# Copyright (c) 2014-2019 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://twitter.com/ps66uk/status/1032177208335450112
# Note: C2 direct link is added due to remark from #239

http://occe.com/image1/image/Panel/five/fre.php

# Reference: https://twitter.com/malwrhunterteam/status/1032537769787183104

americaircairmakan.com
botnet.americaircairmakan.com

# Reference: https://twitter.com/FewAtoms/status/1033040103155871744

agodatex.ga
http://185.185.40.152/jeff/five/fre.php

# Reference: https://twitter.com/olihough86/status/1033055339359420417

polixservices.com

# Reference: https://twitter.com/0xffff08000/status/1033054440306036737
 
http://embramedica.com.br/site/wp-content/plugnis/ipconfig/five/PvqDq929BSx_A_D_M1n_a.php
 
# Reference: https://twitter.com/malware_traffic/status/1033003634001367042
 
yardng.com
 
# Reference: https://twitter.com/pollo290987/status/1032998085503447041
 
rmsalf.com

# Reference: https://twitter.com/olihough86/status/1031644479109963776

http://191.101.42.43/fdgd/five/PvqDq929BSx_A_D_M1n_a.php
http://studemplo.com/admin/studemplo/Panel/five/PvqDq929BSx_A_D_M1n_a.php
phcc-india.com
typrat.club
www.cem-hk.co

