# Copyright (c) 2014-2018 Miroslav Stampar (@stamparm)
# See the file 'LICENSE' for copying permission

# Reference: https://www.zscaler.com/blogs/research/njrat-pushes-lime-ransomware-and-crypto-wallet-grabbers

online2018.duckdns.org
oficinabogota.duckdns.org

# Reference: https://totalhash.cymru.com/analysis/?f78f486a199a8c39c9760e4dec9bcdea5a399e5e

buttacuore.no-ip.org

# Reference: http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered.pdf

alitatat.no-ip.org
dr-vip.no-ip.org
gdsg.no-ip.org
hack-badone.no-ip.biz
hassoon03.no-ip.info
ksadxxd24.no-ip.org
kurdkalar11.zapto.org
kyfen.dyndns.biz
m3333m.no-ip.org
mohammad3badi.zapto.or
mp3.servemp3.com
naif.no-ip.org
nasr23200.no-ip.org
saman70.no-ip.org
samirsamir.hopto.org
special.no-ip.biz
wisam77.no-ip.biz
wolblid.zapto.org
xxsniper.no-ip.biz
zackhaviland.no-ip.org

# Reference: https://citizenlab.ca/2016/08/group5-syria/

ahriman.no-ip.org

# Reference: https://twitter.com/JaromirHorejsi/status/1047416731243872257

a78o.com

# Reference: https://twitter.com/ScumBots

131454.ddns.net
133katelinn.hopto.org
3amojoker.zapto.org
abodxf901.ddns.net
acess1.kro.kr
acessgood.kro.kr
adeldu122.ddns.net
admintool312.ddns.net
agx1996.ddns.net
ahmed2016.ddns.net
alyom123123.myq-see.com
amazonhack.hopto.org
amerkad19.ddns.net
anu.dominguezllc.com
apk.servemp3.com
aqwe.ddns.net
asd312.hopto.org
asda.ddns.net
asdfg123456.ddns.net
ayach.ddns.net
ayman1950.ddns.net
azedsq.hopto.org
bachir7.hopto.org
bbus19.ddns.net
bkjy1122334455.ddns.net
by900.zapto.org
bymixterix.duckdns.org
c5s3o-xd7esp.serveftp.com
cano.zapto.org
connectionsdfghhh.myftp.biz
connectionsxxx.ddns.net
corralesking.hopto.org
costa113.ddns.net
darkcomentsaved.duckdns.org
dasdsadsadsadsa.ddns.net
ddnsrat.ddns.net
delightc.myftp.biz
descobriu.ddns.net
dhayan.ddns.net
dzabdou.sytes.net
dzad.ddns.net
dzirione1.myq-see.com
dzspoukadz2.myq-see.com
eeq.ddns.net
ellisa.publicvm.com
emad1300.ddns.net
ethicalhacking.myftp.biz
ezcom.myftp.biz
fitnesswebsite.duckdns.org
free.sytes.net
ghgghg.ddns.net
gzzruler.ddns.net
hacker13534.myftp.org
hacker200.ddns.net
hacker4040.ddns.net
hackerhacker11.ddns.net
hackingloading157.ddns.net
hack-zozocraft6.ddns.net
hakonamatata8991.ddns.net
hasoneking753.ddns.net
hdaoud96.ddns.net
helal.hopto.org
hm-ma662ma.serveblog.net
