不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2023/04/07
※2023/04/07 更新
マルウェア感染させると考えられるURLを検知（2023/04/07）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://62[.]84[.]97[.]90/providerPhpgeo[.]php | DCRat |
| URL | hxxp://5[.]75[.]159[.]229/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://94[.]142[.]138[.]224/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://94[.]142[.]138[.]174/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3[.]dll hxxp://94[.]142[.]138[.]174/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://94[.]142[.]138[.]174/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://94[.]142[.]138[.]174/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://94[.]142[.]138[.]224/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://5[.]75[.]159[.]229/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://94[.]142[.]138[.]224/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll hxxp://94[.]142[.]138[.]174/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://94[.]142[.]138[.]174/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll hxxp://5[.]75[.]159[.]229/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://94[.]142[.]138[.]224/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue[.]dll hxxp://94[.]142[.]138[.]224/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://94[.]142[.]138[.]224/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3[.]dll hxxp://5[.]75[.]159[.]229/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3[.]dll hxxp://94[.]142[.]138[.]224/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll hxxp://5[.]75[.]159[.]229/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140[.]dll hxxp://5[.]75[.]159[.]229/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140[.]dll hxxp://5[.]75[.]159[.]229/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3[.]dll |
RecordBreaker |
| URL | hxxp://79[.]137[.]195[.]45:8080/api/hello | Rhadamanthys |
| URL | hxxps://yorkrefrigerent[.]md/public/castr/sae[.]txt hxxps://yorkrefrigerent[.]md/public/[.]sssb/usz[.]txt hxxp://ergon[.]club/yaski/webpanel/inc/c26165277f768c[.]php |
Agent Tesla |
| URL | hxxp://179[.]43[.]175[.]187/motl/crypto[.]exe hxxp://jsw[.]co[.]id/system1/Group[.]exe |
Remcos |
| URL | hxxp://chuteu42[.]top/gate[.]php | CryptBot |
| URL | hxxp://20[.]211[.]5[.]151/XBoom-UpdateStage3[.]exe hxxp://20[.]211[.]5[.]151/XBoom-UpdateStage[.]exe |
AsyncRAT |
| URL | hxxp://20[.]211[.]5[.]151/XBoom-Update[.]exe | Venom RAT |
| URL | hxxps://106[.]53[.]109[.]148/about hxxps://81[.]71[.]77[.]164/index hxxps://81[.]71[.]10[.]192/api/x hxxps://106[.]53[.]111[.]113/index hxxps://18[.]181[.]253[.]66:1000/activity hxxps://194[.]87[.]46[.]87:4433/ptj hxxp://194[.]87[.]46[.]87/fwlink hxxp://121[.]43[.]43[.]204:9001/match hxxp://121[.]43[.]43[.]204:9003/dot[.]gif hxxp://121[.]36[.]52[.]164:8080/pixel[.]gif hxxps://43[.]136[.]81[.]234/wp06/wp-includes/po[.]php hxxps://107[.]148[.]131[.]30/match hxxp://103[.]67[.]191[.]89:8080/g[.]pixel hxxp://124[.]222[.]30[.]121:5000/activity hxxp://121[.]43[.]43[.]204:9009/load hxxps://185[.]143[.]223[.]120:444/cx hxxp://185[.]143[.]223[.]120:88/pixel hxxp://124[.]71[.]31[.]99:1111/cm hxxp://47[.]120[.]1[.]64:8888/cx hxxps://123[.]60[.]91[.]195/ga[.]js hxxps://bbc[.]cctv03[.]tk:8443/api/x hxxp://47[.]94[.]213[.]25/dpixel hxxps://0xx1[.]kaspemskyupdate[.]com/css/jquery[.]min[.]js hxxps://netupdates[.]net/read/v6[.]61/7DKM5KDKR8 hxxps://lalovetoy[.]co/en[.]html hxxp://124[.]222[.]25[.]119/jquery-3[.]3[.]1[.]min[.]js hxxp://182[.]92[.]238[.]128:8080/j[.]ad hxxp://0xx1[.]kaspemskyupdate[.]com/css/jquery[.]min[.]js