857c371cafb5af3158eb0a73c9b51eb5823d9002c7d3a8/detection

dalu.ltd/gh/
purespeech.net/gh/

# Reference: https://www.virustotal.com/gui/file/1c57ad28bc07997adeb829bda45513521d95fe2c6880736f69fa701828a30255/detection

cricketxtreme.com/sk/
dikaiyun.com/sk/
hypno.solutions/sk/
kervax.com/sk/
playlanddaycare.biz/sk/
tunegeartech.com/sk/
ukholidayhome.com/sk/
ybsankeshu.com/sk/

# Reference: https://www.virustotal.com/gui/file/af14c1c7562021939f0a68e699a3ba28e26cb6d8d12e8df2c8ca4deba6ceacd7/detection

dalu.ltd
dalu.ltd/gh/
fangjiedaikuan.com/gh/
kervax.com/gh/
massimogirardi.com/gh/
shiweitian.net/gh/
vidolin.info/gh/

# Reference: https://www.virustotal.com/gui/file/fc9be600e3961102a93f5096cac156c1be7e875af98e12ab4f85698f8442475b/detection

byhisgraceestate.com/sh/
comet-sunsun.com/sh/
honeyanda.com/sh/
kervax.com/sh/
maltafarmhouse.com/sh/
shciicoe.com/sh/
zpjrt.com/sh/

# Reference: https://www.virustotal.com/gui/file/3e85d65f5ea95309ad331f5c371449ae85bad3efd0e272b3983377f54a5dee32/detection

fensier.com/sh/
kervax.com/sh/
lapanganpoker.com/sh/
lex-investigations.info/sh/
napshoes.com/sh/
sunbul-phone.com/sh/
umrah-visa.com/sh/

# Reference: https://www.virustotal.com/gui/file/47b251c6e857843db7f377471c90ec48d3ea0f0f5ced461aebf607644815f181/detection

byhisgraceestate.com/sh/
cbd-innovation.com/sh/
eba-ecoenergy.com/sh/
sabetta.family/sh/

# Reference: https://www.virustotal.com/gui/file/b066282209652ab35d7f93ce103b33b06a10e9d4b74e1ea3263466e2789b422d/detection

dharmaworksonline.com/gh/
dukabcn.net/gh/
fangjiedaikuan.com/gh/
gppz999.com/gh/
kervax.com/gh/
mirinavsgorgon.com/gh/
niyoufan.com/gh/
yinstkd.com/gh/

# Reference: https://www.virustotal.com/gui/file/bb8d0853cb0dad63c6098031f2166ba7171259efc5ce83968bdf121cfdff8763/detection
# Reference: https://www.virustotal.com/gui/file/21deeba7640f04a0149d5bd890d8a638c1e126e82c49d0d04a5fcf42c3e5af75/detection

5injlq.com/wi/
720wangzhan.com/wi/
adjointlab.com/wi/
adskitchen.com/wi/
ashishtank.com/wi/
backroomcoffee.com/wi/
cbelleza.com/wi/
chocoval.com/wi/
formattressesok.live/wi/
iron-rain.com/wi/
jamaltooley.com/wi/
janeadamwedding.com/wi/
kervax.com/wi/
lec88.com/wi/
lingnuoguanjia.com/wi/
mengxiangfengcai.com/wi/
musicbyrivals.com/wi/
nvwang41.com/wi/
pg5-formations.com/wi/
tinymarvels.com/wi/
understandingbitcoin.info/wi/
web-design.review/wi/
wm-sb.com/wi/
xyfps.com/wi/
zen507.com/wi/

# Reference: https://www.virustotal.com/gui/file/e97f3ad278b659df4d30bf8181f0698562342e7c03a5a1d41bc601856b2b725c/detection

claddingsheets.info/m01/
coinpon.biz/m01/
kervax.com/m01/
listingclose.com/m01/
ructious.com/m01/
rustedcrate.com/m01/
yczpsh.com/m01/
zeroabuseproject.info/m01/

# Reference: https://www.virustotal.com/gui/file/627b93e8da6daaee1b32bc527ca60f79c501ecd0a3a820fc2a7dea588a795f24/detection

