| URL | Domain | IP Address | Threat Actor Email(s) |
|---|---|---|---|
| 784119[.]cf/att[.]zip[.]zip | 784119[.]cf | 31[.]220[.]17[.]248 | lindarichman101@gmail[.]com |
| access2882[.]xyz/LUNO_2020%20(1)[.]zip | access2882 | 102[.]130[.]115[.]253 | gilbert2400@mail[.]ru |
| actaccs[.]xyz/chasebank[.]zip | actaccs[.]xyz | 170[.]10[.]161[.]6 | arnoldmann90@gmail[.]com |
| africads12[.]xyz/popup%20(2)[.]zip | africads12[.]xyz | 162[.]241[.]27[.]152 | No Email: +4932221097517 |
| allprojectsunlimited[.]top/Firstbank2[.]zip | allprojectsunlimited[.]top | 91[.]234[.]99[.]220 | zate123man@gmail[.]com pronc@prontomail[.]com |
| amigocanino[.]club/acessar[.]zip | amigocanino[.]club | 104[.]24[.]112[.]110 104[.]24[.]113[.]110 |
No Email: 216[.]172[.]161[.]27 |
| apkagain[.]xyz/OFFICE[.]zip | apkagain[.]xyz | 91[.]234[.]99[.]200 | blackhatservers@gmail[.]com |
| batricka-71[.]gq/fax/Whyxoffice365%202018[.]zip | batricka-71[.]gq | 35[.]157[.]48[.]36 | None (Unconfigured) |
| beethemovies[.]ml/Ourtime/Ourtime1[.]zip | beethemovies[.]ml | 192[.]210[.]199[.]68 | amadareed7@gmail[.]com |
| bethasda-71[.]ga/fax/Whyxoffice365%202018[.]zip | bethasda-71[.]ga | 15[.]223[.]67[.]215 | None (Unconfigured) |
| bethasda-71[.]gq/fax/Whyxoffice365%202018[.]zip | bethasda-71[.]gq | 15[.]223[.]67[.]215 | None (Unconfigured) |
| binmon[.]gq/schwab/schwabere[.]zip | binmon[.]gq | 185[.]244[.]39[.]21 | samuraijack90@protonmail[.]com samuraijack90@yandex[.]com |
| binmon[.]gq/schwabu[.]zip | binmon[.]gq | 185[.]244[.]39[.]21 | evilbug90@yandex[.]com |
| biology-71[.]ml/html/excelz[.]zip | biology-71[.]ml | 34[.]94[.]190[.]216 | bennywise8@protonmail[.]com bennywise4@yandex[.]com |
| calibeautysupplies[.]top/deliver/Onedrive[.]xx[.]zip | calibeautysupplies[.]top | 91[.]234[.]99[.]210 | richardsweldon57@gmail[.]com |
| cannont-71[.]ga/yahoo/yahoologin[.]zip | cannont-71[.]ga | 35[.]156[.]61[.]38 | youremailhere@gmail[.]com (probably unconfigured) |
| chat[.]wahatsapp[.]event20[.]gq/SC%20GRUP%20FRONTAL[.]zip | chat[.]wahatsapp[.]event20[.]gq | 212[.]24[.]105[.]169 | Wirawijaya1901@gmail[.]com |
| chat[.]wahatsapp[.]zord20[.]gq/SC%20GRUP%20FRONTAL[.]zip | chat[.]wahatsapp[.]zord20[.]gq | 212[.]24[.]105[.]169 | Wirawijaya1901@gmail[.]com |
| checkout-enchanced[.]ddns[.]net/Europe[.]zip | checkout-enchanced[.]ddns[.]net | 62[.]4[.]21[.]167 | yanko[.]pro@protonmail[.]com |
| cm-vfxira[.]ddns[.]net/sharepoint[.]zip | cm-vfxira[.]ddns[.]net | 111[.]90[.]149[.]203 | affpat231@gmail[.]com |
| dorsetvarex[.]top/hsabankV2[.]zip | dorsetvarex[.]top | 35[.]238[.]185[.]184 | hopelogz@gmail[.]com davegame@engineer[.]com |
| dorsetvarex[.]top/secumd1[.]zip | dorsetvarex[.]top | 35[.]238[.]185[.]184 | hopelogz@gmail[.]com davegame@engineer[.]com |
| elpatroni[.]ddns[.]net/yahoo/ATtt[.]zip | elpatroni[.]ddns[.]net | 15[.]223[.]68[.]220 | chibamobilestore@hotmail[.]com lynchbim@gmail[.]com re5ultpage@yandex[.]com |