hxxps://1[.]117[.]243[.]253:5555/push hxxp://95[.]214[.]27[.]59:7777/ca hxxps://206[.]189[.]245[.]2/inform/v6[.]71/LT4TRZAZTPT hxxps://42[.]193[.]108[.]137:10087/cm hxxps://120[.]55[.]160[.]6/ptj hxxps://61[.]141[.]222[.]100:11443/jscroll/board/list[.]jpg hxxp://54[.]204[.]222[.]201:999/dot[.]gif hxxp://123[.]249[.]91[.]163:526/dpixel hxxp://39[.]104[.]92[.]153:85/load hxxp://223[.]247[.]221[.]123:8888/match hxxp://198[.]12[.]74[.]39:8081/activity hxxps://104[.]244[.]79[.]172/IE9CompatViewList[.]xml hxxp://62[.]204[.]41[.]44/updates[.]rss hxxp://124[.]222[.]30[.]121:5004/updates[.]rss hxxps://34[.]143[.]224[.]74/seatalk/images/img_logo[.]html hxxp://43[.]142[.]188[.]168:8223/load hxxp://45[.]63[.]4[.]126:2345/script/src/main[.]js hxxps://114[.]116[.]120[.]37/ptj hxxp://172[.]245[.]168[.]31/ca hxxp://43[.]154[.]94[.]90:8880/api/logout hxxp://123[.]249[.]91[.]163/dpixel hxxp://124[.]221[.]113[.]201:12345/dot[.]gif hxxps://39[.]98[.]208[.]57/audiencemanager[.]js hxxps://121[.]89[.]239[.]11:1443/j[.]ad hxxps://api[.]zalrc131[.]top:8443/api/logout hxxps://38[.]105[.]168[.]110:5443/ca hxxps://43[.]139[.]71[.]151:3316/pixel[.]gif hxxp://80[.]66[.]75[.]53:52974/image/serser[.]png hxxps://43[.]139[.]190[.]82:9099/www/handle/doc hxxps://btig[.]xyz:9001/article/details |
Cobalt Strike |
| URL | hxxps://temeculatireshop[.]com/1uwog/ hxxps://centraltrucks[.]com[.]br/jexc/ hxxps://brevardbusinessguide[.]com/P4m9JdF/ hxxps://plantationlandscapingandirrigation[.]com/7EwmGoE/ hxxps://pathways4success[.]com/ZsF1aj9/ hxxps://pryhmshift[.]com/Ow2/izhawDNIJ hxxps://tomazellapresentes[.]com[.]br/ZeUvz7b/ hxxps://heraldoturismo[.]com[.]br/on3t7A/ hxxps://stealingexcellence[.]com/rVR9r/ hxxps://alzheimersdigest[.]net/ZKpva/ hxxps://t-lows[.]com/ggAJ2m/ hxxps://seicas[.]com/KvtM0/ hxxps://choicefaz[.]com[.]br/w1W2/ hxxps://antoinettegabriel[.]com/YuUE/ hxxps://qassimnews[.]com/yweNej/ hxxps://farmfutures[.]in/tlUtBc/ hxxps://medano355condominio[.]com/Tt7l/ hxxp://milleniuninformatica[.]com[.]br/Le9/ hxxps://app[.]mlc[.]uts[.]com[.]pk/it/it[.]php hxxps://artofbeing[.]gvi[.]la/eunv/eunv[.]php hxxp://welearning[.]co[.]in/tc/tc[.]php hxxps://ufirstnews[.]lk/at/at[.]php hxxps://unioncomercio[.]pe/iero/iero[.]php hxxps://wisdomvalley[.]lk/im/im[.]php hxxps://vcasecurity[.]us/tatu/tatu[.]php hxxps://tumibuys[.]africa/qsu/qsu[.]php hxxps://revamp[.]uts[.]com[.]pk/lab/lab[.]php hxxps://tanmayenterprises[.]xyz/ful/ful[.]php hxxps://ofijur[.]com[.]ar/amsl/amsl[.]php hxxps://montenegro-menu[.]me/iesi/iesi[.]php hxxps://refresh[.]rs/tseo/tseo[.]php hxxps://onlinefighttv[.]live/er/er[.]php hxxps://restaurantmurad[.]ro/de/de[.]php hxxps://superheldenkaart[.]nl/pro/pro[.]php hxxps://mnfs[.]uts[.]com[.]pk/orp/orp[.]php hxxps://nidanhospital[.]com/umo/umo[.]php hxxps://ryl[.]rs/uie/uie[.]php hxxps://reallife[.]live/otli/otli[.]php hxxps://shippertech[.]shop/use/use[.]php hxxps://nutrivital[.]pe/at/at[.]php hxxps://hotelvip[.]ro/aq/aq[.]php hxxps://ibime[.]edu[.]mx/imu/imu[.]php hxxps://exeum[.]biz/elo/elo[.]php hxxps://marketingfactory[.]me/anut/anut[.]php hxxps://fipl[.]ng/nt/nt[.]php hxxps://lipsum[.]tech/uoe/uoe[.]php hxxps://enalaz[.]digital/col/col[.]php hxxps://hasaninternational[.]net/tvld/tvld[.]php hxxps://gdmc[.]africa/ce/ce[.]php hxxps://iredi[.]org/net/net[.]php hxxps://eprinter[.]co[.]in/ft/ft[.]php hxxps://farmfutures[.]in/iqud/iqud[.]php hxxps://makspec[.]co[.]zw/cil/cil[.]php hxxps://mind[.]uts[.]com[.]pk/ea/ea[.]php hxxps://felix-bergner[.]com/oot/oot[.]php hxxps://kammiesstore[.]co[.]uk/epu/epu[.]php hxxps://appsradios[.]pro/muu/muu[.]php