# Copyright (c) 2014-2019 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://twitter.com/James_inthe_box/status/1039605676404760576

bproduction.zapto.org

# Reference: https://twitter.com/ScumBots/status/1045052146067165184

hyper-servers.ddns.net

# Reference: https://twitter.com/ScumBots/status/1044912611089948672

corralesking.hopto.org

# Reference: https://twitter.com/ScumBots/status/1046354478268592128

abjbwtf.myftp.biz

# Reference: https://twitter.com/ScumBots/status/1045931693167833088

131454.ddns.net

# Reference: https://twitter.com/ScumBots/status/1045776922171576320

kurviood.ddns.net
samostrelqsh.ddns.net

# Reference: https://twitter.com/ScumBots/status/1045746857408892928

staling79.mooo.com

# Reference: https://twitter.com/ScumBots/status/1043738462233485312

pauldenero.ddns.net

# Reference: https://twitter.com/ScumBots/status/1042779678367473665

clientswin.ddns.net

# Reference: https://twitter.com/ScumBots/status/1042704306795888640

haku004.hopto.org

# Reference: https://twitter.com/ScumBots/status/1042515566584586242

win.ddnsking.com

# Reference: https://twitter.com/ScumBots/status/1037861013255860224

scammer0304.ddns.net

# Reference: https://twitter.com/ScumBots/status/1037098491472998405

popopooo3847343dfer.publicvm.com
xcvx2343242sdfsdfsdfsxcv.publicvm.com

# Reference: https://twitter.com/ScumBots/status/1036487098189205504

aylmao1337.tk

# Reference: https://twitter.com/ScumBots/status/1034248460223037441

adeldu122.ddns.net

# Reference: https://twitter.com/ScumBots/status/1041050784081883136

hbk4.ddns.net

# Reference: https://twitter.com/ScumBots/status/1051065520328458240

needpull.ddns.net

# Reference: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~NanoCor-DM/detailed-analysis.aspx

obiank.ddns.net

# Reference: https://twitter.com/ScumBots/status/1052360306788327424

exotic-40931.portmap.io

# Reference: https://twitter.com/ScumBots/status/1052552825228673024

cuberwar.myvnc.com
cyber786.myvnc.com

# Reference: https://twitter.com/Racco42/status/1046873169070645248

chukwd.duckdns.org

# Reference: https://twitter.com/ScumBots/status/1053824958399500288

fgcvhjbk.bounceme.net

# Reference: https://twitter.com/ScumBots/status/1054761124745412608

icheatedonyourcrush.ddns.net

# Reference: https://twitter.com/ScumBots/status/1055210337266491392

myhostsaddddd.hopto.org

# Reference: https://twitter.com/ScumBots/status/1056965649929510914

zenzen15.ddns.net

# Reference: https://twitter.com/ScumBots/status/1058154734417260544

Pirmary.dynu.net

# Reference: https://twitter.com/ScumBots/status/1058241556451254272

mohamedsaeed.ddns.net

# Reference: https://twitter.com/ScumBots/status/1058932359117107201

zentune.sytes.net

# Reference: https://twitter.com/ScumBots/status/1059509916707311617

avo4.ddns.net

# Reference: https://twitter.com/ScumBots/status/1061253904103600128

skynipit.ddns.net

# Reference: https://twitter.com/ScumBots/status/1061269005296693248

office365update.duckdns.org
systen32.ddns.net

# Reference: https://twitter.com/ScumBots/status/1061510597278425089

ogkush.ddns.net

# Reference: https://twitter.com/ScumBots/status/1061710662940942338

jake1234.ddns.net

# Reference: https://twitter.com/ScumBots/status/1062224311430365185

onixoino.ddns.net

# Reference: https://twitter.com/ScumBots/status/1063892541253345281

daddyup.ddns.net

# Reference: https://twitter.com/ScumBots/status/1064575794121445376

weekskypp.hopto.org

# Reference: https://twitter.com/ScumBots/status/1065002353307324418

mcnana.theworkpc.com

# Reference: https://twitter.com/ScumBots/status/1067214563651796992

masterzion.ddns.net

# Reference: https://twitter.com/ScumBots/status/1067237079376191488

yeetyeeter.ddns.net

# Reference: https://twitter.com/ScumBots/status/1067829739107352577

sicknessdk.duckdns.org

# Reference: https://twitter.com/ScumBots/status/1068244972011487232

intercambiotestg99.duckdns.org

