# Copyright (c) 2014-2019 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html

bigred-tours.com
clients12-google.com
clients2-google.com
p3-marketing.com
cdn-googleapi.com
cdn-googleservice.com
acity-lawfirm.com
algew.me
aloqd.pw
amhs.club
anselbakery.com
apvo.club
arctic-west.com
auyk.club
b-bconsult.com
bcleaningservice.com
bigrussianbss.com
bipismol.com
bipovnerlvd.com
blopsadmvdrl.com
blopsdmvdrl.com
bnrnboerxce.com
bpee.pw
bureauofinspections.com
bvyv.club
bwuk.club
bwwrvada.com
cgqy.us
chatterbuzz-media.com
chenstravelconsulting.com
cihr.site
citizentravel.biz
cjsanandreas.com
ckwl.pw
cloo.com
cnkmoh.pw
cnlu.net
cnmah.pw
coec.club
coffee-joy-usa.com
cspg.pw
ctxdns.org
ctxdns.pw
cuuo.us
daskd.me
dbxa.pw
ddmd.pw
deliciouswingsny.com
dlex.pw
dlox.pw
dnstxt.net
dnstxt.org
doof.pw
dosdkd.mo
dpoo.pw
dsud.com
dtxf.pw
duglas-manufacturing.com
dvso.pw
dyiud.com
eady.club
enuv.club
eter.pw
extmachine.biz
facs.pw
fbjz.pw
fhyi.club
firsthotelgroup.com
firstprolvdrec.com
fkij.net
flowerprosv.com
fredbanan.com
futh.pw
gcan.site
ge-stion.com
gjcu.pw
gjuc.pw
glavpojdfde.com
gnoa.pw
gnsn.us
goldman-travel.com
goproders.com
gprw.site
grand-mars.ru
grij.us
gsdg.site
guopksl.com
gxhp.top
hijrnataj.com
hilertonv.com
hilopser.com
hippsjnv.com
hldu.site
hoplessinple.com
hoplessinples.com
hopsl3.com
hvzr.info
idjb.us
ihrs.pw
imyo.site
itstravel-ekb.ru
ivcm.club
jblz.net
jersetl.com
jimw.club
jipdfonte.com
jiposlve.com
jjee.site
johsimsoft.org
jomp.site
josephevinchi.com
just-easy-travel.com
juste-travel.com
jxhv.site
kalavadar.com
kashtanspb.ru
kbep.pw
kiposerd.com
kiprovol.com
kiprovolswe.com
kjke.pw
kjko.pw
koldsdes.com
kshv.site
kuyarr.com
kwoe.us
ldzp.pw
lgdr.com
lhlv.club
lnoy.site
luckystartwith.com
lvrm.pw
lvxf.pw
manchedevs.org
maofmdfd5.com
meli-travel.com
melitravel.ru
mewt.us
mfka.pw
michigan-construction.com
mjet.pw
mjot.pw
mjut.pw
mkwl.pw
molos-2.com
mtgk.site
mtxf.com
muedandubai.com
muhh.us
mut.pw
mvze.pw
mvzo.pw
mxfg.pw
mxtxt.net
myspoernv.com
navigators-travel.com
neartsay.com
nevaudio.com
neverfaii.com
nroq.pw
ns0.site
ns0.space
ns0.website
ns1.press
ns1.website
ns2.press
ns3.site
ns3.space
ns4.site
ns4.space
ns5.biz
ns5.online
ns5.pw
ntlw.net
nwrr.pw
nxpu.site
oaax.site
odwf.pw
odyr.us
okiq.pw
oknz.club
olckwses.com
olgw.my
oloqd.pw
oneliveforcopser.com
onokder.com
ooep.pw
oof.pw
ooyh.us
orfn.com
otzd.pw
oxrp.info
oyaw.club
p3marketing.org
pafk.us
palj.us
park-travels.com
parktravel-mx.ru
partnersind.biz
pbbk.us
pbsk.site
pdoklbr.com
pdokls3.com
pgnb.net
pinewood-financial.com
pjpi.com
plusmarketingagency.com
ppdx.pw
prideofhume.com
pronvowdecee.com
proslr3.com
prostelap3.com
proverslokv4.com
provnkfexxw.com
pvze.club
qdtn.us
qefg.info
qlpa.club
qsez.club
qznm.pw
rdnautomotiv.biz
redtoursuk.org
reld.info
rescsovwe.com
revital-travel.com
revitaltravel.com
rmbs.club
rnkj.pw
rtopsmve.com
rzzc.pw
sgvt.pw
shield-checker.com
simpelkocsn.com
simplewovmde.com
soru.pw
sprngwaterman.com
strideindastry.biz
strideindustrial.com
strideindustrialusa.com
strikes-withlucky.com
swio.pw
tijm.pw
tnt-media.net
true-deals.com
trustbankinc.com
tsrs.pw
turp.pw
twfl.us
ueox.club
ufyb.club
utca.site
uwqs.club
vdfe.site
viebsdsccscw.com
viebvbiiwcw.com
vikppsod.com
vjro.club
vkpo.us
voievnenibrinw.com
vpua.pw
vpuo.pw
vqba.info
vwcq.us
vxqt.us
vxwy.pw
wein.net
wfsv.us
whily.pw
wider-machinery-usa.com
widermachinery.biz
widermachinery.com
wnzg.us
wqiy.info
wruj.club
wuc.pw
wvzu.pw
xhqd.pw
xnlz.club
xnmy.com
yamd.pw
ybnz.site
ydvd.net
yedq.pw
yodq.pw
yomd.pw
yqox.pw
ysxy.pw
zcnt.pw
zdqp.pw
zjav.us
zjvz.pw
zmyo.club
zody.pw
zrst.com
zugh.us
clients14-google.com
clients18-google.com
clients19-google.com
clients23-google.com
clients31-google.com
clients33-google.com
clients39-google.com
clients46-google.com
clients47-google.com
clients51-google.com
clients52-google.com
clients55-google.com
clients56-google.com
clients57-google.com
clients58-google.com
clients6-google.com
clients62-google.com
clients7-google.com
fda-gov.com
dropbox-security.com
google-sll1.com
google-ssls.com
google-stel.com
google3-ssl.com
google4-ssl.com
google5-ssl.com
ssl-googles4.com
ssl-googlesr5.com
stats10-google.com
stats25-google.com
treasury-government.com
usdepartmentofrevenue.com
bols-googls.com
moopisndvdvr.com
dewifal.com
essentialetimes.com
fisrdteditionps.com
fisrteditionps.com
micro-earth.com
moneyma-r.com
newuniquesolutions.com
wedogreatpurchases.com

