# Copyright (c) 2014-2019 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://github.com/fideliscyber/indicators/blob/master/Blogs/New%20URSNIF%20Targeting%20Italy%20and%20US/url.csv

creatortherefore.cn
goinumder.su
goyanok.at
hothegivforsuffer.cn
hulivam.at
justiceseasfriends.cn
lopertopgo.su
mid100.at
nexpoo.at
noopex.at
outaplaceshave.cn
pergozip.at
therepalon.su
trepeatedandequal.cn

# Reference: https://www.forcepoint.com/blog/security-labs/many-faces-ursnif-email-hijacking-mailslots-and-insecure-servers

14ca1s5asc45.com
9qwe8q9w7asqw.com
asd5qwdqwe4qwe.com
d4q9d4qw9d4qw9d.com
dq9wq1wdq9wd1.com
dqowndqwnd.net
eq9we1qw1qw8.com
fqw4q8w4d1qw8.com
g98d4qwd4asd.com
gtqw5dgqw84.com
hhhasdnqwesdasd.com
hhjfffjsahsdbqwe.com
jjasdkeqnqweqwe.com
kkjkajsdjasdqwec.com
kkmmnnbbjasdhe.com
mmmnasdjhqweqwe.com
oiwerdnferqrwe.com
ooaisdjqiweqwe.com
oooiasndqjwenda.com
oooiawneqweasd.com
oqk4123613123.net
oyiyuarogonase.net
popopoqweneqw.com
ppoadajsqwenqw.com
ppoasdqnwesad.com
pqwoeasodiqwejes232.com
q5q1wdq41dqwd.com
qiwjesijdqweqs.com
qw6e54qwe54wq.com
qw8e78qw7e.com
qwd1q6w1dq6wd1.com
qwd1qw8d4q1wd.com
qwdohqwnduasndwjd212.com
qwe1q9we1qwe51.com
qwekasdqw8412.net
qweoiqwndqw.net
qwojdaisd1231.net
qwqw1e4qwe14we.com
qwqweqw4e1qwe.com
qwundqwjnd.net
r9qweq19w1dq.com
rqw1qwr8qwr.com
rrrradkqwdojnqwd.com
sdf5wer4wer.com
sdjqiweqwnesd.com
t8q79q8wdqw1d.com
tr8q4qwe41ewe.com
tttiweqwneasdqwe.com
uuasdjqwehnasd.com
uurty87e8rt7rt.com
uuyyhsdhasdbee.com
wdojqnwdwd.net
wdq9d5q18wd.com
yyjqnwejqnweqweq.com

# Reference: https://www.f-secure.com/v-descs/trojan_w32_ursnif.shtml

bergesoma.com
polinodara.com

# Reference: https://www.cert-pa.it/news?id=10536

werwaarogonase.net
fhjjndiasnew.net
axewansdownew.net

# Reference: https://twitter.com/JAMESWT_MHT/status/1045682605662851073

d792jssk19usnskdxnsw.com
29uwuwousuw8wuwyuwie.com
ye8283yeiw283929wu2.com
h2812932937292sjshskz.com

# Reference: https://twitter.com/luc4m/status/1045671697268051968

h2812932937292sjshskz.com

# Reference: https://twitter.com/avman1995/status/1047018001810300928

382oiso10si8sowppdoiwpc.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1047414713850781697

/MXE/files/
/TOL/files/

# Reference: https://twitter.com/Bank_Security/status/1049640177361186818
# Reference: https://pastebin.com/mkMfAf9Z

app.kartop.at
doc.dicin.at
app.avitoon.at
doc.avitoon.at
ops.twidix.at
xx.go10og.at
api.kartop.at
m1.fofon.at
cdn.kartop.at
api.tylron.at
chat.twidix.at
api.kaonok.at
chat.jimden.at
mahono.cn

# Reference: https://twitter.com/ViriBack/status/1051565888212791296

hdiwuey872629hsgs18702837.com
k37aos82skd9nal92kamcdla.com

# Reference: https://twitter.com/mgiovamo/status/1051771811438964736

load.testmykickstarter.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1052469234159239168

