不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2024/07/02
※2024/07/02 更新
マルウェア感染させると考えられるURLを検知（2024/07/02）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://43[.]143[.]58[.]212/verchk/verchk_ hxxp://110[.]41[.]14[.]58:7931/cskaocncansodf44s65d4f[.]jpg hxxp://49[.]235[.]118[.]195/activity hxxps://43[.]153[.]222[.]28:4545/activity hxxp://185[.]22[.]152[.]167:9876/match hxxp://64[.]7[.]198[.]173/match hxxp://192[.]252[.]182[.]98:808/push hxxp://43[.]140[.]200[.]250:20000/fwlink hxxps://39[.]100[.]91[.]89/ptj hxxp://54[.]237[.]218[.]187/j[.]ad hxxp://112[.]126[.]85[.]180/g[.]pixel hxxps://81[.]71[.]18[.]114:50002/IE9CompatViewList[.]xml hxxp://60[.]204[.]217[.]11:9998/g[.]pixel hxxp://43[.]153[.]222[.]28:433/en_US/all[.]js hxxp://81[.]71[.]18[.]114:50001/cx hxxps://23[.]95[.]65[.]198/pixel[.]gif hxxp://116[.]198[.]247[.]52/match hxxp://79[.]124[.]40[.]106:82/ca hxxps://heart-direct[.]online/jquery-3[.]3[.]1[.]min[.]js hxxps://ci-wiki[.]cn:8080/js/jquery-3[.]4[.]1[.]min[.]js |
Cobalt Strike |
| URL | hxxp://000366cm[.]nyashka[.]top/phpflowergenerator[.]php hxxp://62[.]109[.]22[.]14/linux03/8/externaleternalToPhpJsrequestserverTrafficUniversaldatalife[.]php hxxp://054717cm[.]n9shteam3[.]top/TojavascriptPollCpuPublicPrivate[.]php hxxp://offsetupdater[.]top/Linepython_ProcessGamemultiwindowsgeneratordatalifedle[.]php hxxp://185[.]177[.]59[.]141/Private/asyncrequestprotect/ApiUniversal/Http1/Datalife/Linuxuploads/protect/datalifeupdatePhpLocal/Base0/linuxBigload/python/BaseSqlLine/update8/protectAsyncprivatetempTemporary[.]php |
DCRat |
| URL | hxxp://185[.]244[.]30[.]5/ehPErt123[.]bin hxxp://109[.]248[.]151[.]29/DttVKmqMztLpGMCsim17[.]bin hxxp://109[.]248[.]151[.]29/MnBzHGsyHle133[.]bin hxxps://hartac[.]co[.]za/wp-content/plugins/dac83144a70c491c9bb53bbf00eb4cc1/xt/mmd/snukingorig2[.]5[.]exe |
Agent Tesla |
| URL | hxxps://song[.]oaksfoxes[.]ltd/tid/202[.]exe | Socks5 Systemz |
| URL | hxxp://37[.]156[.]29[.]141/hidakibest[.]arm4 hxxp://37[.]156[.]29[.]141/hidakibest[.]arm5 hxxp://37[.]156[.]29[.]141/hidakibest[.]arm6 hxxp://37[.]156[.]29[.]141/hidakibest[.]mips hxxp://37[.]156[.]29[.]141/hidakibest[.]mpsl hxxp://37[.]156[.]29[.]141/hidakibest[.]ppc hxxp://37[.]156[.]29[.]141/hidakibest[.]sh hxxp://37[.]156[.]29[.]141/hidakibest[.]sparc hxxp://37[.]156[.]29[.]141/hidakibest[.]x86 |
Mirai |
| URL | hxxp://213[.]238[.]177[.]108/spoofer[.]sys hxxp://213[.]238[.]177[.]108/kdmapper[.]exe hxxp://213[.]238[.]177[.]108/log1[.]exe hxxp://213[.]238[.]177[.]108/log2[.]exe |
