# Copyright (c) 2014-2018 Miroslav Stampar (@stamparm)
# See the file 'LICENSE' for copying permission

# Reference: https://www.virustotal.com/#/ip-address/77.87.77.250

/izuku.sh
/izuku.arm
/izuku.mips
/izuku.mpsl

# Reference: https://blog.paranoidpenguin.net/2018/08/hakaied-with-love-from-telecom-egypt/

/hakai.mips
/hakai.arm5
/hakai.mpsl
/hakai.x86_64

# Reference: https://researchcenter.paloaltonetworks.com/2018/07/unit42-finds-new-mirai-gafgyt-iotlinux-botnet-campaigns/

/okane.arc
/okane.arm
/okane.arm5
/okane.arm6
/okane.arm7
/okane.i486
/okane.i686
/okane.m68k
/okane.mips
/okane.mips64
/okane.mpsl
/okane.ppc
/okane.ppc440fp
/okane.sh4
/okane.spc
/okane.x86

# Reference: https://www.bleepingcomputer.com/news/security/mirai-iot-malware-uses-aboriginal-linux-to-target-multiple-platforms/

/sora.x86
/sora.mips
/sora.mpsl
/sora.arm4
/sora.arm5
/sora.arm6
/sora.arm7
/sora.ppc
/sora.m68k
/sora.arc
/sora.sh4

# Reference: https://www.hindawi.com/journals/scn/2018/7178164/lst16/

/mirai.arm
/mirai.arm5n
/mirai.arm7
/mirai.dbg
/mirai.m68k
/mirai.mips
/mirai.mipsl
/mirai.ppc
/mirai.sh4
/mirai.spc
/mirai.x86

# Reference: https://www.virustotal.com/en/ip-address/209.141.55.13/information/
# Reference: https://twitter.com/i/moments/1046121581393543168

/Extendo.mips 
/Josho.arm5
/Josho.arm7
/8UsA.sh
/zaky.sh

# Reference: https://twitter.com/bad_packets/status/1036415216718733312

/seraph.arc
/seraph.arm
/seraph.arm5
/seraph.arm6
/seraph.arm7
/seraph.i586
/seraph.i686
/seraph.m68k
/seraph.mips
/seraph.mpsl
/seraph.ppc
/seraph.sh
/seraph.sh4
/seraph.spc
/seraph.x86

# Reference: https://twitter.com/bad_packets/status/1038620066873409536

/apep.arc
/apep.arm
/apep.arm5
/apep.arm6
/apep.arm7
/apep.i586
/apep.i686
/apep.m68k
/apep.mips
/apep.mpsl
/apep.ppc
/apep.sh
/apep.sh4
/apep.spc
/apep.x86
/arm.b
/arm5.b
/arm7.b
/mpsl.b

# Reference: https://researchcenter.paloaltonetworks.com/2018/09/unit42-multi-exploit-iotlinux-botnets-mirai-gafgyt-target-apache-struts-sonicwall/

l.ocalhost.host
/sonicwall

# Reference: https://blog.netlab.360.com/threat-alert-a-new-worm-fbot-cleaning-adbminer-is-using-a-blockchain-based-dns-en/

musl.lib
rippr.cc
ukrainianhorseriding.com
/adbs
/adbs2
/fbot.aarch64
/fbot.arm7
/fbot.mips
/fbot.mipsel
/fbot.x86
/fbot.x86_64
/mipsel.bot.le
/mips.bot.be
/i686.bot.le
/arm7.bot.le
/arm64.bot.le
/x86_64.bot.le

# Reference: https://twitter.com/bad_packets/status/1043273974560448514

/ultron.armv4l
/ultron.armv5l
/ultron.armv6l
/ultron.i586
/ultron.i686
/ultron.m68k
/ultron.mips
/ultron.mipsel
/ultron.mipseln
/ultron.powerpc
/ultron.powerpc440fp
/ultron.sh4
/ultron.sparc
/ultron.x86_64
/ultronfinal.armv4l
/ultronfinal.armv5l
/ultronfinal.armv6l
/ultronfinal.i586
/ultronfinal.i686
/ultronfinal.m68k
/ultronfinal.mips
/ultronfinal.mipsel
/ultronfinal.mipseln
/ultronfinal.powerpc
/ultronfinal.powerpc440fp
/ultronfinal.sh4
/ultronfinal.sparc
/ultronfinal.x86_64
/ultron-syn.sh

# Reference: https://twitter.com/bad_packets/status/1043404764027838464

/hoho.arm
/hoho.arm5
/hoho.arm6
/hoho.arm7
/hoho.m68k
/hoho.mips
/hoho.mpsl
/hoho.ppc
/hoho.sh4
/hoho.spc
/hoho.x86

