# Copyright (c) 2014-2020 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: terdot

# Reference: https://twitter.com/ViriBack/status/1207762597887578117

4netdown.com
7travel.online
asepyqicob.ga
bestshareland.com
cooldatazone.com
englishpro.online
netgetdream.com
prozipdownload.com
rapidsha.com

# Reference: https://twitter.com/albertzsigovits/status/1207805362780491777

vipfilehost.com

# Reference: https://twitter.com/ViriBack/status/1209101494471057409

oajdasnndkdahm.com

# Reference: https://twitter.com/James_inthe_box/status/1209101821773398016

fdsjfjdsfjdsjfdjsfh.com
fdsjfjdsfjdsdsjajjs.com
idisaudhasdhasdj.com

# Reference: https://twitter.com/nao_sec/status/1217834630612647946
# Reference: https://app.any.run/tasks/c5f307eb-4389-4713-83a4-67ee331409f9/

isfjiaaodwsoi.com

# Reference: https://app.any.run/tasks/1bc5951f-38a1-4f18-89f5-498f4e8733e7/

6pi3jrqjbssfh6gu.onion.pw

# Reference: https://twitter.com/Racco42/status/1224232852998574080
# Reference: https://app.any.run/tasks/b4707b79-2101-4204-9aa7-30879480fd85/

giril.org
shatskie.org

# Reference: https://app.any.run/tasks/f27e3051-b85a-4f62-be6e-6322c24d5aab/

hourtschem.com

# Reference: https://app.any.run/tasks/b620b4ea-25f0-4fb8-a957-acf2629fe361/

xhj4hypdsb3jozwn.onion.pw

# Reference: https://twitter.com/Racco42/status/1226813759642951680

tarynak.org

# Reference: http://tracker.viriback.com/dump.php (# snapshot 2020-02-23, Zloader)

45.72.3.132:443
185.174.100.9:80
4netdown.com
7travel.online
acusyposaq.gq
asepyqicob.ga
bestshareland.com
l9ce1490.justinstalledpanel.com
prozipdownload.com
netgetdream.com
rapidsha.com
bdr.ubibancaa.fun
cooldatazone.com
oajdasnndkdahm.com
englishpro.online

# Reference: https://twitter.com/malware_traffic/status/1238557668475797504

marchadvertisingnetwork.com
marchadvertisingnetwork1.com
marchadvertisingnetwork2.com
marchadvertisingnetwork3.com
marchadvertisingnetwork4.com
marchadvertisingnetwork5.com
marchadvertisingnetwork6.com
marchadvertisingnetwork7.com
marchadvertisingnetwork8.com
marchadvertisingnetwork9.com
marchadvertisingnetwork10.com

# Reference: https://twitter.com/1ZRR4H/status/1240678076888965121
# Reference: https://pastebin.com/nbhJXUyM

tdvomds.pw

# Reference: https://twitter.com/Racco42/status/1242476400260476929
# Reference: https://app.any.run/tasks/8dfb9e60-3397-448e-9b2e-3170f8babc00/

dandycodes.com
hustlertest.com
sandyfotos.com

# Reference: https://twitter.com/malware_traffic/status/1243301158002855938

botig.xyz

# Reference: https://twitter.com/DynamicAnalysis/status/1243586975665455109

cdncloudtech.xyz
waitupdate.xyz

# Reference: https://twitter.com/DynamicAnalysis/status/1243594194175832065

blazeseher.xyz

# Reference: https://www.virustotal.com/gui/ip-address/47.91.88.100/relations

artiealtiery.xyz
lottiebailony.xyz
pxdgcvnsb.xyz
twinsors.xyz

# Reference: https://twitter.com/DynamicAnalysis/status/1244690703420215296
# Reference: https://www.virustotal.com/gui/ip-address/161.117.177.248/relations

basorkiq.host
bwambztl.xyz
emmnebuc.xyz
ethelenecrace.xyz
hxzfvomd.buzz
merystol.xyz
orruucsl.xyz
pnxkntdl.xyz
rosannahtacey.xyz
tozcftdl.xyz
uenoeakd.site
veqejzkb.xyz
wrjmkdod.xyz

# Reference: https://app.any.run/tasks/fcce1eaf-9c8e-4f86-8516-be4429469bab/

cosomeder.pw
loacorecoder.club
pythonfinder.top

# Reference: https://twitter.com/DynamicAnalysis/status/1244712457068777479

coniglurnerer.pw
goingfurther.club

# Reference: https://twitter.com/DynamicAnalysis/status/1244726754561986562

zoraokorol.xyz

# Reference: https://twitter.com/Racco42/status/1244885376344510464
# Reference: https://twitter.com/Racco42/status/1244885377514643458

fotonums.com
greenrumba.com
hibsurf.com
nexycombats.com
peermems.com
postgringos.com
starterdatas.com
tetraslims.com

# Reference: https://twitter.com/malware_traffic/status/1244961995272658944
# Reference: https://twitter.com/malware_traffic/status/1245476991010320386
# Reference: https://app.any.run/tasks/0ba53a31-e6bf-4343-b28e-770452577622/
# Reference: https://app.any.run/tasks/bce15dd2-0b28-46b9-a0a4-0c578b0ff9f5/

105711.com
106311.com
124331.com
209711.com
restorefutureschool.com/wp-includes/customize/class-wp-customize-partial.dll

# Reference: https://twitter.com/abuse_ch/status/1245035543748018176

amberlessard.xyz
marlodubberly.xyz
paxtontranter.xyz

# Reference: https://twitter.com/DynamicAnalysis/status/1245255570816405504

cristinneese.xyz
dierdreswensson.xyz
judyantonini.xyz
raegodbold.xyz

# Reference: https://twitter.com/DynamicAnalysis/status/1245426914728316928

horatiobrotherton.xyz

# Reference: https://twitter.com/malware_traffic/status/1245474904688005121
# Reference: https://app.any.run/tasks/b2f2a7e3-7922-417f-adf4-67d7a1304eb2/
# Reference: https://www.virustotal.com/gui/url/a13cbbd9aff6991cc01e7e053248b6d7e965591c6abdf0884eb1a1c1025bec55/detection

foodsgoodforliver.com/invest_20.dll

# Reference: https://twitter.com/Racco42/status/1245642286265847815
# Reference: https://app.any.run/tasks/ebc118a2-e633-4cfc-bf66-7b9fdd6ad300/

buhismus.com
smoash.org
spensores.com
zonaa.org

# Reference: https://twitter.com/abuse_ch/status/1245770198453452801

representis.icu
representis.xyz

# Reference: https://twitter.com/DynamicAnalysis/status/1246105347074527234

amgdorie.online

# Reference: https://twitter.com/DynamicAnalysis/status/1246112440611409921

rwtkoaqe.club

# Reference: https://twitter.com/DynamicAnalysis/status/1246112441915801608

ydmfemfe.pw

# Reference: https://twitter.com/Racco42/status/1246162154790760453
# Reference: https://app.any.run/tasks/883607e6-884e-42db-bab6-0050bbbbbd87/

