# Copyright (c) 2014-2020 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-black-vine-cyberespionage-group.pdf

ameteksen.com
asconline.we11point.com
assso.net
capstoneturbine.cechire.com
caref1rst.com
careflrst.com
EmpireB1ue.com
extcitrix.we11point.com
facefuture.us
gifas.blogsite.org
gifas.cechire.com
healthslie.com
hrsolutions.we11point.com
icbcqsz.com
me.we11point.com
mycitrix.we11point.com
myhr.we11point.com
oa.ameteksen.com
oa.technical-requre.com
oa.trustneser.com
polarroute.com
prennera.com
savmpet.com
sharepoint-vaeit.com
sinmoung.com
ssl-vaeit.com
ssl-vait.com
topsec2014.com
vipreclod.com
vpn.we11point.com
we11point.com
webmail.kaspersyk.com
webmail.vipreclod.com
wiki-vaeit.com
we11point.com
ysims.com

# Reference: https://attack.mitre.org/wiki/Group/G0009
# Reference: https://krebsonsecurity.com/wp-content/uploads/2015/02/FBI-Flash-Warning-Deep-Panda.pdf

images.googlewebcache.com
smtp.outlookssl.com