# Copyright (c) 2014-2026 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: devilginx

# Reference: https://twitter.com/MichalKoczwara/status/1601324821614194688

165.22.30.136:3000
165.22.30.136:4000
165.227.198.201:3000
165.227.198.201:4000
20.172.22.144:3000
20.172.22.144:4000
23.99.193.156:3000
23.99.193.156:4000
46.101.184.179:3000
46.101.184.179:4000

# Reference: https://twitter.com/MichalKoczwara/status/1602582437648908289

78.141.195.16:1337

# Reference: https://twitter.com/MichalKoczwara/status/1634155939585482754

143.198.32.165:4000
167.71.190.181:4000

# Reference: https://www.virustotal.com/gui/ip-address/209.97.137.33/relations

evilginx-test.ddns.net
okta.evilginx-test.ddns.net
login.okta.evilginx-test.ddns.net

# Reference: https://twitter.com/banthisguy9349/status/1736660660405039482

13.56.179.221:4000
143.198.43.83:4000
178.62.209.220:4000
54.219.177.74:4000
67.207.82.103:4000
foofficel.com
microssofttonline.nl

# Reference: https://threatfox.abuse.ch/browse/tag/EvilGinx/

143.198.138.173:4000
159.65.47.249:4000
185.224.139.32:2053
195.74.86.44:8443
20.98.48.148:2002
45.56.92.137:443
5.42.64.70:2096
68.219.200.71:4000
aa.aeromexico.foundation
account.avenueconsulting.co
account.trabede.com
ads.customerportalverify.store
adsmanager-graph.eyardimgov.org
adsmanager.eyardimgov.org
api.qantas.aeromexico.foundation
apis.customerportalverify.store
autologon.huenumilla.cl
avenueconsulting.co
b.stats.paypal.secureapp.tools
bank.customerportalverify.store
bfp.usaa.website
bitcdemo-com.huenumilla.cl
blogger.customerportalverify.store
book.qantas.aeromexico.foundation
brannptonbrick.com
browser.huenumilla.cl
business.eyardimgov.org
c6.customerportalverify.store
cdn.aa.aeromexico.foundation
clix.usaa.website
collector.logins.services
content.customerportalverify.store
customerportalverify.store
documentsigningonline.com
drive.google.secureapp.tools
employees.carlsberg.site
fc.customerportalverify.store
foremostsgroup.com
fusion.os.gov.aisp.ps
fusion.ps.gov.aisp.ps
gettymefondeploy.online
github.logins.services
global.customerportalverify.store
graph.eyardimgov.org
isf.gov.lb.gov.aisp.ps
jebmefals.com
live.huenumilla.cl
lms.usaa.website
login-us.huenumilla.cl
login.avenueconsulting.co
login.factset.company
login.microsoft.fom-dev1.bloemer-net.de
login.recruiterteams.com
login.trabede.com
logs.customerportalverify.store
m.customerportalverify.store
mail.carlsberg.site
mail.mod.gov.eg.gov.aisp.ps
mail10.email.gov.aisp.ps
mcasproxy.huenumilla.cl
microsoft.huenumilla.cl
mobile2.usaa.website
myaccount.customerportalverify.store
myaccount.google.secureapp.tools
notifications.google.secureapp.tools
objects.usaa.website
office365.huenumilla.cl
ogs.customerportalverify.store
okta.outlook.nerdwriter.com
omns.customerportalverify.store
outlook-1.huenumilla.cl
outlook-us.huenumilla.cl
outlook.avenueconsulting.co
outlook.trabede.com
passwords.dordaa.at
paxful.usaa.website
play.customerportalverify.store
portal.carlsberg.site
potomac-clickstream.usaa.website
qantas.aeromexico.foundation
recruiterteams.com
secure.duevolostore.com
secure07c.usaa.website
sensors.usaa.website
sessions.usaa.website
smetrics.aa.aeromexico.foundation
smetrics.customerportalverify.store
smtc.qantas.aeromexico.foundation
ssl.google.secureapp.tools
sso.drivevvyze.com
sso.outlook.nerdwriter.com
static.customerportalverify.store
static.facebook.secureapp.tools
static.qantas.aeromexico.foundation
stats.customerportalverify.store
sts.securedocumentservices.ca
t.customerportalverify.store
us.azureauth-duo.factset.company
w1.avenueconsulting.co
webdisk.avenueconsulting.co

# Reference: https://threatfox.abuse.ch/browse/tag/EvilGinx/ (# 2024-01-23)

http://192.119.110.233
143.198.64.151:4000
15.207.223.179:443
188.166.209.186:4000
192.119.110.233:5000
account.deenpel.com
cpanel.dnl-l.ooguy.com
cpcalendars.dnl-l.ooguy.com
cpcontacts.dnl-l.ooguy.com
dnl-l.ooguy.com
expedia-realtime.expeida.net
expedia-rest.expeida.net
expeida.net
hwsrv-1125909.hostwindsdns.com
login.deenpel.com
mediaim.expeida.net
oms.expeida.net
onboarding.expeida.net
outlook.deenpel.com
pay.expeida.net
redirect-r1.pay.expeida.net
static.pay.expeida.net
vap.expeida.net
webmail.dnl-l.ooguy.com

# Reference: https://twitter.com/MichalKoczwara/status/1752446013359403109

miicrossofftonline.nl

# Reference: https://x.com/AvastThreatLabs/status/1806720963205107787

xpfdoc0365090.com
apps.xpfdoc0365090.com

# Reference: https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/master/feeds/unverified/IPPortC2s-30day.csv (# 2024-09-22)

103.47.226.152:3333
134.209.32.59:3333
137.184.38.108:3333
137.184.53.6:3333
138.197.133.22:4000
147.182.133.204:3333
161.35.232.141:4000
167.71.81.157:3333
170.64.224.234:4000
212.111.43.6:3333

# Reference: https://threatfox.abuse.ch/browse/tag/EvilGinx/ (# 2024-09-22)

account.driddex.shop
amazon.testfish.dosoos.com
apis.accountonline.live
events.api.georgicaautoholding.com
jobsprogress.pro
login.monmt.com
mailsession.com
monmt.com
mrdiy.diy
mrdyi.store
newscom.today
o365.zicar.info
outlook.adminstream.org
outlook.mailsession.com
perfectogruop.net
session.mailsession.com

# Reference: https://threatfox.abuse.ch/browse/tag/EvilGinx/ (# 2024-10-13)

134.209.32.140:3333
134.209.40.17:3333
137.184.83.183:4000
161.35.11.78:4000
161.35.4.145:4000
165.22.185.225:3333
167.99.145.60:3333
46.105.63.11:3333
62.84.102.226:3333
85.119.82.36:3333

# Reference: https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/refs/heads/master/feeds/unverified/IPPortC2s-90day.csv (# 2025-01-02)

142.93.165.129:3333
143.110.149.242:4000
146.19.254.74:3333
154.213.187.9:4444
159.223.245.31:3333
161.35.67.226:3333
163.5.160.51:443
18.117.79.177:4444
192.34.59.54:3333
194.62.167.248:3333
209.127.255.68:3333
23.94.148.18:443
34.71.33.30:3333
45.56.69.210:3333
93.95.228.242:3333

# Reference: https://x.com/MichalKoczwara/status/1926722005199470620

mlcrosofft.com
ads.mlcrosofft.com
sso.mlcrosofft.com
ssoo.mlcrosofft.com

# Reference: https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/refs/heads/master/feeds/unverified/IPPortC2s-90day.csv (# 2025-06-14)