2enablehealth.com/jw/
amindfulearth.com/jw/
janainaerobson.com/jw/
kervax.com/jw/
spaceteamentertainment.com/jw/
sweetsenbake.com/jw/
twz1982.com/jw/
xyi876.com/jw/

# Reference: https://twitter.com/James_inthe_box/status/1249767134269304835

masionlex.info

# Reference: https://twitter.com/James_inthe_box/status/1250077975803916288

thamxop.net

# Reference: https://twitter.com/FewAtoms/status/1252947093171441665

systemintergrafileexchangeserverprotocol.duckdns.org

# Reference: https://twitter.com/petrovic082/status/1255122599354552323

thesecuritysoftwarescannerindustrgreat.duckdns.org

# Reference: https://www.virustotal.com/gui/file/9dce0e1dfbf676137ce1e57f626ad4911056a18c8bdc76f8c3d9b6eaff117092/detection

blkdotconnect.com/t8a/
cufusionevents.com/t8a/
guojizk.com/t8a/
jakedfinkel.lawyer/t8a/
pikio24.com/t8a/
radioncr.com/t8a/
spenbulk.com/t8a/

# Reference: https://app.any.run/tasks/8c381564-3161-42e7-8e91-142990fe4717/
# Reference: https://app.any.run/tasks/6a7d9731-d5de-42ed-85d7-84bc2866196d/
# Reference: https://app.any.run/tasks/ee7b9409-b311-4152-bcea-885e2f055215/

1l4m-5qeh0cgx9a.com
amazingthunderworks.com
badnoordzee.com
cosmemia.com
cryptofinance.services
devereaux.us
empety.com
garden-scope.com
godhep.com
hamptonandjones.com
hulebang.com
jiudianhuixun.com
keeperofthebeesnwnj.com
mangaromance.com
myplusha.com
odjmusica.com
portsel.com
quantumreapers.com
schoolofintrovertship.com
sippingnpaintingcolorado.net
storeketo.com
studio815.salon
supremeondemand.com
vannuysland.com
wyalusingbeverage.com