geost.com
klill.com
tarsilh.com

# Reference: https://twitter.com/DynamicAnalysis/status/1246553161373892608

jzfozxqe.site

# Reference: https://twitter.com/MSteve25/status/1246563825500987394
# Reference: https://pastebin.com/hvnwKAX4

axgqqajnfusmnadvpmwy.com
bqxcagrgtkqyoafqdoac.com
dksbrxlwxvvbhrlyjpng.com
dmwavhkmwavspovdtwvm.com
duxyrolqbnodiaswmyce.com
gsqpcgodicxguusvlinr.com
hjlwxvvbeijnueiymmpt.com
htfujurumqddlfrpbivj.com
jgkiohoithggulgcsyht.com
jkluognywgcscvnhtfxm.com
jsyxhoofxmvavxmhkrqn.com
jxfbqgywrtqgyiutwone.com
jxnrhqkcscmeoinifrht.com
ksbrcqibtamreysefsan.com
kudhvynnsxnynwudrcnf.com
kumbfpnlacbtumgbmcds.com
luvyfljyvxtdckqykbxw.com
mcjctcrjxnuhiikoiapd.com
mptuydssaqenxddltean.com
peifedkveokvffenjvat.com
phqhaacetpivjmhkutws.com
pnodralyaaceteviswqx.com
qrbmcgaroafhvoiwkmmy.com
rodlqbkfekwvtnoofbnd.com
saqenxvawbwvxmtednhw.com
tbqenjyadhgyppidxiap.com
urlnxnwcunlayktlnjoj.com
vlqmhrivqkdjbvcyqcii.com
wkskhnehbbfllvuqtmlx.com
xkkxwwusvpucdjdbgwry.com
xpyseiuknkwonuaotbqg.com
yybbfamaemjheuoraimf.com

# Reference: https://twitter.com/DynamicAnalysis/status/1247191438019960833

efbzfyvsb.website

# Reference: https://twitter.com/Racco42/status/1247289428214718474
# Reference: https://app.any.run/tasks/622ebec2-bba4-4de5-9484-a13732282727/

ergensu.com
knalc.com
mioniough.com
namilh.com
ronswank.com
stagolk.com

# Reference: https://twitter.com/DynamicAnalysis/status/1247590823639822337
# Reference: https://www.virustotal.com/gui/ip-address/8.208.91.105/relations

kuaxbdkvbbmivbxkrrev.com
ooygvpxrb.pw

# Reference: https://twitter.com/DynamicAnalysis/status/1247570161860837378
# Reference: https://www.virustotal.com/gui/ip-address/8.208.78.185/relations

xyajbocpggsr.site
zgpqjzwrb.pw

# Reference: https://www.virustotal.com/gui/ip-address/8.208.11.89/relations
# Reference: https://pastebin.com/CdLyBqEm

ddfspwxrb.club
fcowhcwsb.space

# Reference: https://twitter.com/macteca/status/1242456502738325510

209711.com
adsprestige.com
adsprestigecars.com
daudivk.xyz

# Reference: https://twitter.com/James_inthe_box/status/1237858749307445251

mayinakh.xyz

# Reference: https://app.any.run/tasks/2be8ba62-31ec-4882-8ae6-95ae651707b1/

leiomity.com
infinitydeveloperspes.info
unverifiedintigoosjai.info

# Reference: https://app.any.run/tasks/2be23e89-c275-4fa3-85f0-eba9017240d8/

bumblizz.com

# Reference: http://www.pwncode.io/2020/02/spam-campaign-targeting-australian.html

penaght.org
pitinjest.org

# Reference: https://twitter.com/0xE9FBFFFFFF/status/1218146171660701697

ifjedssofllvcr.com
isfjiaaodwsoi.com
mslfiedjssfdes.com
sifeiwdjiesde.com
sldeodjiweiswi.com

# Reference: https://twitter.com/DynamicAnalysis/status/1247916027901628416

http://95.181.152.77
assemble.sg
cworld.top
hwbblyyrb.pw

# Reference: https://twitter.com/Racco42/status/1248226681116123136

mioniough.com
ergensu.com
purots.com
lipurf.com
vacontd.com
zelacarths.com

# Reference: https://twitter.com/DynamicAnalysis/status/1248655950124220416

http://45.138.72.217
giaytore.com/wp-content/themes/calliope/wp-front.php
gdchub.com//wp-content/themes/chihua/wp-front.php

# Reference: https://isc.sans.edu/forums/diary/German+malspam+pushes+ZLoader+malware/25996/
# Reference: https://otx.alienvault.com/pulse/5e8e33f25e325c8269192e07

ergensu.com
mioniough.com
namilh.com
ronswank.com
knalc.com
stagolk.com

# Reference: https://twitter.com/DynamicAnalysis/status/1249725300239413249

free-lans.online/wp/wp-content/themes/calliope/wp_data.php
grundschule-manderbach.de/wp-content/themes/calliope/wp_data.php

# Reference: https://twitter.com/DynamicAnalysis/status/1249738656442724353

fflxcsbtb.pw
nncpsedsb.host

# Reference: https://twitter.com/reecdeep/status/1249999309296320514

braeswoodfarmersmarket.com/wp-smart.php
kacper-formela.pl/wp-smart.php

# Reference: https://twitter.com/executemalware/status/1250091162083393537

caude368.com/wp-content/themes/calliope/wp_data.php
caudebachthu.com/wp-content/themes/calliope/wp_data.php

# Reference: https://twitter.com/Racco42/status/1250146778915184658
# Reference: https://app.any.run/tasks/0ad9a5fe-1cf0-49aa-90ce-e52762ee0bbd/

vacontd.com
zelacarths.com
bluslias.com
adandore.com
ficutept.com
veckeard.com

# Reference: https://twitter.com/DynamicAnalysis/status/1250443051505418241
# Reference: https://pastebin.com/FMEMAUbb

tfkmcgyadnbkwcfbtgpw.com
thqtsaqvmxlvvirchvrm.com
kotgpvsfmhfeleaqjmyp.com
hltywgksxtkgjpmgtjok.com
xdxpfsnelncuggoupcmv.com
ookshkrevododxisotou.com
bviybjknmhfcfrmgcynk.com
gphwvuomaupnmslpukki.com
uoskjsoivaaihjtwuhol.com
itsqvitrywxkaafbqpfc.com
ukknaicxmqmpifohutqx.com
ptdvmmduuuuslotigvci.com
cxmqjnajikgpvjxbfyci.com
wxbcscxmfohckirnqyqi.com
hqnouijvybevxarlnsne.com
sjmyjgjbymeimwockdmx.com
gkqqrknephekkvtasmjs.com
qfuojbylxjtplacqamgo.com
jgempwmqbakubyskbcjh.com
yxhnhwfytcxeockdmnlg.com
rjevoqpcmkbdeseuqopx.com
hubyksxtypsiebxoephw.com
vawmuwepsdtkiabjdqfu.com
imhqnoumkberfdcnldrg.com
asxtasnhawsgjeggkocb.com
kbbnpkujhlvddvfciwwb.com
dndvvxlmxaecsaqvjstp.com
xutovrdrmkehhnjuxxfa.com
smdiyjvdaoikuutdfapu.com
uuusoowkxghertmohjro.com
rdufjiplkkwjwuqopxoe.com
vjuwwbdaoiavffhjqbqm.com