101.32.60.83:4000
104.248.117.30:3333
104.248.167.114:3333
107.161.24.157:3000
119.28.223.139:4000
123.57.143.3:3333
13.60.69.8:3333
137.184.89.150:3333
138.197.25.162:3333
139.59.170.92:3333
143.110.253.93:9000
143.198.105.117:3333
144.172.104.45:3333
146.70.158.214:4000
148.163.80.27:3333
154.58.204.91:9000
156.238.230.148:3333
156.238.230.224:3333
158.160.18.227:3333
159.100.6.112:9000
159.100.9.105:3333
159.65.128.86:3333
159.65.130.32:3333
160.119.251.40:8443
161.35.194.66:3333
164.92.72.96:4000
167.88.164.138:3333
167.99.42.160:4000
172.245.152.21:4000
174.136.229.54:3333
176.111.216.82:3333
176.123.1.151:9000
176.123.2.185:9000
176.126.103.125:4000
176.126.103.251:4000
176.126.103.64:4000
178.62.29.13:3333
18.177.125.151:9000
18.217.106.242:4444
185.101.23.248:3333
185.101.23.252:3333
185.146.232.235:4000
185.193.125.249:4000
185.238.2.142:9000
188.166.199.174:3333
193.56.23.80:3333
194.180.158.14:80
194.195.251.227:4000
194.233.76.207:443
194.62.166.165:3333
194.62.167.215:3333
196.251.114.4:4000
20.83.181.241:443
209.38.202.104:4000
209.38.96.47:4000
209.74.88.128:4000
212.224.86.224:9000
216.176.190.164:3333
217.114.43.122:4000
217.114.43.234:4000
217.114.43.53:4000
23.137.104.78:4000
23.137.105.217:4000
23.227.199.88:443
3.141.231.53:3333
3.145.74.158:3333
31.172.87.193:4000
35.87.129.75:443
37.221.111.94:3333
38.146.27.131:4000
38.146.28.166:4000
43.160.207.83:3333
45.61.160.127:3333
45.86.86.49:9000
52.62.100.83:3333
52.78.43.89:9000
57.182.91.111:4000
62.60.187.68:3333
63.133.220.145:3333
64.23.243.220:3333
77.92.145.20:9000
79.133.51.132:8443
81.0.247.170:143
81.0.247.170:25
81.0.247.170:443
81.0.247.170:993
81.0.247.170:995
84.200.17.247:4000
84.200.24.88:443
84.32.131.104:3333
84.32.131.163:3333
85.239.33.253:9000
87.251.78.217:4000
87.251.78.239:4000
87.251.78.30:4000
87.251.78.37:4000
88.216.68.32:3333
91.209.135.198:4000
91.209.135.199:4000
91.209.135.202:4000
91.209.135.229:4000
91.209.135.231:4000
91.209.135.233:4000
91.209.135.252:4000
91.209.135.71:4000
91.209.135.84:4000
91.209.135.88:4000
93.177.109.20:3333

# Reference: https://x.com/solostalking/status/1946069612090495059
# Reference: https://app.validin.com/detail?find=Login%20%C2%B7%20OXF%20Panel&type=raw&ref_id=72f38ae3a48#tab=host_pairs (# 2025-07-18)

176.65.134.138:4000
176.65.140.81:4000
194.195.122.86:4000
20.200.144.201:4000
206.123.145.218:4000
40.89.209.119:4000
45.74.16.75:4000
45.74.16.91:4000
45.83.28.66:4000
45.83.28.67:4000
51.89.242.47:4000

# Reference: https://x.com/BlinkzSec/status/1948015815501938851

164.92.199.192:4000
43.162.116.186:4000
43.162.122.245:4000
43.162.123.118:4000

# Reference: https://app.validin.com/detail?find=Evilginx%20Super-Evil%20Root%20CA&type=raw&ref_id=bbf2b37b491#tab=host_pairs (# 2025-07-23)