# Reference: https://twitter.com/asset_island_/status/1031608741504933889

pldtdsll.net

# Reference: https://twitter.com/0xffff08000/status/1031613343797207040

claudfx.win

# Reference: https://twitter.com/pollo290987/status/1031544753505165312

http://191.101.42.43/fdgd/five/fre.php

# Reference: https://twitter.com/James_inthe_box/status/1030579493910413312

acadaman.com
dandoesinternet.com

# Reference: https://twitter.com/James_inthe_box/status/1030487639688794115

kelvinarinze.ml
www.scoverykingdom.gq

# Reference: https://pastebin.com/UGm39pdU
# Reference: https://pastebin.com/mgVvSRHi

http://002vt.tk/james/fre.php
http://141.105.71.166/me/fre.php
http://141.105.71.76/blz/fre.php
http://151.80.162.219/marle/fre.php
http://185.111.75.169/cart/disk/fre.php
http://185.148.146.193/~agroinovate/zizisisi/Panel/five/fre.php
http://185.206.144.81/lawi/fre.php
http://185.24.233.254/donep/fre.php
http://185.24.233.32/open/libs/fre.php
http://185.24.233.46/dusx/busz/fre.php
http://185.24.233.74/dusk/hond/fre.php
http://185.24.233.79/baca/opio/fre.php
http://185.24.233.80/pend/chan/fre.php
http://188.215.229.41//GIS/fre.php
http://191.101.42.43/fdgd/five/fre.php
http://31.220.2.200/~hancockw/nok/five/fre.php
http://31.220.2.200/~justicet/ag/five/fre.php
http://5.206.226.99/juicy/fre.php
http://80.211.102.126/deve/tide/fre.php
http://84.38.132.105/oki/Panel/fre.php
http://84.38.133.160/new/Panel/fre.php
http://85.254.72.30/donbig/c1/fre.php
http://89.187.86.7/~blackdia/new/mhoney/fre.php
http://89.187.86.7/~blackdia/vic/bless/fre.php
http://89.45.67.131/smg/fre.php
http://89.45.67.145/emy/fre.php
http://ace.alasrglobal.com/ace/Panel/five/fre.php
http://ace.alasrglobal.com/skinny/Panel/five/fre.php
http://ace.alasrglobal.com/wise/Panel/five/fre.php
http://ackh.ir/gabi/five/fre.php
http://ackh.ir/hamid/five/fre.php
http://ackh.ir/papa/five/fre.php
http://ackh.ir/sp/five/fre.php
http://adrack.us/wp-content/uploads/five/fre.php
http://ahmad52sell.cf/admin/five/fre.php
http://alexamondwonderltd.com/freeBrow/fre.php
http://alpacham.com/ndretr5478/fre.php
http://anitoid.alasrglobal.com/austine/five/fre.php
http://araslanow.net/js/Panel/five/fre.php
http://araslanow.net/wipadmin/Panel/five/fre.php
http://awele.duckdns.org:1717/zip/fre.php
http://babasoft.ooo/fre.php
http://bapican.com/image/admin/Panel/five/fre.php
http://blackdiamondsco.ae/bossftown/fre.php
http://blackdiamondsco.ae/rooney/fre.php
http://blackdiamondsco.ae/wogor/fre.php
http://blogsports.com.ng/cli/Panel/five/fre.php
http://brighten2.alasrglobal.com/file/bell/five/fre.php
http://brighten2.alasrglobal.com/file/tin/five/fre.php
http://brighten2.alasrglobal.com/file/vas/five/fre.php
http://brighten.alasrglobal.com/file/do/five/fre.php
http://britlite.ga/fade/type/fre.php
http://bsales.cf/bs/Panel/five/fre.php
http://bsales.cf/ft/Panel/five/fre.php
http://cityhotel.ge/believe/five/fre.php
http://cityhotel.ge/focus/five/fre.php
http://cityhotel.ge/rozay/five/fre.php
http://colnoygums.com/freg/fre.php
http://cytanets-com.cf/philip/panel/fre.php
http://cytanets-com.cf/qwertyu/panel/fre.php
