不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様27社 -
2023/06/22
※2023/06/22 更新
マルウェア感染させると考えられるURLを検知（2023/06/22）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://www[.]adrem-soft[.]com/vp2023[.]exe hxxps://www[.]adrem-soft[.]com/jeffilesfe[.]exe |
NetSupportManager RAT |
| URL | hxxp://103[.]131[.]57[.]119/00009/unsecapp[.]exe hxxp://194[.]180[.]48[.]59/defounderzx[.]exe hxxp://www[.]atonal[.]com[.]br/shebronzy3[.]1[.]exe |
Formbook |
| URL | hxxp://194[.]180[.]48[.]58/heath3/five/fre[.]php hxxp://45[.]81[.]39[.]192/471/DaHost[.]exe hxxp://45[.]81[.]39[.]192/rer/rererereerererererererererereerererere%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23ererererererer[.]doc hxxp://171[.]22[.]30[.]147/anonymous/five/fre[.]php |
LokiBot |
| URL | hxxp://23[.]94[.]148[.]6/FRE[.]exe hxxp://192[.]3[.]193[.]194/50/DaHostss[.]exe hxxp://194[.]180[.]48[.]58/obizx[.]exe hxxp://195[.]178[.]120[.]24/sjgczchzxcvvcxjhz[.]txt hxxp://194[.]180[.]48[.]59/chamberszx[.]exe |
Agent Tesla |
| URL | hxxp://192[.]3[.]101[.]139/300/DaHost[.]exe hxxp://192[.]3[.]101[.]139/wed/wedrwedrwedrwedrwedrwedrwedrwedrwedrwedr%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23wedrwedrwedrwedrwedr[.]doc |
SmokeLoader |
| URL | hxxp://mynsd2u[.]com/1/data64_1[.]exe hxxp://mynsd2u[.]com/1/data64_2[.]exe hxxps://www[.]nsctpl[.]com/SetUpLyla1906[.]exe hxxp://95[.]214[.]27[.]98/lend/Builddd[.]exe |
RedLine Stealer |
| URL | hxxp://ji[.]jaoaaoas11[.]com/m/ss41[.]exe | Fabookie |
| URL | hxxps://careerbeam[.]in/doc/PurchaseOrderRequestPO7367346document_file[.]7z hxxps://www[.]biopharmzpharma[.]com/staffmemo/MEMOVACATIONLIST7548100283DH4746EYHH[.]tar |
Remcos |
| URL | hxxp://139[.]9[.]243[.]130:443/sugrec hxxps://114[.]132[.]216[.]158/jquery-3[.]3[.]1[.]min[.]js hxxp://114[.]132[.]216[.]158:8080/jquery-3[.]3[.]1[.]min[.]js hxxps://106[.]15[.]107[.]182/push hxxp://203[.]189[.]7[.]212:8099/require-jquery-v1[.]js hxxp://101[.]43[.]190[.]181/news/details hxxps://101[.]43[.]190[.]181:8080/article/details hxxp://78[.]85[.]17[.]88/ca hxxp://85[.]175[.]101[.]203/ca hxxps://124[.]71[.]26[.]85/visit[.]js hxxp://106[.]75[.]232[.]107/load hxxp://43[.]139[.]146[.]60:8033/pixel[.]gif hxxps://lauracenters[.]com/design/query/9X5M3SOE0F hxxp://quasarincorporated[.]com/groupcp hxxp://vespetrolgroup[.]com:8080/ak hxxp://124[.]220[.]210[.]41:9090/push hxxps://api[.]upgrad3[.]cc/updates[.]rss hxxp://47[.]96[.]233[.]223/match hxxp://101[.]35[.]233[.]204/dpixel hxxps://quasarincorporated[.]com/template hxxp://101[.]42[.]16[.]56:8083/cx hxxp://172[.]245[.]180[.]61:11000/IE9CompatViewList[.]xml hxxp://cs[.]kingsoft365[.]top:8083/activity hxxp://103[.]149[.]200[.]79:9530/ga[.]js hxxps://101[.]35[.]233[.]204/activity hxxps://154[.]221[.]17[.]44:2080/ga[.]js hxxp://106[.]12[.]129[.]225:81/pixel[.]gif hxxp://52[.]91[.]78[.]1/viewerng/meta hxxps://47[.]100[.]244[.]166:4443/activity hxxp://43[.]139[.]114[.]134/api/3 hxxp://134[.]209[.]249[.]32/__utm[.]gif