4.fbads.store
acc.fbads.store
acc.teams.m365.acenm.com
access.accessingdiba.posteid-a365.com
account.authlitemathhk.ru
account.miicrosofts.org
account.offfec.me
account.quarles.exploreainow.com
account.teams.m365.acenm.com
account.viber.posteid-a365.com
account.zalopay.site
accounts.appauthservice.online
accounts.identity-zillow.cam
accounts.upsite.up-edu-mx.shop
accountyahoo.posteid-a365.com
acctcdn.miicrosofts.org
acount.support
adfs.fbads.store
ads.login.posteid-a365.com
ads.miicrosofts.org
ads.posteid-a365.com
ads.yahoorecovery.posteid-a365.com
advath.appauthservice.online
advath.miicrosofts.org
aircraftspartsstore.com
allied-constructionllc.online
amazingshinenail.org
ap.appauthservice.online
api-aa1a6aea.offfec.me
api.login.appauthservice.online
api.loginpaxful.posteid-a365.com
api.phish.bejkfkje.store
api2.usaa.com.broadpli.com
apm.vpce.gdw55e.quarles.exploreainow.com
apm.vpce.gdw55e.teams.m365.acenm.com
appauthservice.online
apple.posteid-a365.com
appleid.apple.posteid-a365.com
auth.ebanking.posteid-a365.com
auth.miicrosofts.org
authh.miicrosofts.org
authlitemathhk.ru
authserv-misciosoft.net
b.stats.paypal.posteid-a365.com
baker221.co.uk
bli.su
bqztzw.postfinancelogin.posteid-a365.com
browser.miicrosofts.org
burnsmcd.co
c.paypal.posteid-a365.com
c6.paypal.posteid-a365.com
c6.postfinancelogin.posteid-a365.com
canvvapro.com
cdn.apple.posteid-a365.com
cdn.livee.publicvm.com
cdn.miicrosofts.org
chuongvn.space
cloudflare.posteid-a365.com
cloudviewer-dashboardclearinghouse.art
cloumi.website
comet.appauthservice.online
consent.appauthservice.online
consent.cmp.appauthservice.online
csp.fbads.store
csp.login.posteid-a365.com
csp.miicrosofts.org
csp.teams.m365.acenm.com
dealerhub.ebanking.posteid-a365.com
deskschoolpro.com
dhl.posteid-a365.com
dotfoods.miicrosofts.org
dreamhome.lat
ebanking.posteid-a365.com
edge-chat-fb.cloumi.website
exchangeodds.live
exploreainow.com
familysparents.site
fbads.store
fbsvm.cam
fbwatch.live
fc.login.posteid-a365.com
fc.posteid-a365.com
feedbackws.apple.posteid-a365.com
feedbackws.icloud.posteid-a365.com
fpt2.miicrosofts.org
frenchfluencys.club
ftp.miicrosofts.org
g.sst.quarles.exploreainow.com
g.sst.teams.m365.acenm.com
geo.appauthservice.online
google.posteid-a365.com
graph.cloumi.website
guce.login.posteid-a365.com
guce.yahoorecovery.posteid-a365.com
gui.miicrosofts.org
gui.teams.m365.acenm.com
hagtr.com
help.miicrosofts.org
hnd.stats.paypal.posteid-a365.com
hypstarcdn.service-tiktok.cam
id.appauthservice.online
id.miicrosofts.org
idd.miicrosofts.org
identity-zillow.cam
img1.miicrosofts.org
img6.miicrosofts.org
iwannatest.site
jigpgt4.yatebyaviyebu.shop
js.loginpaxful.posteid-a365.com
js.miicrosofts.org
kakao.service-tiktok.cam
kliknlbmontenegro.posteid-a365.com
link1url.help
live.teams.m365.acenm.com
livee.publicvm.com
livelogin.posteid-a365.com
login-yahoo.posteid-a365.com
login.baker221.co.uk
login.d.benzeta.com
login.livee.publicvm.com
login.livelogin.posteid-a365.com
login.login.posteid-a365.com
login.microsoftonline.login.posteid-a365.com
login.miicrosofts.org
login.notrust.es
login.office.safelogins.su
login.outlook.secprojectapptest.xyz
login.portal-github.com
login.posteid-a365.com
login.quarles.exploreainow.com
login.secprojectapptest.xyz
login.teams.m365.acenm.com
login.thecrabsterchief.work
login.usersettings.gianteaglepharmacy.it.com
login.zalopay.site
login1-sow.com
login1.miicrosofts.org
login4.fbads.store
logincdn.miicrosofts.org
loginpaxful.posteid-a365.com
m.identity-zillow.cam
m.instasec.nl
m.paypal.posteid-a365.com
m.service-tiktok.cam
m365.office.safelogins.su
magnificent-goods-catch-and-sons.com
mail-googlservice.site
mail.cadescorretora.com.br
mail.login.posteid-a365.com
mail.posteid-a365.com
mail.yahoorecovery.posteid-a365.com
microsoft-onedrive.trunetkings.xyz
microsoft-onedrive.trunetkings.xyz.trunetkings.xyz
microsoft.suvorovaart.ru
microsoft.upgrade1.zip
microsoftonline.login.posteid-a365.com
miicrosofts.org
mmcapi.miicrosofts.org
mon-va.instasec.nl
mon-va.service-tiktok.cam
mrdiy.diy
msalaunch.miicrosofts.org
msf-mfa.cam
msfed.appauthservice.online
msfed.miicrosofts.org
myaccount.appauthservice.online
myaccount.google.posteid-a365.com
nipponindiaim.co.in
ns1.chuongvn.space
ns2.chuongvn.space
ns2.magnificent-goods-catch-and-sons.com
ns2.skinsgonewild.com
o.appauthservice.online
o.miicrosofts.org
o365.zicar.info
offauth0.com
offfec.me
office.miicrosofts.org
office.safelogins.su
ogs.mail-googlservice.site
oidc.mail.appauthservice.online
ok.teams.m365.acenm.com
okta.teams.m365.acenm.com
onlyfame.icu
outlook.appauthservice.online
outlook.livee.publicvm.com
outlook.livelogin.posteid-a365.com
outlook.login.secprojectapptest.xyz
outlook.microsoft.upgrade1.zip
outlook.miicrosofts.org
outlook.notrust.es
outlook.offfec.me
outlook.secprojectapptest.xyz
paypal.posteid-a365.com
pbnj.site
play.focusv.ru
play.google.posteid-a365.com
play.up-edu-mx.shop
polyfill.service-tiktok.cam
portal.zalopay.site
posteid-a365.com
postfinancelogin.posteid-a365.com
privacynotice.hengxaingltd.com
query.appauthservice.online
react.appauthservice.online
react.miicrosofts.org
rengine.zalopay.site
res.miicrosofts.org
sbbe.loginpaxful.posteid-a365.com
sci.miicrosofts.org
sci.offfec.me
search.appauthservice.online
secprojectapptest.xyz
secure.appauthservice.online
secure.miicrosofts.org
secureee.miicrosofts.org
securitytestpasskey.ru
sensors.login1-sow.com
service-tiktok.cam
setup.apple.posteid-a365.com
shhwwerfa.com
signin.miicrosofts.org
smusxath.miicrosofts.org
sofianeyaya.fr
southwesternconstructiongroup.site
sp.authpoint.usa.miicrosofts.org
sp.authpoint.usa.offauth0.com
sp.authpoint.usa1.miicrosofts.org
ssl.accountgoogle.posteid-a365.com
ssl.link1url.help
ssl.securitytestpasskey.ru
ssl.up-edu-mx.shop
sso.appauthservice.online
sso.miicrosofts.org
sso.offfec.me
sso.office.safelogins.su
sso.teams.m365.acenm.com
sso.zalopay.site
sso3.miicrosofts.org
sso4.miicrosofts.org
ssoo.miicrosofts.org
stake.moi
static-cdn.cloumi.website
static.fbsvm.cam
static.fbwatch.live
static.login1-sow.com
static.service-tiktok.cam
stats.paypal.posteid-a365.com
stats.postfinancelogin.posteid-a365.com
sub.item516115614531821.fbads.store
sub.item516885621531826.fbads.store
sub.item518475621531819.fbads.store
sub.item519985621531817.fbads.store
t.paypal.posteid-a365.com
team-endurancecom.sofianeyaya.fr
the-inconsulting.net
thecrabsterchief.work
thexfil.site
trunetkings.xyz
turiagaa.ru
udc.yahoorecovery.posteid-a365.com
ui.miicrosofts.org
ulgroup.miicrosofts.org
up-edu-mx.shop
upgrade1.zip
upsite.up-edu-mx.shop
usa.appauthservice.online
usa.miicrosofts.org
usaa.miicrosofts.org
usersettings.gianteaglepharmacy.it.com
video.appauthservice.online
vn3hg.miicrosofts.org
vn3hg.offfec.me
wcpstatic.miicrosofts.org
wmw-o365.cam
wmw-tik-tok.cam
yahoo.posteid-a365.com
yahoorecovery.posteid-a365.com
ycom.appauthservice.online
ywnjb.appauthservice.online
ywnjb.offfec.me
zalopay.site
zdassets.loginpaxful.posteid-a365.com

# Reference: https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/refs/heads/master/feeds/unverified/IPPortC2s-90day.csv (# 2025-07-26)

http://13.61.105.64
http://194.180.158.14
103.124.105.76:4000
104.193.69.173:443
13.210.249.235:3333
144.172.117.108:443
159.223.109.10:3333
18.221.91.216:3333
196.251.72.3:4000
3.106.188.239:3333
35.228.18.60:3333
45.9.149.15:4000
8.218.222.240:443
82.29.72.11:4000
95.217.15.168:3333

# Reference: https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/refs/heads/master/feeds/unverified/IPPortC2s-90day.csv (# 2025-10-05)

http://35.171.186.126
104.218.50.250:4000
104.234.36.60:4000
104.234.37.139:4000
104.234.37.156:4000
111.90.151.129:2850
111.90.151.72:2850
124.198.132.121:4000
146.103.119.187:4000
146.190.135.251:3333
146.190.68.5:3333
162.213.249.133:4000
164.92.178.59:3333
168.231.124.24:3333
172.237.131.251:3333
185.161.209.117:443
185.230.161.155:2850
194.180.158.22:8443
195.77.8.140:4444
20.199.83.166:6666
208.113.131.209:3333
208.73.203.229:443
38.146.28.85:4000
4.216.156.191:3333
40.160.2.204:3333
43.162.108.133:4000
43.162.114.107:4000
43.162.114.240:4000
46.101.93.233:3333
62.60.226.57:4000
65.108.80.194:3333
66.45.248.205:4000
77.223.214.71:8443
83.229.112.185:3333
91.241.93.244:4000

# Reference: https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/refs/heads/master/feeds/unverified/IPPortC2s-90day.csv (# 2025-11-08)

109.120.137.142:443
151.241.100.8:4000
16.171.160.238:3333
185.165.169.224:3333
194.163.134.116:3333
195.77.8.140:8080
213.210.13.209:3333
23.227.199.49:4000
31.97.134.73:8082
45.145.171.123:8443
46.62.228.181:3333
47.79.95.100:3333
82.29.155.150:3333
91.219.151.74:3000
91.92.240.188:4000