# Reference: http://blog.talosintelligence.com/2017/03/dnsmessenger.html

algew.me
aloqd.pw
bpee.pw
bvyv.club
bwuk.club
cgqy.us
cihr.site
ckwl.pw
cnmah.pw
coec.club
cuuo.us
daskd.me
dbxa.pw
dlex.pw
doof.pw
dtxf.pw
dvso.pw
dyiud.com
eady.club
enuv.club
eter.pw
fbjz.pw
fhyi.club
futh.pw
gjcu.pw
gjuc.pw
gnoa.pw
grij.us
gxhp.top
hvzr.info
idjb.us
ihrs.pw
jimw.club
jomp.site
jxhv.site
kjke.pw
kshv.site
kwoe.us
ldzp.pw
lhlv.club
lnoy.site
lvrm.pw
lvxf.pw
mewt.us
mfka.pw
mjet.pw
mjut.pw
mvze.pw
mxfg.pw
nroq.pw
nwrr.pw
nxpu.site
oaax.site
odwf.pw
odyr.us
okiq.pw
oknz.club
ooep.pw
ooyh.us
otzd.pw
oxrp.info
oyaw.club
pafk.us
palj.us
pbbk.us
ppdx.pw
pvze.club
qefg.info
qlpa.club
qznm.pw
reld.info
rnkj.pw
rzzc.pw
sgvt.pw
soru.pw
swio.pw
tijm.pw
tsrs.pw
turp.pw
ueox.club
ufyb.club
utca.site
vdfe.site
vjro.club
vkpo.us
vpua.pw
vqba.info
vwcq.us
vxqt.us
vxwy.pw
wfsv.us
wqiy.info
wvzu.pw
xhqd.pw
yamd.pw
yedq.pw
yqox.pw
ysxy.pw
zcnt.pw
zdqp.pw
zjav.us
zjvz.pw
zmyo.club
zody.pw
zugh.us
cspg.pw

# Reference: https://www.accenture.com/t00010101T000000Z__w__/gb-en/_acnmedia/PDF-83/Accenture-Goldfin-Security-Alert.pdf

bipovnerlvd.com
blopsadmvdrl.com
bnrnboerxce.com
dewifal.com
essentialetimes.com
fisrteditionps.com
halyk-bank.com
kiprovolswe.com
kiprovol.com
micro-earth.com
moneyma-r.com
privat-bankau.com
privatbank-ua.com
tejara-bank.com
voievnenibrinw.com
wedogreatpurchases.com