hxxps://47[.]242[.]203[.]102/en_US/all[.]js hxxp://47[.]108[.]52[.]84:9999/load hxxp://92[.]63[.]196[.]48:92/dpixel hxxp://179[.]43[.]154[.]137:445/pixel[.]gif hxxp://49[.]232[.]213[.]90:5555/IE9CompatViewList[.]xml hxxp://107[.]148[.]50[.]95:4444/ga[.]js hxxp://106[.]13[.]20[.]56/cx hxxp://3[.]110[.]85[.]218:6379/ga[.]js hxxp://54[.]234[.]158[.]24/Baked/viewtopic[.]php hxxp://116[.]196[.]68[.]29:40005/push hxxp://182[.]61[.]45[.]3:6789/wp08/wp-includes/dtcla[.]php hxxp://c2c[.]updatenews[.]me:8880/activity hxxps://152[.]89[.]198[.]29/__utm[.]gif hxxps://121[.]36[.]225[.]82/visit[.]js hxxp://quasarincorporated[.]com:1080/html hxxp://60[.]188[.]56[.]136:18080/api/3 hxxp://121[.]4[.]34[.]103/dot[.]gif hxxp://59[.]110[.]4[.]246/updates[.]rss hxxp://192[.]144[.]231[.]110/__utm[.]gif hxxp://47[.]108[.]52[.]84:5555/__utm[.]gif hxxp://179[.]43[.]154[.]137/__utm[.]gif hxxp://47[.]100[.]244[.]166:2022/match hxxp://185[.]225[.]74[.]47/activity hxxp://82[.]157[.]110[.]128:8080/activity hxxps://external[.]myazureonline[.]com/IE9CompatViewList[.]xml hxxp://47[.]242[.]238[.]41/activity hxxps://cs[.]p0dan[.]site:2053/async/ddljson hxxps://cscscscscs[.]imalloc[.]cn:58443/api/3 |
Cobalt Strike |
| URL | hxxps://linedgreen[.]org/mCGhH5yY | FAKEUPDATES |
| URL | hxxp://balkun[.]com/operazione hxxps://balkun[.]com/operazione hxxps://avas1ta[.]com/in/login/ hxxps://avas1t[.]de/in/loginq/ hxxps://duckduckgo1[.]com/search/intet/ hxxps://duckduckgo2[.]com/searfch/inteft/ hxxp://94[.]140[.]114[.]123/c32[.]jpg hxxp://94[.]140[.]114[.]123/c64[.]jpg hxxps://balkun[.]com/ricevuta |
Gozi |
| URL | hxxp://190[.]211[.]252[.]22/y hxxp://190[.]211[.]252[.]19/y |
Mirai |
| URL | hxxp://192[.]210[.]215[.]42/v/panel/uploads/Dnlanfmltc[.]vdf hxxp://192[.]3[.]109[.]146/325/DaHost[.]exe |
PureCrypter |
| URL | hxxp://151[.]236[.]14[.]60/c1oHe/q9cRd2n0 hxxp://193[.]235[.]147[.]20/6BlnalS/5RhE9y5 hxxp://162[.]252[.]175[.]53/krBALa/XdE2u hxxps://mdsonline[.]co[.]in/tbra/?1946723 hxxps://viltare[.]com/PlI6qXoN[.]dat hxxps://citarfas[.]com/xk1haRU2f[.]dat hxxps://motrawer[.]com/XQO3nF8[.]dat hxxps://wersika[.]com/mDy634QV8[.]dat hxxps://bingalos[.]com/u0kwdiTOTAs1[.]dat hxxps://waeaosu[.]com/xriZnQCso6YS[.]dat hxxp://dgmsoft[.]com[.]tr/pmaaxnluqn/vodka[.]gif hxxps://urbankrafted[.]com/gbfeelrdpm/vodka[.]gif hxxp://charlottepajamass[.]com/yxxqvysjsx/vodka[.]gif hxxps://thestreamresort[.]in/whhhpivtfu/vodka[.]gif hxxp://lab4cash[.]cl/xisqnhynwe/vodka[.]gif hxxps://yoursellersbuddy[.]com/tgqczqrshv/vodka[.]gif hxxp://doanlienhiep[.]vn/jtgyyassoz/vodka[.]gif hxxp://jynacademy[.]com/anlhdovxxp/vodka[.]gif hxxp://damnproudtobe[.]info/anhlgenbrs/vodka[.]gif hxxps://newlaunchesproject[.]com/shlrcdpyid/vodka[.]gif hxxps://corladcajamarca[.]org/ivsiccoxyn/vodka[.]gif hxxps://vaillartservis[.]com[.]tr/yqhenvbvjg/vodka[.]gif hxxps://marwatsllc[.]com/fmupdburcg/vodka[.]gif hxxps://nexoitsolution[.]com/hijhavxoqr/vodka[.]gif