hodaharhash90000.ddns.net
honma123.codns.com
hostname124.ddns.net
hostname1994.hopto.org
id7oomz.ddns.net
igi456.ddns.net
imkrapoke.ddns.net
infotechhdz.ddns.net
infra.giize.com
ippoofer.ddns.net
issa19900.ddns.net
itcoder1.myftp.biz
jack-12.ddns.net
jaguar19.ddns.net
jj8555765.ddns.net
jokertop1.zapto.org
julianas.duckdns.org
jutt9244.myftp.biz
kaliou.ddns.net
kanichnadia.duckdns.org
kaydo.ddns.net
kingdomro.viewdns.net
kira99.ddns.net
ksks.gotdns.ch
ksoo.hopto.org
kvinx.ddns.net
layane.ddns.net
leoleoer.ddns.net
lolyou312.ddns.net
m4grinexploit.ddns.net
m5drhm.ddns.net
mainjhin.duckdns.org
malokatest.duckdns.org
mamoon1.ddns.net
mazin131.myftp.biz
mezo454.myftp.biz
mgnoongmz.ddns.net
midoalhashmi.ddns.net
mixterix.duckdns.org
mk5-ma552ma.myddns.me
mmfff.ddns.net
mnbhaker-36090.portmap.io
mnbr0099887766.ddns.net
moha07.ddns.net
mohand8080.ddns.net
moncefneymar.ddns.net
moviesnews.hopto.org
mr4x.linkpc.net
mujo.ddns.net
myhomemainip00.sn-video.com
nadour.ddns.net
njhost.hopto.org
njrathacked8953.ddns.net
okmnji.ddns.net
Optimusz1-43372.portmap.io
oraes.hopto.org
otmanmess.ddns.net
patakos0010.ddns.net
ppooiimmnnbb00.ddns.net
protecteur6.ddns.net
pruebas10101.ddns.net
psycho77777.ddns.net
pwtk000001.ddns.net
q3alkhater123.ddns.net
qqwweerr.ddns.net
queda2122.ddns.net
rahmoni2710.myq-see.com
rampo123445.myftp.biz
raramimi123.ddns.net
rat24695.ddns.net
realandeasy.ddns.net
realhacking2018.3utilities.com
ricardobola.duckdns.org
rogeriouk.ddns.net
rorohack.ddns.net
sanform.publicvm.com
sasa123456789.ddns.net
securyt.servep2p.com
serveursam.hopto.org
serviceapatchhttps.duckdns.org
seskoal7rbe.ddns.net
shadownbr2021.ddns.net
shiheb.ddns.net
shmg.ddns.net
shytangz1.ddns.net
sowuid20181.ddns.net
spaececowboy.myddns.me
ssouma20.ddns.net
sunil.duckdns.org
the-don187.publicvm.com
trojanf.ddns.net
tuguldur.hopto.org
turlututu.zapto.org
updatesystem.linkpc.net
vanpir.no-ip.biz
wawa10.hopto.org
windowsdwm.ddns.net
wirelessdriver.onthewifi.com
wrk44.ddns.net
xcvxcvskljfsf8923742347234.publicvm.com
xderty.myq-see.com
xxx313.ddns.net
yojen0120.myddns.me
z3ror1997.ddns.net
zahanco.myftp.biz
zakizaki.hopto.org
zero4.ddns.net
zine31-43081.portmap.io
ziziduturfu.ddns.net
zmr.ddns.net
zmzm88881.ddns.net
zxcvbn1234566.ddns.net
zxcvbn123456.ddns.net
zzxxccllkkjj99.zapto.org