http://dandoesinternet.com/cis1406/tutorial10/fre.php
http://dandoesinternet.com/cis1407/fre.php
http://dandoesinternet.com/mobile/ch1/fre.php
http://devhaevents.us/2415452354/242424/fre.php
http://dutch-tour-guide-marrakech.com/app/Panel/five/fre.php
http://eastlandproduce.us/.well-known/acme-challenge/over/raw/fre.php
http://eholes.viewyoursite.co.uk/LucianoLokiPanel/fre.php
http://emakqroup.tk/obi/panel/fre.php
http://emakqroup.tk/sim/panel/fre.php
http://embramedica.com.br/site/wp-content/plugnis/fre.php
http://emoticon.tk/hcode/kmaster/fre.php
http://e-ne1.com/Hab-Lok/fre.php
http://eurobike1.cf/obinna/fre.php
http://familyhealths.ga/cdi-directory/five/fre.php
http://fascine-cemdene.com/wp/wp-includes/js/js/five/fre.php
http://fasterre.gq/hcode/bazon/fre.php
http://fojidedar.com/bazz/fojide2/fre.php
http://fojidedar.com/fojide/fre.php
http://fojidedar.com/soft/amadin/fre.php
http://fox-lighting.ga/poop/club/fre.php
http://freecaps.ml/over/jump/fre.php
http://fruitfulmonth.tk/raphael/fre.php
http://geranntibankasi.com/getyoui980/jertyui989/fre.php
http://haksenlimited.com/slim/fre.php
http://hamon.ir/mate/five/fre.php
http://highstarsino.cf/anyi/fre.php
http://hkenngr.com/herty987/letry78/fre.php
http://homeduderezort.com/includes/1010/fre.php
http://homeduderezort.com/includes/gator/fre.php
http://homeduderezort.com/includes/nas/fre.php
http://homefieldtech.com/anu/five/fre.php
http://homefieldtech.com/box/five/fre.php
http://homefieldtech.com/juke/five/fre.php
http://homefieldtech.com/mzx/five/fre.php
http://homefieldtech.com/Obo/five/fre.php
http://homefieldtech.com/uok/five/fre.php
http://housded.cf/hcode/azuka/fre.php
http://icannsorg.com/icann2/five/fre.php
http://icannsorg.com/icann/five/fre.php
http://incitecpivot-au.com/mertyui567/kertli879/fre.php
http://inout-me.ml/fixx/sure/fre.php
http://inquire.website/images/five/fre.php
http://isnmainpasedal.com/amb/fre.php
http://jamespanel.tk/cole/fre.php
http://jamespanel.tk/low/five2/fre.php
http://jamespanel.tk/odee/fre.php
http://joxax.privatedocuments.site/jox/loki/fre.php
http://jvl-jp.co/ser567/gotert/fre.php
http://katherinajetter.com/vxzc/Panel/fre.php
http://katherinajetter.com/xzcsadwqe23/fre.php
http://khanapenaband.com/jon/fre.php
http://lablocks.site/Panel/five/fre.php
http://laloderkozam.com/laloder2/five/fre.php
http://laloderkozam.com/laloder3/five/fre.php
http://laloderkozam.com/laloder4/five/fre.php
http://launchgrowthtoday.download/bobo22/Panel/five/fre.php
http://launchgrowthtoday.download/choo/Panel/five/fre.php
http://launchgrowthtoday.download/jamike/Panel/five/fre.php
http://logsession.space/citycenter/fashion/trending/fre.php
http://lovaniacreative.com/wp-admin/js/inc/Panel/five/fre.php
http://madlovert.ml/swanky/wp-content/uploads/Panel/five/fre.php
http://magic1.cf/gat/fre.php
http://magic3.ml/gozie/fre.php
http://marksky.org/medosky/fre.php
http://maxthon.duckdns.org:6060/dark/fre.php
http://msa-fit.gq/sql/Panel/five/fre.php
http://mxchlp.com/team/wide/fre.php
http://namesnetworks.com/blog/educational/fre.php
http://nextlevelshop.info/woldpress/logistics/Panel/five/fre.php