37iwdmx103qlsmx.com
againstitudents.com
ey271psx8127301.com
woatinkwoo.com

# Reference: https://blog.minerva-labs.com/attackers-insert-themselves-into-the-email-conversation-to-spread-malware

nesocina.com
tapertoni.com
tenicoriv.com
onkoloper.com
nidersona.com
maxigozo.com
nasodirom.com

# Reference: https://twitter.com/Bank_Security/status/1055099888906702850
# Reference: https://pastebin.com/DYZhgSnH

kiki.33gourmetdelinyc.com
loads.smallworld-parties.com
load.kapswholesale.com
mino.aghapyfoodridgewood.com
nupp.810delicafe.com
nopp.ajisaijapanesenyc.com
pool.jfklandscape.com

# Reference: https://www.nttsecurity.com/docs/librariesprovider3/default-document-library/jp_ursnif_20161226

i56a4c1dlzcdsohkwr.biz
66ssywiogjvwljaopw.com
reebovnenewbne001.com
neneeeenqwenene188.com
ceeoerunw10.com
echo.listentree.com
pop.lawadviceonline.org
licensecanadian.ru
arewithoutwarranty.xyz
thenotwithsoldsuequiv.ru
goglosmmosss.com

# Reference: https://blog.yoroi.company/research/ursnif-long-live-the-steganography/

pereloplatka.host
roiboutique.ru
uusisnfbfaa.xyz
nolavalt.icu
sendertips.ru

# Reference: https://www.cybereason.com/blog/new-ursnif-variant-targets-japan-packed-with-new-features

baderson.com
mopscat.com
gorsedog.com
pintodoc.com
ropitana.com
pirenaso.com
papirosn.com
delcapen.com

# Reference: https://twitter.com/avman1995/status/1094181713121558529

qfelicialew.city
mzg4958lc.com
gxuxwnszau.band

# Reference: https://twitter.com/avman1995/status/1108760534894170113

insurancephotolive.xyz
nophotoinsecure.xyz
topolotonop.xyz

# Reference: https://twitter.com/avman1995/status/1108623779062861824

fnyah44.email
wrladoph.city
rsf58.city
subaldodd.email

# Reference: https://twitter.com/James_inthe_box/status/1109520290323693568

keepincomemoney.website

# Reference: https://blog.talosintelligence.com/2019/03/threat-roundup-0315-0322.html (Win.Malware.Ursnif-6896385-0)

kkariannekatrina.company
f61leeii.com
qmitchelkp.com

# Reference: https://otx.alienvault.com/pulse/5c9a405e5645c8011c7030f3

blogger.scentasticyoga.com

# Reference: https://twitter.com/bomccss/status/1110997371188465664

sumeriun.com

# Reference: https://twitter.com/gorimpthon/status/1078159820371288064

thatconditions.online

# Reference: https://twitter.com/gorimpthon/status/1077498826934480896

theanyexppatent.online

# Reference: https://twitter.com/Sec_S_Owl/status/1084967201222717440

theincludingte.online

# Reference: https://twitter.com/58_158_177_102/status/1087514326607355904

freetoper.accountant

# Reference: https://twitter.com/AES256bit/status/1079582045439877121

tformlicensable.online

# Reference: https://twitter.com/gorimpthon/status/1078159820371288064

thatconditions.online

# Reference: https://twitter.com/gorimpthon/status/1077498826934480896

theanyexppatent.online

# Reference: https://twitter.com/AES256bit/status/1063113281441738752

cjwefomatt.com
dubbergergbb.com
ticrerfgiff.com

# Reference: https://twitter.com/bomccss/status/1103211371817197568

mopscat.com

# Reference: https://twitter.com/CybereasonJPSOC/status/940267086802063360

comanylimiteddocume.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1113063803753684995
# Reference: https://app.any.run/tasks/223464af-a7be-454b-8f8f-2a8819bde8c1

posakloska.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1113429156040196096
# Reference: https://app.any.run/tasks/22f1f4c3-0297-49a9-89a9-787eee944de9

adonis-medicine.at

# Reference: https://blog.yoroi.company/research/ursnif-the-latest-evolution-of-the-most-popular-banking-malware/

nuovalo.icu
nuovalo.site

# Reference: https://twitter.com/avman1995/status/1116271689057427456

lunchrappz.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1117694292359819265
# Reference: https://app.any.run/tasks/ca845868-1bba-47ac-8fc5-cf3ba9b86b80