# Reference: https://blogs.infoblox.com/threat-intelligence/dns-uncovers-infrastructure-used-in-sso-attacks/

acmsquared.com
ads2ads.com
aghomesandproperties.com
allwebdirectories.com
amj-international.com
apartamentosmalaga.com
armingaud.com
bazmepaigham.com
bedrijvenregister.com
bestshayari.com
brillianceboundielts.com
brownak.com
buildonhope.com
cappadociavisittours.com
catering-amato.com
cccsok.com
citywideprayer.com
controlunlimited.com
coralridgehour.com
dartsinireland.com
data-logistics.com
dhoughton.com
dogcuty.com
e-briefe.com
eggcoo.com
eheringe-trauringe.com
ehsantrust.com
esdetodo.com
fluffybascha.com
forty-something.com
freaksandfriends.com
geegletee.com
georgiayr.com
goraba.com
hafikoman.com
heisseliebe.com
hurenkontakte.com
ideallivingsolutions.com
igreensoft.com
ilchirone.com
impexinc.com
inkdchronicles.com
intellipex.com
intercuba.com
ispamembers.com
jimmylange.com
joshuasdodds.com
kbdav.com
l2storm.com
littlenuggetsco.com
lost-signal.com
lpdeco.com
monnalissaboutique.com
mpoterbaru2024.com
mykidsfashion.com
northstarcouncil.com
qrcodespoweredbygs1.com
schnaitsee.com
sercanaydin.com
srpskazemlja.com
thelovecity.com
thermalresistivity.com
transusasia.com
tubeunderwater.com
weddingsarahetemmanuel.com
winbet299mas.com
yoopuipui.com

# Reference: https://x.com/volrant136/status/2042258325606105111
# Reference: https://x.com/MichalKoczwara/status/2042286743374774533

securedrnicrosoftconnect.com

# Reference: https://x.com/stop_spammerz/status/2077422659558617142
# CERT_FINGERPRINT_SHA256-HOST/IP=9bcd6161c13d5e61a41799f8a03af6664af69328dc2bc4a140c265466ab70eab
# TITLE-HOST/IP=Devilginx | Dashboard

185.212.128.139:9000
185.212.128.176:9000
185.212.128.215:9000
185.212.128.231:9000
185.212.128.24:9000
185.212.128.80:9000
185.212.128.81:9000
185.212.129.117:9000
185.212.129.185:9000
185.212.129.221:9000
185.212.131.27:9000
185.212.131.28:9000
195.242.118.161:9000
185-212-128-155.cprapid.com
4workntt.click
bankofamericaedd.dynamic-dns.net
bankofamericaedd.itsaol.com
bofaeddprepaid.dynamic-dns.net
bofaeddvisa.dynamic-dns.net
bofavisaprepaid.ddns.info
dashcam2.link
dashcam3.com
secure-chasebullsjitshsit.dynamic-dns.net
visaprepaidprocessing.ns01.us
visaprepaidprocessing.otzo.com

# Reference: https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-07-14-Malicious-files-and-infrastructure-from-npm-PyPI-Supply-Chain-packages.txt
# TITLE-HOST/IP=Evilginx | Login

148.230.93.72:4000
162.35.174.220:4000
164.92.104.155:4000
165.22.202.213:4000
172.235.144.71:4000
195.250.25.214:4000
198.58.109.141:4000
217.60.195.151:3000
43.201.183.135:9000
45.9.148.93:4000
5.181.188.230:3000
66.29.131.145:4000
66.29.131.145:5000
supportive.fit

# TITLE-HOST/IP=Evilginx Super-Evil Root CA
# TITLE-HOST/IP=Evilginx Management Platform
# TITLE-HOST/IP=Evilginx Signature Trust Co.
# TITLE-HOST/IP=Evilginx
# TITLE-HOST/IP=Evilginx Phishlets - Premium Security Tools
# TITLE-HOST/IP=Evilginx Panel
# TITLE-HOST/IP=Evilginx Admin
# TITLE-HOST/IP=Evilginx | Login
# TITLE-HOST/IP=Evilginx2