http://nextwaveconsulting.com.au/Cpanel/Panel/five/fre.php
http://novachim.ro/plugins/editors/five/fre.php
http://nutgetsloversplay.usa.cc/wp-content/themes/twentyfifteen/Panel/five/fre.php
http://oajandassociates.com/images/oajand/Panel/five/fre.php
http://officebase.website/js/five/fre.php
http://ojoboplaza.club/Angel/Panel/five/fre.php
http://ojoboplaza.club/Drama/Panel/five/fre.php
http://ojoboplaza.club/Man/Panel/five/fre.php
http://onlyadoonbit.com/asji/fre.php
http://opercomex.co/billionaire/kendra/fre.php
http://orkaden.com/wp-includes/Text/me/fre.php
http://panelhq.cf/jr/five/fre.php
http://panelhq.gq/airforce/five/fre.php
http://panelhq.gq/chelsea/five/fre.php
http://panelhq.gq/gold/five/fre.php
http://panelhq.gq/stars/five/fre,php
http://profirst.com.vn/aug777/five/fre.php
http://profirst.com.vn/aug/five/fre.php
http://ptads.ml/pide/seed/fre.php
http://punjabjaogi.com/Panel/fre.php
http://qureshioffice.alasrglobal.com/admin7/bgn/sfe/fre.php
http://qureshioffice.alasrglobal.com/admin/xxx/zzz/fre.php
http://qureshioffice.alasrglobal.com/sam1/xknf/kdlt/fre.php
http://reachmy90s.com/includes/Panel/five/fre.php
http://rozedaro.com/administrator/Panel/five/fre.php
http://saintechelon.tk/fre.php
http://sccoast.tk/logs/panel/fre.php
http://sccoast.tk/phil/panel/fre.php
http://schooolcode.download/uk8k/Panel/five/fre.php
http://shaktiorkatimo.com/symboss/fre.php
http://shinyei-co.gq/cade/dope/fre.php
http://sinomagnetor3.cf/anyi/fre.php
http://soolitaytangya.com/blessed/Panel/five/fre.php
http://sternpid.ga/firm/fost/fre.php
http://strcutform.com/vinye/Panel/five/fre.php
http://strijdbladen.ga/donstan/five/fre.php
http://swaz.hanirnail.net/five/fre.php
http://szccf361.com/flinkas260/fre.php
http://theonlygoodman.com/eig/fre.php
http://theonlygoodman.com/nin/fre.php
http://tondice.flu.cc/images./45skele/fre.php
http://tondice.flu.cc/images./imgs01sg-/fre.php
http://tradelink.qa/aug/five/fre.php
http://tutorialdnsstep1.com/admin/fre.php
http://tutorialdnsstep1.com/toturial/fre.php
http://uzocloudservers.gq/jeff/five/fre.php
http://veloceqlobal.net/rain/hope/fre.php
http://victoralifts.com/wpss/fre.php
http://wapsihonaylo.com/wapsi3/five/fre.php
http://wapsihonaylo.com/wapsi4/five/fre.php
http://wapsihonaylo.com/wapsi/five/fre.php
http://wcegroups.com/done/hont/fre.php
http://westiles.ga/lope/coop/fre.php
http://wiglelamberfo.com/eme/fre.php
http://www.constantialiquidators.com/freg/fre.php
http://www.crownventureintl.com/wip-admin/Panel/five/fre.php
http://www.gardensun.ru/daily/fre.php
http://www.gardensun.ru/eca/fre.php
http://www.mysticalreflections.life/web-content/web/upgrade/wp_obtain/log/Panel/five/fre.php
http://www.netgateway.top/panel/fre.php
http://www.scoverykingdom.gq/jeff/five/fre.php
http://www.semaprin.info/mi/fre.php
http://www.sierracontrol.ru/cmd11/fre.php
http://www.sierracontrol.ru/vipu/fre.php
http://www.woelpuu.com/hertuyi/teryio/fre.php
http://www.woelpuu.com/terypp/youip/fre.php
http://www.zealsale.com.np/file/Panel/five/fre.php
http://xsftruss.ml/edunew/fre.php
http://ymwsolutions.com/testfilez/fre.php
nawck.ml
mitch-portal.tk
sintrol.cf
sirmitch.ml