# Reference: https://twitter.com/ScumBots/status/1069162266279510016

insta.webhop.me

# Reference: https://twitter.com/ScumBots/status/1069502003116679168

wadlalafala2344.myftp.biz

# Reference: https://twitter.com/ScumBots/status/1070743939089612800

y013s.ddns.net

# Reference: https://twitter.com/ScumBots/status/1070868509763215360

moms.myftp.biz

# Reference: updates up to https://twitter.com/ScumBots/status/1079871582284247041

amerkad19.ddns.net
blubjkh.ddns.net
chromeservice.serveirc.com
kurwa.ddns.net
nanithecorelol.ddns.net
ncore.ddns.net
sambosaxzx.ddns.net
svchostest.ddns.net
vpnchjuy.ddns.net

# Reference: https://www.symantec.com/blogs/threat-intelligence/african-financial-attacks

nemesis225.ddns.net

# Reference: https://twitter.com/ScumBots/status/1086998543217426432

madarahost.ddns.net

# Reference: https://twitter.com/ScumBots/status/1088781872510001152

axuas.ddns.net

# Reference: https://twitter.com/ScumBots/status/1088908631930736640

minimalprojectscm.ddns.net

# Reference: https://twitter.com/ScumBots/status/1089191742681817094

nanoocore.ddns.net
Listener.chickenkiller.com
ukurbap.duckdns.org
5.59.91.86:5552

# Reference: https://twitter.com/ScumBots/status/1096141287328280576

karutohack.ddns.net

# Reference: https://twitter.com/ScumBots/status/1099342379386134529

185.56.90.79:1799

# Reference: https://twitter.com/ScumBots/status/1097262422912614401

194.5.99.9:36460

# Reference: https://twitter.com/ScumBots/status/1099474498317889536

109.181.151.155:1263

# Reference: https://twitter.com/ScumBots/status/1101973465895264257

lp0766.ddns.net

# Reference: https://twitter.com/ScumBots/status/1102094396542144513

fucka.ddns.net
fuckyoua.ddns.net

# Reference: https://twitter.com/ScumBots/status/1102422807672246274

windowuser.ddns.net

# Reference: https://twitter.com/ScumBots/status/1102547247231840258

141.255.152.199:54979

# Reference: https://twitter.com/ScumBots/status/1102573669455462400

demisoda2.kro.kr

# Reference: https://twitter.com/ScumBots/status/1102973809316032512

nanotestit.ddns.net

# Reference: https://twitter.com/ScumBots/status/1103321099440398343

csgo45bj.ddns.net

# Reference: https://twitter.com/ScumBots/status/1104808531184812037

31.49.241.6:1604

# Reference: https://twitter.com/ScumBots/status/1105793638041354240

141.255.151.202:5552

# Reference: https://twitter.com/ScumBots/status/1105797415901253633

141.255.158.98:53896

# Reference: https://twitter.com/James_inthe_box/status/1102914959556538368

185.84.181.88:4050

# Reference: https://twitter.com/ScumBots/status/1108326582664527872

10.9.36.186:6969

# Reference: https://twitter.com/ScumBots/status/1108311482247335936

213.89.206.15:1337

# Reference: https://twitter.com/Racco42/status/1102848826556276736

top1.apexgamingjo.waw.pl

# Reference: https://twitter.com/casual_malware/status/1107441450415992832

nanocore2019.bounceme.net

# Reference: https://twitter.com/James_inthe_box/status/1100793529595383809

ninodns.duckdns.org

# Reference: https://twitter.com/ViriBack/status/1093994913249853440
# Reference: https://pastebin.com/rQ0Cnkh0

lightchibuike.ddns.net
pixls.ddns.net

# Reference: https://twitter.com/ViriBack/status/1065597117937434625

bosmanchi.ddns.net

# Reference: https://twitter.com/killamjr/status/1093553362174242816

tntsure.ddns.net

# Reference: https://twitter.com/pollo290987/status/1092796516555808770

megida.hopto.org

# Reference: https://twitter.com/Racco42/status/1059945882274197504

194.5.99.243:2019

# Reference: https://twitter.com/HerbieZimmerman/status/1057692658104262657

194.5.98.182:7020

# Reference: https://twitter.com/luc4m/status/1044855395615997953

datalogsbackups.hopto.org

# Reference: https://twitter.com/matte_lodi/status/1049203238963167233
# Reference: https://app.any.run/tasks/bb524301-c794-4813-8e72-a03ae7d5b8cc