hxxps://ashokudhayan[.]com/jpdsvtreny/vodka[.]gif hxxps://kitesconsulting[.]us/ohfcbneuel/vodka[.]gif hxxps://budgetgad[.]com/jhlciprlhx/vodka[.]gif hxxps://vpphoangha[.]com/yzzrjtguuc/vodka[.]gif hxxp://senki-jp[.]com/bxvsqjjjaa/vodka[.]gif hxxp://educationday[.]ca/mromheannc/vodka[.]gif hxxp://elpasa[.]ir/qewqdkabgb/vodka[.]gif hxxps://bantuindigital[.]id/xzknhupeeg/vodka[.]gif hxxps://ferroliyetkiliservis[.]com[.]tr/kdkzuezstq/vodka[.]gif hxxps://lelesangkuriangabahnasrudin[.]com/djypxgcxna/vodka[.]gif hxxp://bdoaa[.]org/dzlehgvavu/vodka[.]gif hxxps://uhi[.]go[.]ug/luoo/?1 hxxps://humanaapparels[.]com/ln/?1 hxxps://sunriseguesthouse[.]co[.]za/it/?1 hxxps://sayehbeautysalon[.]ir/emp/?1 hxxps://kasaengenharia[.]com[.]br/spoq/?1 hxxps://quranforkids[.]com/iim/?6053772 hxxps://pastimenang[.]lol/nt/?1 hxxps://alafog[.]com/to/?1 hxxps://novaturi[.]com/sdit/?1 hxxps://tpbprodukhebat[.]lol/se/?1 hxxps://mastionline[.]in/etui/?1 hxxps://vizucomunicacaovisual[.]com[.]br/rief/?1 hxxps://curemedicals[.]com/aqt/?1 hxxps://aparecida[.]pb[.]gov[.]br/oe/?1 hxxps://pakbow[.]com/oms/?1 hxxps://camaramarizopolis[.]pb[.]gov[.]br/bla/?1 hxxps://khaithaclothien[.]edu[.]vn/ea/?1 hxxps://utkalautomobiles[.]com/iadq/?1 hxxps://shadea[.]it/pt/?1 hxxps://thewebcam[.]show/loit/?1 hxxps://opontodoestudante[.]com[.]br/pts/?1 hxxps://inetcomputers[.]ca/tu/?1 hxxps://okairiglobal[.]com/txp/?1 hxxps://downtowntravelt[.]com/qi/?1 hxxps://asriah[.]net/emu/?1 hxxps://gcdrang[.]in/fnm/?1 hxxps://casanova1948[.]com/tp/?1 hxxps://eastpooja[.]com[.]my/ipms/?1 hxxps://mykatakara[.]com/ua/?1 hxxps://zenithsquad[.]co/iier/?1 hxxps://esplay[.]com[.]br/ut/?1 hxxps://demo[.]jpe[.]njc[.]gov[.]ng/eeu/?1 hxxps://traintravelreservationonline[.]com/om/?1 hxxps://affilisites[.]info/inl/?1 hxxps://redemuniz[.]com[.]br/in/?1 hxxps://visapoint[.]travel/uset/?1 hxxps://websolucionesdigitales[.]com/aua/?1 hxxps://droneinnovationsug[.]com/oii/?1 hxxps://sumeetgroup[.]com/uttu/?1 hxxps://horizon[.]ac[.]ug/qsi/?1 hxxps://unicaltexnik[.]az/un/?1 hxxps://valampurihotel[.]com/qnu/?1 hxxps://infopediareviews[.]com/ce/?1 hxxps://jacksonkatz[.]com/nou/?1 hxxps://ma4salebyowner[.]com/aofu/?1 hxxps://oieetv[.]com/peaa/?1 hxxp://isabellepotel[.]fr/apouhphepn/vodka[.]gif hxxps://zstore[.]pk/toe/?1 hxxps://zerin[.]ml/tmee/?1 hxxps://zagata[.]com[.]br/ies/?1 hxxps://yasang[.]co[.]tz/eaeo/?1 hxxps://yementareem[.]com/iutt/?1 hxxps://wilshirelabs[.]com/ii/?1 hxxps://writospark[.]com/io/?1 hxxps://webspy[.]xyz/uqda/?1 hxxps://webproyectos[.]com[.]mx/aqua/?1 hxxps://web-98[.]ir/tlta/?1 hxxps://wawarmer[.]ir/euq/?1 hxxps://vpsemotiv[.]com/nnme/?1 hxxps://wavesoundpro[.]ph/amuu/?1 hxxps://visaoimobptu[.]com[.]br/el/?1 hxxps://vincomex[.]com[.]mx/tue/?1 hxxps://vipnightsgirls[.]com/vgle/?1 hxxps://vericut[.]com[.]br/id/?1 hxxps://vdf[.]in/rre/?1 hxxps://ventottomaggio[.]it/uqua/?1 hxxps://uttaraspa[.]xyz/ate/?1 hxxps://vadanikaval[.]in/emar/?1 hxxps://urspaces[.]in/sidi/?1 