# Reference: https://twitter.com/DynamicAnalysis/status/1250461394115362818

http://45.138.72.228
adrianjohnreviews.com/wp//wp-content/themes/calliope/wp-front.php
ambicare.misuperweb.es/wp-content/themes/calliope/wp-front.php

# Reference: https://twitter.com/DynamicAnalysis/status/1250474339704725505
# Reference: https://app.any.run/tasks/703d4ce4-4e99-43cb-bde0-9b37a6950bf3/

ltuywjafbt.icu
nurgsozebt.pw

# Reference: https://twitter.com/DynamicAnalysis/status/1250811123517067265

pqayjeenbbt.icu
tepbfiafbtt.pw
gxieahdgreifujrocxgg.com
lcefclurxxmkjchqfbkr.com
mifkudjueyugefbhnuao.com
chwwnmnkaljgkcvwavaw.com
iafkjgpqxvivqvlrxhbe.com
ukuecptwinsqenjawygj.com
vdukuesfsaqcogusvlvw.com
sakpisjgeyenxdedqktc.com
xqmyoogaxmvyuuhfilqm.com
hrivqkffkathnpvrjpng.com
shwpleanyjftceyamboo.com
wnjvlcedqktcxqmymkha.com
ometlymgjxnrhloygtts.com
tjpvpfpaqvatvgghmpng.com
shwplegjkccbkqniytvn.com
jpiqhjmeilalallibqgg.com
wnjvlraocxggusvlfesa.com
alalallibqggwnjvlrjh.com
ilwfwfwowiqqmksnnolc.com
bxeyenxdedqktcxqmyxh.com
beuyxqmkhadrduogueyx.com
mtacqjjhilwdurxxkugb.com
vdlwisawlnxduymklidi.com
dgdujngmwhrwyjduxyru.com
ubahlcbhugevudeypbiv.com
xmnbhaafustskowogxie.com
ifedwtewnuxklymveifk.com
uuorthyrroddoiwypmfg.com
jjqusiihmkajxjvfcuek.com
ajjelymkjcsluwqxnwcb.com
ahwpwhrwyjjsaqpkbxev.com
umnkjcsnyoafqdmgulfx.com

# Reference: https://twitter.com/DynamicAnalysis/status/1250816870787227655

experiza.com.br/wp-includes/js/gritg.php
reneixer.org/wp/wp-content/themes/calliope/wp_data.php
semplyusya.ru/wp-content/themes/calliope/wp_data.php

# Reference: https://twitter.com/executemalware/status/1250807797857628160

saidulhussen.com/wp-content/themes/calliope/wp-front.php
sarkarjewells.com/wp-content/themes/calliope/wp-front.php

# Reference: https://twitter.com/DynamicAnalysis/status/1251163062628831239

http://95.181.172.99
rksinha.com/wp-content/themes/calliope/wp-front.php
salamdrug.com/wp-content/themes/calliope/wp-front.php

# Reference: https://twitter.com/DynamicAnalysis/status/1251164977832001536

q8dl3.com/wp-content/themes/calliope/wp_data.php
sarkarjewells.com/wp-content/themes/calliope/wp_data.php
groundhogday2020.com/wp-includes/blocks/gumjf.php

# Reference: https://twitter.com/DynamicAnalysis/status/1251164979186761728
# Reference: https://pastebin.com/k9jpj5xc

ajvwdjtebb.pw
lgepubbf.icu
jlcusnqhdwceneaqogsp.com
ifasotqhtqkwlchqymcg.com
srigxnfqgpvxsdgwhwvn.com
pjiklbggolkygstlhjpm.com
wdvybuaunwbahdpennvh.com
mldfverghyfjljaxabgw.com
ykncwpdttjlxstjftoid.com
peprcmfsyehxwqenebrq.com
twunwdtidytinvqbspux.com
xswyhtyewpqekodkiiqe.com
vcckggkylqsgqkwlbgcw.com
ydxogbkwprdimlmdhoiv.com
litqmbfvioyadihmpvly.com
djsvdmyisdrdrnolitdb.com
akgslsamgxyokstpiqbe.com
xkxjtbtqxhrafwlwkjhy.com
ltngvmmswlkpqbnxjoby.com
lotfxlikltbhxphwibnj.com
uxlbsdttbwegldfgpjdk.com
fbqxbftoidpeprcdrtgi.com
wcbkqtirfwxgqkavpmxo.com
raovqqdyubovhxkapxtu.com
spgkfvqoefsrksmidcdy.com
viomovnywflgntqxtglc.com
qqrsvmxtxcmfssohycfg.com
pjdkssohycsqmlrtwixl.com
bdppqpcajdrgtjygsmgl.com
ptjilhhknoxrsvmxrvvs.com
hdwkxqrsxmaesjtkioyq.com
wobjftotqayqtumvnyyh.com
rqgfngjnntoxebovqqfb.com
qxuidcllpugkllgcnnvo.com

# Reference: https://twitter.com/DynamicAnalysis/status/1251218013367554049
# Reference: https://app.any.run/tasks/613cde47-a250-46af-8c15-d1b8e096b625/
# Reference: https://app.any.run/tasks/57fc3cf4-7b7f-41e1-a27c-06eaad188c20/
# Reference: https://app.any.run/tasks/f8fd3b18-1aff-4398-9d75-777989358638/

http://108.62.12.98

# Reference: https://twitter.com/DynamicAnalysis/status/1252259631042301957

lakeviewbinhduong.com.vn/wp-content/themes/calliope/wp-front.php
nevefe.com/wp-content/themes/calliope/wp-front.php

# Reference: https://twitter.com/DynamicAnalysis/status/1252259632762011649

dcaiqjgnbt.icu
nmttxggtb.press
rymxiptdskhnpvbyromq.com

# Reference: https://app.any.run/tasks/d2ca7fbf-a02b-40ed-907f-9e4d3dd06565/

cmmxhurildiigqghlryq.com
fvqlkgedqjiqgapudkgq.com
fyratyubvflktyyjiqgq.com
iawfqecrwohcxnhwtofa.com
nlbmfsyplohyaicmxhum.com
nmqsmbiabjdnuushksas.com
ojnxjgfjlftfkkuxxiqd.com
pwkqhdgytsshkoibaake.com
snnmnkxdhflwgthqismb.com
wmwifbajxxbcxmucxmlc.com