hxxps://bexpress[.]shop/aeiq/aeiq[.]php hxxps://adwlegal[.]co[.]in/ocfo/ocfo[.]php hxxps://appbackup[.]uts[.]com[.]pk/gt/gt[.]php hxxps://capri[.]uts[.]com[.]pk/aq/aq[.]php hxxps://alafia-group[.]online/iit/iit[.]php hxxps://cherryb[.]lk/tntm/tntm[.]php hxxp://tbs[.]ac[.]tz/os/os[.]php hxxps://19dm82[.]info/mloa/mloa[.]php hxxps://datamax[.]ng/et/et[.]php hxxps://changme[.]co/odit/odit[.]php hxxps://beyondsol[.]ca/to/to[.]php hxxps://4dev[.]best/uiaq/uiaq[.]php hxxp://testing[.]uts[.]com[.]pk/tivs/tivs[.]php hxxps://capri2[.]uts[.]com[.]pk/ido/ido[.]php hxxp://sarswatisansthan[.]com/ep/ep[.]php hxxp://juncalnet[.]com[.]ar/ee/ee[.]php hxxp://mediaking[.]pk/tsiu/tsiu[.]php hxxp://dlight[.]co[.]ke/imto/imto[.]php hxxp://casacerveza[.]co[.]za/dpra/dpra[.]php hxxp://kikkb[.]si/mob/mob[.]php hxxp://bdcjhelum[.]online/niam/niam[.]php hxxp://iteck[.]cl/exim/exim[.]php hxxp://leadermate[.]in/io/io[.]php hxxp://mbgrouprealty[.]in/rr/rr[.]php hxxps://moodle[.]ust[.]md/sid/sid[.]php hxxps://jmgva[.]gvi[.]archi/enlo/enlo[.]php hxxps://piazzagrande[.]info/qei/qei[.]php hxxps://pay9[.]xyz/rdl/rdl[.]php hxxps://manueldalzon[.]cl/uere/uere[.]php hxxps://library[.]rtu[.]ac[.]rw/rn/rn[.]php hxxps://smartpersia[.]ir/tsa/tsa[.]php hxxps://naturefood[.]pk/od/od[.]php hxxps://maakeloans[.]co[.]za/ia/ia[.]php hxxps://penaloza[.]mx/ui/ui[.]php hxxps://sisgnuino[.]pe/lua/lua[.]php hxxps://studyseo[.]io/uq/uq[.]php hxxps://rakometzasekoedete[.]mk/pd/pd[.]php hxxps://vps[.]uoz[.]edu[.]krd/pd/pd[.]php hxxps://hobigacorku[.]xyz/esr/esr[.]php hxxps://sidus[.]lk/llen/llen[.]php hxxps://jovendeisapre[.]cl/ap/ap[.]php hxxps://ububelememorial[.]co[.]za/mh/mh[.]php hxxps://hiletask[.]rw/nl/nl[.]php hxxps://tgmweb[.]ir/ma/ma[.]php hxxps://lamingthomson[.]hu/eeae/eeae[.]php hxxps://expertadr[.]ro/qi/qi[.]php hxxps://mynhaka[.]co[.]zw/ds/ds[.]php hxxps://propiedadesventura[.]cl/isnl/isnl[.]php hxxps://injazco[.]com/mi/mi[.]php hxxps://oliv[.]tw/ep/ep[.]php hxxps://syntexcommunications[.]com/tnce/tnce[.]php hxxps://mtdecor[.]in/roi/roi[.]php hxxps://keylights[.]in/eos/eos[.]php hxxps://rosatifragrances[.]co[.]zw/ei/ei[.]php hxxps://shervinbrs[.]ir/emcu/emcu[.]php hxxps://inetcomputers[.]ca/lo/lo[.]php hxxps://nvl[.]uts[.]com[.]pk/iol/iol[.]php hxxps://hphc[.]org[.]in/osla/osla[.]php hxxps://topnotchgroup[.]pk/to/to[.]php hxxps://picenum[.]eu/ar/ar[.]php hxxps://keewaycolombia[.]co/ae/ae[.]php hxxps://trimir[.]in/teq/teq[.]php hxxps://spaceaction[.]info/enr/enr[.]php hxxps://futuractiontraders[.]com/igcq/igcq[.]php hxxps://energomonting[.]mk/ra/ra[.]php hxxps://nca[.]edu[.]sa/tqiu/tqiu[.]php hxxps://registrocolegiados[.]cl/dmm/dmm[.]php hxxps://sjgarden[.]pk/ti/ti[.]php hxxps://iesanjosedesaco[.]edu[.]co/em/em[.]php hxxps://onsiteprojects[.]eu/uet/uet[.]php hxxps://srggroup[.]in/utra/utra[.]php hxxps://t1maesai[.]ac[.]th/mdm/mdm[.]php hxxps://school20[.]edu[.]mn/aee/aee[.]php hxxps://espp[.]my[.]id/rn/rn[.]php hxxps://intangibleheritage[.]eu/odom/odom[.]php hxxps://greenafricaguide[.]nl/pvv/pvv[.]php hxxps://ocrea[.]ma/aecl/aecl[.]php hxxps://imprimeya[.]mx/oes/oes[.]php hxxps://goodnewstest[.]online/nnio/nnio[.]php hxxps://gvi-demo[.]gvi[.]la/uai/uai[.]php hxxps://gastranaut[.]az/uem/uem[.]php hxxps://smansatangse[.]sch[.]id/umot/umot[.]php hxxps://softnaija[.]ng/iis/iis[.]php hxxps://trickjisca[.]vip/uc/uc[.]php hxxps://maya-bay[.]gr/oi/oi[.]php hxxps://maghribioriginal[.]ma/osq/osq[.]php hxxps://opencartturkey[.]com/itiu/itiu[.]php hxxps://mythstorecsgo[.]ir/rc/rc[.]php hxxps://yoloenvio[.]mx/se/se[.]php hxxps://intranet[.]upp[.]edu[.]pe/uoa/uoa[.]php