# Copyright (c) 2014-2020 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: emissary panda, apt27, apt 27, threat group 3390, bronze union, iron tiger, tg-3390, temp.hippo, group 35, ziptoken

# Reference: https://securelist.ru/luckymouse-hits-national-data-center/90213/

bbs.sonypsps.com
update.iaacstudio.com
wh0am1.itbaydns.com
google-updata.tk
windows-updata.tk

# Reference: https://securelist.com/luckymouse-ndisproxy-driver/87914/

http://103.75.190.28
http://213.109.87.58

# Reference: https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox

language.wikaba.com
solution.instanthq.com
trprivates.com
mildupdate.com

# Reference: https://docs.google.com/document/d/1oYX3uN6KxIX_StzTH0s0yFNNoHDnV8VgmVqU5WoeErc (2018-06-21: EmissaryPanda waterhole in Mongolia's president and parliament websites)

activity.maacson.com
bbs.maacson.com
dns.itbaydns.com
fasterwall.com
govmn.tk
static.fasterwall.com
wh0am1.itbaydns.com
maacson.com

# Reference: https://twitter.com/MeltX0R/status/1179800013150527488

tdjsyqty0takah2x.gitoos.com