eloiyus.site
nuovalo.icu

# Reference: https://twitter.com/JAMESWT_MHT/status/1117711355363168256
# Reference: https://app.any.run/tasks/f6198a2a-e3c2-48dd-b1ab-dcd723770fd1

itschoolegz.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1123206109421027329
# Reference: https://pastebin.com/NqSBZYCd

npou82vb.info
xjustusia37.xyz

# Reference: https://blog.talosintelligence.com/2019/05/threat-roundup-0426-to-0503.html (# Win.Malware.Ursnif-6957672-0)

ciemona.top
fqwalfredoesheridan.info
resolver1.opendns.com
vmelynaa.club
zwbaoeladiou.xyz

# Reference: https://twitter.com/bomccss/status/1125667764868247552

lidersonef.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1125746846335479808

b49ealsgrjf63w.info

# Reference: https://twitter.com/VirITeXplorer/status/1126015303312396288

sharktankdigestq.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1126044178327191558

velissimilio.site
zxcvsdffffdsv.icu

# Reference: https://twitter.com/VirITeXplorer/status/1128936190311391233

jxfps21tjohnathon.xyz
ntyrique6024karlie.xyz

# Reference: https://twitter.com/JAMESWT_MHT/status/1130797257375330304
# Reference: https://twitter.com/James_inthe_box/status/1130805489707520000
# Reference: https://pastebin.com/ZUKsE8FQ

r588uaacornell.info
tzdottopm.xyz
v22xscot.info

# Reference: https://twitter.com/SethKingHi/status/1131762896793268224

fbilly75.com
tcletuswi.top
vtaeladarius47.com

# Reference: https://twitter.com/sugimu_sec/status/1133293529025744896

newupdatindef.info

# Reference: https://twitter.com/JAMESWT_MHT/status/1133327173467672581

loaidifds.club

# Reference: https://twitter.com/SethKingHi/status/1133565099577266176

dohilda.club
m49crod.info
mshaun24sidney.top

# Reference: https://twitter.com/sugimu_sec/status/1133714003455168512

aliooird.us

# Reference: https://twitter.com/sugimu_sec/status/1133716946967416835

doliurt.icu

# Reference: https://twitter.com/VirITeXplorer/status/1134009733705359360

clarrywillow.top
rueu5334.info

# Reference: https://twitter.com/JAMESWT_MHT/status/1134039582729822209

office-365-cloud6-2.pw

# Reference: https://twitter.com/JAMESWT_MHT/status/1134373743634071557

sumvawe1s.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1134438287358271489

tericks90.info

# Reference: https://pastebin.com/8AkBCP3p

cannamariecordell.com
hchyna985.top

# Reference: https://twitter.com/JAMESWT_MHT/status/1135815803880820742
# Reference: https://twitter.com/sugimu_sec/status/1135818200455626752

http://176.10.118.191
markeettit.club
markeettit.email
riehmconstruction.com
westseattlenailsalon.com

# Reference: https://twitter.com/58_158_177_102/status/1136164132279861248

paderson.top

# Reference: https://twitter.com/JAMESWT_MHT/status/1136181780531294208

allspanawaystorage.net
extrastoragesandiego.com
searchstoragequote.com
usastoragenetwork.com