ambition.ddns.net

# Reference: https://twitter.com/Ring0x0/status/1006200464772419585

delawizzy.ddns.net

# Reference: https://twitter.com/Antelox/status/859092998818344961

herackles.moneyhome.biz

# Reference: https://twitter.com/JAMESWT_MHT/status/751375987028484096

businessdb4.duckdns.org
businessdb5.duckdns.org

# Reference: https://twitter.com/JayTHL/status/729724613907783680

212.7.208.81:51010

# Reference: https://twitter.com/JayTHL/status/705429671303774208

greenbacks.no-ip.biz

# Reference: https://twitter.com/MalwareConfig/status/694596719426826240

admindarkcomet.no-ip.biz

# Reference: https://twitter.com/MalwareConfig/status/694296245679099904

QuantumDevv.chickenkiller.com

# Reference: https://twitter.com/MalwareConfig/status/651147773257977856

paychuby.no-ip.biz

# Reference: https://twitter.com/MalwareConfig/status/650097923196342272

aeht.no-ip.biz

# Reference: https://twitter.com/MalwareConfig/status/650097877851746304

freedarren.no-ip.biz

# Reference: https://twitter.com/MalwareConfig/status/650097559160156160

purevid.no-ip.org

# Reference: https://twitter.com/MalwareConfig/status/650097117315395584

ik4ito.ddns.net

# Reference: https://twitter.com/MalwareConfig/status/650096982590156800

mlgsnip3r.no-ip.biz

# Reference: https://twitter.com/ScumBots/status/1109640234864701441

67.253.236.155:5553

# Reference: https://twitter.com/ScumBots/status/1110266084760920064

gangbanghangchang.myftp.biz

# Reference: https://twitter.com/James_inthe_box/status/1110579161884577792

172.81.132.137:54984

# Reference: https://twitter.com/x42x5a/status/1113414801705844738

kgentle77.duckdns.org

# Reference: https://twitter.com/ScumBots/status/1114521149034123265

185.101.94.172:36460
rmcos.sparcos-es.com

# Reference: https://twitter.com/HerbieZimmerman/status/1115325369371045889

185.165.153.114:2525

# Reference: https://twitter.com/x42x5a/status/1115556640026177537

184.75.209.169:5787

# Reference: https://twitter.com/malwrhunterteam/status/1115942079711129602

ebaystube.hopto.org

# Reference: https://twitter.com/Racco42/status/1116793128319459329

moran101.duckdns.org

# Reference: https://pastebin.com/S3cZw7CA

154.16.63.122:1919
184.75.209.169:5787
185.56.90.91:1989
185.84.181.83:5302
194.5.98.26:1012
194.5.99.229:5050
213.208.152.197:9737
33393.ddns.net
arab1.myq-see.com
frazodee.hopto.org
gefide5.ddns.net
hhhssa.chickenkiller.com
lacoban.ddns.net
office365.duckdns.org
onielnfo.ddns.net
repoyochar2u.ddns.net
repoyochar2u.hopto.org
skynetcdt.dyndns.org
webaccess.hopto.org
wilfred123.ddns.net

# Reference: https://pastebin.com/ZCVB1pww

103.200.6.3:5490
181.214.55.23:9989
181.215.247.55:9780
185.148.241.40:3413
185.208.211.13:1943
185.244.30.106:1985
185.244.30.116:1985
185.244.30.98:8030
194.5.99.176:54984
194.5.99.181:4488
194.5.99.84:1604
194.68.59.45:32101
86.144.241.171:1608
95.140.125.77:52097
95.140.125.79:10203
ADMIN.ndplc.gq
anunankis3.duckdns.org
burdun.dynu.net
cjbo12.ddns.net
ibrak.ddns.net
jacksmithcarter.ddns.net
jasoiuuydealaa.sytes.net
kenzog.no-ip.biz
kroger.ddns.net
lordblessme.duckdns.org
lordblessme.hopto.org
MARKET.ndplc.gq
microsoftware.hopto.org
netframework.serveminecraft.net
okaforchukwuma247.ddns.net
parcel.duckdns.org
rattool0.ddns.net
rogersbvrly0123.ddns.net
shahan1337.ddns.net
shootingstar.ddns.net
talknahealga1974.myq-see.com
vpnserver.ddns.me
xxxnpornlegitnoscam.ddns.net