0g.doubleclick.net.amazonaws.com.mediaplanung.biz
0googleads.g.doubleclick.net.com.mediaplanung.biz
0nyofe08.todaygood.space
10g.doubleclick.net.amazonaws.com.mediaplanung.biz
10googleads.g.doubleclick.net.com.mediaplanung.biz
154-86-119-227.sslip.io
1ad.doubleclick.net.amazonaws.com.mediaplanung.biz
1celebration.life
1ogoogleads.g.doubleclick.net.com.mediaplanung.biz
1web4all.net
2.26.123.89.sslip.io
20.82.124.87.nip.io
210g.doubleclick.net.amazonaws.com.mediaplanung.biz
210googleads.g.doubleclick.net.com.mediaplanung.biz
21ad.doubleclick.net.amazonaws.com.mediaplanung.biz
21ogoogleads.g.doubleclick.net.com.mediaplanung.biz
234panel.online
2redirector.2bd.net
3210g.doubleclick.net.amazonaws.com.mediaplanung.biz
3210googleads.g.doubleclick.net.com.mediaplanung.biz
321ad.doubleclick.net.amazonaws.com.mediaplanung.biz
321ogoogleads.g.doubleclick.net.com.mediaplanung.biz
37.148.134.208.nip.io
3secure-web.cisco.com.amazonaws.com.mediaplanung.biz
3xcv09.lusy.ink
43210g.doubleclick.net.amazonaws.com.mediaplanung.biz
43210googleads.g.doubleclick.net.com.mediaplanung.biz
4321ad.doubleclick.net.amazonaws.com.mediaplanung.biz
4321ogoogleads.g.doubleclick.net.com.mediaplanung.biz
43secure-web.cisco.com.amazonaws.com.mediaplanung.biz
4c799c47-82ba-4bdf-a3a2-bec8e271f167.fs.lucidlink.com
543210g.doubleclick.net.amazonaws.com.mediaplanung.biz
543210googleads.g.doubleclick.net.com.mediaplanung.biz
54321ogoogleads.g.doubleclick.net.com.mediaplanung.biz
543secure-web.cisco.com.amazonaws.com.mediaplanung.biz
654321ad.doubleclick.net.amazonaws.com.mediaplanung.biz
654321ogoogleads.g.doubleclick.net.com.mediaplanung.biz
6543secure-web.cisco.com.amazonaws.com.mediaplanung.biz
6protect-jp.mimecast.com.amazonaws.com.mediaplanung.biz
7654321ad.doubleclick.net.amazonaws.com.mediaplanung.biz
7654321ogoogleads.g.doubleclick.net.com.mediaplanung.biz
76543secure-web.cisco.com.amazonaws.com.mediaplanung.biz
76protect-jp.mimecast.com.amazonaws.com.mediaplanung.biz
7notifications.google.com.amazonaws.com.mediaplanung.biz
7qgs12ooc.todaygood.space
7r0les.todaygood.space
87654321ad.doubleclick.net.amazonaws.com.mediaplanung.biz
87654321ogoogleads.g.doubleclick.net.com.mediaplanung.biz
876543secure-web.cisco.com.amazonaws.com.mediaplanung.biz
876protect-jp.mimecast.com.amazonaws.com.mediaplanung.biz
87notifications.google.com.amazonaws.com.mediaplanung.biz
8urldefense.proofpoint.com.amazonaws.com.mediaplanung.biz
987654321ogoogleads.g.doubleclick.net.com.mediaplanung.biz
9876protect-jp.mimecast.com.amazonaws.com.mediaplanung.biz
987notifications.google.com.amazonaws.com.mediaplanung.biz
98oiukjq.sporterfan.com
98urldefense.proofpoint.com.amazonaws.com.mediaplanung.biz
9k.mediaplanung.biz
a.p4irs.com
aadcdn-msft.icseingenieria.cc
aadcdn.365office.dpdns.org
aadcdn.actualizacion-seguridad.com
aadcdn.drilltest.anugan.com
aadcdn.icseingenieria.cc
aadcdn.lomesroll.com
aadcdn.rnicrosoftrecovery.com
aadcdn.signal-relay.com
aadcdn.testing01.uk
aadcdnalt.mikecrosoft.info
aadcdnn.rnicrosoftrecovery.com
aadlogin.lomesroll.com
aawe.finance
abs.protocolendless.com
acadain-asset.com
academy.login.secureportal-mx.com
academy.secureportal-mx.com
academy.test.wetransfer.pro
account-ms.icseingenieria.cc
account.154-86-119-227.sslip.io
account.actualizacion-seguridad.com
account.check-photo.dderby.net
account.ciberseguridad-eia.xyz
account.icseingenieria.cc
account.messager.my
account.mselite.org
account.outiook-offlceauthyfyveriflive.info
account.rnicrosoftrecovery.com
account.s.pcidi-ca.co
account.salenndoor.com
account.takersuz-lab.com
account.varrysections.digital
accountgd.mikecrosoft.info
accounts-google.109-199-97-174.sslip.io
accounts.aawe.finance
accounts.admin-gsync.xyz
accounts.appnafk.dpdns.org
accounts.booking.ciberseguridad-eia.xyz
accounts.docuhost.sbs
accounts.gm-verification.duckdns.org
accounts.google.bain-corp.com
accounts.login.hope-relief-center.site
accounts.opensupport.net
accounts.rnicrosoftrecovery.com
accounts.secureportal-mx.com
accounts.varrysections.digital
accounts.vortunsa.qinch.top
accountsettingsupdate.com
acm.messager.my
actualizacion-seguridad.com
ad.doubleclick.net.amazonaws.com.mediaplanung.biz
ad.doubleclick.net.tronscan.sbs
ad.messager.my
adfs.lomesroll.com
adfsts.lomesroll.com
admin.ciberseguridad-eia.xyz
admin.france-privatequidedtours.com
admin.gamerplaying.com
admin.varrysections.digital
admin.wddj.co.in
ads.onetime-authentication.cruiserscrib.com
ads.yahoos.live
advath.varrysections.digital
africapower.grosbit.com
airs.intuitqbo.com
ajax.rs-dns.sbs
ajax.varrysections.digital
akira.lab.evilginx.com
alertadeseguranca.com.br
allenkeith.varrysections.digital
amazonaws.com.mediaplanung.biz
amazonaws.com.tronscan.sbs
amcdn.varrysections.digital
an.messager.my
analytics.gm-verification.duckdns.org
analytics.secureportal-mx.com
anotherdomain.in
ap-northeast-1.amazonaws.com.tronscan.sbs
ap-southeast-1.amazonaws.com.tronscan.sbs
apc01.safelinks.protection.outlook.com.tronscan.sbs
api-2-0.aol.aktaninery.com
api.ciberseguridad-eia.xyz
api.go007-go007-go007-go007.top
api.lqmbq.site
api.passport.yandex.hdgv.ru
api.rootvk.messager.my
apipersforating.com
apis.aawe.finance
apis.accountrestore.online
apis.gm-verification.duckdns.org
apis.loginemai.com.br
apis.secureportal-mx.com
apis.varrysections.digital
apis.wjdiadjai.lol
apm.vpce.gdw55e.vdjhrr.de
app-qbo.intuitqbo.com
app.154-86-119-227.sslip.io
app.messager.my
app.portal-verify.app
app.private-info.support
appleid-cdn.icloud.accounts-secured.com
appleid-cdn.storage-icloude.com
appletotal.cloud
apps.154-86-119-227.sslip.io
apps.dmg-tech.com
asdfdf.sporterfan.com
asdgiukl.sbs
assets.dmg-tech.com
atlas.hdgv.ru
auth.messager.my
auth.port-base.com
auth.ticketmaster.komba.sbs
auth.usaubereats.com
auth.varrysections.digital
auth0api.lomesroll.com
auth0au.lomesroll.com
auth0cdn.lomesroll.com
auth0eu.lomesroll.com
auth0login.lomesroll.com
authgfx.office.mywallet.help
authlg.lomesroll.com
authpoint.usa.varrysections.digital
authpoint.varrysections.digital
autn.port-base.com
autologon.actualizacion-seguridad.com
autologon.icseingenieria.cc
avatars.messager.my
aventuresaviation.com
b.stats.paypal.aktaninery.com
b2.messager.my
b2cauth.lomesroll.com
b2clogin.lomesroll.com
bcfremote.dmg-tech.com
bcm.messager.my
bdo.dmg-tech.com
beamer.port-base.com
bewdleybridge.co.uk
bing.com.tronscan.sbs
birdiethirty.com
biz-gooogle.ltd
bladerunner.lab.evilginx.com
blockchain92i.shop
blog.lomesroll.com
blogger.secureportal-mx.com
bphkxnap.texteq.cfd
browser.events.data.actualizacion-seguridad.com