# Reference: https://myonlinesecurity.co.uk/slightly-different-lokibot-delivery-via-embedded-ole-objects-in-rtf-word-doc/

http://kikehraeein.com/web-obtain/file/web/log/Panel/five/fre.php

# Reference: https://twitter.com/DynamicAnalysis/status/1034488992987860995

apidava.tk

# Reference: https://blog.talosintelligence.com/2018/08/threat-roundup-0824-0831.html

szccf361.com

# Reference: https://blog.talosintelligence.com/2018/08/threat-roundup-0817-0824.html

www.1113sophie.info
www.41230319.net
www.cryptocoindigital.com
www.kacakbahisfirmasi.com
www.marryingmaldonado.com
www.mywdn.com
www.risu-nursery.com
www.saurabh.online
www.shiqiyingli.com
www.sicknessfitness.com
www.themonkeygrindervintage.com
www.unsubchef.com
www.win.link
www.xn--vhq6e39ls7w.net
www.zexpar.com

# Reference: https://viriback.com/30-days-later-97-panels/

http://annamadums.ml/jazzy/PvqDq929BSx_A_D_M1n_a.php
http://bellegin.ru/doncha10/pen.php
http://bellegin.ru/don-cha11/pen.php
http://bellegin.ru/oshok/pen.php
http://bollingoes.ml/ngoes/PvqDq929BSx_A_D_M1n_a.php
http://braithwalte.co.uk/blam/five/PvqDq929BSx_A_D_M1n_a.php
http://braithwalte.co.uk/block/five/PvqDq929BSx_A_D_M1n_a.php
http://braithwalte.co.uk/konvict/five/PvqDq929BSx_A_D_M1n_a.php
http://braithwalte.co.uk/smith/five/PvqDq929BSx_A_D_M1n_a.php
http://cadjetbums.ml/tbums/PvqDq929BSx_A_D_M1n_a.php
http://domainsender.info/moon/five/PvqDq929BSx_A_D_M1n_a.php
http://domainsender.info/sun/five/PvqDq929BSx_A_D_M1n_a.php
http://dunysaki.ru/buch-x5/pen.php
http://dunysaki.ru/doncha-2/pen.php
http://dunysaki.ru/stephen/pen.php
http://erintoba.info/bbbb/Panel/five/PvqDq929BSx_A_D_M1n_a.php
http://eriousimen.ml/eriou/PvqDq929BSx_A_D_M1n_a.php
http://finelets.ru/buch-x3/pen.php
http://finelets.ru/buch-x4/pen.php
http://finelets.ru/fankzu/pen.php
http://gokuu.club/ckan/PvqDq929BSx_A_D_M1n_a.php
http://gokuu.club/M/PvqDq929BSx_A_D_M1n_a.php
http://joanread.ru/decap/pen.php
http://joanread.ru/work-1/pen.php
http://lidgeys.ru/buch-k/pen.php
http://lidgeys.ru/buch-l/pen.php
http://lidgeys.ru/buch-m/pen.php
http://lidgeys.ru/buchX-1/pen.php
http://lidgeys.ru/buch-x2/pen.php
http://lidgeys.ru/eddy/pen.php
http://papgon10.ru/davidm/pen.php
http://papgon10.ru/don-12/pen.php
http://papgon10.ru/don-one/pen.php
http://papgon10.ru/kennyB-1/pen.php
http://papgon10.ru/oshok-two/pen.php
http://thousandan.ml/andan/PvqDq929BSx_A_D_M1n_a.php
http://topreadz.ru/alexbe/pen.php
http://topreadz.ru/doncha-3/pen.php
http://topreadz.ru/willy-1/pen.php
http://ultrainstinct.ru/file/exe/five/PvqDq929BSx_A_D_M1n_a.php
http://unifarmex.net/Dstan/Panel/five/PvqDq929BSx_A_D_M1n_a.php
http://unifarmex.net/hsp1/Panel/five/PvqDq929BSx_A_D_M1n_a.php
http://unifarmex.net/nesto/Panel/five/PvqDq929BSx_A_D_M1n_a.php
http://uy-akwaibom.ru/vinho/Panel/five/PvqDq929BSx_A_D_M1n_a.php
http://vailablity.ml/vaila/PvqDq929BSx_A_D_M1n_a.php
http://viettrust-vn.net/samii/PvqDq929BSx_A_D_M1n_a.php
http://vopspyder.website/home/five/PvqDq929BSx_A_D_M1n_a.php
http://vopspyder.website/log/five/PvqDq929BSx_A_D_M1n_a.php
http://wheelonexs.ml/wheel/PvqDq929BSx_A_D_M1n_a.php

# Reference: https://github.com/stamparm/maltrail/pull/284#issuecomment-417861246

ajmanz.gq

# Reference: https://twitter.com/DynamicAnalysis/status/1037472184636256256

http://theonlygoodman.com/fit/fre.php

# Reference: https://twitter.com/nullcookies/status/1038235674565066757

crasemerzom.com

# Reference: https://twitter.com/avman1995/status/1038285919219068928

http://99.198.127.106
http://blackdiamondsco.ae/test/fre.php

# Reference: https://twitter.com/ViriBack/status/983011333506588672
# Reference: https://pastebin.com/nwWHHFe0

http://www.bartolini-system.net/loop/PvqDq929BSx_A_D_M1n_a.php
http://logs.boxxta.website/ikol/five/PvqDq929BSx_A_D_M1n_a.php

# Reference: https://blog.talosintelligence.com/2018/09/threat-roundup-0907-0914.html (Win.Dropper.Hploki-6682476-0)

www.bvasetro.com
www.com-logninsauthorize.info
www.grm-group.info
www.healinggoodness.com
www.losmejorescrm.com
www.mechakawaii.com
www.mytechnik-beratung.com
www.ptt-test.com
www.testci20170903033002.net
www.thlg8.com
www.vintageontheline.com

# Reference: https://pastebin.com/bEqJKZfZ

http://strutitinca.ro/ftp/fre.php
http://zenshinonline.ru/amb/fre.php
http://zenshinonline.ru/eka/fre.php
http://zenshinonline.ru/file/fre.php

# Reference: https://www.maltiverse.com/sample/1ea139164e3525a5a4f3feb333551a806852cca40e49698fbf65d49bd4f7c27c

loggerkeys-hosting.xyz

# Reference: https://www.maltiverse.com/sample/16d06c604487ad96b04f226827dc033d61c80b345a323faee5c9d4a0b2a108d0

tananaislanoidd.ga

# Reference: http://cybercrime-tracker.net/index.php?search=Lokibot

corelis.group
zenshinonline.ru
harltdoors.com
devhaevents.us
grace4good.cf
theonlygoodman.com
premierevents.co.zw