# Reference: https://twitter.com/DynamicAnalysis/status/1260721412773380096

russchine2specia21plumbingsndymaterialjp.duckdns.org

# Reference: https://unit42.paloaltonetworks.com/silverterrier-covid-19-themed-business-email-compromise/

12kungwsdyducationaldeveloperinvestmenty.duckdns.org
6uniteddefenceforstdygorvermentsocialeme.duckdns.org
americanmicrosoftclouddepartment.duckdns.org
antipiracydetectorganisationforwsdy3film.duckdns.org
bbchenkotsdywoolandpappercompanybnhs5.duckdns.org
chinoex2onlineantibullyandgeneralxpstdy5.duckdns.org
chnes9wealthandstdyorganisationsumit.duckdns.org
chneswealstdy8thandorganisationjokbo.duckdns.org
chneswealthandorganisationstdy7joppl.duckdns.org
chneswsdy13wealthandmoduleorganisationrn.duckdns.org
chneswsdy8wealthandorganisationjokbo.duckdns.org
chnfrndsecurityandgorvermentstdy1socialf.duckdns.org
chnfrndsub1inteligentangencysndy4project.duckdns.org
chnfrndtsdysecurityandgorvermentsocialjf.duckdns.org
chnfrndwsdy1securityandgorvermentsocialf.duckdns.org
cloudfilesharingdomainurllinksys.duckdns.org
crimedetectivefor1stdygorvermentndsocial.duckdns.org
empowermentorganisationstday1government.duckdns.org
engin3worldstdydevelopmentandtechnology.duckdns.org
engintsdy3worlddevelopmentandtechnology.duckdns.org
fileexchangeserverprotocolsystemintergra.duckdns.org
filegotosecureothers.duckdns.org
frndgreen1frdycreamcostmeticsladiesshop.duckdns.org
frndgreen3creamwsdycostmeticsbabystored.duckdns.org
globaltransfersecurefilethroughcloud.duckdns.org
green9wsdyelectronicsandkitchenappliance.duckdns.org
investmenteducationkungykmtsdy8agender.duckdns.org
kung11ducationalstdydeveloperinvestmenty.duckdns.org
kung13eduationalstdydeveloperinvestmenty.duckdns.org
kungeducationalinvestment8tusdyagender.duckdns.org
kungfrdyeducationalinvestment8agender.duckdns.org
kungglobalinvestmenteductgpmstdy8addres.duckdns.org
kungglobalinvestmentjpjeductaddres5stdy.duckdns.org
kungglobalinvestmentjpjwsdy6eductaddres.duckdns.org
kungstdy7globalinvestmentjmpeductaddres.duckdns.org
kungwsdy7globalinvestmentjmpeductaddres.duckdns.org
livevideoremoteconference.duckdns.org
mastervisacloudesystemprtomicrosftwareus.duckdns.org
msofficeinternatiinalfilecloudtransfer.duckdns.org
msofficewordfiletransfertotheadmintrue.duckdns.org
office365securefilegatewaytransfer.duckdns.org
omentradinginternationalprivateltd.duckdns.org
prodigtsdy5organizationalcompanygroupin.duckdns.org
russchine2specialstdy1plumbingmaterialsv.duckdns.org
russchine2specialstdy2plumbingmaterialgh.duckdns.org
russchine2wsdy1specialplumbingmaterialsv.duckdns.org
russchine2wsdyspecial6plumbingjkmaterial.duckdns.org
shgshg13nationalwsdyobjindustrialatempt.duckdns.org
shgshg9nationalobjwsdyindustrialgoogler.duckdns.org
shgshgnationalindustrialwsdy8googleklm.duckdns.org
shgshgnationalobjindustrialstdy10atempt.duckdns.org
shgshgnstdy7ationalindustrialgoogleklm.duckdns.org
shgshgstdy9nationalobjindustrialgoogle.duckdns.org
silentexploitfileexchangerzeroday.duckdns.org
tescogroseryand1wsdayelectronicstorehome.duckdns.org
tescohomegroseryandelectronicstday2store.duckdns.org
tescostday1groseryandelectronicstorehome.duckdns.org
webxpostdytechnologyhardsoftware5buyers.duckdns.org
wewewewewesesesesasbacwederffggffddsss.duckdns.org
windowsdefenderwithfiewallprotocolsecure.duckdns.org
windowsfirewallprotcolsecuritysystem.duckdns.org
worldengindevelopnw7stdymenttechnology.duckdns.org

# Reference: https://twitter.com/luc4m/status/1261260538870366210

6wsdychinese2profesionalandhealthanalpn.duckdns.org

# Reference: https://news.sophos.com/en-us/2020/05/14/raticate/

ef-oh.com/c208/
odoyo.net/c208/
hearee.com/c208/
binzom.com/c208/
pizzans.com/c208/
phochain.com/sa/
rdrfi.com/sa/
skylod.com/sa/
hsctsu.com/sa/
cbespania.info/c206/
conrak.net/c206/
coxemen.com/c206/
dachfix.com/c206/
hypnose-beziers.com/c206/
jevmod.com/c206/
lighthouse-campus24.com/c206/
miscov.com/p0x/
oleum.gmbh/c206/
pupilfy.com/c206/
ratokasutka.com/p0x/
tellpizzqhut.com/c206/
terenium.com/c206/
vibe.restaurant/c206/
yamatobb.com/c206/
yncits89.com/p0x/
czxpkj.com/c206/
cbespania.info/c206/
jevmod.com/c206/
slashoff.com/c208/
sofisleep.com/c208/
jinshasoft.com/c208/
binzom.com/c208/
bywebhost.com/c208/
jinshasoft.com/c208/

# Reference: https://app.any.run/tasks/fe1f56d5-b4ac-401f-abcf-2e25957c13da/

methvenonthemove.com
3lmktgsvc.com
hylg6.com
100fwq.com
laperamordidablog.com
gtitdunproductions.com
glamotd.com
www.azasianow.com/gm1/