| enhanced-upgrade[.]ddns[.]net/Europe[.]zip | enhanced-upgrade[.]ddns[.]net | 62[.]4[.]21[.]167 | yanko[.]pro@protonmail[.]com |
| expire-enhanced[.]ddns[.]net/Europe[.]zip | expire-enhanced[.]ddns[.]net | 62[.]4[.]21[.]167 | yanko[.]pro@protonmail[.]com |
| fanigh[.]ml/logins/dropboxu%20(1)[.]zip | fanigh[.]ml | 178[.]159[.]36[.]97 | annyoordaz@gmail[.]com keiernslopper@gmail[.]com meycroxxmayne@gmail[.]com robbinscott130@gmail[.]com sendinfo2@africamail[.]com |
| farmandt[.]ga/galbar/office-365[.]zip | farmandt[.]ga | 162[.]244[.]94[.]202 | officeonesa@gmail[.]com |
| farmandt[.]ga/hangower/office-365[.]zip | farmandt[.]ga | 162[.]244[.]94[.]202 | officeonesa@gmail[.]com |
| farmandt[.]ga/notificati0n/office-365[.]zip | farmandt[.]ga | 162[.]244[.]94[.]202 | officeonesa@gmail[.]com |
| farmandt[.]ga/scr[.]zip | farmandt[.]ga | 162[.]244[.]94[.]202 | chrstnlvrdg@gmail[.]com jamestanner2299@gmail[.]com jchrstnlvrdg@gmail[.]com |
| farmandt[.]ga/scr/office-365[.]zip | farmandt[.]ga | 162[.]244[.]94[.]202 | johnsonp[.]desk@gmail[.]com |
| finework[.]ddns[.]net/microsoftonline[.]com/ofc[.]zip | finework[.]ddns[.]net | 192[.]210[.]150[.]186 | ibrahemhitler@yandex[.]com |
| gamingcrypto[.]top/cibcedited[.]zip | gamingcrypto[.]top | 91[.]234[.]99[.]210 | zate123man@gmail[.]com |
| garenagratis[.]joinclaim[.]tk/Codashop2019[.]zip | garenagratis[.]joinclaim[.]tk | 167[.]86[.]104[.]214 | mengakakxd@gmail[.]com |
| ghfcyv[.]ddns[.]net/office/OneDrive%20(2)[.]zip | ghfcyv[.]ddns[.]net | 13[.]82[.]126[.]172 | nsfphese2@gmail[.]com |
| gidlellc[.]xyz/txt/txt[.]zip | gidlellc[.]xyz | 46[.]17[.]96[.]124 | mexyinc@yandex[.]com |
| gracemail[.]ddns[.]net/update/update[.]zip | gracemail[.]ddns[.]net | 13[.]82[.]126[.]172 | larrygeezy@yandex[.]com |
| informacionclien[.]servepics[.]com/es-ID6655/bankiaPV[.]zip | informacionclien[.]servepics[.]com | 172[.]104[.]78[.]40 | unconfigured |
| instatop[.]cf/Box/Box[.]zip | instatop[.]cf | 192[.]185[.]112[.]213 | nwestpalllets@gmail[.]com |
| ip[.]viewdns[.]net/verifying/rackspace[.]zip | ip[.]viewdns[.]net | 185[.]148[.]147[.]164 | camilacarter6@gmail[.]com |
| isitsa-71[.]ga/ANA(1)[.]zip | isitsa-71[.]ga | 192[.]232[.]246[.]34 | omex1231231@gmail[.]com |
| jumpsuit-71[.]tk/Wemail[.]zip | jumpsuit-71[.]tk | 18[.]195[.]148[.]12 | ceo@aramcogroup[.]xyz |
| kankmitwa[.]gq/Proposal/page%20(1)[.]zip | kankmitwa[.]gq | 192[.]210[.]199[.]68 | goldenlogs2018@yandex[.]com |
| kashinnat[.]ga/dosal/0nfile[.]zip | kashinnat[.]ga | 192[.]210[.]199[.]68 | dmatcc376537@gmail[.]com |
| kashinnat[.]ga/office/Office365[.]zip | kashinnat[.]ga | 192[.]210[.]199[.]68 | scottmich13@gmail[.]com |
| kashinnat[.]gq/Ourtimee/Ourtime1[.]zip | kashinnat[.]gq | 192[.]210[.]199[.]68 | amadareed7@gmail[.]com |