# Reference: https://twitter.com/DynamicAnalysis/status/1252259631042301957

http://176.96.238.22

# Reference: https://pastebin.com/iRHL4GWi

evdjomtwobiavfmljisx.com
rcksrimcpjftiapuboev.com
ortbeulgcdsoaixsccqa.com
gkpxrwfnwsnnntiosuke.com
utkjtbnnntioseutkjtd.com
vkqkgabhhusseolewjhp.com
rymxiptdskhnpvbyromq.com
bndgxvofnwouhtwcbnea.com
nbeylnmbypoiiwxmhlrt.com
aprksbosaqqnugkkxwwu.com
cdjionvneqetyxstwkoj.com
lcvxabahjpwkjitxtmcd.com
jdbsjdkmhkppigbmttfp.com
arwkisndarssjdkmhkpp.com
igbmtkobjpkdwrlkfwqw.com
uningssimhvotltbdsws.com
rqcnhmdnfrpeebiohvhn.com
xnwcundtxtbtsixssddv.com
sjarfhvphsxylbdsiplu.com
vpjauysexuqtktdpjqws.com
mliesawlsrqytfhnhmtw.com
omobgtrshndsvqnyntjq.com
jwgpqwueyuuhfinscsmo.com
aimfpniwpwqkmfdlolbd.com
eyqecunqtobjldxblfee.com
biivkbkluauuhutuxefv.com
dwhwdnumdhdvehbrxlln.com
fuctcoxsokefetkmimcm.com
vicudrlwqpxbkdbmcdsb.com
oewjhvbiivvjpvfvuvka.com
iyhkxnxvdgxhloxrigfg.com
lmiledpbsudhfpnuaoch.com

# Reference: https://twitter.com/Racco42/status/1252365091204247556
# Reference: https://app.any.run/tasks/e1a9d05d-f499-4839-b457-4e9cede501c8/

baatiot.com
lonehee.com
maremeo.com
soceneo.com
spardanos.com
surgued.com
tremood.com
welefus.com

# Reference: https://twitter.com/reecdeep/status/1252604177852833794

teachertoh.com/wp-content/themes/calliope/wp-front.php
topspeedfitness.com.my/blog/wp-content/themes/calliope/wp-front.php

# Reference: https://twitter.com/James_inthe_box/status/1252604516991504384

hcmbqvcntd.pw

# Reference: https://twitter.com/p5yb34m/status/1252648679543934976

iawfqecrwohcxnhwtofa.com
pwkqhdgytsshkoibaake.com
snnmnkxdhflwgthqismb.com
wmwifbajxxbcxmucxmlc.com
yompmepuagwsmxeecqtk.com

# Reference: https://twitter.com/executemalware/status/1252616122488283136

teachertoh.com/wp-content/themes/calliope/wp-front.php
topspeedfitness.com.my/blog/wp-content/themes/calliope/wp-front.php

# Reference: https://twitter.com/executemalware/status/1252728411912572928
# Reference: https://pastebin.com/jia92L9d

http://195.2.93.15
maesimplesmente.com/wp-admin/includes/wp-smart.php
glsunzdf.casa
xaprgnve.icu
ualdfdjoevspjtpilbtb.com

# Reference: https://bazaar.abuse.ch/sample/d63088780e90eda6a7ce286d6b190614f0ea6f1f55c6e6e9d6a30260eb84d03c

gveejlsffxmfjlswjmfm.com

# Reference: https://twitter.com/Racco42/status/1253643478392856576
# Reference: https://app.any.run/tasks/18cc20c7-d61d-4531-9948-91572d81f631/

coult.org
rhald.org
rutom.org
tilyn.org

# Reference: https://twitter.com/DynamicAnalysis/status/1250043720512274434

xltoogmecoulgkloygal.com

# Reference: https://twitter.com/Racco42/status/1255409164651761667

chorbly.org
kodray.org
retualeigh.com

# Reference: https://twitter.com/DynamicAnalysis/status/1257369145177526272

shetkarimarket.com/wp-snapshots/tmp/wp-smart.php
theislandmen.com/wp-smart.php
visadvise.com/cgi-bin/s2dhfwe.php

# Reference: https://twitter.com/DynamicAnalysis/status/1257376602394066944

rswtgmhf.pw
fwgdhdln.icu
pwnuuhiikmjmkrjeyuxr.com

# Reference: https://twitter.com/malware_traffic/status/1257438530357415937

april30domain.com
april30x3domain.com
aftohysmkffhjpjrljee.com
bblfjlftfhghincgyqke.com
bblftofqpxnkomjjvyyf.com
bstpepygxuywdfdukacj.com
cfrmmlirggjkpinueaon.com
cjfpbllwcexqpxnkbcxm.com
covjpgxudajxbotxvcwe.com
cpuinvhqkucymkjsklhx.com
dajxbfyxgvsjmibctyys.com
dukwerbshhkpiarcvkrn.com
frdbmneytexqystpesej.com
fyhwkddxonibjdbvymbo.com
glpntvrkwerbshjmibwe.com
ijdbmnngwrmbiawfnmjw.com
irjrljealjumbfvsnahy.com
ismbklxfpxkweryqnvhq.com
jtwslqaoorsxqvbhxwhp.com
ljuvmhxwdokmwebxkcdy.com
lscxmhaylhskygxwbdnu.com
lwcckeovaldrbshhkpia.com
mjabstgnbkpntvtmygtn.com
pnkomsusnahyarsbkpli.com
pvlrmtqqbnnmacfxsddo.com
rqyoliismbiawdlgpamp.com
rtnqqwmfmajmroxiqgdh.com
tecgekmkdpwerbppskpl.com
thjmibwebdnuirjhocns.com
tperkjvyyfukdgcuhlok.com
vfcyisijtwgmxhreetmr.com
wfqakwaaixyhwtofubfm.com
xhrqdpavwwybewoicjea.com
xjtmdhcharsffefunepy.com

# Reference: https://twitter.com/reecdeep/status/1257711966401028096

ekhobrand.com

# Reference: https://twitter.com/malware_traffic/status/1257701476455059457

xn--80agatbmcgncccbd9andd6w.xn--p1ai

# Reference: https://twitter.com/DynamicAnalysis/status/1257723521385578498

exukinjyukrglrwqedto.com

# Reference: https://johannesbader.ch/blog/the-dga-of-zloader/

jgqhigsjkulmsvvhshmk.com
wapjdxlstholqwakofgi.com
aiavxvlshmkweccksfky.com
liswrfujohqsnbnohetn.com
hciqylualwcnyvajdkqq.com
pdtlshacpbacpnhcndpd.com
kdacggcctwcavdgvpbmk.com
wapwtpwciertrhkdaxrp.com
shyjgiyhyegxeqqpdtya.com
gccggcctwcerlshacpba.com
cpnhcndpdkylibtlbeco.com
bxhwpdkqdakbplfvfqwn.com
bioonshmwrbecckfcavh.com