hxxps://unixsolutions[.]com[.]au/iuas/?1 hxxps://udinamo[.]edu[.]mx/xea/?1 hxxps://tudien[.]org[.]vn/at/?1 hxxps://tupiel[.]co/ouad/?1 hxxps://tortafreidamiao[.]com[.]br/tre/?1 hxxps://tpbkingarthur[.]xyz/auqu/?1 hxxps://toplinemarketing[.]co[.]ke/eua/?1 hxxps://topanwede[.]click/uaq/?1 hxxps://topan77legend[.]store/riau/?1 hxxps://topanmantaphoki[.]lol/rqru/?1 hxxps://toners[.]co[.]ke/smnt/?1 hxxps://tiblej[.]com/dot/?1 hxxps://thevoiceproject[.]org/ipi/?1 hxxps://thesolotravellers[.]in/ap/?1 hxxps://thecrescentschools[.]com/oub/?1 hxxps://telemarketinganalytics[.]com/ii/?1 hxxps://tempatnyagacor[.]cyou/ilol/?1 hxxps://tbfobyyashica[.]com/tes/?1 hxxps://synergisticresources[.]co[.]uk/uste/?1 hxxps://suesley[.]com[.]br/le/?1 hxxps://success[.]org[.]pk/iion/?1 hxxps://stjoseph[.]jws[.]co[.]tz/insi/?1 hxxps://strengthen[.]co[.]in/lusp/?1 hxxps://stareheboyscentre[.]ac[.]ke/qcot/?1 hxxps://staidipta[.]ac[.]id/ems/?1 hxxps://srdm[.]in/ttuv/?1 hxxps://ss[.]dev[.]br/edt/?1 hxxps://srajan[.]in/tin/?1 hxxps://spybangladesh[.]com/dta/?1 hxxps://spysoftwareindia[.]com/lei/?1 hxxps://spectronmw[.]com/dl/?1 hxxps://solu-tec[.]com[.]mx/gsi/?1 hxxps://somevalcaminhoes[.]com[.]br/nhi/?1 hxxps://softsguide[.]com/of/?1 hxxps://socialwelfare[.]ajk[.]gov[.]pk/eto/?1 hxxps://sknafaka[.]co[.]ke/sdqi/?1 hxxps://sms[.]rcm[.]edu[.]ng/mu/?1 hxxps://sistemaonline[.]top/epsu/?1 hxxps://sinopecperu[.]com/midu/?1 hxxps://sipaz[.]net/ise/?1 hxxps://singleherbs[.]in/opo/?1 hxxps://sindimov-mg[.]com[.]br/oe/?1 hxxps://siis[.]in/em/?1 hxxps://shawnloucks[.]com/orer/?1 hxxps://sharesistemas[.]com[.]br/rm/?1 hxxps://seuclick[.]com[.]br/trl/?1 hxxps://securitycamhelpline[.]us/esdt/?1 hxxps://sekobank[.]com/sdu/?1 hxxps://sciforschenonline[.]org/evem/?1 hxxps://scaleacad[.]com/lori/?1 hxxps://sattamatka134[.]mobi/nei/?1 hxxps://sanctuaryglobaltravels[.]com/teao/?1 hxxps://santahelena[.]pb[.]gov[.]br/nno/?1 hxxps://safagoldmarketing[.]com/ord/?1 hxxps://samaafm[.]com/amri/?1 hxxps://rpi[.]gov[.]bd/eeuu/?1 hxxps://rockbarbarbearia[.]com/qm/?1 hxxps://royalmassageyspa[.]pe/qsu/?1 hxxps://revistas[.]upp[.]edu[.]pe/ol/?1 hxxps://rekordplast[.]rs/st/?1 hxxps://reraeasy[.]com/tliv/?1 hxxps://redesignshomeinspections[.]com/ei/?1 hxxps://redeshopping[.]net/pio/?1 hxxps://raska[.]ls[.]gov[.]rs/pisi/?1 hxxps://rangreza[.]com[.]pk/te/?1 hxxps://radysis-asia[.]com/ntei/?1 hxxps://rahuldravid[.]com/rtut/?1 hxxps://quraniqraacademy[.]com/ns/?1 hxxps://quranforkids[.]com/ut/?1 hxxps://questmedicalimaging[.]com/ttu/?1 hxxps://purelove[.]app/dol/?1 hxxps://qngnode[.]cc/nr/?1 hxxps://psicologodiego[.]com[.]br/eld/?1 hxxps://publitek[.]com[.]br/aa/?1 hxxps://prueba-testing[.]vps[.]co[.]ve/ru/?1 hxxps://profimail[.]info/alen/?1 hxxps://projob[.]tk/ot/?1 hxxps://procurement[.]njc[.]gov[.]ng/tuno/?1 hxxps://polymerprod[.]com/oup/?1 hxxps://prescriptionfood[.]com[.]hk/nuq/?1 hxxps://pmconnection[.]co[.]za/io/?1 hxxps://pokretoslobodjenje[.]rs/oea/?1 