# Reference: https://twitter.com/VirITeXplorer/status/1136165811968716800

gopickupnow.com

# Reference: https://twitter.com/58_158_177_102/status/1136162140283236352

firedron.top

# Reference: https://twitter.com/VirITeXplorer/status/1136529259000995840

mmmtbsusanna.info
r52yoo.top

# Reference: https://twitter.com/JAMESWT_MHT/status/1136542388510441472

vduncanoo.club

# Reference: https://twitter.com/Racco42/status/1136991881626341377

blockshain.info

# Reference: https://twitter.com/sugimu_sec/status/1137987552097366016

iqqoiuetyd.club
niloiuyrt.info

# Reference: https://twitter.com/bomccss/status/1138620211140030464

marcoplfind.at

# Reference: https://twitter.com/Bank_Security/status/1138680380242968576
# Reference: https://pastebin.com/ut0fw5Ry

filomilalno.club
fileneopolo.online
reziki.online
reziki.xyz

# Reference: https://twitter.com/VirITeXplorer/status/1138703768994758656

b64zwvi.top
mjoan95bn.info

# Reference: https://twitter.com/58_158_177_102/status/1140519789368098818

timenard.top
tupeska.top

# Reference: https://twitter.com/reecdeep/status/1140880338790617089

m6147keeganpw.info

# Reference: https://twitter.com/VirITeXplorer/status/1141597876432322560

dmurrayh52k.club
fconnieao.club

# Reference: https://twitter.com/sugimu_sec/status/1141618472612319232

iluuryeqa.info
ueba6ka.club

# Reference: https://twitter.com/JAMESWT_MHT/status/1141636986912018432

jyoe91alverta.top

# Reference: https://twitter.com/James_inthe_box/status/1141788413697253376

api.fiho.at
digital.audiobookjunkie.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1141969652656082944

uytr5e.imtbreds.com

# Reference: https://twitter.com/reecdeep/status/1142006559247097856

iluuryeqa.info

# Reference: https://blog.talosintelligence.com/2019/06/threat-roundup-0614-0621.html (# Win.Malware.Ursnif-6995948-1)

capoverso.info
cyberplay.at

# Reference: https://twitter.com/killamjr/status/1143138622289391616

zuvwax.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1143483784605708291

sdelaneyuaclotilde.club

# Reference: https://twitter.com/JAMESWT_MHT/status/1144155439598309376
# Reference: https://app.any.run/tasks/383c4c0a-e2f0-46d2-9688-27243cd17681/