neshta |
| URL | hxxp://211[.]108[.]60[.]155/MpMgSvc[.]jpg hxxp://81[.]28[.]12[.]254/445[.]jpg |
YoungLotus |
| URL | hxxp://198[.]23[.]165[.]253/Photo[.]scr hxxp://94[.]156[.]67[.]161/bins/Video[.]scr hxxp://94[.]156[.]67[.]161/bins/AV[.]scr hxxp://94[.]156[.]67[.]161/bins/Photo[.]scr |
Coinminer |
| URL | hxxps://facturas[.]duratex[.]com[.]mx/Facturador_En_Linea/?id=51553&code=FlOQESFoScUbWffVACAYDoFNUWYDMXsySgIfUdeVrGsAninSUAQKj | Mekotio |
| URL | hxxp://77[.]105[.]132[.]27/vidar2806[.]exe | Vidar |
| URL | hxxp://77[.]105[.]132[.]27/lumma2806[.]exe | Lumma Stealer |
| URL | hxxp://cx5519[.]com/tmp/index[.]php hxxp://office-techs[.]biz/tmp/index[.]php hxxp://gebeus[.]ru/tmp/index[.]php hxxp://evilos[.]cc/tmp/index[.]php |
SmokeLoader |
| URL | hxxps://www[.]clinicachirurgie3[.]ro/article[.]php hxxps://www[.]colourful-decor[.]be/article[.]php |
GootLoader |
| URL | hxxp://172[.]245[.]135[.]155/S3006M/csrss[.]exe hxxp://198[.]23[.]227[.]166/xampp/md/gv[.]gv[.]gvvvvv[.]doc hxxp://198[.]23[.]227[.]166/22177/imageflowerskeeprosepictureshere[.]gif hxxp://172[.]245[.]135[.]155/xampp/hdb/g/gdfvr[.]hta hxxp://sinopecllc[.]top/plug[.]scr |
Remcos |
| URL | hxxps://evoluxcontabilidade[.]com[.]br/JULY/tEThjWJvC141[.]bin hxxps://evoluxcontabilidade[.]com[.]br/JULY/Tekstlsnings118[.]java hxxps://contemega[.]com[.]do/New/New/Reificering[.]fla hxxp://cpsbioscience[.]com/YUYJTURY1/Sodens[.]jpb hxxp://103[.]195[.]237[.]43/uPjMJXcuf244[.]bin hxxp://103[.]195[.]237[.]43/Wrongdoings193[.]pcx hxxp://185[.]222[.]58[.]113/SrkUwDSgspxlFfEyjFIJCX107[.]bin hxxp://185[.]222[.]58[.]113/bJibCYgZszSl185[.]bin hxxp://185[.]222[.]58[.]113/ubsFsaZf137[.]bin hxxp://103[.]237[.]86[.]247/PXNJpbdykTkqcuMJrGUU5[.]bin hxxp://103[.]237[.]86[.]247/Anemia[.]snp hxxp://103[.]237[.]86[.]247/Gean[.]asi hxxp://103[.]237[.]86[.]247/YckNurPLCcwPGiweiCyGTJ2[.]bin hxxp://103[.]237[.]86[.]247/JrFdfe171[.]bin hxxp://103[.]237[.]86[.]247/Carpetmaking[.]pcx hxxps://contemega[.]com[.]do/New/New/mVbkq170[.]bin hxxps://contemega[.]com[.]do/New/New/Pustene[.]lpk hxxps://contemega[.]com[.]do/Nedslagnings[.]dwp hxxps://contemega[.]com[.]do/zPwwF47[.]bin |
CloudEyE |
| URL | hxxp://92[.]249[.]48[.]29/arm5 hxxp://92[.]249[.]48[.]48/arm5 hxxp://92[.]249[.]48[.]29/arm hxxp://205[.]185[.]121[.]21/arm hxxp://94[.]156[.]79[.]13/bot[.]mips |
MooBot |