hxxps://pioneermedicalservices[.]co[.]ug/aei/?1 hxxps://peachypinktumblers[.]com/iacv/?1 hxxps://persus23[.]com/aeq/?1 hxxps://pdamtbwkotasmi[.]co[.]id/ei/?1 hxxps://partoaramesh[.]ir/et/?1 hxxps://pal-auto[.]com/ui/?1 hxxps://pakhams[.]com/tl/?1 hxxps://oxyhealth[.]com[.]sa/eo/?1 hxxps://ownyourhealthandfitness[.]com/til/?1 hxxps://orbitstarnet[.]com[.]ng/tm/?1 hxxps://ortopediawong[.]com/sno/?1 hxxps://omnia[.]com[.]py/me/?1 hxxps://onlecar[.]com/iie/?1 hxxps://omax[.]com[.]pk/ed/?1 hxxps://officialfxempire[.]com/ie/?1 hxxps://nwssu[.]edu[.]ph/oisl/?1 hxxps://ns[.]com[.]pk/pa/?1 hxxps://no-reply[.]co[.]za/tsa/?1 hxxps://ninetofab[.]com/oug/?1 hxxps://nnt[.]gov[.]la/est/?1 hxxps://nidanhospital[.]com/dapc/?1 hxxps://news7tamilvideos[.]com/at/?1 hxxps://nics[.]net[.]pk/eauc/?1 hxxps://news2023[.]me/os/?1 hxxps://negdar[.]dd[.]sa/atn/?1 hxxps://networkstore[.]net[.]np/stuq/?1 hxxps://nanyangvalley[.]com/it/?1 hxxps://naijhiphop[.]com[.]ng/vtet/?1 hxxps://nanahygiene[.]com/aqan/?1 hxxps://mzansivoice[.]co[.]za/odt/?1 hxxps://nahid[.]info/ture/?1 hxxps://mywovenwords[.]com/ieb/?1 hxxps://mypetspedia[.]com/inn/?1 hxxps://myhummergarden[.]com/utte/?1 hxxps://mygiftsbyprecious[.]com/qe/?1 hxxps://myhandycrafts[.]com/eies/?1 hxxps://myfirstschools[.]in/ret/?1 hxxps://mycopycrypto[.]com/utq/?1 hxxps://mydailyfit[.]it/eimi/?1 hxxps://mubashir-rehman[.]com/ds/?1 hxxps://mulberryhotels[.]in/qni/?1 hxxps://mrakroletne[.]com/uq/?1 hxxps://morrebsict[.]com/nm/?1 hxxps://montdent[.]com/stve/?1 hxxps://morgenhealthcare[.]in/mlpc/?1 hxxps://monsoonempress[.]com/aom/?1 hxxps://melt-salama-connect[.]co/st/?1 hxxps://modiosapk[.]site/ra/?1 hxxps://melaniegowen[.]com/uod/?1 hxxps://melhemco[.]com/oroc/?1 hxxps://mech-technologies[.]com/don/?1 hxxps://megashoes[.]mx/mq/?1 hxxps://mdca[.]co[.]ae/pum/?1 hxxps://mdsonline[.]co[.]in/tbra/?1 hxxps://maxusmetropolitanos[.]mx/um/?1 hxxps://maulagroup[.]pk/im/?1 hxxps://maxborbrasil[.]com[.]br/tus/?1 hxxps://matrixmediaht[.]com/ud/?1 hxxps://marvens[.]in/us/?1 hxxps://master-bucks[.]com/qa/?1 hxxps://marbella[.]co[.]in/ltsl/?1 hxxps://makiss[.]com[.]br/iqo/?1 hxxps://mama-putt[.]co[.]za/auaq/?1 hxxps://madarsmasr[.]com/doml/?1 hxxps://maidepaula[.]com/iies/?1 hxxps://mabdurrazzaque[.]me/quui/?1 hxxps://lugardehistorias[.]com[.]br/uh/?1 hxxps://lokmatmoststylish[.]com/dou/?1 hxxps://loradesign[.]hu/aqa/?1 hxxps://livingwellwithmikeandlisa[.]com/px/?1 hxxps://lokmatmaharashtrian[.]com/lu/?1 hxxps://lidertrade[.]com[.]br/ii/?1 hxxps://lifeafterdiets[.]com[.]au/sopb/?1 hxxps://liceulborsec[.]ro/ems/?1 hxxps://letstart[.]us/al/?1 hxxps://lexduco[.]lk/uocl/?1 hxxps://learnquranonlineacademy[.]com/mmt/?1 hxxps://learntor[.]ng/nou/?1 hxxps://ldcc[.]com[.]do/mauu/?1 hxxps://leaderhomes[.]com[.]au/eeng/?1 hxxps://laviva2[.]eu/ts/?1 hxxps://lamaratourism[.]com/ceq/?1 hxxps://laronda[.]cl/mtpu/?1 hxxps://lagoa[.]pb[.]gov[.]br/cbat/?1 hxxps://lainefraser[.]com/qo/?1 