browser.events.data.varrysections.digital
bs.messager.my
business.coppsindoor.org
bx.varrysections.digital
c6.paypal.aktaninery.com
cache.marriott-rewards.duckdns.org
calendar.varrysections.digital
captcha.2.26.123.89.sslip.io
capture.coppsindoor.org
ccm.messager.my
cdn-1.acadain-asset.com
cdn-2.acadain-asset.com
cdn-3.acadain-asset.com
cdn.37.148.134.208.nip.io
cdn.accountrestore.online
cdn.check-photo.dderby.net
cdn.messager.my
cdn.rs-dns.sbs
cdn.secure-workportal.com
cdn.varrysections.digital
cdn2.varrysections.digital
cdndz.messager.my
centrify.lomesroll.com
centrifypod.lomesroll.com
ceres-das.intuitqbo.com
cfl.demo.ifcs-demo-bb.win
cfp.varrysections.digital
cheesengtong.shop
ciberseguridad-eia.xyz
cisco.com.amazonaws.com.mediaplanung.biz
cisco.com.tronscan.sbs
citrix.dmg-tech.com
clck.messager.my
clients1.varrysections.digital
clients2.varrysections.digital
clients3.varrysections.digital
clients4.varrysections.digital
clients5.varrysections.digital
clients6.varrysections.digital
cloud.duosign.net
cloudfront.net.amazonaws.com.mediaplanung.biz
cloudfront.net.mediaplanung.biz
cloudfront.net.tronscan.sbs
codbilkedsas.org
com.amazonaws.com.mediaplanung.biz
com.mediaplanung.biz
completion.xst.wddj.xyz
connect.celticcommunications.co
connect.coppsindoor.org
consent-cmp.stripe-accountverify.com
content.aawe.finance
content.lifecycle.varrysections.digital
content.secuautcheck.org
content.secureportal-mx.com
content.varrysections.digital
content.vortunsa.qinch.top
contract.xxx
copilot.994e79c0-ffb1-4df9-b623.cloud
corp-express.ru
corsapi.messager.my
cpanel.niii.shop
csp.accountrestore.online
csp.icseingenieria.cc
csp.meta-email.online
csp.varrysections.digital
csp.yahoos.live
cudasvc.com.mediaplanung.biz
cudasvc.com.tronscan.sbs
cyberark.lomesroll.com
cyberarkid.lomesroll.com
cyberarkidp.lomesroll.com
cyberpunk.lab.evilginx.com
dashboard.microsoftaitech.com
dashboardframework.intuitqbo.com
data.varrysections.digital
db9c149a4ab5c4.cloudfront.net.amazonaws.com.mediaplanung.biz
dcc.meta-email.online
dealerhub.focusv.ru
delaware.varrysections.digital
demo.ifcs-demo-bb.win
desktop.dmg-tech.com
deusex.lab.evilginx.com
device.login.ofice365.ca
device.lomesroll.com
deviceintel-identityra.intuitqbo.com
df.cfp.varrysections.digital
dmg-tech.com
docs.varrysections.digital
docusign.verifylogin.app
dotfoods.meta-email.online
dotfoods.varrysections.digital
doubleclick.net.amazonaws.com.mediaplanung.biz
doubleclick.net.com.mediaplanung.biz
doubleclick.net.tronscan.sbs
dreamrayale.com
drilltest.anugan.com
drive.gm-verification.duckdns.org
drive.secureportal-mx.com
drive.varrysections.digital
drive.wjdiadjai.lol
dropboxcaptcha.drepbox.com
dsxcwa.icseingenieria.cc
du90lny7be.todaygood.space
duoadmin.lomesroll.com
duoapi.lomesroll.com
duoauth.lomesroll.com
duofed.lomesroll.com
duoframe.lomesroll.com
duosso.lomesroll.com
duostatic.lomesroll.com
dynamic.wjdiadjai.lol
e.messager.my
ecs.varrysections.digital
enterprise.bit24.dev
entrustauth.lomesroll.com
entrustid.lomesroll.com
eu-central-1.amazonaws.com.tronscan.sbs
eu-west-1.amazonaws.com.mediaplanung.biz
eu-west-1.amazonaws.com.tronscan.sbs
eu.auth.varrysections.digital
eu0c435.icseingenieria.cc
eur01.safelinks.protection.outlook.com.tronscan.sbs
eur02.safelinks.protection.outlook.com.tronscan.sbs
eur03.safelinks.protection.outlook.com.tronscan.sbs
eur04.safelinks.protection.outlook.com.tronscan.sbs
events.acadain-asset.com
events.data.varrysections.digital
events.lomesroll.com
events.varrysections.digital
events.wjdiadjai.lol
evil-admin.inbox4sure.com
evil-admin.m4b.in
evil.ybo-lab.com
evilginx-mgmt.zeabur.app
evilginx-store.pro
evilginx.com
evilginx.pushdemos.com
facebook.com.tronscan.sbs
favicon.messager.my
fbcdn.coppsindoor.org
fc.accountrestore.online
fc.yahoos.live
feedbackws.storage-icloude.com
files.port-base.com
filin.messager.my
fonts.gm-verification.duckdns.org
fonts.secureportal-mx.com
fonts.testing-evil.duckdns.org
fonts.varrysections.digital
forum.lomesroll.com
fpp.intuitqbo.com
fpt.varrysections.digital
friam.lomesroll.com
frlogin.lomesroll.com
fropenam.lomesroll.com
fslogin.lomesroll.com
g.doubleclick.net.amazonaws.com.mediaplanung.biz
g.doubleclick.net.com.mediaplanung.biz
g.doubleclick.net.tronscan.sbs
gallery.lomesroll.com
gateway.icloud.accounts-secured.com
gd0.com.co
gdevents.lomesroll.com
gdgui.lomesroll.com
gdimg1.lomesroll.com
gdimg6.lomesroll.com
gdsso.lomesroll.com
ghjftyghbj.zeabur.app
github.ciberseguridad-eia.xyz
gm-verification.duckdns.org
go.actualizacion-seguridad.com
google.bain-corp.com
google.com.amazonaws.com.mediaplanung.biz
google.com.tronscan.sbs
google.coppsindoor.org
google.platform.secureportal-mx.com
googleads.g.doubleclick.net.amazonaws.com.mediaplanung.biz
googleads.g.doubleclick.net.com.mediaplanung.biz
googleads.g.doubleclick.net.tronscan.sbs
googleadservices.com.tronscan.sbs
googletag.wjdiadjai.lol
googletagmanager.coppsindoor.org
gpt-mail.stripe-accountverify.com
gpt.yahoos.live
graph.eltestdelninio.top
graph.meta-email.online
graph.serviceteamoffice365.click
graph.varrysections.digital
graphql.login.masarofficial.com
gsss1msqaguv.todaygood.space
gstatic.coppsindoor.org
guce.accountrestore.online
guce.onetime-authentication.cruiserscrib.com
guce.yahoos.live
gui.icseingenieria.cc
gui.meta-email.online
gui.vdjhrr.de
h7amzbxs.todaygood.space
hcwdg.ecraltchit.com
hcwdg.lomesroll.com
hemenode-deposit3.holliganbet1129.com
hervw.lomesroll.com
hge9h7c.todaygood.space
hnrvrve.lomesroll.com
home.messager.my
homeoffice.dmg-tech.com
hrvetbr.lomesroll.com
hterw.lomesroll.com
icloud2.aktaninery.com
id.alifabank.ru
id.hdgv.ru
id.outiook-offlceauthyfyveriflive.info
id.rootvk.messager.my
id.varrysections.digital
id4.apipersforating.com
idmsa.storage-icloude.com
iframe.platform.secureportal-mx.com
ig-verify.duckdns.org
images.wjdiadjai.lol
imap.dmg-tech.com
img.messager.my
img1.aventuresaviation.com
img6.mikecrosoft.info
imgs.protonn.duckdns.org
imgs2.messager.my
instagram.oudblast.com
intercourierservice.com
internet.1web4all.net
intuitqbo.com
iu3b21s0q.todaygood.space
jjzabigzhgx.todaygood.space
join.ciberseguridad-eia.xyz
jumpcloud.lomesroll.com
jumpsso.lomesroll.com
jycxa4jmfow1.todaygood.space
kmxarm.todaygood.space
kws1-1.messager.my
kws1.messager.my
kws2-1.messager.my
kws2.messager.my
kws21.messager.my
kws4-1.messager.my
kws4.messager.my
kws41.messager.my
kws5-1.messager.my
kws5.messager.my
l.facebook.com.tronscan.sbs
lab.evilginx.com
lgcdn.rnicrosoftloginsoft.xyz
lgcdn.rnicrosoftrecovery.com