| kashinnat[.]gq/payment/Ourtime%20_1[.]zip | kashinnat[.]gq | 192[.]210[.]199[.]68 | michaelbarnstein1994@gmail[.]com |
| kashinnat[.]tk/b2/Ourtime[.]zip | kashinnat[.]tk | 192[.]210[.]199[.]68 | alarapepapichular0147@gmail[.]com |
| kashinnat[.]tk/b3/Ourtime[.]zip | kashinnat[.]tk | 192[.]210[.]199[.]68 | alarapepapichular0147@gmail[.]com |
| kashinnat[.]tk/jumi/Ourtime[.]zip | kashinnat[.]tk | 192[.]210[.]199[.]68 | alarapepapichular0147@gmail[.]com |
| kashinnat[.]tk/r4/Ourtime[.]zip | kashinnat[.]tk | 192[.]210[.]199[.]68 | alarapepapichular0147@gmail[.]com |
| katanzero-71[.]cf/SSA/Dedicated%20Office-[.]zip | katanzero-71[.]cf | 35[.]180[.]210[.]253 | anonymouslyf494@gmail[.]com |
| katota-71[.]cf/Dutch[.]zip | katota-71[.]cf | 34[.]95[.]193[.]177 | adeolalogs@gmail[.]com |
| katota-71[.]ml/telus/telus[.]zip | katota-71[.]ml | 34[.]95[.]193[.]177 | step590hart@gmail[.]com johnsmith4370@mail[.]com usedqbd@mail[.]ru |
| kratos-71[.]ga/sniper001/Amexx1[.]zip | kratos-71[.]ga | 34[.]77[.]81[.]43 | wendercruz5@gmail[.]com |
| ladmen[.]ga/logins/dropboxu%20(1)[.]zip | ladmen[.]ga | 178[.]159[.]36[.]97 | annyoordaz@gmail[.]com keiernslopper@gmail[.]com meycroxxmayne@gmail[.]com robbinscott130@gmail[.]com sendinfo2@africamail[.]com |
| lebonton[.]ddns[.]net/BOA%20scampage[.]zip | lebonton[.]ddns[.]net | 172[.]105[.]3[.]249 | johnfernadez@yopmail[.]com[.]com |
| lebonton[.]ddns[.]net/new-sg[.]zip | lebonton[.]ddns[.]net | 172[.]105[.]3[.]249 | santana[.]sim@hotmail[.]com |
| lebonton[.]ddns[.]net/Scam%20LCL[.]zip | lebonton[.]ddns[.]net | 172[.]105[.]3[.]249 | jaredbelowich@protonmail[.]com |
| lebonton[.]ddns[.]net/scama%20bnp%20paribas[.]zip | lebonton[.]ddns[.]net | 172[.]105[.]3[.]249 | r47ma@yandex[.]com |
| lqanchodien[.]anffgaming[.]tk/accgame123kcom[.]rar | lqanchodien[.]anffgaming[.]tk | 103[.]27[.]62[.]57 | n[.]tuan12368@gmail[.]com |
| microsecurities[.]tk/pdf2020[.]zip | microsecurities[.]tk | 3[.]249[.]142[.]62 | steveresult196705@gmail[.]com |
| moolboros[.]cf/365business[.]zip | moolboros[.]cf | 192[.]210[.]199[.]68 | yft[.]t@yandex[.]com leadsresults1@gmail[.]com |
| moolboros[.]ga/sp/omo%20(1)[.]zip | moolboros[.]ga | 192[.]210[.]199[.]68 | dranselmhennis@gmail[.]com |
| nkrimo[.]viewdns[.]net/Rackspaceerfinal[.]zip | nkrimo[.]viewdns[.]net | 185[.]148[.]147[.]222 | penley[.]niesel@gmail[.]com world2god@yandex[.]com |
| omanuito[.]hopto[.]org/20200117%20-%20Office%20365%20True%20Login[.]zip | hopto[.]org | 52[.]175[.]219[.]98 | rayreddingtonr8@gmail[.]com |
| omeltoa-71[.]gq/off2020[.]zip | omeltoa-71[.]gq | 35[.]157[.]48[.]36 | myworkpermit01@yandex[.]com myworkpermit01@gmail[.]com |
| onica[.]sytes[.]net/ofc[.]zip | onica[.]sytes[.]net | 51[.]116[.]177[.]47 | logslogsx@gmail[.]com |
| paypalconfirm[.]hopto[.]org/OldCode%202020%20Office%20Scampage[.]zip | paypalconfirm[.]hopto[.]org | 207[.]148[.]4[.]235 | sahil[.]ahmef@yandex[.]com |
