274 lines
5.9 KiB
Plaintext
274 lines
5.9 KiB
Plaintext
# Copyright (c) 2014-2026 Maltrail developers (https://github.com/stamparm/maltrail/)
|
|
# See the file 'LICENSE' for copying permission
|
|
|
|
# Aliases: rustystealer
|
|
|
|
# Reference: https://www.virustotal.com/gui/file/01caca23428e0f6d56feda4b411d989f4b0c8ad4dd28664f5f2b7de428b76004/detection
|
|
|
|
cookchildren.online
|
|
kapetownlink.com
|
|
planewool.xyz
|
|
prosefriend.online
|
|
tripsilver.xyz
|
|
send.planewool.xyz
|
|
x.prosefriend.online
|
|
|
|
# Reference: https://www.virustotal.com/gui/file/09d0cdc348159d318c85d24df59f9e6eef87378b5db0928098bfbead2001b0fe/detection
|
|
# Reference: https://www.virustotal.com/gui/file/1cb1a21abafc822d404532d535efe11cb0a6b48dcff8777918f1dc93526bcf44/detection
|
|
# Reference: https://www.virustotal.com/gui/file/4d65d18ae8bc2f0d964c4bd3edf69eaf3ebe0ff096c5c34a264d00250083e8db/detection
|
|
# Reference: https://www.virustotal.com/gui/file/60f42886a42faba991a42281867ad534f7941cf084bf2499f3207d92fdd8fdb9/detection
|
|
# Reference: https://www.virustotal.com/gui/file/d1fc40640387f0e0a1cc8b2ac456df926e7a5da518c06105c5e31ad47c130e4d/detection
|
|
# Reference: https://www.virustotal.com/gui/file/a426556070e6041b959712e0565f7659bd23c8b26fe6ab33f3ef4142110b7483/detection
|
|
# Reference: https://www.virustotal.com/gui/file/007e2862e63ee27c6e3648872ca75f72f7ae89a38345acff920af9d771545530/detection
|
|
|
|
antsmemory.xyz
|
|
beadhouse.xyz
|
|
blowaunt.xyz
|
|
clamwire.xyz
|
|
destructionheat.site
|
|
doorthing.website
|
|
jumpweight.website
|
|
mealcat.online
|
|
railthrill.xyz
|
|
rathobbies.xyz
|
|
restfork.website
|
|
seedcake.website
|
|
sidemark.xyz
|
|
theoryconnection.website
|
|
veinplantation.website
|
|
windactivity.online
|
|
231005002055611.bcn.lca62.shop
|
|
|
|
# Reference: https://www.virustotal.com/gui/ip-address/37.1.198.251/relations
|
|
|
|
ambadevgroup.info
|
|
haveastory.info
|
|
ilyincompany.com
|
|
mysoft.lol
|
|
mysoftwareusa.info
|
|
s63b44.info
|
|
safestatsapihost.info
|
|
shkiperlol.info
|
|
superload.info
|
|
usandeu.info
|
|
xlavaproduction.info
|
|
|
|
# Reference: https://www.virustotal.com/gui/ip-address/193.233.133.148/relations
|
|
|
|
bakbakbak.info
|
|
lavaproduction.info
|
|
mihomeme.info
|
|
|
|
# Reference: https://www.virustotal.com/gui/ip-address/92.246.136.253/relations
|
|
|
|
mydomen2.info
|
|
|
|
# Reference: https://www.virustotal.com/gui/file/4913d89ba0123fc0b260b78caf10bc858bd9a80acc93cdd71a3e4c46fb722935/detection
|
|
|
|
http://38.180.21.8
|
|
|
|
# Reference: https://x.com/JAMESWT_WT/status/1953054444658082228
|
|
# Reference: https://www.virustotal.com/gui/file/19d0c555a01d598acd0758ed2dd2fe11f0463c69fb2841142f5650ec594a9c53/detection
|
|
|
|
stoveweather.info
|
|
yarncontool.icu
|
|
|
|
# Reference: https://www.virustotal.com/gui/file/d33dec5994f60f81a577ac0b1014ba12cfa72d2f519c86803ae41814cd994ca3/detection
|
|
|
|
skintemper.xyz
|
|
toothbrushkettle.icu
|
|
|
|
# Reference: https://www.virustotal.com/gui/file/e7fae3501be53731b6da813ee2f8bd3cf33058393974d4d26ba6bd019a94d403/detection
|
|
|
|
ministerkiss.xyz
|
|
teethelbow.icu
|
|
|
|
# Reference: https://app.validin.com/detail?find=02c833a2ee65e620c245b2112086e3ee&type=hash&ref_id=e2bbd6709b6#tab=host_pairs (# 2025-08-06)
|
|
|
|
achieverart.space
|
|
airplanemove.info
|
|
airporticicle.info
|
|
api.phoenixgps.in
|
|
atlantichockey.org
|
|
baitstring.xyz
|
|
bangkok-service.net
|
|
bb.handssurprise.website
|
|
bhatkalnews.com
|
|
biketoes.xyz
|
|
birthdayreward.xyz
|
|
biteducks.sbs
|
|
bloodcrown.xyz
|
|
boneyarn.xyz
|
|