hxxps://pluma[.]uma[.]edu[.]ve/atl/atl[.]php hxxps://pdfplan[.]cl/irna/irna[.]php hxxps://siscovitalie[.]co[.]zw/tsm/tsm[.]php hxxps://homiez[.]rw/iemo/iemo[.]php hxxps://kcenterprises[.]ind[.]in/eaip/eaip[.]php hxxps://zetafruit[.]cl/upi/upi[.]php hxxps://gynaeonline[.]com/spo/spo[.]php hxxps://maxwhere[.]us/mae/mae[.]php hxxps://penz-forras[.]hu/ets/ets[.]php hxxps://iphonewalay[.]pk/tiuq/tiuq[.]php hxxps://sunandmoonventures[.]co[.]ke/nfd/nfd[.]php hxxps://somos[.]gvi[.]la/uh/uh[.]php hxxps://trustworthyhomeservices[.]in/pn/pn[.]php hxxps://prayerhub[.]online/rod/rod[.]php hxxps://novaoficina[.]pt/no/no[.]php hxxps://tavacudetoate[.]ro/qa/qa[.]php hxxps://profesor[.]uma[.]edu[.]ve/ssue/ssue[.]php hxxps://ustf[.]ae/ui/ui[.]php hxxps://speednetispbd[.]com/ir/ir[.]php hxxps://tapcard[.]ma/immn/immn[.]php hxxps://rbahhcpanel[.]in/nlt/nlt[.]php hxxps://rakib[.]live/ris/ris[.]php hxxps://intangibleculturalheritage[.]eu/aeda/aeda[.]php hxxps://itguy[.]live/di/di[.]php hxxps://maclyon[.]cl/orim/orim[.]php hxxps://worthlandschool[.]online/tt/tt[.]php hxxps://viralebu[.]com/ate/ate[.]php hxxps://gladtidingsapihub[.]com/qu/qu[.]php hxxps://ouranos[.]cm/ouib/ouib[.]php hxxps://fotodyduch[.]pl/ol/ol[.]php hxxps://grupociv[.]com/rerl/rerl[.]php hxxps://sylvielydiasekinger[.]pro/ru/ru[.]php hxxps://hercules[.]biz/aam/aam[.]php hxxps://payafter[.]online/uci/uci[.]php hxxps://serveur[.]today/mrpe/mrpe[.]php hxxps://xfone[.]xyz/ub/ub[.]php hxxps://rar[.]ust[.]md/is/is[.]php hxxps://pfc[.]ps/or/or[.]php hxxps://naserrestaurant[.]ro/ue/ue[.]php hxxps://radio[.]uma[.]edu[.]ve/seut/seut[.]php hxxps://retrokicks[.]store/uo/uo[.]php hxxps://jalgaonmission[.]co[.]in/ieea/ieea[.]php hxxps://extension[.]uma[.]edu[.]ve/el/el[.]php hxxps://tracevtech[.]com[.]ng/lps/lps[.]php hxxps://quicklive[.]us/tca/tca[.]php hxxps://laotrafm[.]com/uuo/uuo[.]php hxxps://tours[.]lk/uq/uq[.]php hxxps://wilde[.]cl/iep/iep[.]php hxxps://peteazy[.]in/oal/oal[.]php hxxps://freshdata[.]website/dutn/dutn[.]php hxxps://insideedge[.]xyz/ducr/ducr[.]php hxxps://prospectrealty[.]pk/to/to[.]php hxxps://kohademo[.]uma[.]edu[.]ve/ldep/ldep[.]php hxxps://elisha[.]lk/muau/muau[.]php hxxps://securitydeals[.]us/tua/tua[.]php hxxps://sickfishmixnft[.]io/uuet/uuet[.]php hxxps://paymax[.]asia/tt/tt[.]php hxxps://spidi[.]co[.]tz/mreo/mreo[.]php hxxps://twixconsult[.]ug/vs/vs[.]php hxxps://tsyl[.]in/ns/ns[.]php hxxps://webifie[.]top/amun/amun[.]php hxxps://revistas[.]upp[.]edu[.]pe/nn/nn[.]php hxxps://overtechent[.]co[.]ke/aut/aut[.]php hxxps://myappsdemo[.]online/po/po[.]php hxxps://rexon[.]digital/isee/isee[.]php hxxps://ouranos[.]africa/ef/ef[.]php hxxps://iepalmardecandelaria[.]edu[.]co/ual/ual[.]php hxxps://selectbrands[.]in/iigs/iigs[.]php hxxps://yellylawluvy[.]me/ou/ou[.]php hxxps://popeholding[.]mk/scdq/scdq[.]php hxxps://jarsofclayng[.]online/lr/lr[.]php hxxps://newsstack[.]live/oar/oar[.]php hxxps://mindfulnessteachers[.]hk/ml/ml[.]php hxxps://prisacamoldova[.]ro/rc/rc[.]php hxxps://mtgl[.]co[.]th/btd/btd[.]php hxxps://robhubs[.]pro/mmou/mmou[.]php hxxps://partners-int[.]us/at/at[.]php hxxps://rcnapp[.]one/ti/ti[.]php hxxps://preciousit[.]in/dein/dein[.]php hxxps://royalqcoin[.]finance/ms/ms[.]php hxxps://votrevue[.]ma/aqe/aqe[.]php hxxps://msacc[.]af/sc/sc[.]php hxxps://hotelyvillasgranvia[.]mx/im/im[.]php hxxps://ven[.]is/mlea/mlea[.]php hxxps://securebiz[.]xyz/meiq/meiq[.]php hxxps://laboratorioneomedica[.]cl/giut/giut[.]php hxxps://itax[.]ke/einm/einm[.]php hxxps://mismbu[.]sch[.]id/ete/ete[.]php hxxps://intelligentdistributors[.]in/utet/utet[.]php hxxps://pishonhelpinghands[.]ca/odt/odt[.]php