| paypalconfirm[.]hopto[.]org/x/eDocu[.]zip | paypalconfirm[.]hopto[.]org | 207[.]148[.]4[.]235 | jeffrey[.]hastings@yandex[.]com |
| pickitup-71[.]ml/new[.]zip | pickitup-71[.]ml | 15[.]188[.]146[.]157 | donlee86@163[.]com donlee86@yandex[.]com |
| plortan[.]hopto[.]org/20200117%20-%20Office%20365%20True%20Login[.]zip | plortan[.]hopto[.]org | 52[.]175[.]219[.]98 | rayreddingtonr8@gmail[.]com |
| pubg[.]jtacid[.]com/PubG[.]zip | pubg[.]jtacid[.]com | 67[.]222[.]38[.]73 | N/A |
| pubg4all[.]ml/PubG[.]zip | pubg4all[.]ml | 67[.]222[.]38[.]73 | N/A |
| rackspacesupport[.]servehttp[.]com/Verify/rackspace%20(1)%20(1)[.]zip | rackspacesupport[.]servehttp[.]com | 18[.]191[.]245[.]150 | linuxforce3@gmail[.]com |
| rackspacesupport1[.]servepics[.]com/loads/lol[.]zip | rackspacesupport1[.]servepics[.]com | 18[.]191[.]245[.]150 | wa[.]rre[.]sh[.]mo@gmail[.]com |
| rackspacesupport1[.]servepics[.]com/rackspacedoyi/rackspace%20(1)%20(1)[.]zip | rackspacesupport1[.]servepics[.]com | 18[.]191[.]245[.]150 | linuxforce3@gmail[.]com |
| rackspacesupport1[.]servepics[.]com/rackspacesupportpap/rackspace%20(1)%20(1)[.]zip | rackspacesupport1[.]servepics[.]com | 18[.]191[.]245[.]150 | linuxforce3@gmail[.]com |
| record-enhanced[.]ddns[.]net/Europe[.]zip | record-enhanced[.]ddns[.]net | 62[.]4[.]21[.]167 | yanko[.]pro@protonmail[.]com |
| rororas-71[.]cf/Ovvice2019[.]zip | rororas-71[.]cf | 35[.]246[.]242[.]26 | newresumebox2019@gmail[.]com |
| secureowasettings[.]ddns[.]net/Adobee/Adobe[.]zip | secureowasettings[.]ddns[.]net | 192[.]236[.]155[.]17 | tiffanymoore1881@gmail[.]com |
| sergant-71[.]ga/chaseedit%20(1)[.]zip | sergant-71[.]ga | 192[.]185[.]121[.]44 | mawshood@gmail[.]com |
| setting-infos[.]doctorsbotox[.]com/xMR[.]JOKERx_2020_freshantibots[.]zip | setting-infos[.]doctorsbotox[.]com | 94[.]199[.]200[.]79 | unconfigured |
| setting-infos[.]sytes[.]net/xMR[.]JOKERx_2020_freshantibots[.]zip | setting-infos[.]sytes[.]net | 94[.]199[.]200[.]79 | unconfigured |
| shipment[.]ddns[.]net/On-Demand-Delivery%20non%20auto[.]zip | shipment[.]ddns[.]net | 192[.]119[.]67[.]177 | securednotification0@gmail[.]com |
| skalton-71[.]ml/fax/Whyxoffice365%202018[.]zip | skalton-71[.]ml | 35[.]180[.]210[.]253 | None (Unconfigured) |
| soowe-71[.]tk/sfexp/SfExssmine[.]zip | soowe-71[.]tk | 54[.]248[.]54[.]108 | dkinly0924@gmail[.]com |
| supportadmin[.]servepics[.]com/sounds/random1[.]zip | supportadmin[.]servepics[.]com | 18[.]191[.]245[.]150 | officedesk2100@gmail[.]com onesasky@gmail[.]com |
| suppportcentreapple[.]servehttp[.]com/16Shop-Apple-V2[.]zip | suppportcentreapple[.]servehttp[.]com | 162[.]241[.]107[.]47 | ressultkontol@gmail[.]com |
| teionxeraosuevalsieg7[.]ga/file_login/pdf_login/DocusignSSL[.]zip | teionxeraosuevalsieg7[.]ga | 178[.]159[.]36[.]95 | resultboxx18@yandex[.]com |