lgmss.rnicrosoftloginsoft.xyz
lh3.secureportal-mx.com
lh3.vortunsa.qinch.top
lifecycle.varrysections.digital
likemore-go.messager.my
limg.messager.my
linkedin-api.platform.secureportal-mx.com
linkedin.com.tronscan.sbs
linkprotect.cudasvc.com.tronscan.sbs
live.meta-email.online
live.rnicrosoftrecovery.com
live.vdjhrr.de
lm.takersuz-lab.com
log.vdjhrr.de
logdz.messager.my
login-live.icseingenieria.cc
login-ms.icseingenieria.cc
login.a1teryx.com
login.acadain-asset.com
login.accountrestore.online
login.aol.aktaninery.com
login.aventuresaviation.com
login.bewdleybridge.co.uk
login.cailovelife.art
login.cdn.tripleclickads.com
login.check-photo.dderby.net
login.ciberseguridad-eia.xyz
login.coppsindoor.org
login.dmg-tech.com
login.formall.org
login.icseingenieria.cc
login.intercourierservice.com
login.login.o365.teams-microsoftonline-com-common-oauth2-v2-0-authorize-login.com
login.login.takersuz-lab.com
login.loginverify365.com
login.magllatech.co.tz
login.messager.my
login.microsoftonline.com.maya-auth.xyz
login.microsoftonline.otp-secure.com
login.midarnericapaper.com
login.mselite.org
login.myliveoffice.live
login.o365.expreahsha.xyz
login.onetime-authentication.cruiserscrib.com
login.outlook.aktaninery.com
login.port-base.com
login.re-acc.cc
login.realxcore.com
login.rmrocha-eng.live
login.rnicrosoftloginsoft.xyz
login.rnicrosoftrecovery.com
login.rootvk.messager.my
login.salenndoor.com
login.secured-signin.com
login.signal-relay.com
login.takersuz-lab.com
login.teamhroffice.com
login.testing01.uk
login.ultimate-cloudbrowser.space
login.varrysections.digital
login.xfr0.com
login.yahoos.live
login1.varrysections.digital
logincdn.icseingenieria.cc
logincdn.signal-relay.com
logincdn.varrysections.digital
loginii.varrysections.digital
loginverify365.com
logya.messager.my
m.binance.aktaninery.com
m.googlle.live
m.instagram.oudblast.com
m.lusy.ink
m.mselite.org
m16.spkauszahlung.de
m34.spkauszahlung.de
m365.acadain-asset.com
m365.texteq.cfd
m365.varrysections.digital
mail.accountrestore.online
mail.accounts.secuautcheck.org
mail.coppsindoor.org
mail.dmg-tech.com
mail.evilginx-store.pro
mail.gm-verification.duckdns.org
mail.mailportal-x.mywire.org
mail.messager.my
mail.onetime-authentication.cruiserscrib.com
mail.opensupport.net
mail.secureportal-mx.com
mail.stripe-accountverify.com
mail.teams-microsoftonline-com-common-oauth2-v2-0-authorize-login.com
mail.testing-evil.duckdns.org
mail.varrysections.digital
mail.yahoos.live
marriott-rewards.duckdns.org
maxihavale.holliganbet1129.com
me.messager.my
media-exp1.platform.secureportal-mx.com
media-exp1.secureportal-mx.com
media.lomesroll.com
mediaplanung.biz
meet.varrysections.digital
messagepathconfirmation.download
messager.my
meta-assistance.icu
meta-email.online
mikecrosoft.info
mimecast.com.amazonaws.com.mediaplanung.biz
mimecast.com.tronscan.sbs
mnemo-col.co
msauth.lomesroll.com
msauthimg.lomesroll.com
mselite.org
msfed.994e79c0-ffb1-4df9-b623.cloud
msfed.icseingenieria.cc
msfed.varrysections.digital
msstatic.lomesroll.com
myaccount.aawe.finance
myaccount.accountrestore.online
myaccount.admin-gsync.xyz
myaccount.google.bain-corp.com
myaccount.googlle.live
myaccount.login.alienvfxstudio.digital
myaccount.secureportal-mx.com
myaccount.varrysections.digital
myapps.dmg-tech.com
mysignins.lomesroll.com
n1.lusy.ink
nam01.safelinks.protection.outlook.com.tronscan.sbs
nam02.safelinks.protection.outlook.com.tronscan.sbs
nam03.safelinks.protection.outlook.com.tronscan.sbs
nam04.safelinks.protection.outlook.com.tronscan.sbs
nam11.safelinks.protection.outlook.com.tronscan.sbs
nam12.safelinks.protection.outlook.com.tronscan.sbs
nazqh9a7v8f.todaygood.space
net.amazonaws.com.mediaplanung.biz
net.com.mediaplanung.biz
net.mediaplanung.biz
newassets.protonn.duckdns.org
news.lomesroll.com
nihau8ma3ot.todaygood.space
nl9u2vlikzd.todaygood.space
noon.ignorelist.com
notifications.gm-verification.duckdns.org
notifications.google.com.amazonaws.com.mediaplanung.biz
notifications.google.com.tronscan.sbs
notifications.secureportal-mx.com
npmjs-security.com
ns1.accountrestore.online
nudata.ticketmaster.komba.sbs
o.icseingenieria.cc
o.outiook-offlceauthyfyveriflive.info
o.varrysections.digital
o2.messager.my
o365.adsmisoft.com
o365.teams-microsoftonline-com-common-oauth2-v2-0-authorize-login.com
oauth2.varrysections.digital
off-account.office.plumbingnowllc.org
off-outlook.plumbingnowllc.org
office.familiasgps.shop
office.plumbingnowllc.org
office.serviceteamoffice365.click
office.sgohsyu.com
office.varrysections.digital
ogoogleads.g.doubleclick.net.com.mediaplanung.biz
ogs.gm-verification.duckdns.org
ogs.secureportal-mx.com
ogs.varrysections.digital
okta-adobe.lomesroll.com
okta-alberici.lomesroll.com
okta-bizzabo-sso.lomesroll.com
okta-brinkmann.lomesroll.com
okta-brookdale.lomesroll.com
okta-cna.lomesroll.com
okta-crossland.lomesroll.com
okta-dmns.lomesroll.com
okta-docusign.lomesroll.com
okta-dollar.lomesroll.com
okta-dot.varrysections.digital
okta-jll.lomesroll.com
okta-login.varrysections.digital
okta-longbow.lomesroll.com
okta-medallia.lomesroll.com
okta-o.varrysections.digital
okta-olsson.lomesroll.com
okta-otis.lomesroll.com
okta-rcmd.lomesroll.com
okta-ryan.lomesroll.com
okta-sci.varrysections.digital
okta-swapcard.lomesroll.com
okta-ul.varrysections.digital
okta-weitz.lomesroll.com
okta-wellpower.lomesroll.com
okta.icseingenieria.cc
oktaadmin.lomesroll.com
oktaapac.lomesroll.com
oktaauth.lomesroll.com
oktacdn.lomesroll.com
oktacdn2.lomesroll.com
oktaemea.lomesroll.com
oktaoie.lomesroll.com
oktaprev.lomesroll.com
oktares.lomesroll.com
oma.dmg-tech.com
oneapi.lomesroll.com
oneapp.lomesroll.com
onecdn.lomesroll.com
onecdn.varrysections.digital
onelogin.lomesroll.com
oness.varrysections.digital
onestatic.lomesroll.com
onetime-authentication.cruiserscrib.com
op2.varrysections.digital
openapi.messager.my
opus-analytics.stripe-accountverify.com
outlook.accountrestore.shop
outlook.ciberseguridad-eia.xyz
outlook.com.tronscan.sbs
outlook.e-onlinesl.com
outlook.icseingenieria.cc
outlook.meta-email.online
outlook.office.mywallet.help
outlook.rnicrosoftrecovery.com
outlook.testing01.uk
outlook.varrysections.digital
owa.dmg-tech.com
p4irs.com
packwizbot.com
panel.lusy.ink
passwordreset.actualizacion-seguridad.com
paypalobjects.papalservice.services
pcsl.port-base.com
pcsstart.port-base.com
peoplesworld.in
pepsico.varrysections.digital
personalization.intuitqbo.com
piconstudio.duckdns.org
pingapi.lomesroll.com
pingasia.lomesroll.com
pingassets.lomesroll.com