hxxps://korpore[.]com[.]br/eo/?1 hxxps://kninternational[.]org/eutp/?1 hxxps://komchetoi[.]com/ieu/?1 hxxps://kkllc[.]me/ple/?1 hxxps://klavierart[.]at/ql/?1 hxxps://khullamanch[.]com/tm/?1 hxxps://jpe[.]njc[.]gov[.]ng/le/?1 hxxps://karezma[.]co/ae/?8602162 hxxps://jocaclaudino[.]pb[.]gov[.]br/sms/?1 hxxps://jobportal[.]tiv[.]vic[.]edu[.]au/auat/?1 hxxps://jobzdream[.]com/os/?1 hxxps://jjimportexport[.]com[.]do/atu/?1 hxxps://jetfuel[.]ph/omre/?1 hxxps://jacobballard[.]com/nasu/?1 hxxps://ius[.]edu[.]bd/lvte/?1 hxxps://itvations[.]co[.]uk/rlq/?1 hxxps://irisenglishschool[.]in/daoi/?1 hxxps://iqramubarik[.]com/am/?1 hxxps://ipn[.]co[.]id/oi/?1 hxxps://intlnet[.]work/ioqm/?1 hxxps://insutec[.]ao/uacr/?1 hxxps://institutobiblicocatolico[.]com[.]mx/caed/?1 hxxps://innokat[.]com[.]pk/usic/?1 hxxps://infocamaras[.]com[.]ar/rieo/?1 hxxps://industriallandlease[.]com/gns/?1 hxxps://indianrobostore[.]com/pfu/?1 hxxps://indiaspoc[.]org/uqd/?1 hxxps://inace[.]com[.]br/uli/?1 hxxps://impexonind[.]com/uen/?1 hxxps://illuminazionedepoca[.]com/rtam/?1 hxxps://imaccochinkalabhavan[.]com/an/?1 hxxps://ikoyinurseryschool[.]com/ot/?1 hxxps://iestpjctello[.]edu[.]pe/mo/?1 hxxps://hotdelivery[.]com/afhi/?1 hxxps://hseqinternational[.]com[.]co/isid/?1 hxxps://hillsidebridal[.]com/ima/?1 hxxps://hmtdtechvn[.]com/uqs/?1 hxxps://harchaoui-training[.]dz/uuq/?1 hxxps://hcnhealthcare[.]com/uamr/?1 hxxps://hapvidaplanos[.]com[.]br/ir/?1 hxxps://guteblock[.]com/mdue/?1 hxxps://hanisvisa[.]com/io/?1 hxxps://growocs[.]com/aits/?1 hxxps://grupoalema[.]com[.]br/ee/?1 hxxps://greenreeflive[.]com/iniq/?1 hxxps://goldplusnigeria[.]com/si/?1 hxxps://gramturbo[.]com/atte/?0772682 hxxps://goldenmindsbulacan[.]com/iqe/?1 hxxps://goldcrown[.]co[.]ke/ieqa/?1 hxxps://gayatri[.]store/cqe/?1 hxxps://garagedoorrepairmarshfieldma[.]com/eiru/?1 hxxps://garzadeyta[.]com[.]mx/ev/?1 hxxps://fytco[.]sa/cncs/?1 hxxps://gaestetica[.]it/oote/?1 hxxps://fundex[.]us/uroi/?1 hxxps://freshgreen[.]com[.]au/rum/?1 hxxps://friofort[.]cl/raor/?1 hxxps://fpno[.]edu[.]ng/nlc/?1 hxxps://foodanddesire[.]com[.]au/iap/?1 hxxps://foroozesh[.]ir/ne/?1 hxxps://floridaimporta[.]com[.]ar/amva/?1 hxxps://firsthomes[.]in/le/?1 hxxps://fivestarguardians[.]com/st/?1 hxxps://fancytextgenerator[.]website/oem/?1 hxxps://findinfo[.]us/uce/?1 hxxps://facturacash[.]online/aste/?1 hxxps://fabricadeinfluencers[.]com[.]br/ina/?1 hxxps://faceocchiali[.]net/elol/?1 hxxps://explorebdesh[.]com/bri/?1 hxxps://everfastcourier[.]com/qu/?1 hxxps://excelenergy[.]in/lr/?1 hxxps://europeanglitters[.]com/tlm/?1 hxxps://essayever[.]com/pit/?1 hxxps://estudios-biblicos-completos[.]org/fgu/?1 hxxps://esquadriasmp[.]com[.]br/ee/?1 hxxps://esisaojoserocasales[.]com[.]br/sdin/?1 hxxps://ericabravar[.]com/nua/?1 hxxps://engenhariaintensa[.]com[.]br/oaoi/?1 hxxps://er4upremium[.]in/dui/?1 hxxps://elsplanetes[.]space/qsa/?1 hxxps://emmanuelgroup[.]org/bpi/?1 hxxps://electromart[.]com/qah/?1 