# Reference: https://app.any.run/tasks/58333b8b-3488-492e-a1e2-f61bec0a1cca/

teampositiongurus.com
zulfahly.net
capterium.com

# Reference: https://twitter.com/DynamicAnalysis/status/1263680114476191744

webxpoadukejumokeadejokeabolanleholagg.duckdns.org

# Reference: https://www.virustotal.com/gui/domain/creatonetwothreefourfivesexsevenmansgg.duckdns.org/relations

creatonetwothreefourfivesexsevenmansgg.duckdns.org

# Reference: https://www.virustotal.com/gui/domain/metadefenderinternationalsolutionfor.duckdns.org/relations

metadefenderinternationalsolutionfor.duckdns.org

# Reference: https://twitter.com/malwrhunterteam/status/1264882811141488641

aviraantivirussecuritysystempro.duckdns.org

# Reference: https://twitter.com/JAMESWT_MHT/status/1265553518049492992

chinese3lowncomeiscausedbythepandemic.duckdns.org
russchine2loganxmenischangedtonewperson.duckdns.org

# Reference: https://twitter.com/JAMESWT_MHT/status/1268827911722799104

22kungcommunicationtariffsuplierlimthdy.duckdns.org

# Reference: https://app.any.run/tasks/947a591b-200c-4409-8a71-7888da9c93fa/

beautyqueenstores.com/k0f/
chataan.com/k0f/
fattireflights.com/k0f/
moviesfan.net/k0f/
printpeacock.biz/k0f/
sptor.net/k0f/
superwebox.com/k0f/

# Reference: https://twitter.com/JAMESWT_MHT/status/1271356489341558785
# Reference: https://app.any.run/tasks/d85e6f91-5369-454c-ae9f-996dea6743c8/

s-immotanger.com/n7ak/
moodandmystery.com/n7ak/
kangen-international.com/n7ak/
joomlas123.info/n7ak/
runzexd.com/n7ak/
belviderewrestling.com/n7ak/

# Reference: https://twitter.com/MaelSecurity/status/1274414782645506049
# Reference: https://app.any.run/tasks/ad5f5540-df5d-4f7d-853d-9ae4a97be620/

officedocumentfilesharingcloudbaseservi.duckdns.org

# Reference: https://app.any.run/tasks/e6dbb7aa-2d2b-4031-be25-0a86c263a6f6/

asmreekasounds.com
arhiereus.com
oxagp.loan
handyngoods.com
simoneisaaclifestyle-1.com
akbank-mobil-giris.com
wrrsh.com

# Reference: https://app.any.run/tasks/ec7fd1c0-e975-44b1-8719-b0d2b7dfa568/

abiligo.net/kkb/
glamotd.com/kkb/
iscompetition.net/kkb/
renkoto.net/kkb/
2nfq.com
adsars.com
aretocloud.com
dentalonline.info
myvelvetcollection.com
theluxuryindustry.com