# Reference: https://twitter.com/reecdeep/status/1258123252054077442

nevefe.com/wp-content/themes/calliope/wp_data.php
salamdrug.com/wp-content/themes/calliope/wp_data.php

# Reference: https://twitter.com/DynamicAnalysis/status/1258431523864403968

wp.regalporn.com/wp-keys.php
qmwechat.cn/wp-keys.php
mothersdryfruits.com/wp-content/uploads/2020/04/fg3rg.php

# Reference: https://twitter.com/Mesiagh/status/1258534969225277441

gsetgyknjfmfspbhhuxd.com

# Reference: https://twitter.com/bit_dam/status/1259511916076154880

lifeprimary.site/wp-keys.php
luckystatus.com/wp-keys.php

# Reference: https://www.virustotal.com/gui/ip-address/8.208.89.250/relations

hwbblyyrb.pw
kuaxbdkvbbmivbxkrrev.com

# Reference: https://twitter.com/reecdeep/status/1259841893917212674

jewellerydesigns.co.za/wp-parser.php
irfanhaber.net/wp-parser.php
luckystatus.com/wp-parser.php
lifeprimary.site/wp-parser.php

# Reference: https://twitter.com/DynamicAnalysis/status/1259884167598411776

45.147.229.254:92
munesdon.top

# Reference: https://twitter.com/DynamicAnalysis/status/1259910913617989632

mutarakis.top

# Reference: https://twitter.com/ffforward/status/1260213067507515395
# Reference: https://www.virustotal.com/gui/domain/japanjisho.info/relations

japanjisho.info/wp-keys.php

# Reference: https://app.any.run/tasks/63a9c45b-bbf2-45f4-b4a3-51e665876a9f/

gavrelets.ru/wp-keys.php

# Reference: https://twitter.com/reecdeep/status/1260246860956123136

mycoursera.in/wp-content/uploads/2020/05/wp-front.php
stoplazyconf.com/wp-front.php

# Reference: https://twitter.com/DynamicAnalysis/status/1260257851395780608

home.comegico.com.mx/wp-parser.php
hormonas.comegico.com.mx/wp-parser.php
hopime.com/wp-parser.php

# Reference: https://twitter.com/DynamicAnalysis/status/1260249869291327495

http://95.181.152.73
hopime.com/wp-content/plugins/apikey/2.dll

# Reference: https://twitter.com/DynamicAnalysis/status/1248277149053747200

braeswoodfarmersmarket.com/wp-smart.php
kacper-formela.pl/wp-smart.php
bullze.com
dcgljuzrb.pw
eoieowo.casa

# Reference: https://twitter.com/ps66uk/status/1260553896897982464

dehabadi.ir/wp-keys.php

# Reference: https://twitter.com/reecdeep/status/1260559351829454848

eleventalents.com/wp-front.php

# Reference: https://twitter.com/reecdeep/status/1260577332206678021

confirmgood.com/wp-parser.php
dehabadi.ir/wp-parser.php
dotworldtour.com/wp-parser.php
eleventalents.com/wp-parser.php

# Reference: https://pastebin.com/KeC2SswU

dehabadi.ir/wp-content/uploads/2020/05/f13r3.php

# Reference: https://twitter.com/DynamicAnalysis/status/1260960649586315264

http://45.138.72.39
almakaaseb.com/wp-content/uploads/2020/05/wp-front.php
neebank.com/wp-content/uploads/2020/05/wp-front.php

# Reference: https://twitter.com/DynamicAnalysis/status/1260960651452743680

kickapoochiefsfootball.com/wp-parser.php
appsbispo.tk/wp-parser.php
staging4.allemny.net/wp-parser.php
bondarenkopjatk.ru/wp-parser.php
euromix.com.ua/wp-parser.php
dinghaomcc.com/wp-parser.php

# Reference: https://twitter.com/reecdeep/status/1261220660958892032

esvconnects.com/wp-content/plugins/apikey/wp-front.php
kickapoochiefsfootball.com
appsbispo.tk
euromix.com.ua
dinghaomcc.com
bondarenkopjatk.ru
staging4.allemny.net

# Reference: https://twitter.com/DynamicAnalysis/status/1261317333689171971

http://176.96.238.42
http://45.138.72.39
esvconnects.com/wp-content/plugins/apikey/wp-front.php
linguy.cn/wp-content/plugins/apikey/wp-front.php
luxiyouyue.club/wp-parser.php
aapasifik.com/wp-parser.php
zylstudio.com/wp-parser.php
caodangyduochanoi1.edu.vn/wp-parser.php
butterfly-crm.solusaas.com/wp-parser.php
karkas24.site/wp-parser.php

# Reference: https://twitter.com/c3rb3ru5d3d53c/status/1262132584185761792

almakaaseb.com/wp-content/uploads/2020/05/wp-front.php
neebank.com/wp-content/uploads/2020/05/wp-front.php

# Reference: https://twitter.com/reecdeep/status/1263063406585708544

alpha.iwp-hydro.ru/wp-keys.php
dinghaomcc.com/wp-keys.php

# Reference: https://twitter.com/James_inthe_box/status/1263129864401387522

unsanrohandper.tk

# Reference: https://twitter.com/reecdeep/status/1263145785119707136

arunruntuchattcar.tk
krisithcomdebe.tk

# Reference: https://pastebin.com/qn8Y7d2Q

letssihamra.gq
puffmenscourtcomenthy.tk
thurlopetnyi.cf
blog.menusmile.com

# Reference: https://twitter.com/JayTHL/status/1263484825362747394

xm-yihao.com/wp-content/uploads/2020/05/wp-front.php
vsenling.net/wp-content/uploads/2020/05/wp-front.php

# Reference: https://twitter.com/DynamicAnalysis/status/1263670717238968320

tishina.pw
lvsenling.net/wp-content/uploads/2020/05/wp-front.php
xm-yihao.com/wp-content/uploads/2020/05/wp-front.php

# Reference: https://twitter.com/DynamicAnalysis/status/1263673958962016258

promptintegratedexpress.com/wp-keys.php
heckenritter.com/wp-keys.php
andikachandra.com/wp-keys.php
gatemovie.online/wp-keys.php

# Reference: https://twitter.com/reecdeep/status/1263831817343336450

activediscounts.club/wp-data.php
hackcheatsonline.club/wp-data.php

# Reference: https://twitter.com/DynamicAnalysis/status/1263873474562600966

9dani.com/wp-keys.php
scsanwei.cn/wp-keys.php
fanscaar.com/wp-parser.php
hecci.vn/wp-parser.php
retemrenecali.ml
busulhurdtib.ga
amunoreratid.tk