# Reference: https://twitter.com/bad_packets/status/1032494091290832896

/.shinka.mips
/.shinka.mpsl

# Reference: https://twitter.com/bad_packets/status/1029965235212320768

/x86_64
/x86_32

# Reference: https://twitter.com/bad_packets/status/1029608234569453569

/init0
/sals

# Reference: https://twitter.com/Ajouini99/status/1046898647764545536

/Boatnet.arm4
/Boatnet.arm5
/Boatnet.arm6
/Boatnet.arm7
/Boatnet.m68k
/Boatnet.mips
/Boatnet.mpsl
/Boatnet.ppc
/Boatnet.sh4
/Boatnet.spc
/Boatnet.x86
/Boatnet.x86_64

# Generic trail from MT heuristic detection

/juno
/sefa.arm
/sefa.arm5
/sefa.arm6
/sefa.arm7
/sefa.i586
/sefa.i686
/sefa.m68k
/sefa.mips
/sefa.mpsl
/sefa.ppc
/sefa.ppc440
/sefa.sh4
/sefa.spc
/sefa.x86

# Reference: https://twitter.com/bad_packets/status/1051616610035806209

/oxy.arm
/oxy.arm5
/oxy.arm6
/oxy.arm7
/oxy.i586
/oxy.i686
/oxy.m68k
/oxy.mips
/oxy.mpsl
/oxy.ppc
/oxy.ppc440
/oxy.sh4
/oxy.spc
/oxy.x86

# Reference: https://twitter.com/ulexec/status/1051959861964169217

/dark.arm
/dark.arm5
/dark.arm6
/dark.arm7
/dark.dbg
/dark.m68k
/dark.mips
/dark.mpsl
/dark.ppc
/dark.sh4
/dark.spc
/dark.srv
/dark.x86

# Reference: https://twitter.com/VessOnSecurity/status/1053591992888950784

/arm.yakuza
/arm5.yakuza
/arm6.yakuza
/arm7.yakuza
/dbg.yakuza
/i586.yakuza
/i686.yakuza
/m68k.yakuza
/mips.yakuza
/mpsl.yakuza
/ppc.yakuza
/ppc440.yakuza
/sh4.yakuza
/spc.yakuza
/srv.yakuza
/x86.yakuza

# Reference: https://twitter.com/VessOnSecurity/status/1051226957118103560

/gemini.arm
/gemini.arm5
/gemini.arm6
/gemini.arm7
/gemini.dbg
/gemini.i586
/gemini.i686
/gemini.m68k
/gemini.mips
/gemini.mpsl
/gemini.ppc
/gemini.ppc440
/gemini.sh4
/gemini.spc
/gemini.srv
/gemini.x86

# Reference: https://twitter.com/VessOnSecurity/status/1036375414141345793

/arm.Akiru
/arm5.Akiru
/arm6.Akiru
/arm7.Akiru
/dbg.Akiru
/i586.Akiru
/i686.Akiru
/m68k.Akiru
/mips.Akiru
/mpsl.Akiru
/ppc.Akiru
/ppc440.Akiru
/sh4.Akiru
/spc.Akiru
/srv.Akiru
/x86.Akiru

# Reference: https://twitter.com/VessOnSecurity/status/1031653320467927046

/BleedStreet.arm
/BleedStreet.arm5
/BleedStreet.arm6
/BleedStreet.arm7
/BleedStreet.dbg
/BleedStreet.i586
/BleedStreet.i686
/BleedStreet.m68k
/BleedStreet.mips
/BleedStreet.mpsl
/BleedStreet.ppc
/BleedStreet.ppc440
/BleedStreet.sh4
/BleedStreet.spc
/BleedStreet.srv
/BleedStreet.x86

# Reference: https://twitter.com/xxdesmus/status/1053440011289280512

/jiren.arm4
/jiren.arm5
/jiren.arm6
/jiren.arm7
/jiren.i586
/jiren.i686
/jiren.m68k
/jiren.mips
/jiren.mpsl
/jiren.ppc
/jiren.sh
/jiren.sh4
/jiren.sparc
/jiren.x86

# Reference: https://otx.alienvault.com/pulse/5a7878488a342f781764803b

cloudflarecock.club
fghdfth.club
fuckthefeds.tk
hightechcrime.club
imadaddy.us
malwaremustive.club
mirai.ao
neuvostoliitto.tk
traplife.ru