# Reference: https://securelist.com/files/2015/02/Carbanak_APT_eng.pdf
# Reference: https://www.fox-it.com/en/files/2014/12/Anunak_APT-against-financial-institutions2.pdf
# Reference: https://www.group-ib.com/resources/threat-research/Anunak_APT_against_financial_institutions.pdf

adguard.name
beefeewhewhush-eelu.biz
blizko.net
blizko.org
comixed.org
coral-trevel.com
datsun-auto.com
di-led.com
financialnewson-line.pw
financialwiki.pw
flowindaho.info
freemsk-dns.com
gjhhghjg6798.com
glonass-map.com
great-codes.com
icafyfootsinso.ru
idedroatyxoaxi.ru
vaserivaseeer.biz
microloule461soft-c1pol361.com
microsoftc1pol361.com
mind-finder.com
operatemesscont.net
paradise-plaza.com
public-dns.us
publics-dns.com
systemsvc.net
system-svc.net
traider-pro.com
travel-maps.info
update-java.net
veslike.com
wefwe3223wfdsf.com
worldnews24.pw
worldnewsonline.pw

# Reference: https://www.tr1adx.net/intel/public/TIB-00002_IOC_Domain.txt

ai0ha.com
atlantis-bahamas.com
bentley-systems-ltd.com
bols-googls.com
dhl-service-au.com
esb-energy-int.com
fda-gov.com
google2-ssl.com
google3-ssl.com
google4-ssl.com
google5-ssl.com
google-ssls.com
google-stel.com
iris-woridwide.com
microfocus-official.com
ornuafood.com
perrigointernational.com
prsnewwire.com
sizzier.com
ssl-googles4.com
ssl-googlesr5.com
strideindustrialusa.com
syngenta-usa.com
taskretaiitechnology.com
treasury-government.com
waldorfs-astoria.com
zynga-ltd.com

# Reference: https://www.rsa.com/content/dam/en/white-paper/the-carbanak-fin7-syndicate.pdf
# Reference: https://otx.alienvault.com/pulse/5a16a16d3477580fcf4e359a

1povkjbdw87kgf518nl361.com
adguard.name
adventureseller.com
advetureseller.com
akamai-technologies.org
akkso-dob.in
akkso-dob.xyz
androidn.ne
androidn.net
ass-pussy-fucking.net
baltazar-btc.com
brazilian-love.org
btcshop.cc
c1pol361.com
cameron-archibald.com
casas-curckos.com
castello-casta.com
casting-cortell.com
chugumshimusona.com
comixed.org
coral-travel.com
coral-trevel.com
critical-damage333.org
datsun-auto.com
di-led.com
dimeline.eu
dragonn-force.com
financialnewsonline.pw
freemsk-dns.com
gendelf.com
glonass-map.com
gooip-kumar.com
great-codes.com
ihave5kbtc.biz
ihave5kbtc.org
java-update.co.uk
jhecwhb7832873.com
klyferyinsoxbabesy.biz
levetas-marin.com
maorkkk-grot.xyz
marcello-bascioni.com
mind-finder.com
my-amateur-gals.com
namorushinoshi.com
narko-cartel.com
narko-dispanser.com
ngx.net
nikaka-ost.in
nikaka-ost.xyz
nyugorta.com
oerne.com
onlineoffice.pw
oplesandroxgeoflax.org
paradise-plaza.com
pasteronixca.com
pasteronixus.com
ppc-club.org
public-dns.com
public-dns.us
publics-dns.com
road-to-dominikana.biz
shfdhghghfg.com
skaoow-loyal.net
skaoow-loyal.xyz
strangeerglassingpbx.org
systemsvc.net
travel-maps.info
updateserver.info
vincenzo-bardelli.com
wascodogamel.com
weekend-service.com
worldnewsonline.pw
zaydo.co
zaydo.space
zaydo.website

# Reference: https://twitter.com/VK_Intel/status/1102754053774290946

tw32-cdn.com

# Reference: https://twitter.com/VK_Intel/status/1096515532558340099

logitech-cdn.com

# Reference: https://twitter.com/HONKONE_K/status/1105351576384749568

cdn-skype.com

# Reference: https://twitter.com/MalwareCantFly/status/1059831561498095617

googleapi-cdn.com

# Reference: https://twitter.com/VK_Intel/status/1072716050259681280

cisco-cdn.com

# Reference: https://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/
# Reference: https://www.flashpoint-intel.com/wp-content/uploads/2019/03/iocs_astra_sqlrat_dnsbot_flashpoint_March2019.csv

bigmoneyforus.com
magicsoundmusic.com

# Reference: https://twitter.com/VK_Intel/status/1112961058812186624

combisecurity.net

# Reference: https://twitter.com/HONKONE_K/status/1117696735973761025
# Reference: https://otx.alienvault.com/pulse/5cb46aba498cfc2a71bb2936

booking-cdn.com
hpservice-cdn.com
jquery-ca-cdn.com
jquery-us-cdn.com
mse-cdn.com
norton-cdn.com