hxxps://halodentisterie[.]ca/spi/spi[.]php hxxps://poianabradului[.]ro/oeoi/oeoi[.]php hxxps://outkast[.]world/uqpe/uqpe[.]php hxxps://premiumtransfer[.]rs/sr/sr[.]php hxxps://sha-d[.]co[.]il/odt/odt[.]php hxxps://kiwmart[.]in/eee/eee[.]php hxxps://slimswa[.]my[.]id/ti/ti[.]php hxxps://shotcreteamv[.]cl/sr/sr[.]php hxxps://southhillstvet[.]co[.]za/ssim/ssim[.]php hxxps://fzcueros[.]cl/ti/ti[.]php hxxps://hkpremiumtv[.]live/sana/sana[.]php hxxps://liceu[.]ust[.]md/deb/deb[.]php hxxps://nhahangdimai[.]com/eud/eud[.]php hxxps://ntmelectricals[.]co[.]zw/eim/eim[.]php hxxps://siddharthahospitals[.]in/nuao/nuao[.]php hxxps://luminetech[.]co/re/re[.]php hxxps://permatek[.]rs/iulp/iulp[.]php hxxps://rtu[.]ac[.]rw/tn/tn[.]php hxxps://ssaaq[.]ir/eset/eset[.]php hxxps://stockexchanges[.]info/tsme/tsme[.]php hxxps://phonehub[.]online/doio/doio[.]php hxxps://localsgirl[.]club/re/re[.]php hxxps://qomhobby[.]com/ec/ec[.]php hxxps://negdar[.]dd[.]sa/cdr/cdr[.]php hxxps://meeask[.]com/aip/aip[.]php hxxps://techmighty[.]studio/etm/etm[.]php hxxps://streamsday2[.]xyz/olr/olr[.]php hxxps://revista[.]ust[.]md/uvla/uvla[.]php hxxps://tawahi[.]host/ov/ov[.]php hxxps://habeebsub[.]com/oda/oda[.]php hxxps://gampa[.]co[.]in/md/md[.]php hxxps://vpnapp[.]wiki/ea/ea[.]php hxxps://lifestylesmoothie[.]store/esee/esee[.]php hxxps://vcallc[.]us/ines/ines[.]php hxxps://futureprotect[.]ltd/eq/eq[.]php hxxp://shameem[.]click/uoi/uoi[.]php hxxps://childinthesun[.]co[.]tz/eir/eir[.]php hxxps://alexia[.]ng/iaui/iaui[.]php hxxps://celloquidcapital[.]com/aloo/aloo[.]php hxxp://eyeforweb[.]info/ra/ra[.]php hxxps://ap[.]sd/teim/teim[.]php hxxps://candelailuminacion[.]cl/ca/ca[.]php hxxps://distribuidorasanbenjamin[.]cl/prn/prn[.]php hxxps://batcat[.]shop/mqda/mqda[.]php hxxps://blends[.]hu/id/id[.]php hxxps://actuarialhub[.]in/cu/cu[.]php hxxps://cedas[.]cl/erii/erii[.]php hxxps://dispecerat[.]ro/pmt/pmt[.]php hxxps://bachirmoukarzel[.]me/aun/aun[.]php hxxps://ccls-khemis[.]dz/erd/erd[.]php hxxps://azooma[.]co/aat/aat[.]php hxxps://azultv[.]ar/iom/iom[.]php hxxps://aviationworld[.]tk/nrt/nrt[.]php hxxps://bookthesalon[.]co[.]in/xtd/xtd[.]php hxxps://apollologistics[.]com[.]br/ca/ca[.]php hxxps://ajton[.]ro/valn/valn[.]php hxxp://gvm[.]am/irp/irp[.]php hxxp://yards[.]live/nutq/nutq[.]php hxxps://beedgeorai[.]in/qu/qu[.]php hxxps://dev[.]njc[.]gov[.]ng/lasi/lasi[.]php hxxps://dhlcm[.]lk/sqie/sqie[.]php hxxp://mycondominio[.]cl/dim/dim[.]php hxxps://classymob[.]ro/aet/aet[.]php hxxps://apply[.]uts[.]com[.]pk/auet/auet[.]php hxxp://metaservers[.]com[.]br/mmu/mmu[.]php hxxps://easylifeart[.]com/uugr/uugr[.]php hxxp://smsbuzzbd[.]com/seer/seer[.]php hxxps://consultaslegales[.]cl/aci/aci[.]php hxxps://audit[.]njc[.]gov[.]ng/ste/ste[.]php hxxps://azbia[.]pk/tpae/tpae[.]php hxxps://antiparoshotel[.]gr/mleb/mleb[.]php hxxps://american-eagle[.]store/naq/naq[.]php hxxps://canaryhosting[.]xyz/mll/mll[.]php hxxp://narcissus[.]co[.]rs/uot/uot[.]php hxxp://prefix[.]co[.]tz/vt/vt[.]php hxxps://denetsolutions[.]co[.]ke/td/td[.]php hxxps://easyflex[.]ng/di/di[.]php hxxps://bosspackaging[.]in/erpt/erpt[.]php hxxps://asrithadiatech[.]in/lrmd/lrmd[.]php hxxps://alumno[.]uma[.]edu[.]ve/uaqi/uaqi[.]php hxxps://bssoftech[.]in/uqte/uqte[.]php hxxps://agv[.]mk/tv/tv[.]php hxxp://valorat[.]mx/toqv/toqv[.]php hxxps://buscot[.]rw/dro/dro[.]php hxxps://contirestaurant[.]ro/tie/tie[.]php hxxps://alfredoallascrofa[.]com/iai/iai[.]php hxxps://dev[.]uma[.]edu[.]ve/uao/uao[.]php hxxps://boxtech[.]cn/upto/upto[.]php hxxps://diside[.]co/oiav/oiav[.]php hxxps://auto-inzerce[.]cz/ur/ur[.]php