# Reference: https://www.proofpoint.com/us/blog/threat-insight/zloader-loads-again-new-zloader-variant-returns
# Reference: https://otx.alienvault.com/pulse/5ec8375aca8f622daf866b49

http://162.241.115.242
http://162.241.70.164
http://185.180.198.32
http://185.185.24.49
http://185.236.202.146
http://185.236.202.226
http://185.236.202.235
http://188.127.226.197
http://195.154.119.165
http://2.57.38.157
http://213.155.31.199
http://217.138.205.135
http://217.138.205.136
http://217.138.205.159
http://45.72.3.132
http://51.83.171.27
http://62.109.2.250
105711.com
106311.com
124331.com
209711.com
238ehs823s8h23.com
23d8s23hs89j239sj23.com
3reh8rd23js9.com
40j9f2j9sj32ssoj.com
4f394j89d3j4d89j34d.com
adandore.com/sound.php
adird.org/sound.php
adran.org/sound.php
adslsticker.world/click.php
adslstickerf.world/click.php
adslstickerf1.world/click.php
adslstickerfone.world/click.php
advokat-hodonin.info
airnaa.org/sound.php
ajvwdjtebb.pw/wp-config.php
akrisko.info
apprdlbtb.pw/wp-config.php
april30domain.com/post.php
april30x3domain.com/post.php
aquolepp.pw
aracp.org/sound.php
artiealtiery.xyz
asdmark.org
avnjila.website/stuck.php
axelerode.club/stuck.php
axelerode.host/stuck.php
baatiot.com/sound.php
baj3tu.xyz/image.php
baj3tu.xyz/thread.php
banog.org/sound.php
banssa.org/sound.php
barbeyo.xyz
basorkiq.host
bdr.ubibanca.pro/stat.php
bdr.ubibanca.xyz/stat.php
bdr.ubibancaa.fun/stat.php
bdr.ubibancaa.host/stat.php
bdr.ubibancaa.space/stat.php
bdr.ubibancaa.website/stat.php
bhajkqmd.xyz
blazeseher.xyz
bluecheese.top/erors.php
bluslias.com/sound.php
botiq.xyz
brewaz.club
brihutyk.xyz
brosmasters.com/sound.php
buhismus.com/sound.php
buhjike.host
bunap.org/sound.php
bwambztl.xyz
calife.best/erors.php
calul.org/sound.php
cersubego.com/sound.php
ch.theblissbinder.com/wp-smart.php
chorbly.org/sound.php
ciconuati.com/sound.php
cmmxhurildiigqghlryq.com/post.php
coult.org/sound.php
cristinneese.xyz
czadvokat.info
d823hrd9239sdj2.com
d9j49dj923993.com
danceeruohitslatm.de/music.php
dandycodes.com/sound.php
dasifosafjasfhasf.com
dasifosafjasfhasf.com/web
dcaiqjgnbt.icu/wp-config.php
dcgljuzrb.pw/wp-config.php
deephousesets1.de/music.php
dentatox.org/sound.php
detid.org/sound.php
dhteijwrb.host
dierdreswensson.xyz
dij49jf39fjd340d.com
disrelure.com/sound.php
djsadhsadsadjashs.pro
dksadjsahnfaskmsa.com
dolax.org/sound.php
dsdjfhd9ddksaas.pro
dsdjfhdsufudhjas.com
dsdjfhdsufudhjas.info
dsdjfhdsufudhjas.pro
dsjadjsadjsadjafsa.info
dsjdjsjdsadhasdas.com
dskdsajdsadasda.info
dskdsajdsahda.info
dskjdsadhsahjsas.info
dxdeedle.host
eirry.org/sound.php
emearibys.com/sound.php
eoieowo.casa/wp-config.php
erbscactus.at/noagate.php
ergensu.com/sound.php
etized.org/sound.php
eurodancehitslatm.de/music.php
evahs.org/sound.php
far.spargroarr.org/tv/x.php
fdsjfjdsfjdsdsjajjs.com
fdsjfjdsfjdsdsjajjs.info
fdsjfjdsfjdsjfdjsfh.com
ffclubs.net
fflxcsbtb.pw/wp-config.php
fibulu.org/sound.php
ficutept.com/sound.php
finib.org/sound.php
finuclier.com/sound.php
flopperos.org/sound.php
footmess.com/sound.php
fotonums.com/sound.php
fsakjdsafasifkajfaf.pro
fslakdasjdnsasjsj.com
fvqlkgedqjiqgapudkgq.com/post.php
fwgdhdln.icu/wp-config.php
fyratyubvflktyyjiqgq.com/post.php
gavrelets.ru/wp-parser.php
gdexordsb.icu/wp-config.php
geost.com/sound.php
gertibaeronjdkwp.site/library/topikpost.php
gilantec.org/sound.php
ginibenio.com/sound.php
giril.org/sound.php
givlonest.com/tv.php
givlonest.org/tv.php
glsunzdf.casa/wp-config.php
gorab.org/sound.php
greenrumba.com/sound.php
grimberks.com/post.php
grually.com/sound.php
gynrhcoe.pw/wp-config.php
hahwuUmkwioq.site/library/topikpost.php
happyiphoneusr.top/erors.php
heartsmobileautorepair.com/123.php
heartsmobileautorepair.com/redir.php
hesaista.org/sound.php
hibsurf.com/sound.php
hinurs.org/sound.php
home.comegico.com.mx/wp-parser.php
hopime.com/wp-parser.php
horatiobrotherton.xyz
horcinx.org/sound.php
hormonas.comegico.com.mx/wp-parser.php
hustlertest.com/sound.php
hwbblyyrb.pw/wp-config.php
iawfqecrwohcxnhwtofa.com/post.php
idisaudhasdhasdj.com
idisaudhasdhasdj.info
idjwidj8f4f5ge.com
idsakjfsanfaskj.com
ifjedssofllvcr.com
iloveyoubaby1.pro
imosey.com/sound.php
insceos.com/post.php
interurbanpu.at/noagate.php
invesund.org/sound.php
iphonexr.top/erors.php
iphonexsmax.top/erors.php
irfanhaber.net/wp-parser.php
isfjiaaodwsoi.com
islacangrejo.fun/library/topikpost.php
itachaphi.com/sound.php
j2888hennene.site/library/topikpost.php
japanjisho.info/wp-parser.php
jdafiasfjsafahhfs.com
jewellerydesigns.co.za/wp-parser.php
js823hs23js.com
jtppbycsb.space/wp-config.php
jzfozxqe.site
kasfajfsafhasfhaf.com
kdsidsiadsakfsas.com
klill.com/sound.php
knalc.com/sound.php
kodray.org/sound.php
kuaxbdkvbbmivbxkrrev.com/wp-config.php
ldhly.com/wp-parser.php
leaben.pw
lesson.musicentrance.com/wp-parser.php
lgepubbf.icu/wp-config.php
liangzizhineng.cn/wp-parser.php
lifeprimary.site/wp-parser.php
lildor.com/sound.php
lipurf.com/sound.php
lonehee.com/sound.php
loots.org/sound.php
lotio.org/sound.php
ltuywjafbt.icu/wp-config.php
luckystatus.com/wp-parser.php
march262020.best
march262020.club
march262020.com
march262020.live
march262020.network
march262020.online
march262020.site
march262020.store
march262020.tech
maremeo.com/sound.php
marlodubberly.xyz
maxbiler.dk/wp-parser.php
mayinakh.xyz/plugins.php
milsop.org/sound.php
mioniough.com/sound.php
monbrase.com/post.php
mslfiedjssfdes.com
msrtuhctb.pw/wp-config.php
naght.org/sound.php
namilh.com/sound.php
nexycombats.com/sound.php
nlbmfsyplohyaicmxhum.com/post.php
nmqsmbiabjdnuushksas.com/post.php
nmttxggtb.press/wp-config.php
nncpsedsb.host/wp-config.php
norpy.org/sound.php
nurgsozebt.pw/wp-config.php
oajdasnndkdahm.com
obeaf.com/sound.php
oidjweidj34rd3.com
ojnxjgfjlftfkkuxxiqd.com/post.php
onfovdaqqrwbvdfoqnof.com/post.php
onregcan.com/post.php
ooygvpxrb.pw
ooygvpxrb.pw/wp-config.php
pacallse.com/sound.php
pearlsolutionis.com/post.php
peermems.com/sound.php
penaght.org/sound.php
penaz.info
perditta.org/sound.php
pheia.com/sound.php
pitinjest.org/sound.php
plemopomps.com/post.php
polild.org/sound.php
postgringos.com/sound.php
postxer.com/sound.php
pqayjeenbbt.icu/wp-config.php
pressrealbox.com/post.php
purots.com/sound.php
pwkqhdgytsshkoibaake.com/post.php
qwd8s3j8s23h8s.com
rarigussa.com/sound.php
rayonch.org/sound.php
rehoterv.org/sound.php
representis.icu
representis.xyz
retualeigh.com/sound.php
rhald.org/sound.php
rizoqur.pw
ronswank.com/sound.php
roo.purcererya.org/tv/x.php
rswtgmhf.pw/wp-config.php
rubense.xyz
rutom.org/sound.php
s28hs823hs823js.com
sandyfotos.com/sound.php
sentspiels.com/sound.php
shatskie.org/sound.php
shotroot.xyz/data.php
sifeiwdjiesde.com
sigmark.org/sound.php
siloban.pw
sldeodjiweiswi.com
smeack.org/sound.php
smenard.com/sound.php
smoash.org/sound.php
snnmnkxdhflwgthqismb.com/post.php
soceneo.com/sound.php
soficatan.site
spardanos.com/sound.php
spensores.com/sound.php
stagolk.com/sound.php
starterdatas.com/sound.php
surgued.com/sound.php
tarsilh.com/sound.php
tarynak.org/sound.php
teamper.org/sound.php
tepbfiafbtt.pw/wp-config.php
teslatis.org/sound.php
tetraslims.com/sound.php
thoughtlibrary.top/library/topikpost.php
tilyn.org/sound.php
tirdo.org/sound.php
todiks.xyz
trancepartysets.de/music.php
trebitmore.org/sound.php
tremood.com/sound.php
twinsors.xyz
unwer.org/sound.php
vacontd.com/sound.php
vanagitah.com/sound.php
veckeard.com/sound.php
verobani.website
vfgthujbxd.xyz
vitog502.digital
vitog502.life
vitog502.live
vitog502.world
watae.org/sound.php
wd23h8qsh8qhs823qs.com
weako.org/sound.php
welefus.com/sound.php
wgyvjbse.pw
wlqaqife.icu/wp-config.php
wmwifbajxxbcxmucxmlc.com/post.php
wuaiwan.cn/wp-content/uploads/2020/04/123.php
xaprgnve.icu/wp-config.php
xyajbocpggsr.site
ydmfemfe.pw
zelacarths.com/sound.php
zernel.org/sound.php
zgpqjzwrb.pw
zonaa.org/sound.php
zoraokorol.xyz