# Reference: http://vxcube.com/recent-threats-ioc/5a505721a39bb533af5137ed/detail

0x01.nexusiotsolutions.net
0x01.preload.su
0x90.bid
1eryxnva.glibc.org
aced.ga
air.sinushost.biz
akuma.pw
alhctuyy.tk
asapvpns.club
aspectleaks.xyz
back.uu8889.com
bakiiszwart.tk
base.monello.tk
bbase.monello.tk
bcnc.changeme.com
bc.nexusiotsolutions.net
bfrxznyisbestie.ml
bfyfa.fun
bhromofreah.top
bigboats.club
bigboatz.us
bkush.ml
blacklister.nl
bloodwars.ws
blueandsausesfries.us
bnexusiotsolutions.net
boatnet.xyz
boat.racoon.ml
booters.ml
botnet.remaiten.org
botnetsale.tk
bounty.bigbotpein.ru
bwww.scotsa.pw
ccc.snicker.ir
central.glibc.org
cked.4horsemen.pw
cktzoh.xyz
cmdmirai.tk
cnc111.ml
cnc.bigbandsinmyvault.tk
cnc.bigbotpein.ru
cncbot.cnbot.space
cncbot.ddns.net
cnc.changeme.com
cnc.linux.lol
cnc.mirai.com
cnc.nutsz.club
cnc.skidsec.org
cnc.smokemethallday.tk
cnc.spamtech.win
cnc.teammalefic.pw
cnc.tonguepunchfartbox.life
cnc.urgay.cf
cnc.vdskge7as.xyz
cnc.voxlobid.tk
c.nexusiotsolutions.net
cn.uvgczsuidrtg.com
conwangg.de
cool.kingdomplugin.nl
coolxr.info
cottoncandyloverscute.website
crazyclothes.store
dankstresser.tk
dannyexe.xyz
ddosattacks.tk
deathlives.ddns.net
d.hi8520.com
dportsmirai.tk
dssgasrea.club
eccc.bulletpool.ru
ertwer.vdskge7as.xyz
featured.cf
fedtraps.cf
ffvfvcnc.changeme.com
frost.botnet.hackedfiles.pw
frxznyisbestie.ml
ftp.xenonbooter.xyz
fyfa.fun
gangsters.cf
gndfgdd.club
gnikllort.com
gotdns.ch
gotnulled.ga
greekhelios21.tk
happyf33t.nl
hello.bigpuller.cf
hoaxnet.ddns.net
hotelcasa.nl
hromofreah.top
ikbensupercool.nl
iktufopjou.nl
infecteverywhere.online
int.aerx.io
internetgangster.tk
internetpolice.ga
internetpolice.ml
internetpolice.tk
iotmirai.tk
isalinux.intercomonline.com
kagbe.nl
kormirai.ddns.net
kringelstan.net
kush.ml
leakedfiles.org
legendarysprx.pw
linuxsecuritys.com
lol665.tk
lol.godlynet.cf
mail.harikatha.com
majikku.us
miraibotnet.ml
miraibotnet.online
miraihoneypot.tk
mirainet.ml
mirainet.tk
mm.haxornah.top
moanmybins.ml
modems.pw
myacerusername.hopto.org
mymiraiserver.hopto.org
mypawnshop.men
nageboorte.ga
naotogoyamamcc.asuscomm.com
net.nageboorte.nl
neuvostoliitto.ml
neuvostoliitto.tk
nexusaquariums.ir
nnn.shenron.pw
nullserversmirai.tk
offlineservers.tk
online.upmirai.club
onyxreppingoat.cf
panel.miraibotnet.eu
powa.daddyhackingteam.com
power4you.ddns.net
predoxing.tk
purgeblood.duckdns.org
putintrump.cf
putintrump.tk
pvpcloud.us
pyfulthag0d.pw
q5f2k0evy7go2rax9m4g.ru
reppin.tk
rofl.leakvortex.pro
rootyi.site
runscape.cf
rw595phpt4kk538s.botanik.gq
s0.3eu.ru
santasbigcandycane.cx
sbnmcd.org
sepinsftw.tk
serveranywhere.cf
serveranywhere.ga
serversrus.club
sevenp.top
smithre.top
ssh.gammaboat.us
swatnetiphone.tk
swatnetsucks.tk
swinginwithme.ru
swizzthegod.us
thebigbadbotnet.tk
thonder.club
totalbooter.us
truepower.club
ttymirai.tk
unix.tk
upfiles.online
uryjsdrfg.club
vap3.ddns.net
wheresmirai.tk
winter.winterboot.net
www.ghoststresser.pw
www.newel.se
www.scotsa.pw
www.trapboat.club
yzykar.ddns.net
zammanaakis.link
zetastress.net