hxxps://avisstur[.]edu[.]pe/sdtu/sdtu[.]php hxxps://disperse[.]cl/eetu/eetu[.]php hxxps://4iptv[.]eu/tsqu/tsqu[.]php hxxps://datastatresearch[.]org/uaha/uaha[.]php hxxp://magyardecse[.]ro/ipn/ipn[.]php hxxps://aulavirtual[.]uma[.]edu[.]ve/tuul/tuul[.]php hxxps://american-eagle[.]site/am/am[.]php hxxps://battiwestzeo[.]lk/edem/edem[.]php hxxp://studiodedesign[.]ro/eu/eu[.]php hxxps://coucou[.]fun/euns/euns[.]php hxxp://professionalpal[.]in/usot/usot[.]php hxxps://anandabalika[.]lk/ed/ed[.]php hxxps://ameisen[.]lk/st/st[.]php hxxps://chromazone[.]nl/ld/ld[.]php hxxp://logictex[.]pk/ns/ns[.]php hxxps://blupointgroup[.]co[.]za/oa/oa[.]php hxxps://ammy[.]pro/vi/vi[.]php hxxps://chartercarretero[.]com/in/in[.]php hxxps://e-learning[.]rtu[.]ac[.]rw/poio/poio[.]php hxxps://demolarreal[.]site/da/da[.]php hxxp://irandji[.]ir/sbdq/sbdq[.]php hxxps://digitalservices[.]se/lssn/lssn[.]php hxxps://abcmontessori[.]co[.]in/istu/istu[.]php hxxp://posup[.]app/quma/quma[.]php hxxps://amhsd[.]co/tui/tui[.]php hxxps://conductasaludable[.]cl/iooo/iooo[.]php hxxps://blessedfx[.]academy/nu/nu[.]php hxxps://amanatechvtu[.]com[.]ng/vae/vae[.]php hxxps://africoops[.]online/oe/oe[.]php hxxps://elear[.]rtu[.]ac[.]rw/irot/irot[.]php hxxps://clinicaduodent[.]ro/pxt/pxt[.]php hxxp://lynx-group[.]ca/iba/iba[.]php hxxps://cyber7tech[.]com/eqau/eqau[.]php hxxps://agrolszakadt[.]hu/asm/asm[.]php hxxp://hirelabs[.]lk/or/or[.]php hxxps://casentlacoupe[.]quebec/oei/oei[.]php hxxp://logodesignflux[.]co/et/et[.]php hxxp://zainba[.]site/qdit/qdit[.]php hxxps://asiangateway[.]xyz/taa/taa[.]php hxxp://imtecfachadas[.]com[.]br/cdai/cdai[.]php hxxps://deltacon[.]ro/lus/lus[.]php hxxps://bellportal[.]io/ise/ise[.]php hxxps://cannabisisrael[.]shop/msdr/msdr[.]php hxxps://charmstudio[.]ro/sap/sap[.]php hxxp://lvbwb[.]go[.]tz/sm/sm[.]php hxxps://247payments[.]live/usos/usos[.]php hxxps://dainese[.]mk/ee/ee[.]php hxxps://dreamdating[.]online/iuo/iuo[.]php hxxps://aussiedigitalagency[.]com[.]au/vr/vr[.]php hxxps://demo[.]uts[.]com[.]pk/eo/eo[.]php hxxps://aarey[.]in/asa/asa[.]php hxxp://hookupday[.]us/ud/ud[.]php hxxp://rajacuan[.]online/ret/ret[.]php hxxps://abrema[.]gov[.]bi/uum/uum[.]php hxxps://dev-hameed[.]space/aut/aut[.]php hxxp://is-a1[.]ml/av/av[.]php hxxp://lacocinadefrancis[.]es/as/as[.]php hxxp://skttech[.]website/si/si[.]php hxxps://cosita[.]or[.]tz/itl/itl[.]php hxxp://prestaoptimo[.]mx/deuq/deuq[.]php hxxp://antoinegatera[.]rw/rmrp/rmrp[.]php hxxp://basenet[.]co[.]tz/lrt/lrt[.]php hxxp://adesso-trading[.]eu/rd/rd[.]php hxxp://ensjsi[.]dz/caut/caut[.]php hxxp://devsoft[.]biz/mpoe/mpoe[.]php hxxp://adverteye[.]in/hr/hr[.]php hxxp://cabletvwifibundle[.]com/iaeb/iaeb[.]php hxxp://dpc[.]edu[.]mn/dieo/dieo[.]php hxxp://beaconaudit[.]az/umu/umu[.]php hxxp://crypbitpro[.]com/sm/sm[.]php hxxp://doganlartarim[.]com/itu/itu[.]php hxxp://centro-froebel[.]edu[.]mx/luno/luno[.]php hxxp://aprr[.]in/ce/ce[.]php hxxp://121directmarketing[.]com/iea/iea[.]php hxxp://esourcemart[.]ca/xsnu/xsnu[.]php hxxps://t-lows[.]com/ggAJ2m/4koozxTgQHrZ hxxps://t-lows[.]com/ggAJ2m/fNnSwve hxxps://t-lows[.]com/ggAJ2m/Nll3mWL hxxps://t-lows[.]com/ggAJ2m/y7uT8eN5iD hxxps://tigerhoster[.]ca/taui/taui[.]php hxxps://qb365[.]biz/nneo/nneo[.]php hxxps://researchinnovation[.]mn/ioi/ioi[.]php hxxps://sindicato2tvn[.]cl/au/au[.]php hxxps://umediacreations[.]lk/et/et[.]php hxxps://shipudeyben[.]co[.]il/ou/ou[.]php hxxps://teachme[.]ust[.]md/ci/ci[.]php hxxps://wkadvocates[.]co[.]ke/eote/eote[.]php hxxps://whoisgay[.]live/ofni/ofni[.]php hxxps://sw4gabis[.]xyz/tne/tne[.]php hxxps://taso[.]or[.]tz/aqo/aqo[.]php