# Reference: https://twitter.com/reecdeep/status/1264903148440780801
# Reference: https://app.any.run/tasks/a50c94bb-5bec-4553-8b37-3127743662b6/

baseballsokuhou.xyz
lenssunvasuncana.tk

# Reference: https://twitter.com/DynamicAnalysis/status/1264973244789952520

auto2000.club
baseballsokuhou.xyz
lenssunvasuncana.tk
margapowhipmipe.tk

# Reference: https://twitter.com/DynamicAnalysis/status/1264973246232793094

tentrhetarav.gq
slidirinisprec.ml
iedison.vip/wp-parser.php
financiallifecoaching.com/wp-parser.php
fly2go.cn/wp-parser.php
kothtdfaputusqvoolks.com

# Reference: https://twitter.com/reecdeep/status/1265652845245870085

uinames.org/wp-keys.php
ferme-imaan.com/wp-keys.php

# Reference: https://twitter.com/reecdeep/status/1265677551948742657

sigmark.org
perditta.org
dentatox.org
flopperos.org
teslatis.org

# Reference: https://twitter.com/DynamicAnalysis/status/1265715477625667584

clicmiscentfrussoting.tk

# Reference: https://twitter.com/JAMESWT_MHT/status/1265641041350328320

unesrafho.cf
cripuntisispoi.tk
sannyjewelry.ir/wp-parser.php

# Reference: https://twitter.com/luc4m/status/1267039320218755072

militanttra.at

# Reference: https://twitter.com/abuse_ch/status/1267362618936786944

urleddrug.at

# Reference: https://twitter.com/James_inthe_box/status/1268221227908227073

gegnacheckwebtiyclin.tk

# Reference: https://twitter.com/reecdeep/status/1268439324665749505

palchik.club
psychotherapyresources.org

# Reference: https://twitter.com/reecdeep/status/1268528381290786818

dambalik.org
erooneah.org
erreessi.org
pecketil.org
reeution.org
semettyx.org
twelicie.org
weisnise.org

# Reference: https://twitter.com/bit_dam/status/1268512036943790081

ogglededibl.at


# Reference: https://twitter.com/reecdeep/status/1268792547003990016

naorietenderpver.gq
placanemcourri.ga

# Reference: https://twitter.com/reecdeep/status/1268776929001443328

destgrena.at

# Reference: https://isc.sans.edu/forums/diary/Polish+malspam+pushes+ZLoader+malware/26196/
# Reference: https://otx.alienvault.com/pulse/5ed944daa31be44ecfc35eb4

tlanddissipate.at

# Reference: https://twitter.com/reecdeep/status/1268899143814205441

regerfederer.club
sharkweek2019.best

# Reference: https://twitter.com/DynamicAnalysis/status/1268945496388841473

lauwang.vn
visionmedia.vn

# Reference: https://pastebin.com/pPAp2chF

chromenerlitigub.tk
riesperetidtur.tk
cmso.med.cmu.ac.th
gahotimaskever.ga
tlenexicagopca.tk
cld.kazgau.com/wp-parser.php
janekleeb.com/wp-parser.php