hxxps://ejsservicos[.]com[.]br/oiq/?1 hxxps://electriuniverselle[.]ma/io/?1 hxxps://ejbreneman[.]com/trun/?1 hxxps://eduinfo[.]com[.]ng/id/?1 hxxps://eesaa[.]co[.]in/caqu/?1 hxxps://ederamartins[.]com[.]br/el/?1 hxxps://ectunnelvpn[.]me/door/?1 hxxps://eafricadominicans[.]org/qese/?1 hxxps://earlbeam[.]com[.]gh/ssi/?1 hxxps://duroply[.]in/lus/?1 hxxps://drrafaeldelpicchia[.]com[.]br/du/?1 hxxps://dreamconstructionhome[.]com/iqa/?1 hxxps://drive[.]ipn[.]co[.]id/eora/?1 hxxps://draleccheng[.]ca/iat/?1 hxxps://doctorshealthcaresystem[.]com/imq/?1 hxxps://dinh[.]dk/tu/?1 hxxps://diquinsa[.]com[.]mx/oni/?1 hxxps://digicanv[.]com/irlo/?1 hxxps://dimelabs[.]io/ds/?1 hxxps://dialyj[.]cm/uq/?1 hxxps://devslogic[.]com/du/?1 hxxps://dialogoscriticos[.]com/ru/?1 hxxps://devlancetech[.]com/eaex/?1 hxxps://developedtechnologies[.]com/svt/?1 hxxps://derekprince[.]rs/nar/?1 hxxps://demo[.]uhi[.]go[.]ug/iaui/?1 hxxps://davik[.]com[.]br/uq/?1 hxxps://darcepel[.]com[.]br/qaea/?1 hxxps://dastkaar[.]com/tu/?1 hxxps://danielafranzen[.]com[.]br/ii/?1 hxxps://dairymachinery[.]pk/fust/?1 hxxps://dancamix[.]com[.]br/vnis/?1 hxxps://cutacut[.]com/ucci/?1 hxxps://cutcut[.]pt/aeuq/?1 hxxps://cursodesobrancelha[.]com[.]br/es/?1 hxxps://crosscityprojects[.]com[.]au/ben/?1 hxxps://crawlercarriersales[.]com/deu/?1 hxxps://consultaelectronicadanfe[.]ml/seom/?1 hxxps://coluccio[.]eu/esr/?1 hxxps://coletivodeestrelas[.]com[.]br/ai/?1 hxxps://colombiamulticolor[.]net/ur/?1 hxxps://cmpocodejosedemoura[.]pb[.]gov[.]br/cst/?1 hxxps://clickoffer-official[.]online/sl/?1 hxxps://cmjoaodourado[.]ba[.]gov[.]br/niu/?1 hxxps://civitas[.]ps/ui/?1 hxxps://cinematalkies[.]in/rq/?1 hxxps://civilwarhomestead[.]com/atni/?1 hxxps://chibs-social[.]com[.]ng/et/?1 hxxps://chiomadigitalagency[.]com[.]ng/ipg/?1 hxxps://cheatingplayingcardsinbangladesh[.]com/uutd/?1 hxxps://centreisland[.]ca/eotr/?1 hxxps://centropuliturapelli[.]it/mo/?1 hxxps://centralvalleylaw[.]com/oo/?1 hxxps://ccmohmand[.]edu[.]pk/reec/?1 hxxps://cctvlearn[.]com/tn/?1 hxxps://ccab[.]ro/iim/?1 hxxps://cartbd[.]info/lapa/?1 hxxps://careersit[.]co[.]za/vteo/?1 hxxps://camaravenhaver[.]rn[.]gov[.]br/tme/?1 hxxps://care[.]hip[.]co[.]th/deep/?1 hxxps://camaranazarezinho[.]pb[.]gov[.]br/tun/?1 hxxps://caffemorenoshop[.]it/asi/?1 hxxps://camaralastro[.]pb[.]gov[.]br/aqau/?1 hxxps://c-54[.]com/avus/?1 hxxps://buycuencaecuador[.]com/quit/?1 hxxps://buydetectors[.]pk/un/?1 hxxps://bulleto[.]io/ssoi/?1 hxxps://bridalbaike[.]com/lvte/?1 hxxps://bomsucesso[.]pb[.]gov[.]br/ur/?1 hxxps://bizztechinfo[.]com/mns/?1 hxxps://bmc[.]edu[.]np/ioe/?1 hxxps://biodina[.]com[.]br/sado/?1 hxxps://beyondluxe[.]in/uni/?1 hxxps://bikecentro[.]com[.]br/atsc/?1 hxxps://bdral[.]com/ima/?1 hxxps://benigletechnologies[.]com/dol/?1 hxxps://balgocburada[.]com/auu/?1 hxxps://babymomhealth[.]com/da/?1 hxxps://balaoboituva[.]com[.]br/au/?1 hxxps://awalisolutions[.]co[.]za/dpit/?1 hxxps://autopower[.]pk/ve/?1 