# Reference: https://twitter.com/ScumBots/status/1047951251009404929

freemind.ddns.net

# Reference: https://twitter.com/ScumBots/status/1048181516633878528

googleaccount.linkpc.net

# Reference: https://twitter.com/ScumBots/status/1048261057012219904

abcdefg1234.ddns.net

# Reference: https://twitter.com/ScumBots/status/1048344128248066048

roka131986.ddns.net

# Reference: https://twitter.com/ScumBots/status/1048381594044698625

dd333333.ddns.net

# Reference: https://twitter.com/ScumBots/status/1048441985911152640

updatefacebook.ddns.net

# Reference: https://twitter.com/ScumBots/status/1048479733468602368

lotsh.ddns.net

# Reference: https://twitter.com/ScumBots/status/1048596751517724672

ze9ahamza.ddns.net

# Reference: https://twitter.com/ScumBots/status/1048917618760056832

ordeksurat.duckdns.org

# Reference: https://twitter.com/ScumBots/status/1048698676967825408

rogerinho.ddns.net

# Reference: https://twitter.com/ScumBots/status/1048959173126488064

echoussama.ddns.net

# Reference: https://twitter.com/malwrhunterteam/status/979050802718367745

njdoander.duckdns.org

# Reference: https://twitter.com/malwrhunterteam/status/963858200520024064

0.tcp.ngrok.io

# Reference: https://twitter.com/MalwareConfig/status/915372033835520001

drunknown.ddns.net

# Reference: https://twitter.com/malwrhunterteam/status/893057627093164033

bigbossh.ddns.net

# Reference: https://twitter.com/malwrhunterteam/status/862962025651154945

xd.zapto.org

# Reference: https://twitter.com/JAMESWT_MHT/status/846731468667834369

fuckjazz.dynu.net

# Reference: https://twitter.com/malwrhunterteam/status/816373140079202304

islax56.zapto.org

# Reference: https://twitter.com/malwrhunterteam/status/789108744634458112

ra3d.noip.me

# Reference: https://twitter.com/malwrhunterteam/status/788036524629778433

njrat81.ddns.net

# Reference: https://twitter.com/malwrhunterteam/status/778302966294020096

fahed3099.ddns.net

# Reference: https://twitter.com/malwrhunterteam/status/759438636979019777

dark-angle03.zapto.org

# Reference: https://twitter.com/malwrhunterteam/status/759267113991278593

kheto.ddns.net

# Reference: https://twitter.com/malwrhunterteam/status/741910466864242688

kickassto.ddns.net

# Reference: https://twitter.com/malwrhunterteam/status/737591739356090368

medo70993.ddns.net

# Reference: https://twitter.com/ScumBots/status/1048996892032602112

njver.ddns.net

# Reference: https://twitter.com/ScumBots/status/1049023313027190784

ghome2222.ddns.net

# Reference: https://twitter.com/ScumBots/status/1049106366017757184

ezygone.ddns.net

# Reference: https://twitter.com/ScumBots/status/1049140334008123392

queda2122.ddns.net

# Reference: https://twitter.com/ScumBots/status/1049045963153833986

dd333333.ddns.net

# Reference: https://twitter.com/ScumBots/status/1049340538682572800

black444.myftp.biz

# Reference: https://twitter.com/ScumBots/status/1049476298383462402

ali.sytes.net

# Reference: https://twitter.com/ScumBots/status/1050069094756732928

avyrs.ddns.net

# Reference: https://twitter.com/ScumBots/status/1049983095418617856

ahmedhero2020.zapto.org

# Reference: https://twitter.com/ScumBots/status/1049793387967246336

rattatata.ddns.net

# Reference: https://twitter.com/ScumBots/status/1049774512785502208

haydaraliyev.duckdns.org

# Reference: https://twitter.com/ScumBots/status/1050159552749084672

samera20145.ddns.net

# Reference: https://twitter.com/ScumBots/status/1050189752924823552

valak666.duckdns.org

# Reference: https://twitter.com/ScumBots/status/1050442668692647942

aldery.linkpc.net

# Reference: https://twitter.com/ScumBots/status/1050604985061335042

goxu00.ddns.net

# Reference: https://twitter.com/ScumBots/status/1050578562644873216

sawhacker2.ddns.net

# Reference: https://twitter.com/ScumBots/status/1050544589097115648

mal3on.ddns.net

# Reference: https://twitter.com/ScumBots/status/1050488231689641984

8vg-ziln400x400.ddns.net

# Reference: https://twitter.com/ScumBots/status/1050469090538782721

microso.ddns.net

# Reference: https://twitter.com/ScumBots/status/1050639094621986818

kvinx.ddns.net

# Reference: https://twitter.com/ScumBots/status/1050733330327658498

medomshakel.ddns.net

# Reference: https://twitter.com/ScumBots/status/1050744659151073280

aaaassss123456789.ddns.net

# Reference: https://twitter.com/ScumBots/status/1050842802643488768

hack9991.hopto.org

# Reference: https://twitter.com/ScumBots/status/1050978698030125056

notelog11.ddns.net

# Reference: https://twitter.com/ScumBots/status/1051012675080196101

runtime.kro.kr

# Reference: https://twitter.com/ScumBots/status/1051076846283104256

unknown277.ddns.net