# Reference: https://twitter.com/FewAtoms/status/1275473977885024261

firewallinternationalgatewayforoffcefile.duckdns.org

# Reference: https://twitter.com/FewAtoms/status/1276181803712167936

americanfirewallsecuritysystemprotocolfi.duckdns.org

# Reference: https://www.virustotal.com/gui/domain/wsdychnesqudusisabadassniggainthe30wmg.duckdns.org/detection

wsdychnesqudusisabadassniggainthe30wmg.duckdns.org

# Reference: https://urlhaus.abuse.ch/downloads/text_recent/

22chnesqudusisabadassniggainthehudolat.duckdns.org
22kungcommunicationtariffsuplierlimthdy.duckdns.org
23chnesqudusisabadassniggainthehudokgd.duckdns.org
2morcmmytalententertamentforwsdyshampn.duckdns.org
4sndychinese2onlyywalkaloneinlifea1ptc.duckdns.org
americanfirewallsecuritysystemprotocolfi.duckdns.org
chinese2stdyonlyywalkaloneinlifeagfd10.duckdns.org
chinese2thdy9onlyywalkaloneinlifeanre.duckdns.org
chinese2wsdyonlyywalkaloneinlifea13klm.duckdns.org
chinese3higncomeiscausedbythepandempv.duckdns.org
chinese4higncomeiscausedbythepandevop.duckdns.org
chinese5higncomeiscausedbythepandekjp.duckdns.org
chinese7higncomeiscausedbystdythepandybv.duckdns.org
chnes29sndyqudusisabadassniggainthebba.duckdns.org
cprvstd4upcomingtalentanimationauditnyc.duckdns.org
cprvtsdy2upcomingtalentanimationauditics.duckdns.org
firewallinternationalgatewayforoffcefile.duckdns.org
green13kegheedahatakankeadeshnaastdyjlp.duckdns.org
green14kegheedahatakankeadeshnaawsdycxz.duckdns.org
greenkegheedahatakankeadeshnaajaotawqsz.duckdns.org
greenkegheedahatakankeadeshnaajaotawsut.duckdns.org
honeysposecurityfileexchangeservice.duckdns.org
internationalantivirussmartscreensecur.duckdns.org
irequestyoutopleaseadviseonthepayment.duckdns.org
kung20communicationtariffsuplierlimited.duckdns.org
kungsndycommunicationtariffsuplier27abj.duckdns.org
livelifewithnocoronafearforcountry.duckdns.org
microsfotinternetsecurefiletransferserve.duckdns.org
microsoftvirutalmachinefilesafetytransf.duckdns.org
mkpksb1behindcloseddoormatchisnotgoods.duckdns.org
morcmmystnewtalententertamentfor1winner.duckdns.org
officedocumentfilesharingcloudbaseservi.duckdns.org
ppkpsureksub2mondaynightgraceofalmighy.duckdns.org
ppkpsuresub1intercontinentalsuitishere.duckdns.org
russchine2mapanxmenischangedonewpethdy9.duckdns.org
russchine2mapanxmenischangedtonewperkkg.duckdns.org
russchine2mapanxmenischangedtonewperpvc.duckdns.org
russchine2mapanxmenischangestdy10donewcx.duckdns.org
russchine2mapanxmenischangestdy12donexaz.duckdns.org
russchine2sndymapanxmenischangedone14ajb.duckdns.org
sharefildecenterforsecurefiletransferwin.duckdns.org
sndychnesprvallanouthegreatsoustraofour.duckdns.org
sndychnesprvlandofglorylandoflifeforle.duckdns.org
sndychnesprvwaybackmaybachholdbageverl.duckdns.org
sndykrlssnp4curruptgovernmentagencytlki.duckdns.org
transferwisefirewallsystemupdatedinfo.duckdns.org
united17sndyfokesokoriorimistreetsjxzw.duckdns.org
united31stdyfrkesokoriorimistreetsjmng.duckdns.org
webxpopunlariscostlyinthemarketsevelmk.duckdns.org
webxstdy18popunlariscostlyinthemarketzq.duckdns.org
workfine12stdyanotherrainbowlomoyentfkw.duckdns.org
workfine15wsdyanotherrainbowlomoyenttdf.duckdns.org
workfine7alogorainbowlomoyentonloyevpn.duckdns.org
wsdy6pksnpcoperategovernmenttgpdagentx.duckdns.org
wsdychnesqudusisabadassniggainthe30wmg.duckdns.org

# Reference: https://twitter.com/Bl4ng3l/status/1276446227928924160
# Reference: https://app.any.run/tasks/d8c16703-53bb-47f3-8ecb-4414bc42451a/

3or8mwa-ynq.com
betokem.com
freamsahub.online
irmcentral.com
porcber.com

# Generic trails

/config.php?account=
/a8c/?r6=
/dy/?7nRL=
/ej/?3fvH1nq=
/ej/?5jxTV4Ux=
/ej/?AnB=
/ej/?d8FL=
/ej/?mL30v=
/gh/?9r=
/gh/?pdfX=
/gh/?wtzx=
/y8r/?kFQl7b=
/kp1/?r6=
/kt0/?Lh54A=
/nu/?n4=
/nu/?8p=
/nu/?rvKdSp48=
/nu/?w2Kdbz9=
/y88/?uZ-D=
/s48/?Yn=
/s8y/?zXq4AN=
/t2p/?Ezg47B=
/te/?9rmDEzj=
/pjn/?yVcHTBN=
/hx227/
/hx321/
/w8t/