hxxps://yourowntelecom[.]com/mc/mc[.]php hxxps://profeito[.]info/aeru/aeru[.]php hxxps://procurement[.]njc[.]gov[.]ng/ntem/ntem[.]php hxxps://topbuzz[.]lol/evl/evl[.]php hxxps://utsup[.]uts[.]com[.]pk/ids/ids[.]php hxxps://myseotools[.]io/tnc/tnc[.]php hxxps://igaz[.]ro/ot/ot[.]php hxxps://hopiavuori[.]fi/uool/uool[.]php hxxps://kapea[.]co[.]ke/ses/ses[.]php hxxps://glamsum[.]in/dt/dt[.]php hxxps://peaceofmind[.]co[.]ke/itse/itse[.]php hxxps://padwoschta[.]edu[.]ng/estc/estc[.]php hxxps://heykemisola[.]ng/mi/mi[.]php hxxps://goodnewsnigeria[.]ng/rsu/rsu[.]php hxxps://influenciadigital[.]pt/ilna/ilna[.]php hxxps://moretressessalon[.]online/npi/npi[.]php hxxps://monival[.]app/uvme/uvme[.]php hxxps://kapco[.]ca/taea/taea[.]php hxxps://greitasleidimas[.]agency/seed/seed[.]php hxxps://azarbamdelijan[.]ir/uu/uu[.]php hxxps://audreycaregiver[.]ng/ia/ia[.]php hxxps://expancio[.]us/asai/asai[.]php hxxps://elsheikh[.]co/ttee/ttee[.]php hxxps://dhaniloanservices[.]in/ecr/ecr[.]php hxxps://elearning[.]rtu[.]ac[.]rw/di/di[.]php hxxps://findventures[.]co[.]za/si/si[.]php hxxps://aula[.]uma[.]edu[.]ve/nunn/nunn[.]php hxxps://blingempire[.]pk/taut/taut[.]php hxxps://eventoletras[.]cl/aov/aov[.]php hxxps://biz9[.]xyz/to/to[.]php hxxps://earnpro[.]live/um/um[.]php hxxps://buildupskills[.]mk/dmii/dmii[.]php hxxps://balozi[.]co[.]ke/due/due[.]php hxxps://corazoncanela[.]mx/utm/utm[.]php hxxps://algadida[.]sd/ms/ms[.]php hxxp://nethub[.]co[.]tz/uioq/uioq[.]php hxxp://ajsquare[.]us/dp/dp[.]php hxxp://ccit[.]jis[.]edu[.]ps/ia/ia[.]php hxxp://lleuques[.]cl/pur/pur[.]php hxxp://opticpc[.]ca/han/han[.]php hxxp://muchibhai[.]live/mrou/mrou[.]php hxxp://revamp[.]uts[.]com[.]pk/lab/lab[.]php hxxps://actionbit[.]info/rl/rl[.]php hxxps://5ma[.]ir/is/is[.]php hxxp://onerkapi[.]com/ie/ie[.]php hxxp://solar-market[.]store/um/um[.]php hxxp://tu7[.]cl/em/em[.]php hxxp://itiswell[.]tbs[.]ac[.]tz/uia/uia[.]php hxxp://abhishekmeena[.]in/ii/ii[.]php hxxp://autoquim[.]mx/ucse/ucse[.]php hxxp://cabletv-promodeals[.]com/aauu/aauu[.]php hxxps://valampurihotel[.]com/tv/tv[.]php hxxps://gradinitapp33-timisoara[.]ro/euc/euc[.]php hxxps://hilltop[.]my/musi/musi[.]php hxxps://oam[.]org[.]mz/qpac/qpac[.]php hxxps://ffbl[.]uts[.]com[.]pk/esd/esd[.]php hxxps://firoomsishospital[.]com/blog/642ed5c9bba97[.]zip hxxp://prodimetal[.]com/blog/642ed6936d31b[.]zip hxxp://add-vetcare[.]com/blog/642ed5efe0c29[.]zip hxxp://45[.]59[.]170[.]48/vodka[.]dat hxxp://94[.]131[.]117[.]30/vodka[.]dat hxxp://206[.]53[.]48[.]21/vodka[.]dat hxxp://45[.]63[.]69[.]116/vodka[.]dat hxxp://193[.]200[.]17[.]207/vodka[.]dat hxxp://91[.]199[.]147[.]177/vodka[.]dat hxxp://firoomsishospital[.]com/blog/642ed5c9bba97[.]zip hxxp://94[.]131[.]117[.]30/9rpYkeAdQvnl[.]dat hxxp://206[.]53[.]48[.]21/CgbgpzhV[.]dat hxxp://193[.]200[.]17[.]207/D84SxHH3[.]dat hxxp://91[.]199[.]147[.]177/15k0wIeUm6[.]dat hxxp://45[.]59[.]170[.]48/ICxWIEF[.]dat hxxp://45[.]63[.]69[.]116/WJ7kfCzlRpz[.]dat hxxp://vozamour[.]com/blog/vodka[.]zip hxxp://devntch[.]com/blog/vodka[.]zip hxxps://estudiaconelo[.]com/blog/vodka[.]zip hxxps://fotografosdezaragoza[.]org/blog/vodka[.]zip hxxp://drwebantivirus[.]net/blog/vodka[.]zip hxxp://creditosbancarios[.]online/blog/vodka[.]zip hxxp://solutions-experts[.]net/blog/vodka[.]zip hxxp://albarqlab[.]com/blog/vodka[.]zip hxxp://corpojuicebar[.]com/blog/vodka[.]zip hxxps://tiendapan[.]com/blog/vodka[.]zip hxxp://boks[.]co[.]id/blog/vodka[.]zip hxxp://simamang[.]com/blog/vodka[.]zip hxxp://revivify[.]co[.]in/blog/vodka[.]zip hxxps://maulanarayalombok[.]co[.]id/blog/vodka[.]zip hxxps://campaolograssi[.]it/blog/vodka[.]zip