# Reference: https://twitter.com/ScumBots/status/1051095855783182336

ils.hopto.org

# Reference: https://twitter.com/ScumBots/status/1051133470523691008

yekihackers.ddns.net

# Reference: https://twitter.com/ScumBots/status/1051159894517272576

cafe.zapto.org

# Reference: https://twitter.com/ScumBots/status/1051212877758107648

satan969.ddns.net

# Reference: https://twitter.com/ScumBots/status/1051405264740597760

jhgjhgjhgjh.com

# Reference: https://twitter.com/ScumBots/status/1051454470041812992

systempc.duckdns.org

# Reference: https://twitter.com/ScumBots/status/1051488307966869505

wwwwxxwwww.zapto.org

# Reference: https://twitter.com/fumik0_/status/1050643239273779200

fanddes.ddns.net

# Reference: https://twitter.com/malwrhunterteam/status/1014949361623666690

redeworf71.duckdns.org

# Reference: https://twitter.com/malwrhunterteam/status/1005175184205271043

ikookady.hopto.org

# Reference: https://twitter.com/HuntressLabs/status/982622664815775744

online2018.duckdns.org

# Reference: https://twitter.com/MalwareConfig/status/915372033835520001

drunknown.ddns.net

# Reference: https://twitter.com/malwrhunterteam/status/893057627093164033

bigbossh.ddns.net

# Reference: https://twitter.com/JAMESWT_MHT/status/846731468667834369

fuckjazz.dynu.net

# Reference: https://twitter.com/0x766c6164/status/809109194783813632

nf12.no-ip.com
roro90.ddns.net

# Reference: https://twitter.com/0x766c6164/status/809104108703645696

5666.ddns.net

# Reference: https://twitter.com/malwrhunterteam/status/793876264377585665

oran20.linkpc.net

# Reference: https://twitter.com/Techhelplistcom/status/766497597943013376

florida.tinydns.tech

# Reference: https://twitter.com/Techhelplistcom/status/717859987897196544

apple-safe.dyndns-office.com

# Reference: https://twitter.com/peterkruse/status/917685310938603520

coralgroups.ddns.net
coralgroups.no-ip.biz
crypter.hopto.org
frenox.ddns.net
mrmoney.redirectme.net
syrian.duckdns.org

# Reference: https://twitter.com/ScumBots/status/1051775198683455488

maroxvi.ddns.net

# Reference: https://twitter.com/ScumBots/status/1051865796102823936

smsm2017.myddns.me

# Reference: https://twitter.com/ScumBots/status/1051805397441568768

barcelona2050.myftp.biz

# Reference: https://twitter.com/ScumBots/status/1051884670001078272

abdo122.ddns.net

# Reference: https://twitter.com/ScumBots/status/1051979041908158465

matrixabdo.ddns.net

# Reference: https://twitter.com/ScumBots/status/1052111159749435393

Wallah1215.linkpc.net

# Reference: https://twitter.com/ScumBots/status/1052122487872544769

mlp35717.ddns.net

# Reference: https://twitter.com/ScumBots/status/1052496199268401152

shabakher.ddns.net

# Reference: https://twitter.com/ScumBots/status/1052567922655326209

ezsemifud1337.zapto.org

# Reference: https://twitter.com/ScumBots/status/1052609442812968960

hazem11.ddns.net

# Reference: https://twitter.com/ScumBots/status/1052594350918684672

thyshit.ddns.net

# Reference: https://twitter.com/ScumBots/status/1052575600693706752

nanatsunotaizai.ddns.net

# Reference: https://twitter.com/ScumBots/status/1052726466964807680

amin26.ddns.net

# Reference: https://twitter.com/ScumBots/status/1052692491714088960

joshton.ddns.net

# Reference: https://twitter.com/ScumBots/status/1052681168645181441

raezo401.ddns.net

# Reference: https://twitter.com/ScumBots/status/1052888921363963904

cyberwar.myvnc.com

# Reference: https://twitter.com/ScumBots/status/1052971833279094789

savaki.duckdns.org

# Reference: https://twitter.com/ScumBots/status/1053013356670529539

hotspotshield.ddns.net

# Reference: https://twitter.com/ScumBots/status/1053272896804741120

testing8080.ddns.net

# Reference: https://twitter.com/ScumBots/status/1053353092287225856

frxy404.ddns.net

# Reference: https://twitter.com/ScumBots/status/1053417266291896320

windowsuport.duckdns.org

# Reference: https://twitter.com/ScumBots/status/1053379520164757504

anas3.ddns.net

# Reference: https://twitter.com/avman1995/status/1039733801189036034

google-llc1.ddnsking.com
domaingamer.webredirect.org

# Reference: https://twitter.com/avman1995/status/1036852068705816578

grandezadns.duckdns.org

# Reference: https://twitter.com/MalwareConfig/status/949754996299567104

no-proxy.myq-see.com

# Reference: https://twitter.com/MalwareConfig/status/666749550162526210

thejjkbq.ddns.net

# Reference: https://twitter.com/MalwareConfig/status/643516970793586688

forgetttt.publicvm.com

# Reference: https://twitter.com/ScumBots/status/1053587135998107648

system3333.ddns.net

# Reference: https://twitter.com/ScumBots/status/1053685287010877441

camikaze.ddns.net

# Reference: https://twitter.com/ScumBots/status/1053734356940976129

nixonhabbo.duckdns.org