n82burdette62.top

# Reference: https://twitter.com/reecdeep/status/1144156253075247104

fundoluyr.fund

# Reference: https://twitter.com/JAMESWT_MHT/status/1144154461759311872

mmontyireina.club
riul.xyz
s62mxcn.club

# Reference: https://twitter.com/sugimu_sec/status/1144180837526585344

48727711.xyz

# Reference: https://twitter.com/JAMESWT_MHT/status/1145676603038605312

g69jylv.xyz
koe32dayton.com
woa79ewinfield.club

# Reference: https://twitter.com/VirITeXplorer/status/1145961294945771521

je28oy379.info

# Reference: https://twitter.com/p5yb34m/status/1146420354564280321

danforthdrugmart.ca
toolz22n5.info

# Reference: https://twitter.com/gorimpthon/status/1147099717693661185

pjr82milford.xyz
cio12y21e99.top
pp70guy53kevin.top

# Reference: https://twitter.com/luc4m/status/1148855879686656000
# Reference: https://pastebin.com/F24ifaDe

celvai.info
wlulua99reagan.info
wms533713juana.club

# Reference: https://github.com/stamparm/maltrail/pull/2869/commits/aef8355aa623f3a137aa885dd6b844b17115b371

cocoon1city.com
kolaandpepsi.com
lloydsbankdocs.com

# Reference: https://twitter.com/reecdeep/status/1151405327335743488

http://185.193.141.248/gs.php
fcamylleibrahim.top
viuecody.club

# Reference: https://twitter.com/sugimu_sec/status/1151491320956874754

qo34789g.xyz

# Reference: https://twitter.com/VirITeXplorer/status/1152118722577993728

thebohuff.com

# Reference: https://twitter.com/VirITeXplorer/status/1152121710369546245

roza1beach.com

# Reference: https://twitter.com/VirITeXplorer/status/1152118727036588032

kolaawhatepsi.com
wyattspaintbody.com

# Reference: https://twitter.com/killamjr/status/1152235739679059969

jpearl26kacey.top
sdorthyyantonietta.top
cutaylorpascale.top

# Reference: https://twitter.com/0bfusCat/status/1153266712130859009

project-xxx1.biz

# Reference: https://twitter.com/P3pperP0tts/status/1154325581795696640

blaneymarquise.info
prnaajm83.club
rcamryny.xyz

# Reference: https://twitter.com/JAMESWT_MHT/status/1154380971753529344

http://109.196.164.79/3.php

# Reference: https://twitter.com/58_158_177_102/status/1155753745486974976

irwhfgowe.xyz
newupprolods.club
riuytessl.xyz

# Reference: https://twitter.com/58_158_177_102/status/1155758187309436928

siurreje.xyz
aliiuyrt.xyz
aliiuyrt.space
newupprolods.fun

# Reference: https://twitter.com/Mesiagh/status/1156235282515025920
# Reference: https://pastebin.com/PYgnFqSU

c67562ukx.top
czgpoy30kane.xyz
zbmou8oa.top

# Reference: https://twitter.com/smica83/status/1156482263019872256

powerprivat.ru
trading-secrets.ru
vaslbnt.ru
intrade-support.at
66.181.168.248:80

# Reference: https://twitter.com/reecdeep/status/1156538323206311936

q9676cassie.com

# Reference: https://twitter.com/reecdeep/status/1156813693872726017

d8021.club
pgtimelda97.top
w47cldemario.top

# Reference: https://twitter.com/killamjr/status/1159088302965833728

t10zulamgya.com

# Reference: https://twitter.com/Cybor_Tooth/status/1161683663840514050

zvaleriefs96.com

# Reference: https://twitter.com/killamjr/status/1161713701684174848

hoal9.com

# Reference: https://twitter.com/sugimu_sec/status/1163786238685401088

llooioloi.xyz

# Reference: https://twitter.com/sugimu_sec/status/1163813726962606081

newupprolods.club

# Reference: https://twitter.com/zuinmichele/status/1164088051418697729
# Reference: https://twitter.com/zuinmichele/status/1164088197485387776

asksuze.com
suze10n1.com
vregbqeg.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1164132237195063296

moneymindedmoms.com

# Reference: https://twitter.com/BompaniMarco/status/1164444291701313537

13287469.best
egiiuouy.club
newupprolods.club

# Reference: https://twitter.com/JAMESWT_MHT/status/1164879244759113729

goarebecao.club
khgyurm.com

# Reference: https://twitter.com/killamjr/status/1164988661848510464

bsamnz.com
gjoannemajor.com

# Reference: https://twitter.com/luc4m/status/1165285566012907520
# Reference: https://pastebin.com/78khyf1y

waehaylieoumaximus.top
wtlverner.club
zjackyouoa.top

# Reference: https://twitter.com/JAMESWT_MHT/status/1165999042180128770
# Reference: https://twitter.com/malware_traffic/status/1166090267767791616

b71t2012.xyz
jt23932.xyz

# Reference: https://twitter.com/sugimu_sec/status/1166005809001558016

mzy48domenico.com

# Reference: https://twitter.com/killamjr/status/1166347365235724288

k23ueugeniay.com
sizfjalenk51.com
v25brigittet.com

# Reference: https://twitter.com/killamjr/status/1166350012961435648

cdn5.inmax.at

# Reference: https://twitter.com/JAMESWT_MHT/status/1166610985106493443

sizfjalenk51.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1166993754697453568

lyckapost.xyz

# Reference: https://twitter.com/JAMESWT_MHT/status/1167048860327452677

qmiller.club

# Reference: https://twitter.com/JAMESWT_MHT/status/1167442145231482880

essaycomplete.xyz
eroomia.com
zuoashlyc.com

# Reference: https://twitter.com/killamjr/status/1167513746689970178

ze5upyoybvc0yeke.com
zuoashlyc.com
x4fwben.xyz
rreynold77.club

# Reference: https://twitter.com/reecdeep/status/1168776666790944768

gfewvb6phuhcjy.com

# Reference: https://twitter.com/VirITeXplorer/status/1168797417417904128

xiviola30heber.xyz

# Reference: https://twitter.com/James_inthe_box/status/1168914983578755073

ciaraburkett.xyz

# Reference: https://twitter.com/gigafio/status/1168927448223932416

tanguear.it
hsz59c1evs1h30.com
x77unhucolten.com

# Reference: https://twitter.com/reecdeep/status/1168776666790944768

107gam.com
10bonusonline24.info
406lawyers.net
alicetheguru.com
atbstroy.com
harpbyrequest.com
litum.org
mesondelprincipe.com
miamicoffeebar.com
orangetheorymb.com
rosenstock.net
stat-football.com
zepcnc.com

