# Copyright (c) 2014-2020 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://www.sophos.com/fr-fr/threat-center/threat-analyses/viruses-and-spyware/Troj~Nivdort-BI/detailed-analysis.aspx

belongattempt.net
belongbeauty.net
belonggarden.net
belongmarket.net
belongneighbor.net
belongnumber.net
belongpartial.net
belongposition.net
belongreport.net
belongspread.net
belongsquare.net
belongstrike.net
chairattempt.net
chairbeauty.net
chairgarden.net
chairmarket.net
chairneighbor.net
chairnumber.net
chairpartial.net
chairposition.net
chairreport.net
chairspread.net
chairsquare.net
chairstrike.net
destroyattempt.net
destroybeauty.net
destroygarden.net
destroymarket.net
destroyneighbor.net
destroynumber.net
destroypartial.net
destroyposition.net
destroyreport.net
destroyspread.net
destroysquare.net
destroystrike.net
effortattempt.net
effortbeauty.net
effortgarden.net
effortmarket.net
effortneighbor.net
effortnumber.net
effortpartial.net
effortposition.net
effortreport.net
effortspread.net
effortsquare.net
effortstrike.net
forgetattempt.net
forgetneighbor.net
forgetnumber.net
forgetpartial.net
forgetposition.net
forgetspread.net
forgetsquare.net
forgetstrike.net
husbandattempt.net
husbandbeauty.net
husbandgarden.net
husbandmarket.net
husbandneighbor.net
husbandpartial.net
husbandreport.net
husbandspread.net
husbandsquare.net
increaseattempt.net
increaseneighbor.net
increasenumber.net
increasepartial.net
increaseposition.net
increasespread.net
increasesquare.net
increasestrike.net
journeyattempt.net
journeybeauty.net
journeygarden.net
journeymarket.net
journeyneighbor.net
journeypartial.net
journeyreport.net
journeyspread.net
journeysquare.net
littleattempt.net
littlebeauty.net
littlegarden.net
littlemarket.net
littleneighbor.net
littlenumber.net
littlepartial.net
littleposition.net
littlereport.net
littlespread.net
littlesquare.net
littlestrike.net
rememberattempt.net
rememberneighbor.net
remembernumber.net
rememberpartial.net
rememberposition.net
rememberspread.net
remembersquare.net
rememberstrike.net
riddenattempt.net
riddenbeauty.net
riddengarden.net
riddenmarket.net
riddenneighbor.net
riddennumber.net
riddenpartial.net
riddenposition.net
riddenreport.net
riddenspread.net
riddensquare.net
riddenstrike.net
sufferattempt.net
sufferbeauty.net
suffergarden.net
suffermarket.net
sufferneighbor.net
suffernumber.net
sufferpartial.net
sufferposition.net
sufferreport.net
sufferspread.net
suffersquare.net
sufferstrike.net
thoseattempt.net
thosebeauty.net
thosegarden.net
thosemarket.net
thoseneighbor.net
thosenumber.net
thosepartial.net
thoseposition.net
thosereport.net
thosespread.net
thosesquare.net
thosestrike.net
throughattempt.net
throughbeauty.net
throughgarden.net
throughmarket.net
throughneighbor.net
throughnumber.net
throughpartial.net
throughposition.net
throughreport.net
throughspread.net
throughsquare.net
throughstrike.net
withinattempt.net
withinbeauty.net
withingarden.net
withinmarket.net
withinneighbor.net
withinnumber.net
withinpartial.net
withinposition.net
withinreport.net
withinspread.net
withinsquare.net
withinstrike.net
wouldattempt.net
wouldneighbor.net
wouldnumber.net
wouldpartial.net
wouldposition.net
wouldspread.net
wouldsquare.net
wouldstrike.net

# Reference: https://github.com/advanced-threat-research/IOCs/blob/master/2016/2016-02-18-nivdort-data-stealing-trojan-arrives-via-spam/nivdort-data-stealing-trojan-arrives-via-spam.csv

buildingsuccess.net
cigarettepresident.net
prettyguard.net