| theorganicsinstitute[.]top/Firstbank2[.]zip | theorganicsinstitute[.]top | 91[.]234[.]99[.]210 | zate123man@gmail[.]com pronc@prontomail[.]com |
| tntshipping[.]sytes[.]net/note/kr[.]zip | tntshipping[.]sytes[.]net | 18[.]188[.]65[.]80 | chibamobilestore@hotmail[.]com lynchbim@gmail[.]com re5ultpage@yandex[.]com |
| twoone-71[.]tk/outlook/Whyxoffice365%202018[.]zip | twoone-71[.]tk | 18[.]195[.]148[.]12 | None (Unconfigured) |
| ukworkingboxmmod[.]hopto[.]org/New/Office[.]zip | ukworkingboxmmod[.]hopto[.]org | 192[.]236[.]155[.]17 | onlyresults147@gmail[.]com |
| uptades-paypal[.]ddns[.]net/Castro%20impots[.]zip | uptades-paypal[.]ddns[.]net | 45[.]79[.]79[.]27 | rez2krez@protonmail[.]com |
| verification3dsecu[.]ddns[.]net/login[.]zip | verification3dsecu[.]ddns[.]net | 213[.]52[.]128[.]153 | zaek69120@gmail[.]com |
| voice028112[.]servehttp[.]com/officeW365[.]zip | voice028112[.]servehttp[.]com | 43[.]240[.]64[.]76 | Robertkhamann@gmail[.]com |
| wanderinglib[.]top/update[.]zip | wanderinglib[.]top | 40[.]79[.]240[.]201 | goren[.]speedm@gmail[.]com |
| www[.]crosbyton[.]tk/box/1drve[.]zip | www[.]crosbyton[.]tk | 13[.]231[.]229[.]72 | piratesgirl5580@gmail[.]com |
| www[.]jackndoll[.]tk/DocuSign[.]zip | www[.]jackndoll[.]tk | 51[.]89[.]21[.]154 | dw09360@yahoo[.]com |
| www[.]jackndoll[.]tk/suntrust%20page[.]zip[.]zip | www[.]jackndoll[.]tk | 51[.]89[.]21[.]154 | dw09360@yahoo[.]com |
| www[.]lavaflow[.]cf/client[.]zip | www[.]lavaflow[.]cf | 192[.]210[.]199[.]68 | incgnx@gmail[.]com |
| www[.]lavaflow[.]tk/office/Office365[.]zip | www[.]lavaflow[.]tk | 192[.]210[.]199[.]68 | scottmich13@gmail[.]com |
| www[.]login4[.]customerss[.]xyz/bof[.]zip | www[.]login4[.]customerss[.]xyz | 104[.]219[.]248[.]112 | bofgraenox2020@hotmail[.]com |
| www[.]lyoth[.]tk/hot/2020Outlook[.]zip | www[.]lyoth[.]tk | 13[.]231[.]229[.]72 | syafihqazimassyura@gmail[.]com akasdonald@hotmail[.]com tny20rz@gmail[.]com |
| www[.]mail54357[.]xyz/online[.]standardbank[.]co[.]za[.]zip | www[.]mail54357[.]xyz (not resolving currently) | 102[.]130[.]115[.]253 | gilbert2400@mail[.]ru |
| www[.]mail5800[.]xyz/online[.]standardbank[.]co[.]za[.]zip | www[.]mail5800[.]xyz (not resolving currently) | 102[.]130[.]115[.]253 | gilbert2400@mail[.]ru |
| www[.]optamenwa[.]tk/VnOndrv[.]zip | www[.]optamenwa[.]tk | 192[.]210[.]199[.]68 | joanakdstiles@gmail[.]com |
| www[.]recordbirds[.]top/cgi–bin/office[.]zip | www[.]recordbirds[.]top | 91[.]234[.]99[.]253 | payagent008@gmail[.]com |
| xenlene[.]xyz/txt/txt[.]zip | xenlene[.]xyz | 185[.]148[.]147[.]240 | grace2020grace@yandex[.]com mexyinc@zoho[.]com |
| xlsinvoices[.]sytes[.]net/note/att[.]net[.]zip | xlsinvoices[.]sytes[.]net | 18[.]188[.]65[.]80 | chibamobilestore@hotmail[.]com lynchbim@gmail[.]com re5ultpage@yandex[.]com |