# Reference: https://twitter.com/reecdeep/status/1169174309149061121
# Reference: https://app.any.run/tasks/816dc2bd-2f23-4d06-b16f-7f8e904059c7/

alloiudh.casa

# Reference: https://twitter.com/reecdeep/status/1169178088963543040

llaiuyeiv.xyz

# Reference: https://twitter.com/James_inthe_box/status/1169265148659261441
# Reference: https://pastebin.com/VyyyMUJa

d2h2e7azvio4e7sp.com
hateatate.xyz
tcolleen4463dn.com
v57zfvp.com

# Reference: https://twitter.com/notajungman/status/1169274359397199872

zbtgcvclwr3qoz7h.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1169280410238562304

gl6063f3cc237zqm.com
kv4gfnj59y0r9q6l.com

# Reference: https://twitter.com/malware_traffic/status/1169312743956066305

pb128o6c2favwk.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1169592043246690304

gbszciag8tgf2m.com

# Reference: https://twitter.com/Paladin3161/status/1169588648259411968
# Reference: https://pastebin.com/Z7YSad5d

t2.fiho.at
u2.inmax.at

# Reference: https://twitter.com/malware_traffic/status/1169727825823354880

f39fxnzeanabelle.xyz
sdscqgtm63mz1b.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1169899678453731329

bostonfrogpond.com
neobootcamp.xyz

# Reference: https://twitter.com/JAMESWT_MHT/status/1169936612769370112
# Reference: https://app.any.run/tasks/ff7fda21-ff34-4b9d-bae0-6588d0682e0e/

ty29lt.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1171034830143987712

w6948qzoila.xyz

# Reference: https://twitter.com/luc4m/status/1171721625043161092

ooakieyrc.xyz

# Reference: https://twitter.com/reecdeep/status/1172056906803924995

wantriopplos.xyz

# Reference: https://twitter.com/gigafio/status/1172481607334342657

tabibmadical.com

# Reference: https://twitter.com/VirITeXplorer/status/1173879933124448256

30082019.xyz
aliiuyrt.xyz
bateshkeeutgv.best
fileouya.xyz
leuzervllik.website
rezervoi300819.online
zelrvllik.fun

# Reference: https://twitter.com/JAMESWT_MHT/status/1175037824451665926

limitsno.at

# Reference: https://twitter.com/pancak3lullz/status/1175089086614462464

tkynyd710wiw.com

# Reference: https://twitter.com/pancak3lullz/status/1175081472945983490

gyttgod.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1176152753510473729

shvaiwq.com

# Reference: https://twitter.com/reecdeep/status/1176383004995923968

centalnana.com
the53augustine.com

# Reference: https://twitter.com/sugimu_sec/status/1176409540004200448

newupistebls.shop
UpdatelinkNew.cc

# Reference: https://twitter.com/Mesiagh/status/1176245402737135616

chiasun.xyz
eleanora.xyz
sweetlights.at

# Reference: https://twitter.com/reecdeep/status/1176743174133432322

skindnarog.com
twbaayoe.com

# Reference: https://twitter.com/reecdeep/status/1176754046352408578

asinaptali.com

# Reference: https://twitter.com/VirITeXplorer/status/1176764806344380416

utirierons.com
huminatacp.com
meartitalo.com
jmmeamafaldaannamae.xyz

# Reference: https://twitter.com/reecdeep/status/1176809589418975232

UplUpdkb21.pw

# Reference: https://twitter.com/JAMESWT_MHT/status/1177238068618846208

noteboockfix993.info
guiqkuoeelenor.top

# Reference: https://twitter.com/58_158_177_102/status/1178963613882601472

alister-mathmatics.club

# Reference: https://twitter.com/JAMESWT_MHT/status/1179294188107653120

soatti2.com
x91aot53.club

# Reference: https://twitter.com/w3ndige/status/1179292167652679680
# Reference: https://app.any.run/tasks/ee7bf38d-c9ad-4ded-a236-10c54eae623c/