# Reference: https://ghostbin.com/paste/qyhf6

107.173.58.71:30117
109.247.80.150:20000
154.16.201.167:3114
154.16.220.215:7177
173.46.85.23:1996
178.209.51.235:4156
181.215.247.13:19983
181.215.247.189:4199
181.215.247.194:1002
181.215.247.70:7000
185.121.166.5:1012
185.244.30.121:5129
185.244.30.127:1985
185.244.30.94:8030
185.244.30.98:9645
185.84.181.65:8128
189davidcameron.ddns.net
191.101.22.21:1005
191.101.22.231:7200
194.5.99.179:4040
194.5.99.197:54984
194.5.99.22:3940
194.5.99.5:2017
194.68.59.31:1756
198.23.210.211:5890
2018bless.duckdns.org
212.7.208.100:17084
212.7.208.155:10001
212.7.208.94:3413
213.184.126.145:2001
31.220.7.204:1626
37.49.225.19:4335
41.231.120.13:9176
45.35.105.149:30198
46.36.39.22:2212
62.109.11.164:54984
78.47.149.66:7331
79.172.242.29:36378
88.208.246.117:7000
89.35.228.239:57356
89.46.222.206:9998
91.192.100.23:7012
91.192.100.4:3535
91.192.100.5:8181
91.92.136.158:1608
95.140.125.52:2018
95.140.125.85:6020
95.213.251.165:2547
a.tomx.xyz
anonymouss21.ddns.net
babazam.xyz
baseman45.pdns.cz
bennicholas.hopto.org
bitcoinonemmusd.hopto.org
bnow.duckdns.org
brytonwilliams.ddns.net
chykn.hopto.org
comboplug.duckdns.org
darkrig1.ddns.net
dayung.duckdns.org
dickson78.duckdns.org
ehispride1.ddns.net
frankfurt1.perfect-privacy.com
frankfurt2.perfect-privacy.com
frankwill12.ddns.net
godsblessing.dotdns.ch
heinrichschroth.hopto.org
ijomsdavis1.ddns.net
irofuuzo.ddns.net
isaacjekwu123.ddns.net
kotsiros.ddns.net
lappenfick.hopto.org
lascoyaya.sytes.net
maxwellclassic.ddns.net
mercadoliinio.duckdns.org
mikkymouse.duckdns.org
mybackups.duckdns.org
nano.xblbyesma.com
nanoip2.ddns.net
newera.serveftp.com
officewkgrace.ddns.net
osynewvps.duckdns.org
paychenco.ddns.net
paymeaji.ddns.net
snooper112.ddns.net
suncraft.duckdns.org
sydneyjames101.ddns.net
timmy44.ddns.net
timmy55.ddns.net
tonymaris.ddns.net
TUIYR.chickenkiller.com
wackysite.duckdns.org
xblbyesma.com
yannythefanny.ddns.net
z.whorecord.xyz

# Reference: https://twitter.com/James_inthe_box/status/1029752092473217025

185.82.220.137:33691

# Reference: https://twitter.com/pancak3lullz/status/1115982919628148736

194.5.99.30:4488

# Reference: https://twitter.com/pancak3lullz/status/1083411311160102912

185.125.205.71:6789
omada20.ddns.net

# Reference: https://twitter.com/pancak3lullz/status/1082284798708723713

185.125.205.68:3190
jasoncarlosscot.hopto.org

# Reference: https://twitter.com/pancak3lullz/status/1080543756456214528

173.46.85.96:2222
chibuike.ddns.net

# Reference: https://twitter.com/James_inthe_box/status/1120752034829856768

91.192.100.50:7030