hxxp://fadinhaempreendedora[.]com/blog/vodka[.]zip hxxp://albahloul[.]com/blog/vodka[.]zip hxxp://nasinternet[.]com/blog/vodka[.]zip hxxp://omah9[.]com/blog/vodka[.]zip hxxp://gtuc[.]ge/blog/vodka[.]zip hxxp://tanishkenclave[.]in/blog/vodka[.]zip hxxp://fkadeal[.]com/blog/vodka[.]zip hxxp://homeofficenodigital[.]com/blog/vodka[.]zip hxxp://cipavi[.]co/blog/vodka[.]zip hxxp://kovalekimoveis[.]com/blog/vodka[.]zip hxxps://tlabak[.]com/blog/vodka[.]zip hxxp://kc-egypt[.]com/blog/vodka[.]zip hxxps://nacionalni[.]rs/blog/vodka[.]zip hxxps://cre8tivetravels[.]com/blog/vodka[.]zip hxxp://baldev[.]nl/blog/vodka[.]zip hxxp://awt[.]co[.]id/blog/vodka[.]zip hxxp://campaolograssi[.]it/blog/vodka[.]zip hxxp://dwi-susanto[.]web[.]id/blog/vodka[.]zip hxxp://bkpsl[.]org/blog/vodka[.]zip hxxp://gdi[.]ge/blog/vodka[.]zip hxxp://ldsinternacional[.]com/blog/vodka[.]zip hxxp://heavenlyglades[.]com/blog/vodka[.]zip hxxp://neosystemspa[.]cl/blog/vodka[.]zip hxxp://mlvirtual[.]org/blog/vodka[.]zip hxxp://detierra[.]cl/blog/vodka[.]zip hxxp://star-stream[.]com/blog/vodka[.]zip hxxps://firoomsishospital[.]com/blog/vodka[.]zip hxxp://rojasconstrucciones[.]cl/blog/vodka[.]zip hxxp://12tkj5[.]my[.]id/blog/vodka[.]zip hxxp://coolersonline[.]ae/blog/vodka[.]zip hxxp://lucigottransportes[.]cl/blog/vodka[.]zip hxxp://add-vetcare[.]com/blog/vodka[.]zip hxxp://prodimetal[.]com/blog/vodka[.]zip hxxp://tlabak[.]com/blog/vodka[.]zip hxxp://tiendapan[.]com/blog/vodka[.]zip hxxp://maulanarayalombok[.]co[.]id/blog/vodka[.]zip hxxp://fotografosdezaragoza[.]org/blog/vodka[.]zip hxxp://estudiaconelo[.]com/blog/vodka[.]zip hxxp://nacionalni[.]rs/blog/vodka[.]zip hxxp://cre8tivetravels[.]com/blog/vodka[.]zip hxxp://firoomsishospital[.]com/blog/vodka[.]zip |
QakBot |
| URL | hxxp://45[.]88[.]66[.]207/oxza/index[.]php | Azorult |
| URL | hxxp://jsw[.]co[.]id/system1/crypt[.]exe hxxp://jsw[.]co[.]id/system1/rrrr[.]exe |
RedLine Stealer |
| URL | hxxp://integrainspections[.]ca/forum/viewtopic[.]php hxxp://stratuscomputing[.]com/forum/viewtopic[.]php hxxp://integrainspection[.]org/forum/viewtopic[.]php hxxp://integrainspections[.]co/forum/viewtopic[.]php |
Pony |
| URL | hxxp://erswuniconsharing[.]com/rest/api[.]php | Bitter RAT |
| URL | hxxp://185[.]253[.]54[.]51/fuckjewishpeople[.]ppc hxxp://185[.]253[.]54[.]51/fuckjewishpeople[.]sparc hxxp://185[.]253[.]54[.]51/fuckjewishpeople[.]arm4 hxxp://185[.]253[.]54[.]51/fuckjewishpeople[.]mpsl hxxp://185[.]253[.]54[.]51/fuckjewishpeople[.]arm6 hxxp://185[.]253[.]54[.]51/fuckjewishpeople[.]arm7 hxxp://185[.]253[.]54[.]51/fuckjewishpeople[.]arm5 hxxp://185[.]253[.]54[.]51/fuckjewishpeople[.]mips |
Bashlite |
| URL | hxxp://79[.]137[.]206[.]65/login | Hydra |
| URL | hxxp://45[.]95[.]233[.]60/976a2eda99155f48[.]php hxxp://45[.]95[.]233[.]60/c84324114e7f7b53/sqlite3[.]dll hxxp://45[.]95[.]233[.]60/c84324114e7f7b53/nss3[.]dll hxxp://45[.]95[.]233[.]60/c84324114e7f7b53/vcruntime140[.]dll hxxp://45[.]95[.]233[.]60/c84324114e7f7b53/freebl3[.]dll hxxp://45[.]95[.]233[.]60/c84324114e7f7b53/msvcp140[.]dll hxxp://45[.]95[.]233[.]60/c84324114e7f7b53/mozglue[.]dll hxxp://45[.]95[.]233[.]60/c84324114e7f7b53/softokn3[.]dll hxxp://23[.]227[.]202[.]68/0243ec92ae2268d1[.]php |
Stealc |
| URL | hxxp://139[.]144[.]16[.]247/thisisahiddendirectory/svchost[.]exe | XWorm |
| URL | hxxp://198[.]12[.]123[.]17:8902/Vre | Vjw0rm |
| URL | hxxp://154[.]221[.]19[.]94/GXS[.]exe?abc=%25d/ hxxp://154[.]221[.]19[.]94/GXS[.]exe |
Nitol |
| URL | hxxp://175[.]107[.]0[.]184:40190/Mozi[.]m | Mozi |
| URL | hxxp://111[.]173[.]117[.]71:5566/server[.]exe | YoungLotus |