miooosooosos.xyz

# Reference: https://twitter.com/luc4m/status/1179351029726502912

lfdxf54ia.com
muucriogabe.com

# Reference: https://twitter.com/blu3_team/status/1179544056457768962
# Reference: https://app.any.run/tasks/e2cc76c0-0551-496f-8830-65b4a5de6077/

cornsholav.com

# Reference: https://twitter.com/VirITeXplorer/status/1179663290118615040

gonetplay.xyz

# Reference: https://twitter.com/dor0n1/status/1179663720974303232

doizvethea.xyz

# Reference: https://twitter.com/JAMESWT_MHT/status/1179721642462851074

fornewinst0310.info
majavontehm.com

# Reference: https://twitter.com/w3ndige/status/1180003595921612805
# Reference: https://twitter.com/w3ndige/status/1180003598039683072
# Reference: https://app.any.run/tasks/2ce5a776-f5f9-4724-a652-ce6a08e5f268/

buismashallah.at
doollsllslaas.xyz
ey7kuuklgieop2pq.onion
joskaejw.xyz
shoshanna.at

# Reference: https://twitter.com/James_inthe_box/status/1180124151320698880
# Reference: https://app.any.run/tasks/3ab547c6-d615-46f4-8a96-94ba4458d48f/

angiasatop.com
fumpregere.com

# Reference: https://twitter.com/bomccss/status/1180442530548076544
# Reference: https://app.any.run/tasks/b98c0ab1-0c9f-465c-83e2-c476ec4786c8/

limitsno.at
mashallah.at

# Reference: https://twitter.com/sugimu_sec/status/1181139013362544640

pianiilii.pw

# Reference: https://twitter.com/luc4m/status/1181158309845450752

aaxvkah7dudzoloq.onion
anumal-planet.at
weekends-estate.xyz

# Reference: https://twitter.com/sugimu_sec/status/1181195928469852160

newupistebls.online

# Reference: https://twitter.com/VirITeXplorer/status/1181244650432192513

finlllaio.club
finlllaio.host
finlllaio.space
zelrvllik.fun
30082019.xyz

# Reference: https://twitter.com/JAMESWT_MHT/status/1181512884637114373

kenneyai.xyz

# Reference: https://twitter.com/VirITeXplorer/status/1181466099252109313

atomoton.xyz
customwastereceptacles.com
enrichcollege.xyz
prodartsfans.com
suckpussycat.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1181515327223545857

laogxsc3377allison.club

# Reference: https://twitter.com/abuse_ch/status/1181521509971644416

reejosephiney.top
wr29shaniakobe.xyz
zkeaganarlie.xyz

# Reference: https://twitter.com/JAMESWT_MHT/status/1181465402611777536

attorneyfd.com
corsoesq.info
enrichcollege.xyz
customwastereceptacles.com
national-industries.com
newplannersolutions.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1181833036478009345

hemamasandthepapasband.com
barradesalinas.com
proboxingfans.com
emilystravel1.com

# Reference: https://twitter.com/VirITeXplorer/status/1181850076857155584

finemineraldealers.co
forensicpursuit.info
proboxingfans.com

# Reference: https://twitter.com/reecdeep/status/1181851038753656833

alerihbfer.xyz

# Reference: https://twitter.com/reecdeep/status/1181854384101216257

newupistebls.shop

# Reference: https://twitter.com/JAMESWT_MHT/status/1181930891133804544

gacraze0710.com
t7763jykqeiy.com

# Reference: https://twitter.com/VirITeXplorer/status/1182185779860299776

adigitalteam.com
randyrash.xyz
theramones.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1182236944467714048

cartoons-online.at

# Reference: https://twitter.com/JAMESWT_MHT/status/1182270410601222147

puylzmay.xyz

# Reference: https://twitter.com/sugimu_sec/status/1182284839061348352

c66845582aniyah.club
dcz35percy.top
tfernzq.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1182552698459250689

deidrekreuz.com
newmillerhvac.com
samportal.com
skinrenaissanceclinic.net
spaceagemeat.xyz
sprintnetworksti.com
thekingofsoul.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1182560077070454786

vip-statistic.at

# Reference: https://twitter.com/James_inthe_box/status/1182682649753600000

tenusitidi.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1183647452353695745

