# Copyright (c) 2014-2020 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://twitter.com/ninoseki/status/1168102281713045504
# Reference: https://otx.alienvault.com/pulse/5be215744ab6fe50c74e94e6
# Reference: https://blog.netlab.360.com/70-different-types-of-home-routers-all-together-100000-are-being-hijacked-by-ghostdns-en/

http://104.196.177.180
http://104.196.232.200
http://104.197.106.6
http://104.198.54.181
http://104.198.77.60
http://104.199.77.41
http://104.248.155.139
http://107.155.132.186
http://107.155.152.10
http://107.155.152.16
http://132.148.148.78
http://139.60.162.188
http://139.60.162.201
http://144.22.104.185
http://155.94.88.155
http://162.216.152.58
http://166.62.103.184
http://173.82.168.104
http://185.137.94.120
http://185.162.229.147
http://185.70.186.4
http://191.252.191.180
http://191.252.203.201
http://192.99.133.147
http://192.99.187.193
http://198.27.121.241
http://198.50.212.232
http://198.50.222.139
http://200.196.240.104
http://200.196.240.120
http://34.73.48.65
http://34.83.129.246
http://35.185.127.39
http://35.185.9.164
http://35.187.149.224
http://35.187.202.208
http://35.187.238.80
http://35.187.246.103
http://35.188.134.185
http://35.189.101.217
http://35.189.125.149
http://35.189.30.127
http://35.189.59.155
http://35.189.63.168
http://35.189.92.68
http://35.194.197.94
http://35.195.116.90
http://35.195.176.44
http://35.196.101.227
http://35.196.89.26
http://35.197.148.253
http://35.197.160.167
http://35.197.172.214
http://35.198.11.42
http://35.198.203.18
http://35.198.22.154
http://35.198.31.197
http://35.198.39.201
http://35.198.5.34
http://35.198.56.227
http://35.198.74.14
http://35.199.106.0
http://35.199.117.75
http://35.199.151.193
http://35.199.2.186
http://35.199.61.19
http://35.199.66.147
http://35.199.75.224
http://35.199.77.82
http://35.199.98.107
http://35.200.179.26
http://35.200.186.172
http://35.200.28.69
http://35.201.11.237
http://35.201.4.21
http://35.203.111.239
http://35.203.116.212
http://35.203.135.65
http://35.203.143.138
http://35.203.167.224
http://35.203.18.30
http://35.203.183.182
http://35.203.25.136
http://35.203.3.16
http://35.203.48.110
http://35.203.5.160
http://35.203.8.203
http://35.203.81.109
http://35.203.85.130
http://35.203.99.113
http://35.204.103.135
http://35.204.146.109
http://35.204.148.156
http://35.204.175.255
http://35.204.237.126
http://35.204.51.103
http://35.204.77.160
http://35.204.80.189
http://35.205.148.72
http://35.205.24.104
http://35.207.28.174
http://35.221.109.188
http://35.221.110.75
http://35.221.192.155
http://35.221.71.123
http://35.227.25.22
http://35.228.156.223
http://35.228.156.99
http://35.228.240.14
http://35.228.244.19
http://35.228.73.198
http://35.228.90.15
http://35.230.104.237
http://35.230.149.66
http://35.230.158.25
http://35.230.162.54
http://35.230.165.35
http://35.230.38.33
http://35.231.163.40
http://35.231.52.239
http://35.231.60.255
http://35.231.68.186
http://35.232.10.244
http://35.233.135.207
http://35.234.131.31
http://35.234.136.116
http://35.234.155.174
http://35.234.156.85
http://35.234.158.120
http://35.234.77.117
http://35.234.89.25
http://35.234.94.97
http://35.235.89.254
http://35.236.116.201
http://35.236.117.108
http://35.236.2.49
http://35.236.203.212
http://35.236.205.241
http://35.236.222.1
http://35.236.246.82
http://35.236.25.247
http://35.236.254.11
http://35.236.34.51
http://35.236.46.246
http://35.236.94.2
http://35.237.127.167
http://35.237.204.11
http://35.237.215.211
http://35.237.32.144
http://35.237.68.143
http://35.237.98.219
http://35.238.4.122
http://35.238.74.24
http://35.240.156.17
http://35.240.176.163
http://35.240.212.106
http://35.240.234.169
http://35.240.94.181
http://35.241.151.23
http://35.242.134.99
http://35.242.140.13
http://35.242.143.117
http://35.242.152.241
http://35.242.203.94
http://35.242.245.109
http://35.243.195.131
http://35.247.224.113
http://40.114.78.143
http://40.74.85.45
http://51.68.184.181
http://51.75.89.185
http://52.234.212.27
http://80.211.37.41
http://93.188.161.184

# Reference: https://decoded.avast.io/simonamusilova/ghostdns-exploit-kit-strikes-back/

http://138.197.149.162
avast.users.scale.virtualcloud.com.br
cvtonelli.com.br
novonovonovo.users.scale.virtualcloud.com.br

# Reference: https://www.platinbilisim.com.tr/TR/Medya/Duyurular/dikkat-ghost-dns-261 (Turkish)
# Reference: https://blog.netlab.360.com/70-different-types-of-home-routers-all-together-100000-are-being-hijacked-by-ghostdns-en/

139.60.162.188:53
139.60.162.201:53
144.22.104.185:53
173.82.168.104:53
18.223.2.98:53
192.99.187.193:53
198.27.121.241:53
200.196.240.104:53
200.196.240.120:53
35.185.9.164:53
80.211.37.41:53

# Reference: https://github.com/reaperb0t/GhostDNS/blob/master/Remote_DNS_Changing_Exploits_not_GHOSTDNS_specific/37214.txt

133.71.33.7:53

# Reference: https://github.com/reaperb0t/GhostDNS/blob/master/Remote_DNS_Changing_Exploits_not_GHOSTDNS_specific/42197.sh

133.7.133.7:53

# Reference: https://twitter.com/ninoseki/status/1207634830927679488

107.155.152.15:53

# Reference: https://twitter.com/ninoseki/status/1250014776014454784

167.114.178.206:53