hxxps://awaisahmadtech[.]com/de/?1 hxxps://autopartslife[.]com/ul/?1 hxxps://australiancattledog[.]com[.]br/inve/?1 hxxps://autoingress[.]com[.]au/ntoe/?1 hxxps://attivo[.]co[.]in/dcqu/?1 hxxps://aurogroup[.]net/aaeu/?1 hxxps://astrologia[.]com[.]co/eqi/?1 hxxps://aspwholesales[.]com/do/?1 hxxps://artscape[.]co[.]in/neis/?1 hxxps://arslonga[.]gr/qe/?1 hxxps://artemisamontessylvan[.]org/iuc/?1 hxxps://arjrepresentacoes[.]com[.]br/ecit/?1 hxxps://arcagroup[.]com[.]mx/eqt/?1 hxxps://arittek[.]com/ea/?1 hxxps://apkvisions[.]com/vd/?1 hxxps://araghgir[.]ir/nion/?1 hxxps://angelicahairdesign[.]com/mema/?1 hxxps://anticorrupcionchubut[.]gob[.]ar/ibdn/?1 hxxps://andreguimaraes[.]com[.]br/anic/?1 hxxps://americanglitter[.]com/ese/?1 hxxps://anahygiene[.]com/eitu/?1 hxxps://amcare[.]com[.]mx/di/?1 hxxps://aloja-oficial[.]com/uut/?1 hxxps://aloja-oficial[.]online/iu/?1 hxxps://almoez[.]com/uo/?1 hxxps://aliservice[.]cl/oue/?1 hxxps://alhoja[.]net/uaad/?1 hxxps://alignpx[.]com/li/?1 hxxps://al-hayahscan[.]com/satu/?1 hxxps://aguademar[.]com/oi/?1 hxxps://ajsdatasub[.]com[.]ng/bxpc/?1 hxxps://agcs[.]com[.]bd/te/?1 hxxps://afelschool[.]com/ips/?1 hxxps://advilla[.]co/mpuo/?1 hxxps://aestusco[.]com/onau/?1 hxxps://adharshevent[.]in/is/?1 hxxps://adnglobal[.]my/sr/?1 hxxps://10d[.]om/cio/?1 hxxps://9pound[.]co[.]za/tt/?1 hxxps://vestracash[.]com/wykplmufnp/vodka[.]gif hxxps://tropikalyamarket[.]com/jtofibztoi/vodka[.]gif hxxps://roya4tpwebsite[.]almoasherbiz[.]com/ssbfxkethi/vodka[.]gif hxxps://radiotvmixcba[.]com[.]ar/lrjuxtikhi/vodka[.]gif hxxps://palmyrasigns[.]com/ijqzeuhsih/vodka[.]gif hxxps://jewishseniorsnetwork[.]ca/umpsezffwn/vodka[.]gif hxxps://gruposdl[.]com[.]br/baorpblgnu/vodka[.]gif hxxps://friendshipcirclenl[.]ca/wpbkvgvgub/vodka[.]gif hxxps://eaglemarinevalve[.]com/ginnnsirsm/vodka[.]gif hxxps://cgidetroit[.]com/jipriwyhhi/vodka[.]gif hxxp://tsgg[.]ge/btegclvmau/vodka[.]gif hxxp://vaillantyetkiliservisim[.]com[.]tr/bbsistqmrl/vodka[.]gif hxxp://sonyyetkiliservis[.]com[.]tr/yhovvtpdae/vodka[.]gif hxxp://sparepartrunningtext[.]com/vptsancfyx/vodka[.]gif hxxp://rhnomina[.]com[.]ve/gbqvvauwhu/vodka[.]gif hxxp://dev[.]boostsearches[.]com/rebmpqfgly/vodka[.]gif hxxp://klikmapan[.]id/nudflfuxew/vodka[.]gif hxxp://bojiradio[.]com/psfjruhtrf/vodka[.]gif |
QakBot |
| URL | hxxp://new2bs[.]top/build[.]exe | Arkei Stealer |
| URL | hxxps://webriiz[.]radicalhosts[.]ir/wp-content/themes/alireza/rat/index[.]php?username=MGmg hxxps://webriiz[.]radicalhosts[.]ir/wp-content/themes/alireza/rat hxxps://webriiz[.]radicalhosts[.]ir/wp-content/themes/alireza/rat/index[.]php |
IRATA |
| URL | hxxp://1[.]168[.]103[.]99/x/pty hxxp://1[.]168[.]103[.]99/x/tty1 hxxp://1[.]168[.]103[.]99/x/tty5 hxxp://1[.]168[.]103[.]99/x/tty0 hxxp://1[.]168[.]103[.]99/x/tty2 hxxp://1[.]168[.]103[.]99/x/tty3 hxxp://1[.]168[.]103[.]99/x/tty4 hxxp://1[.]168[.]103[.]99/x/tty6 |
Tsunami |
| URL | hxxp://78[.]47[.]228[.]71:22022/upload[.]zip | Vidar |