bracesonpostcard.com
startdfy.com
yourpremiersmile.com
adultprizes.xyz

# Reference: https://twitter.com/VirITeXplorer/status/1183639745726943232

carringtonit.xyz
thefuturesgame.biz

# Reference: https://twitter.com/w3ndige/status/1183799724979249152

jonkortyjjsas.xyz
joskaejw.club
maiamirainy.at
seioodsoi.club
ujaioep.website

# Reference: https://twitter.com/w3ndige/status/1181989173458288640

chetropposdsa.xyz

# Reference: https://twitter.com/w3ndige/status/1181276348003864576

proposopsd.xyz

# Reference: https://twitter.com/reecdeep/status/1184023581455454209

raloautt.pro

# Reference: https://twitter.com/luc4m/status/1184049545833058304

livejunto.xyz

# Reference: https://twitter.com/JAMESWT_MHT/status/1184120117929611265

qisqholden.com

# Reference: https://twitter.com/sugimu_sec/status/1184448482641240065

newupistebls.site
obolko.site

# Reference: https://pastebin.com/HLnQT4qy

votaritar.at

# Reference: https://twitter.com/abuse_ch/status/1184757198364258304

sjoanie52v3.com
wgersonioia.com

# Reference: https://www.sentinelone.com/blog/writing-malware-traffic-decrypters-for-isfb-ursnif/

bemiljqjohnpaul.com
jjasonbenedict.top

# Reference: https://twitter.com/JAMESWT_MHT/status/1185078973614743552

sac-sofom.com
patinauniversity.net
northcarolinaforeclosuresforsale.com
jostensarlington.com
emilystravel1.com

# Reference: https://twitter.com/reecdeep/status/1186552161255280640
# Reference: https://twitter.com/reecdeep/status/1186572239006846976
# Reference: https://twitter.com/sugimu_sec/status/1189110803716165632

slalloim.host
slalloim.pw
slalloim.site
slalloim.space

# Reference: https://twitter.com/reecdeep/status/1186555095049211904

iehrbfoei.xyz

# Reference: https://twitter.com/JAMESWT_MHT/status/1186556083927691264

wngtdpablo.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1187274922588082176

issmalta.xyz
mrsvgnpwr.com
waszkovia.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1187319895685500928

nokatelinabe.top
r8566noahthea.com
wlnfermin.com

# Reference: https://twitter.com/killamjr/status/1187731670696378368

bullisworg.com

# Reference: https://twitter.com/killamjr/status/1187733046377754624

cy56emie.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1187699534144651265

mqz8342lela.com

# Reference: https://twitter.com/Paladin3161/status/1187740438180061185

rexa.at

# Reference: https://twitter.com/sugimu_sec/status/1189113687711219712
# Reference: https://twitter.com/reecdeep/status/1191283783644917760

oeuhbfqw.xyz
oeurhbf.xyz

# Reference: https://twitter.com/JAMESWT_MHT/status/1191280036273360896
# Reference: https://app.any.run/tasks/140d1cda-31c4-4151-9f88-cec83f2475a1/

chucelo.fun
chucelo.pw

# Generic trails

/%20%20%20%20.php
/2poef1/j.php
/Flux/tst/index.php?l=
/iwp01-2ksm/20918201.php
/loq91/10x.php
/p109/mv.php?l=
/pwoxi444/vpvop.php
/qoie8rg/m1m2m.php
/qtra/ttqr.php
/rgpsl/ie.php
/s9281P/yt1.php
/skoex/po2.php
/xap_102b-AZ1/704e.php
/3retyxo2m.php
/83939-2039.php
/89289_928_1.php
/cecolf.php
/fgoow.php
/huonasdh.php
/Jingu.php
/jogptfbuu
/levond.php
/nerkom.php
/opanskot.php
/pagjfut54.php
/paghgutj44.php
/pagig84.php
/pagigmu48.php
/pagioiu88.php
/pagkype32.php
/pagnuko56.php
/pagnupo27.php
/pe10pd.php
/si2s81-19.php
/suoepwxpamxapxlamslxdo.php
/transaction.php2
/traxic.php