brand-award.com
|
|
bucketdeer.info
|
|
bulbname.xyz
|
|
buttoncamera.sbs
|
|
buttonsize.xyz
|
|
cableword.cfd
|
|
cakestoothbrush.icu
|
|
celestialvault.org
|
|
chalkrose.sbs
|
|
chalkwriting.space
|
|
chancethroat.icu
|
|
coilfood.xyz
|
|
coilwood.info
|
|
committeedinner.icu
|
|
committeegovernor.icu
|
|
crackarithmetic.icu
|
|
creampump.info
|
|
creatorbedroom.cfd
|
|
crimeauthority.cfd
|
|
crownsmoke.xyz
|
|
crowsalt.icu
|
|
crowstop.icu
|
|
dam.silkjam.online
|
|
daughtercemetery.xyz
|
|
detailminister.sbs
|
|
digitaltokens.xyz
|
|
distancesnails.cfd
|
|
distributioncurrent.icu
|
|
doctorframe.sbs
|
|
dogsjar.xyz
|
|
dropcoast.icu
|
|
e.spadesheep.xyz
|
|
echeloncasualmembership.com
|
|
eventauthority.info
|
|
everbodys.net
|
|
eyessock.info
|
|
ezrastorah.org
|
|
factlow.xyz
|
|
fairiespet.icu
|
|
fhand.com
|
|
flocksnakes.website
|
|
fronteranetworks.com
|
|
gavinouyang.com
|
|
gc-consortium.com
|
|
german.brand-award.com
|
|
governmentmoney.icu
|
|
grainink.website
|
|
grainsleet.cfd
|
|
grapecub.sbs
|
|
guidefrog.sbs
|
|
hairteeth.icu
|
|
hallchance.xyz
|
|
handsound.info
|
|
handssurprise.website
|
|
harmonybear.sbs
|
|
hkdgames.com
|
|
hotgrandfather.icu
|
|
houseshot.icu
|
|
houseslake.xyz
|
|
hydrantworm.icu
|
|
ikhtiarumrah.id
|
|
insectcrow.sbs
|
|
ironwealth.sbs
|
|
kalakrutiengineers.com
|
|
konverzija.si
|
|
laughincome.icu
|
|
leechall.com
|
|
lockplay.sbs
|
|
locksea.website
|
|
lotussglestari.com
|
|
magicvan.icu
|
|
meetingclover.xyz
|
|
memoryneck.info
|
|
mintborder.icu
|
|
mombike.cfd
|
|
mverp.com
|
|
navrang.com
|
|
neckrun.xyz
|
|
nervedime.website
|
|
newyearconcert.com
|
|
njathleticclub.net
|
|
nutkittens.info
|
|
onesmartmove.ca
|
|
pearactivity.xyz
|
|
personteam.cfd
|
|
picklebucket.xyz
|
|
playgroundstone.cfd
|
|
plotcake.icu
|
|
pointdinosaurs.xyz
|
|
pointrespect.xyz
|
|
potlove.xyz
|
|
powerpin.icu
|
|
powersmoke.xyz
|
|
producesound.xyz
|
|
proseharbor.xyz
|
|
punishmentslave.info
|
|
quincepart.icu
|
|
radioactivity.fm
|
|
railwaytime.xyz
|
|
rainrice.sbs
|
|
rainroad.icu
|
|
religionhome.icu
|
|
reststeel.website
|
|
robinkiss.info
|
|
robinrail.xyz
|
|
roofspade.info
|
|
roomside.sbs
|
|
rootflock.icu
|
|
seabusiness.xyz
|
|
shadeinsect.icu
|
|
shapework.cfd
|
|
shirtdowntown.xyz
|
|
sidefog.xyz
|
|
silkjam.online
|
|
silverbox.cfd
|
|
sisterobservation.icu
|
|
sistershook.icu
|
|
smellstamp.icu
|
|
sonplane.info
|
|
spacecondition.icu
|
|
spadesheep.xyz
|
|
sparkdonkey.icu
|
|
spoonkittens.sbs
|
|
spoonporter.xyz
|
|
stacjacafe.pl
|
|
steelactivity.website
|
|
steelteam.xyz
|
|
strawtalk.website
|
|
streetpage.icu
|
|
theoryquarter.cfd
|
|
thingspies.info
|
|
thrillcondition.xyz
|
|
tiagopremios01.com.br
|
|
toothbrushdoctor.xyz
|
|
totalweather.net
|
|
trainsrub.icu
|
|
tripshape.xyz
|
|
truckobservation.icu
|
|
try2dev.com
|
|
vasebird.xyz
|
|
visitorboy.info
|
|
volcanostop.xyz
|
|
volleyballsong.xyz
|
|
washlumber.icu
|
|
wavailability.com
|
|
weekinsurance.xyz
|
|
wildernessweight.cfd
|
|
winedebt.info
|
|
x8cut.com
|
|
yamhot.icu
|
|
yarncontrol.icu
|
|
yearducks.info
|
|
yxwdrama.com
|
|
|
|
# Reference: https://x.com/malwrhunterteam/status/1998789728548831353
|
|
# Reference: https://www.virustotal.com/gui/file/e4e09416c63536c975a88d1a43281948b69d52e7cb56febf15df23b9dd2fa7a1/detection
|
|
|
|
193.161.193.99:57952
|
|
|
|
# Generic
|
|
|
|
/api_pedl.php
|
|
/api_pedl.php?spot=
|
|
/track_inl2EU.php
|
|
/track_inl2EU.php?tim=
|
|
/pe/build.php?pe=n
|
|
/pe/buildIN.php
|
|
/pe/buildIN.php?sub=
|
|
/plo.php?spot=
|
|
/plopp.php?fz=
|
|
/ploss.php?a=
|
|
/tracker/thank_you.php?trk=
|