# Referenc: https://app.any.run/tasks/5efe9c94-1037-4f6d-bb0d-04a890e467d7/

onallyblo.at

# Reference: https://twitter.com/reecdeep/status/1270287441669259266

sdeputizi.at

# Reference: https://twitter.com/reecdeep/status/1270336551575334913

uringvermi.at

# Reference: https://twitter.com/abuse_ch/status/1270600330506637312

erpoweredent.at

# Reference: https://twitter.com/CERT_Polska_en/status/1270623116931317760
# Reference: https://pastebin.com/raw/Ap38Fr7e
# Reference: https://pastebin.com/raw/YyYs8Her

aonagenarian.eu
destgrena.at
eetownvulgar.xyz
entspartner.at
eronisuseab.xyz
lungeflight.xyz
ogglededibl.at
retinaegras.at
tlanddissipate.at
urleddrug.at

# Reference: https://twitter.com/58_158_177_102/status/1270629663124013061

linesburline.at

# Reference: https://twitter.com/killamjr/status/1270745629774528512

speechdogfadewaji.tk

# Reference: https://twitter.com/reecdeep/status/1270756509664915456

studentsclasses.com

# Reference: https://twitter.com/DynamicAnalysis/status/1270779264988622849

caisalebebespli.ml
speechdogfadewaji.tk
mounlametling.ga
lucreteanu.de
luvletter.club

# Reference: https://twitter.com/DynamicAnalysis/status/1270779266448252928

vastmenkrirohama.gq
toolvienrewic.cf
shreejeeherbs.com/wp-parser.php
han-teknik.com/wp-parser.php

# Reference: https://twitter.com/MaelSecurity/status/1271335205463379968

oidblueprin.at

# Reference: https://twitter.com/reecdeep/status/1272530598725369862

datearoc.org
matarlod.org

# Reference: https://twitter.com/abuse_ch/status/1273651845383274496

neomithirdseman.tk
reafdersfaca.ga

# Reference: https://twitter.com/reecdeep/status/1273665225070444548

wireborg.com/wp-keys.php
zmedia.shwetech.com/wp-keys.php
datalibacbi.ml
procacardenla.ga

# Reference: https://pastebin.com/TutiU3FW

datalibacbi.ml
gueberzehngemoonde.tk
fernmasucsavidi.cf
wireborg.com/wp-parsing.php
secretele-naturii.xyz
legendcoder.com/wp-parsing.php
tiilearaphefanpa.gq
sutoverlaopers.tk

# Reference: https://twitter.com/p5yb34m/status/1274084982634377216

legendcoder.com/wp-keys.php
pullingmezcnarcmer.tk
reinin.tw/wp-keys.php
ruibrunconcallconsta.tk

# Reference: https://twitter.com/malware_traffic/status/1274088854191050752

http://205.185.125.104

# Reference: https://twitter.com/MaelSecurity/status/1274092413716496385

nlbmfsyplohyaicmxhum.com
snnmnkxdhflwgthqismb.com
softwareserviceupdater1.com
softwareserviceupdater2.com

# Reference: https://twitter.com/abuse_ch/status/1274228809315897345

tiilearaphefanpa.gq

# Reference: https://twitter.com/DynamicAnalysis/status/1274250360094289920

pullingmezcnarcmer.tk
ruibrunconcallconsta.tk

# Reference: https://pastebin.com/4P65E0tz

thebypath.com/wp-parsing.php
dramalove.su/wp-parsing.php
hongsamlinhchi.vn/wp-parsing.php
monquasuckhoe.com/wp-parsing.php
nhansamlinhchi.com.vn/wp-parsing.php

# Reference: https://twitter.com/reecdeep/status/1275085198946963457
# Reference: https://app.any.run/tasks/aa0c8899-a534-4882-930e-282b9e889320/

thepsaokhue.com
metagro.com.br/wp-keys.php
loughturnperceidrin.ml
joliroomlides.tk

# Reference: https://twitter.com/DynamicAnalysis/status/1275110199754461184

unencansatecal.ml

# Reference: https://twitter.com/James_inthe_box/status/1275112840488075264

194.36.191.113:443

# Reference: https://twitter.com/reecdeep/status/1275434331368910849
# Reference: https://app.any.run/tasks/33b0d6d2-7f70-4044-89e0-ce984c64624d/

blacalypichab.ga
esoseraz.cf
skwifi.net
stalaleninmac.tk
yqm5.cn

# Reference: https://twitter.com/reecdeep/status/1275449351372824578

magic-place.fr/wp-crunch.php
velocitii.com/wp-crunch.php
hongsamlinhchi.vn/wp-crunch.php
thepsaokhue.com/wp-parsing.php

# Reference: https://twitter.com/malware_traffic/status/1275602265575997445

snnmnkxdhflwgthqismb.com

# Reference: https://twitter.com/DynamicAnalysis/status/1275812564203638785

abdulwajed.xyz
anhthienquang.com/wp-parser.php
artnego.com.tr/wp-parser.php
babysayworld.com/wp-parser.php
bhutansyncits.com/wp-parser.php
infinitearc.com/wp-parser.php
thebypath.com/wp-parser.php
npxrqvwocrpecygjnclw.com

# Reference: https://twitter.com/abuse_ch/status/1276047071653646341

axisbasis.xyz
newhopedream.com

# Reference: https://twitter.com/H_Miser/status/1273191024798679040

abdulwajed.xyz
anbecatanketppi.tk
anhthienquang.com
autoclub2000.club
babysayworld.com
baseballsokuhou.xyz
bhutansyncits.com
lenssunvasuncana.tk

# Reference: https://twitter.com/reecdeep/status/1276506416833060864

britemanid.cf

# Reference: https://twitter.com/reecdeep/status/1277593590777163776

celvadesynola.gq

# Reference: https://twitter.com/reecdeep/status/1277618971878010880
# Reference: https://app.any.run/tasks/91c2c1e5-1c91-493a-b356-0086352a0339/
# Reference: https://app.any.run/tasks/7ba31e84-0619-430e-9d78-6581d8a0b1e1/

ceoblaws.com
pettsmickey.com
vooydvclhlqukhdvrsxe.com

# Reference: https://twitter.com/abuse_ch/status/1277627432774897665

nlbmfsyplohyaicmxhum.com
snnmnkxdhflwgthqismb.com
softwareserviceupdater1.com
softwareserviceupdater2.com

# Generic trails

/blocks/gumjf.php
/RA9cbC/tM0LVE.php
/js/gritg.php
/14gt134.php
/3YUjngR.php
/56hgfbcx.php
/87aksjt.php
/abbyupdater.php
/adfw3.php
/axick.php
/fg3rg.php
/g34gc.php
/gf3rg.php
/gravitels.php
/kjzge.php
/NlGkb4ivk.php
/noagate.php
/ph4xUMChrXId6.php
/qgg43g.php
/rqh3h51.php
/s2dhfwe.php
/tM0LVE.php
/ajt1eg4fh
/bag4hy
/deg34g
/f2f23