| URL | hxxp://pipp[.]seo7sry[.]com/agov/ hxxp://pipp[.]showroomilgiornodopo[.]it/agov/ hxxp://pipp[.]retromad1[.]ro/agov/ hxxp://pipp[.]laofix[.]com[.]tr/agov/ hxxp://pipp[.]nsaservices[.]com[.]br/agov/ hxxp://pipp[.]eshaqlaw[.]com/agov/ hxxp://pipp[.]japanbangladeshhospital[.]com/agov/ hxxp://pipp[.]dipankardey[.]com/agov/ hxxp://pipp[.]diasecampos[.]com[.]br/agov/ hxxp://pipp[.]dilagosburguer[.]com[.]br/agov/ hxxp://pipp[.]agauto[.]co[.]ke/agov/ hxxp://pipp[.]debellis[.]com[.]br/agov/ hxxp://panda[.]superdreadi[.]com/agov/ hxxp://panda[.]tafca[.]cl/agov/ hxxp://panda[.]lojaniq[.]com/agov/ hxxp://panda[.]sixfibras[.]com[.]br/agov/ hxxp://panda[.]laofix[.]com[.]tr/agov/ hxxp://panda[.]dilagosburguer[.]com[.]br/agov/ hxxp://panda[.]japanbangladeshhospital[.]com/agov/ hxxp://newscp[.]xpresscard[.]info/agov/ hxxp://panda[.]creativeeventsbd[.]com/agov/ hxxp://newscp[.]top2stay[.]com/agov/ hxxp://newscp[.]tracymasonmedia[.]com/agov/ hxxp://newscp[.]thirtyline[.]com[.]my/agov/ hxxp://newscp[.]srprof[.]com/agov/ hxxp://newscp[.]superanimalpet[.]com/agov/ hxxp://newscp[.]sc3bhgr7781[.]universe[.]wf/agov/ hxxp://newscp[.]slagveld[.]co[.]za/agov/ hxxp://newscp[.]sc1dsnb7288[.]universe[.]wf/agov/ hxxp://newscp[.]sc1tmtd4794[.]universe[.]wf/agov/ hxxp://newscp[.]savannah[.]sd/agov/ hxxp://newscp[.]sacs[.]ec/agov/ hxxp://newscp[.]sagarsprings[.]com/agov/ hxxp://newscp[.]roborave[.]mx/agov/ hxxp://newscp[.]romalogistics[.]com[.]pe/agov/ hxxp://newscp[.]posdata-si[.]com/agov/ hxxp://newscp[.]ranasariagroup[.]com/agov/ hxxp://newscp[.]officialrtv[.]com/agov/ hxxp://newscp[.]myindiamall[.]in/agov/ hxxp://newscp[.]nextsol[.]com[.]br/agov/ hxxp://newscp[.]laboratoriomacruzfarma[.]com/agov/ hxxp://newscp[.]machaquila[.]com/agov/ hxxp://newscp[.]junoindia[.]com/agov/ hxxp://newscp[.]kashier365[.]com/agov/ hxxp://newscp[.]inncomex[.]com[.]mx/agov/ hxxp://newscp[.]janeladedramaturgia[.]com/agov/ hxxp://newscp[.]hotelultimafrontiera[.]com/agov/ hxxp://newscp[.]hchemical[.]sd/agov/ hxxp://newscp[.]hospitaldesanluis[.]com[.]co/agov/ hxxp://newscp[.]geliankft[.]hu/agov/ hxxp://newscp[.]grupomv[.]com[.]py/agov/ hxxp://newscp[.]entreprisesdavenir[.]fr/agov/ hxxp://newscp[.]geber[.]com[.]mx/agov/ hxxp://newscp[.]dolphinmanagement[.]ro/agov/ hxxp://newscp[.]ebitan[.]com[.]bd/agov/ hxxp://newscp[.]debambu[.]es/agov/ hxxp://newscp[.]colbiomor[.]org/agov/ hxxp://newscp[.]contechprojects[.]com/agov/ hxxp://newscp[.]bariel[.]co[.]id/agov/ hxxp://newscp[.]cgsbim[.]cl/agov/ hxxp://newscp[.]area14st[.]com/agov/ hxxp://newscp[.]atiliomarola[.]com[.]ar/agov/ hxxp://newscp[.]academicindia[.]in/agov/ hxxp://newscp[.]allkemie[.]com/agov/ hxxp://newcp[.]urunstand[.]com/agov/ hxxp://newscp[.]aaptiroots[.]in/agov/ hxxp://newcp[.]termomecconsultoria[.]com[.]br/agov/ hxxp://newcp[.]thebestbodrumtemizlik[.]com/agov/ hxxp://newcp[.]sosgestion[.]com[.]co/agov/ hxxp://newcp[.]techcube[.]in/agov/ hxxp://newcp[.]smartlabor[.]it/agov/ hxxp://newcp[.]recubplast[.]com[.]co/agov/ hxxp://newcp[.]seo7sry[.]com/agov/ hxxp://newcpp[.]wychelmconnect[.]com[.]ng/agov/ hxxp://newcp[.]qadricaterers[.]com/agov/ hxxp://newcpp[.]wecarefamilydentistry[.]com/agov/ hxxp://newcpp[.]wpsuperlink[.]online/agov/ hxxp://newcpp[.]vanguardaamazonense[.]com[.]br/agov/ hxxp://newcpp[.]uns-kikaku[.]com/agov/ hxxp://newcpp[.]upvs[.]com[.]ng/agov/ hxxp://newcpp[.]themavvel[.]co[.]ke/agov/ hxxp://newcpp[.]tracymasonmedia[.]com/agov/ hxxp://newcpp[.]techtrust[.]pt/agov/ hxxp://newcpp[.]tecsoluciones[.]com[.]pe/agov/ hxxp://newcpp[.]tabledemassagepliante[.]fr/agov/ hxxp://newcpp[.]stayeasyplus[.]com/agov/ hxxp://newcpp[.]streakk[.]com[.]ng/agov/ hxxp://newcpp[.]smartzone[.]sa/agov/ hxxp://newcpp[.]spiegelenergy[.]com/agov/ hxxp://newcpp[.]scotiaperu[.]pe/agov/ hxxp://newcpp[.]seguroautoagora[.]com[.]br/agov/ hxxp://newcpp[.]saamtrek[.]co[.]za/agov/ hxxp://newcpp[.]sbtabriz[.]com/agov/ hxxp://newcpp[.]recettecuisinegastronomie[.]fr/agov/ hxxp://newcpp[.]quantum-ev[.]co/agov/ hxxp://newcpp[.]quasar[.]sa/agov/ hxxp://newcpp[.]princekushwaha[.]com[.]np/agov/ hxxp://newcpp[.]payall[.]com[.]ng/agov/ hxxp://newcpp[.]powerunits[.]ng/agov/ hxxp://newcpp[.]ontrace[.]id/agov/ hxxp://newcpp[.]park-systems[.]net/agov/ hxxp://newcpp[.]nonisec[.]com/agov/ hxxp://newcpp[.]nonisec[.]com[.]ar/agov/ hxxp://newcp[.]pnmls[.]cd/agov/ hxxp://newcpp[.]natroglobal[.]com/agov/ hxxp://newcpp[.]news[.]co[.]tz/agov/ hxxp://newcpp[.]musamwaky[.]co[.]tz/agov/ hxxp://newcpp[.]nationaltemps[.]co[.]uk/agov/ hxxp://newcpp[.]moralesalducin[.]com/agov/ hxxp://newcpp[.]movie[.]co[.]tz/agov/ hxxp://newcpp[.]moimoveis[.]com[.]br/agov/ hxxp://newcpp[.]meadvilleorthodontics[.]com/agov/ hxxp://newcpp[.]medicalmedia[.]com[.]mx/agov/ hxxp://newcpp[.]mahtokitchencare[.]com/agov/ hxxp://newcpp[.]levinesolutions[.]net/agov/ hxxp://newcpp[.]ludotenis[.]com/agov/ hxxp://newcpp[.]lacitavilla[.]com/agov/ hxxp://newcpp[.]kgcdiary[.]com/agov/ hxxp://newcpp[.]ktktech[.]my[.]id/agov/ hxxp://newcpp[.]inversionesllort[.]com/agov/ hxxp://newcpp[.]isabelaayrosa[.]adv[.]br/agov/ hxxp://newcpp[.]imcbgten4[.]org/agov/ hxxp://newcpp[.]hotel[.]co[.]tz/agov/ hxxp://newcpp[.]ilutex[.]com[.]br/agov/ hxxp://newcpp[.]gridedgenews[.]com/agov/ hxxp://newcpp[.]harmonyvillage[.]gr/agov/ hxxp://newcpp[.]fridaybd[.]com/agov/ hxxp://newcpp[.]gridedge[.]com[.]au/agov/ hxxp://newcpp[.]faybd[.]com/agov/ hxxp://newcpp[.]faforon[.]com[.]ng/agov/ hxxp://newcpp[.]fatp[.]co[.]tz/agov/ hxxp://newcpp[.]faforlife[.]com[.]ng/agov/ hxxp://newcpp[.]faforon[.]com/agov/ hxxp://newcpp[.]dungnguyenarchi[.]com/agov/ hxxp://newcpp[.]embassydevelopments[.]com/agov/ hxxp://newcpp[.]dktravel[.]com[.]ec/agov/ hxxp://newcpp[.]dsts-immigration[.]com/agov/ hxxp://newcpp[.]dilagosburguer[.]com[.]br/agov/ hxxp://newcpp[.]damaskin[.]ro/agov/ hxxp://newcpp[.]danmartin[.]ro/agov/ hxxp://newcpp[.]confidable[.]com/agov/ hxxp://newcpp[.]credencewatches[.]com/agov/ hxxp://newcpp[.]casamagdalenapublicidad[.]com[.]co/agov/ hxxp://newcpp[.]cncmorelos[.]org/agov/ hxxp://newcpp[.]billionairesestate[.]com/agov/ hxxp://newcpp[.]bocadosdeamor[.]com/agov/ hxxp://newcpp[.]banjarkode[.]com/agov/ hxxp://newcpp[.]aurespa[.]ca/agov/ hxxp://newcpp[.]balebuku[.]my[.]id/agov/ hxxp://newcpp[.]altaymediaalbania[.]org/agov/ hxxp://newcpp[.]apa[.]ba/agov/ hxxp://newcpp[.]almoajel[.]sa/agov/ hxxp://newcpp[.]afrokulchagroup[.]com/agov/ hxxp://newcpp[.]afrokulchatravel[.]co[.]za/agov/ hxxp://newcpp[.]activelifemd[.]com/agov/ hxxp://newcpp[.]afrokulcha[.]co[.]za/agov/ hxxp://newcpp[.]3dsurf[.]ir/agov/ hxxp://newcpp[.]abrakadabra[.]com[.]pe/agov/ hxxp://newcp[.]olivrodapatria[.]online/agov/ hxxp://newcpp[.]1ihost[.]com[.]br/agov/ hxxp://newcp[.]oiltanker[.]com[.]ng/agov/ hxxp://newcp[.]liderford[.]com/agov/ hxxp://newcp[.]lourencoviajante[.]pt/agov/ hxxp://newcp[.]japeto[.]ro/agov/ hxxp://newcp[.]jcgama[.]com/agov/ hxxp://newcp[.]icredes[.]com/agov/ hxxp://newcp[.]iluminate[.]com[.]mx/agov/ hxxp://newcp[.]hypercctv[.]org/agov/ hxxp://newcp[.]grid-edge[.]com[.]au/agov/ hxxp://newcp[.]gridedgenews[.]com/agov/ hxxp://newcp[.]gaziemircicekciler[.]com/agov/ hxxp://newcp[.]ghdemo[.]com[.]tr/agov/ hxxp://newcp[.]frederic-monereau[.]com/agov/ hxxp://newcp[.]dominantlegaltrans[.]com/agov/ hxxp://newcp[.]essentemizlik[.]com/agov/ hxxp://newcp[.]coliturcusco[.]com[.]pe/agov/ hxxp://newcp[.]departamentosenpueblolibre[.]com/agov/ hxxp://newcp[.]bitezeventwedding[.]com/agov/ hxxp://newcp[.]atlasfizyoterapi[.]com[.]tr/agov/ hxxp://newcp[.]aurejewelry[.]ca/agov/ hxxp://newcp[.]ankarasevkattesisat[.]com/agov/ hxxp://newcp[.]americansports[.]com/agov/ hxxp://newcp[.]ankaracilingirci[.]com/agov/ hxxp://dibbadu[.]sulmov[.]com[.]br/agov/ hxxp://dibbadu[.]trujilloserrano[.]com/agov/ hxxp://dibbadu[.]sscmcc[.]cl/agov/ hxxp://dibbadu[.]promoveazaonline[.]com/agov/ hxxp://dibbadu[.]smartfuture[.]co[.]za/agov/ hxxp://dibbadu[.]proexcon[.]com/agov/ hxxp://dibbadu[.]nextsol[.]com[.]br/agov/ hxxp://dibbadu[.]planamoveis[.]com[.]br/agov/ hxxp://dibbadu[.]myportfolio[.]com[.]co/agov/ hxxp://dibbadu[.]institutointei[.]com/agov/ hxxp://dibbadu[.]millennialstourandtravel[.]co[.]ke/agov/ hxxp://dibbadu[.]geofieldp[.]com/agov/ hxxp://dibbadu[.]dolphinmanagement[.]ro/agov/ hxxp://dibbadu[.]evergraphics[.]com/agov/ hxxp://dibbadu[.]ciptransfer[.]com/agov/ hxxp://dibbadu[.]caelectrons[.]com[.]br/agov/ hxxp://dibbadu[.]carboneralabanda[.]com[.]co/agov/ hxxp://dibbadu[.]arkaconstructores[.]com/agov/ hxxp://bp[.]worldcup[.]co[.]tz/agov/ hxxp://dibbadu[.]absoluteitbd[.]com/agov/ hxxp://bp[.]wocrimestoppers[.]org/agov/ hxxp://bp[.]wheelsofwilliamsport[.]com/agov/ hxxp://bp[.]wheelsofwilliamsport[.]net/agov/ hxxp://bp[.]wegolions[.]org/agov/ hxxp://bp[.]watertownctlions[.]org/agov/ hxxp://bp[.]trueearthchanges[.]com/agov/ hxxp://bp[.]video[.]co[.]tz/agov/ hxxp://bp[.]sygenpharma[.]com/agov/ hxxp://bp[.]tdsorsta[.]ro/agov/ hxxp://bp[.]stasy-union[.]gr/agov/ hxxp://bp[.]seo7sry[.]com/agov/ hxxp://bp[.]shivaagorealty[.]com/agov/ hxxp://bp[.]segurobligatorio[.]pro/agov/ hxxp://bp[.]saleseconomic[.]com/agov/ hxxp://bp[.]sc1jtfu9765[.]universe[.]wf/agov/ hxxp://bp[.]riscasvicosas[.]pt/agov/ hxxp://bp[.]rafikidodomahotel[.]com/agov/ hxxp://bp[.]richardobenton[.]com/agov/ hxxp://bp[.]petersparre[.]com/agov/ hxxp://bp[.]niceguyrebrands[.]xyz/agov/ hxxp://bp[.]paltouchsystems[.]net/agov/ hxxp://bp[.]news[.]co[.]tz/agov/ hxxp://bp[.]natenrjs[.]com/agov/ hxxp://bp[.]nationalbeatpoetryfoundation[.]org/agov/ hxxp://bp[.]myindiamall[.]in/agov/ hxxp://bp[.]moimoveis[.]com[.]br/agov/ hxxp://bp[.]movie[.]co[.]tz/agov/ hxxp://bp[.]mibenditoadolescente[.]com/agov/ hxxp://bp[.]marthareingold[.]com/agov/ hxxp://bp[.]mgcsw[.]gov[.]ss/agov/ hxxp://bp[.]littleleafstudio[.]co[.]uk/agov/ hxxp://bp[.]lyctechnologies[.]com/agov/ hxxp://bp[.]linenessentials[.]com/agov/ hxxp://bp[.]kidsightusa[.]org/agov/ hxxp://bp[.]killerworkdev[.]com/agov/ hxxp://bp[.]kgcdiary[.]com/agov/ hxxp://bp[.]isap-union[.]gr/agov/ hxxp://bp[.]jpxhelmet[.]com/agov/ hxxp://bp[.]innovatalks[.]com/agov/ hxxp://bp[.]fursforus[.]net/agov/ hxxp://bp[.]hotelultimafrontiera[.]com/agov/ hxxp://bp[.]fortclean[.]net/agov/ hxxp://bp[.]fatp[.]co[.]tz/agov/ hxxp://bp[.]flyingdonvstg[.]franciaim[.]net/agov/ hxxp://bp[.]emporioecuador[.]com/agov/ hxxp://bp[.]easthartfordinterfaith[.]org/agov/ hxxp://bp[.]edgenetworks[.]rs/agov/ hxxp://bp[.]dumbeg[.]com/agov/ hxxp://bp[.]davidliving[.]com/agov/ hxxp://bp[.]dieterforjudge[.]com/agov/ hxxp://bp[.]ctvidamelhor[.]com[.]br/agov/ hxxp://bp[.]celebratebloomfield[.]org/agov/ hxxp://bp[.]celloxwatches[.]com/agov/ hxxp://bp[.]car[.]co[.]tz/agov/ hxxp://bp[.]brankenattorneys[.]co[.]tz/agov/ hxxp://bp[.]cairnhillwatches[.]com/agov/ hxxp://bp[.]blogcanadiense[.]com/agov/ hxxp://bp[.]appoemn[.]org/agov/ hxxp://bp[.]bernard-bourcy[.]net/agov/ hxxp://bp[.]aminadabelago[.]com[.]br/agov/ hxxp://bp[.]afrokulchagroup[.]com/agov/ hxxp://bp[.]americansports[.]com/agov/ hxxp://bp[.]absolutairarcondicionado[.]com[.]br/agov/ hxxp://bitp[.]weltpropiedades[.]cl/agov/ hxxp://bp[.]4dpayme[.]com/agov/ hxxp://bitp[.]tilakhighfiji[.]com/agov/ hxxp://bitp[.]tiedyeromania[.]ro/agov/ hxxp://bitp[.]sviat21[.]com/agov/ hxxp://bitp[.]siupk[.]net/agov/ hxxp://bitp[.]smslogin[.]xyz/agov/ hxxp://bitp[.]raagifts[.]com/agov/ hxxp://bitp[.]quasar[.]sa/agov/ hxxp://bitp[.]quick-eg[.]com/agov/ hxxp://bitp[.]pouradhwani[.]com/agov/ hxxp://bitp[.]phrapitta[.]com/agov/ hxxp://bitp[.]pisuka[.]com/agov/ hxxp://bitp[.]ontech[.]co[.]zm/agov/ hxxp://bitp[.]nwg[.]com[.]pk/agov/ hxxp://bitp[.]olivrodapatria[.]online/agov/ hxxp://bitp[.]navihost[.]in/agov/ hxxp://bitp[.]idealindustryltd[.]com/agov/ hxxp://bitp[.]kkenterprises[.]pk/agov/ hxxp://bitp[.]htechs[.]com/agov/ hxxp://bitp[.]heavenconstruction[.]pk/agov/ hxxp://bitp[.]heavenmarketing[.]pk/agov/ hxxp://bitp[.]fromagetambourin[.]fr/agov/ hxxp://bitp[.]grantindonesia[.]com/agov/ hxxp://bitp[.]ebibote[.]com/agov/ hxxp://bitp[.]clementinasketchbook[.]com/agov/ hxxp://bitp[.]dicoar[.]com/agov/ hxxp://bitp[.]blueroselb[.]com/agov/ hxxp://bitpa[.]vendotuttonline[.]com/agov/ hxxp://bitpa[.]vissnatech[.]ir/agov/ hxxp://bitp[.]avansisgroup[.]com/agov/ hxxp://bitpa[.]tigercampcorbett[.]com/agov/ hxxp://bitpa[.]soltita[.]com/agov/ hxxp://bitpa[.]tatlibuketi[.]com/agov/ hxxp://bitpa[.]socialobserver[.]in/agov/ hxxp://bitpa[.]sarshipping[.]net/agov/ hxxp://bitpa[.]smsfi[.]com/agov/ hxxp://bitpa[.]remoteprints[.]com/agov/ hxxp://bitpa[.]professoranagida[.]online/agov/ hxxp://bitpa[.]pta-greece[.]gr/agov/ hxxp://bitpa[.]planethair[.]gr/agov/ hxxp://bitpa[.]owanbefood[.]com[.]ng/agov/ hxxp://bitpa[.]palms77hotel[.]com/agov/ hxxp://bitpa[.]newestrealty[.]com/agov/ hxxp://bitpa[.]nationaltemps[.]co[.]uk/agov/ hxxp://bitpa[.]neebs[.]edu[.]np/agov/ hxxp://bitpa[.]mydreamsltd[.]com/agov/ hxxp://bitpa[.]miogatto[.]gr/agov/ hxxp://bitpa[.]moralesalducin[.]com/agov/ hxxp://bitpa[.]mejoresconsejosvida[.]online/agov/ hxxp://bitp[.]alkareemimport[.]com/agov/ hxxp://bitpa[.]mathinmaps[.]net/agov/ hxxp://bitp[.]alan[.]my/agov/ hxxp://bitp[.]alamri-ip[.]com/agov/ hxxp://bitpa[.]innovatalks[.]com/agov/ hxxp://bitpa[.]jcaisse-dev[.]org/agov/ hxxp://bitpa[.]hostpinas[.]com/agov/ hxxp://bitpa[.]elshamel[.]online/agov/ hxxp://bitpa[.]guptavedika[.]com/agov/ hxxp://bitpa[.]eamarseba[.]com/agov/ hxxp://bitpa[.]dogfestival[.]gr/agov/ hxxp://bitpa[.]drcaraccessories[.]com/agov/ hxxp://bitpa[.]dctcbd[.]com/agov/ hxxp://bitpa[.]desipolska[.]pl/agov/ hxxp://bitpa[.]combienemetmonargent[.]info/agov/ hxxp://bitpa[.]bicoman[.]net/agov/ hxxp://bitpa[.]casamagdalenapublicidad[.]com[.]co/agov/ hxxp://bitpa[.]bghbd[.]com/agov/ hxxp://bitpa[.]beautifulbooze[.]com/agov/ hxxp://bitpa[.]bariel[.]co[.]id/agov/ hxxp://bitpa[.]athleticshub[.]co[.]uk/agov/ hxxp://bitpa[.]babajani[.]com/agov/ hxxp://bitpa[.]artemilenario[.]fr/agov/ hxxp://bitpa[.]ananyajain[.]com/agov/ |
FindPOS |
| URL | hxxp://147[.]45[.]78[.]162/a17861b9cb6f1a53[.]php hxxp://147[.]45[.]78[.]162/d82daa352ff6e06f/nss3[.]dll hxxp://147[.]45[.]78[.]162/d82daa352ff6e06f/msvcp140[.]dll hxxp://147[.]45[.]78[.]162/d82daa352ff6e06f/sqlite3[.]dll hxxp://147[.]45[.]78[.]162/d82daa352ff6e06f/mozglue[.]dll hxxp://147[.]45[.]78[.]162/d82daa352ff6e06f/softokn3[.]dll hxxp://147[.]45[.]78[.]162/d82daa352ff6e06f/freebl3[.]dll hxxp://147[.]45[.]78[.]162/d82daa352ff6e06f/vcruntime140[.]dll hxxp://77[.]91[.]77[.]80/riana/super[.]exe |
Stealc |
| URL | hxxp://defgyma[.]com/dl/buildcr[.]exe | STOP |
| URL | hxxps://beetrootculture[.]com/cdn-vs/original[.]js hxxps://propertyclosings[.]com/cdn-vs/cache[.]php hxxps://propertyclosings[.]com/cdn-vs/original[.]js hxxp://propertyclosings[.]com/cdn-vs/33per[.]php hxxps://speedchaoptimise[.]com/VldqVWYSjm0BKVt1dmTTY9NE54urFdVG3S-H6mqD4XOX hxxps://beetrootculture[.]com/cdn-vs/cache[.]php hxxp://beetrootculture[.]com/cdn-vs/33per[.]php |
FAKEUPDATES |
| URL | hxxp://198[.]46[.]178[.]137/88133/igccu[.]exe hxxp://198[.]46[.]178[.]137/xampp/mc/mck[.]kc[.]kc[.]kcckckckck[.]doc hxxp://dashboardproducts[.]info/bally/fre[.]php |
LokiBot |
| URL | hxxp://209[.]141[.]57[.]51/x86 hxxp://45[.]95[.]146[.]42/mips hxxp://45[.]95[.]146[.]42/arm hxxp://209[.]141[.]57[.]51/mips |
Bashlite |