# Reference: https://twitter.com/ViriBack/status/1046391838448537601
# Reference: https://pastebin.com/4QRaU8T7

http://geranntibankasi.com/slowkizzy567/kertyui456/PvqDq929BSx_A_D_M1n_a.php
http://hkenngr.com/herty987/letry78/PvqDq929BSx_A_D_M1n_a.php
http://incitecpivot-au.com/dertyu987/treyuo9809/PvqDq929BSx_A_D_M1n_a.php
http://incitecpivot-au.com/lerty67/loivet56/PvqDq929BSx_A_D_M1n_a.php
http://incitecpivot-au.com/mertyui567/kertli879/PvqDq929BSx_A_D_M1n_a.php
http://insightthk.com/hermonth/jerk/PvqDq929BSx_A_D_M1n_a.php
http://insightthk.com/loki2/PvqDq929BSx_A_D_M1n_a.php
http://insightthk.com/loki3/PvqDq929BSx_A_D_M1n_a.php
http://jvl-jp.co/gert67/teryu7/PvqDq929BSx_A_D_M1n_a.php
http://jvl-jp.co/nwokorie45777/fertyuoui/PvqDq929BSx_A_D_M1n_a.php
http://jvl-jp.co/sert67/tyuio98/PvqDq929BSx_A_D_M1n_a.php
http://jvl-jp.co/sertyoup/latinoper90/PvqDq929BSx_A_D_M1n_a.php
http://jvl-jp.co/slamp89/ketu56/PvqDq929BSx_A_D_M1n_a.php
http://kaokao-twn.com/yerter/getyu/PvqDq929BSx_A_D_M1n_a.php
http://karenandkarren.com/multi980/mertyui989/PvqDq929BSx_A_D_M1n_a.php
http://kurarray.com/fertyuio/lopiytu/PvqDq929BSx_A_D_M1n_a.php
http://kurarray.com/loptyuier/liouy56/PvqDq929BSx_A_D_M1n_a.php
http://kurarray.com/loptyuio/lop0980/PvqDq929BSx_A_D_M1n_a.php
http://ledteroptyi.xyz/gertyu99/ertyu8/PvqDq929BSx_A_D_M1n_a.php
http://ledteroptyi.xyz/hertyuu89/menter67/PvqDq929BSx_A_D_M1n_a.php
http://ledteroptyi.xyz/kertyu767/jertyu657/PvqDq929BSx_A_D_M1n_a.php
http://ledteroptyi.xyz/loipter/teryuop999/PvqDq929BSx_A_D_M1n_a.php
http://lltagrain.com/cash2/PvqDq929BSx_A_D_M1n_a.php
http://lltagrain.com/kelle/PvqDq929BSx_A_D_M1n_a.php
http://lltagrain.com/money/PvqDq929BSx_A_D_M1n_a.php
http://lltagrain.com/tino/PvqDq929BSx_A_D_M1n_a.php
http://oceanlinkmarrine.com/loki2/PvqDq929BSx_A_D_M1n_a.php
http://oceanlinkmarrine.com/loki4/PvqDq929BSx_A_D_M1n_a.php
http://oliverrbatlle.com/setyi98/etruo89/PvqDq929BSx_A_D_M1n_a.php
http://phcc-india.com/dertyuop345/teryup234/PvqDq929BSx_A_D_M1n_a.php
http://phcc-india.com/limitedmert/menter567/PvqDq929BSx_A_D_M1n_a.php
http://phcc-india.com/nertyoiu67/eartyuoiyue67/PvqDq929BSx_A_D_M1n_a.php
http://phcc-india.com/slamptiert5/fertyupw456/PvqDq929BSx_A_D_M1n_a.php
http://phcc-india.com/startboi89234/netwer675/PvqDq929BSx_A_D_M1n_a.php
http://pldtdsll.net/betstyui789/erty6786/PvqDq929BSx_A_D_M1n_a.php
http://pldtdsll.net/fishyoiu/fishtery77/PvqDq929BSx_A_D_M1n_a.php
http://pldtdsll.net/sertyu45/teryu34/PvqDq929BSx_A_D_M1n_a.php
http://redsseammgt.com/loki5/PvqDq929BSx_A_D_M1n_a.php
http://rmsalf.com/hertioyu567/lertu789/PvqDq929BSx_A_D_M1n_a.php
http://rmsalf.com/mentiyu98/letluy78/PvqDq929BSx_A_D_M1n_a.php
http://sertencee.xyz/kogilop/yopuit77/PvqDq929BSx_A_D_M1n_a.php
http://sertencee.xyz/shakamally/loipy67/PvqDq929BSx_A_D_M1n_a.php
http://siyaghasourccing.com/lokily89/werty6789/PvqDq929BSx_A_D_M1n_a.php
http://siyaghasourccing.com/smello/ertyop009/PvqDq929BSx_A_D_M1n_a.php
http://www.dersertlord.xyz/loki4/PvqDq929BSx_A_D_M1n_a.php
http://www.dersertlord.xyz/loki5/PvqDq929BSx_A_D_M1n_a.php
http://www.sertencee.xyz/shunshuo/terrampeedar/PvqDq929BSx_A_D_M1n_a.php
http://www.siyaghasourccing.com/serto99/jerty45/PvqDq929BSx_A_D_M1n_a.php
http://www.siyaghasourccing.com/sertoiu/fertuiop/PvqDq929BSx_A_D_M1n_a.php
http://www.slompbit.xyz/lopitre87/teryuio09/PvqDq929BSx_A_D_M1n_a.php
http://www.slompbit.xyz/lopityrety/kerterty/PvqDq929BSx_A_D_M1n_a.php
http://www.woelpuu.com/hertuyi/teryio/PvqDq929BSx_A_D_M1n_a.php
http://www.woelpuu.com/terypp/youip/PvqDq929BSx_A_D_M1n_a.php

# Reference: https://isc.sans.edu/forums/diary/More+malspam+pushing+Lokibot/23754/

oceanlinkmarrine.com/loki1/fre.php
oceanlinkmarrine.com/loki2/fre.php
oceanlinkmarrine.com/loki3/fre.php
oceanlinkmarrine.com/loki4/fre.php
oceanlinkmarrine.com/loki5/fre.php

# Reference: https://twitter.com/avman1995/status/1046751735971282944

nisol.ga/chika/fre.php

# Reference: https://pastebin.com/AasLyArF

monochromestr.site/fbm/encode.php

# Reference: https://twitter.com/avman1995/status/1052426452187185153

octone.igg.biz/chri1/cgi.php

# Reference: https://app.any.run/tasks/4515e611-f351-436b-982a-72229c1a1853

hmcrogenics.com

# Reference: https://twitter.com/dvk01uk/status/1097767868874264576

/LL0/200g-xz/cat.php

# Reference: https://twitter.com/dvk01uk/status/1097357708246896640

/kston/link.php

# Reference: https://twitter.com/Securityinbits/status/1090893221754884100

/scott/link.php

# Reference: https://twitter.com/Racco42/status/1027476386808848384

maxthon.duckdns.org
sockets.duckdns.org

# Reference: https://twitter.com/ps66uk/status/1062658307507273733

/sgbbu2/cat.php

# Reference: https://twitter.com/illegalFawn/status/1113086451233755136

alexiwobi.ga
dandyla1.ga

# Reference: https://twitter.com/luc4m/status/1103214408682139648

aurelio.xyz

# Reference: https://twitter.com/0_1_0_1_0_0_0_0/status/1116638803475746816

camopionari.cf
dankasa.tk
olododo.tk
sweetreuyh.tk
underneat.gq
yriuiuteuieu.gq

# Reference: https://twitter.com/pancak3lullz/status/1121057197914509312

/cka2/cat.php

# Generic (callback) paths

/chri1/cgi.php
/fbm/encode.php
/PvqDq929BSx_A_D_M1n_a.php
/fre.php
/pen.php