pingauth.lomesroll.com
pingca.lomesroll.com
pingeu.lomesroll.com
pingfed.lomesroll.com
pingidp.lomesroll.com
pinglogin.lomesroll.com
pixel.coppsindoor.org
pk.varrysections.digital
platform.platform.secureportal-mx.com
platform.secureportal-mx.com
play.aawe.finance
play.accountrestore.online
play.gm-verification.duckdns.org
play.google.bain-corp.com
play.secureportal-mx.com
play.varrysections.digital
play.vortunsa.qinch.top
playesservices.com
plumbingnowllc.org
pogoda.messager.my
pop.sgohsyu.com
portal-cdn.varrysections.digital
portal.dmg-tech.com
portal.icseingenieria.cc
portal.messager.my
portal.varrysections.digital
portal000.porterhartcouty.sbs
privacy-cs.messager.my
privacy.actualizacion-seguridad.com
promo.lusy.ink
proofpoint.com.amazonaws.com.mediaplanung.biz
proofpoint.com.tronscan.sbs
prospecting.intuitqbo.com
protect-au.mimecast.com.tronscan.sbs
protect-eu.mimecast.com.tronscan.sbs
protect-jp.mimecast.com.amazonaws.com.mediaplanung.biz
protect-jp.mimecast.com.tronscan.sbs
protect-us.mimecast.com.tronscan.sbs
protect.mimecast.com.tronscan.sbs
protection.outlook.com.tronscan.sbs
protocolendless.com
proxy.messager.my
pstmrk.it.tronscan.sbs
public.onecdn.varrysections.digital
px-captcha-b.ticketmaster.komba.sbs
px-captcha-c.ticketmaster.komba.sbs
px-captcha-d.ticketmaster.komba.sbs
px-captcha.ticketmaster.komba.sbs
q.ciberseguridad-eia.xyz
qfp.intuitqbo.com
qgcusvk.portal-verify.app
qqq.qweqq.p-e.kr
quickbooks.intuitqbo.com
qydgp6pfgck.todaygood.space
r.ciberseguridad-eia.xyz
r.messager.my
r3.messager.my
rambtur.store
raymondreddington.cfd
rdg.dmg-tech.com
rdp.dmg-tech.com
rds.dmg-tech.com
rds1.dmg-tech.com
rdweb.dmg-tech.com
react.icseingenieria.cc
react.rnicrosoftloginsoft.xyz
react.varrysections.digital
realtime.platform.secureportal-mx.com
red-team.live
reklama.messager.my
remote.dmg-tech.com
remote2.dmg-tech.com
remotebb.dmg-tech.com
res-1.cdn.varrysections.digital
res.cdn.rnicrosoftrecovery.com
res.cdn.varrysections.digital
res.public.onecdn.varrysections.digital
res.varrysections.digital
res1.varrysections.digital
rimborson.sbs
rnicrosoftrecovery.com
rootdz.messager.my
rootvk.messager.my
rootyan.messager.my
rootyar.messager.my
rootyas.messager.my
rorl.lusy.ink
roweri.lomesroll.com
rs-dns.sbs
rs.messager.my
rsaaccess.lomesroll.com
rsacloud.lomesroll.com
rsaid.lomesroll.com
s.skttonero.com
s3.ap-northeast-1.amazonaws.com.tronscan.sbs
s3.ap-southeast-1.amazonaws.com.tronscan.sbs
s3.eu-central-1.amazonaws.com.tronscan.sbs
s3.eu-west-1.amazonaws.com.mediaplanung.biz
s3.eu-west-1.amazonaws.com.tronscan.sbs
s3.us-east-1.amazonaws.com.tronscan.sbs
s3.us-east-2.amazonaws.com.tronscan.sbs
s3.us-west-2.amazonaws.com.tronscan.sbs
safelinks.protection.outlook.com.tronscan.sbs
sbx.coppsindoor.org
sci.outiook-offlceauthyfyveriflive.info
sci.varrysections.digital
scontent.meta-email.online
scontent.xx.coppsindoor.org
sdk-api.messager.my
sdkapi.messager.my
secure-web.cisco.com.amazonaws.com.mediaplanung.biz
secure.ciberseguridad-eia.xyz
secure.coppsindoor.org
secure.duosign.net
secure.euecho.com
secure.lomesroll.com
secure.varrysections.digital
secureauth.lomesroll.com
secureauthidp.lomesroll.com
secureportal-mx.com
security.intuitqbo.com
securty-alert.com
sender.lusy.ink
sepho.cvmatch.space
ser-pan-comido.com
serviceteamoffice365.click
sessions.wjdiadjai.lol
setup.accountrestore.online
setup.storage-icloude.com
sfdev.lomesroll.com
sflogin.lomesroll.com
sftest.lomesroll.com
sharepoint.dmg-tech.com
signin-sso.id-sage.pro
signup.actualizacion-seguridad.com
site.paypalsonline.com
sites.dmg-tech.com
sjkeekke.yogz.biz.id
skcjdghscjkd9.softether.net
smppcanada.com
smusxath.varrysections.digital
so.simplyfashiontv.com
souwebaccess.dmg-tech.com
sp.authpoint.usa.icseingenieria.cc
sp.authpoint.usa.varrysections.digital
ssl.aawe.finance
ssl.docuhost.sbs
ssl.meta-email.online
ssl.papalservice.services
ssl.porterhartcouty.sbs
ssl.secureportal-mx.com
ssl.testing-evil.duckdns.org
ssl.varrysections.digital
ssl.vdjhrr.de
ssl.vortunsa.qinch.top
ssl.voxshift.us
sso.acadain-asset.com
sso.aventuresaviation.com
sso.icseingenieria.cc
sso.login.imriwret.site
sso.serviceteamoffice365.click
sso.varrysections.digital
sso2.varrysections.digital
ssoss.mikecrosoft.info
ssso.outiook-offlceauthyfyveriflive.info
stat.messager.my
static-cdn.login.masarofficial.com
static-exp1.platform.secureportal-mx.com
static-exp1.secureportal-mx.com
static.binance.aktaninery.com
static.coppsindoor.org
static.messager.my
storage-icloude.com
storage.messager.my
storage.rnicrosoftrecovery.com
storage.varrysections.digital
strm.messager.my
sts.meta-email.online
stslogin.lomesroll.com
substrate.varrysections.digital
support-u.abrdns.com
supportive.fit
taboola.com.amazonaws.com.mediaplanung.biz
taboola.com.tronscan.sbs
taxorganizer.publicvm.com
test.todaygood.space
the519.eastus.cloudapp.azure.com
thrivetracker.com.tronscan.sbs
tilt.serviceteamoffice365.click
todaygood.space
top-fwz1.messager.my
topfwz1.messager.my
track.lomesroll.com
track.thrivetracker.com.tronscan.sbs
trc.taboola.com.amazonaws.com.mediaplanung.biz
trc.taboola.com.tronscan.sbs
trk.messager.my
ts.dmg-tech.com
ttgg.9123123.xyz
tzd66u2rre.todaygood.space
udc.onetime-authentication.cruiserscrib.com
udc.yahoos.live
ulgroup.icseingenieria.cc
ulgroup.office.plumbingnowllc.org
ulgroup.varrysections.digital
unified-terms-svc.intuitqbo.com
urldefense.proofpoint.com.amazonaws.com.mediaplanung.biz
us-east-1.amazonaws.com.tronscan.sbs
us-east-2.amazonaws.com.tronscan.sbs
us-west-1.amazonaws.com.tronscan.sbs
us-west-2.amazonaws.com.tronscan.sbs
usa.icseingenieria.cc
usa.varrysections.digital
v70pusy7p13.todaygood.space
variabilityengine.intuitqbo.com
varrysections.digital
vdjhrr.de
venus.web.messager.my
vhg.fern-estates.com
video.celticcommunications.co
vipaccess.lomesroll.com
vn3hg.office.plumbingnowllc.org
vn3hg.rnicrosoftloginsoft.xyz
vn3hg.varrysections.digital
vn3ms.rnicrosoftloginsoft.xyz
vortunsa.qinch.top
vpn.dmg-tech.com
watchguard.varrysections.digital
web.messager.my
widgets.messager.my
wn.bambicci.com
wo3ih.rnicrosoftloginsoft.xyz
wordpress.letter.wtf
wwwgstatic.vortunsa.qinch.top
x.protocolendless.com
xd-adfs--paychex--com.lomesroll.com
xd-sso--myid--disney--com.lomesroll.com
xray.messager.my
xs1.tronscan.sbs
xx.fbcdn.coppsindoor.org
y9a13f8chjf9.todaygood.space
yahoos.live
youtube.aawe.finance
youtube.absolu1st.xubi.org
youtube.docuhost.sbs
youtube.varrysections.digital
yp7s.lusy.ink
ywnjb.rnicrosoftloginsoft.xyz
ywnjb.varrysections.digital
yxc1.lusy.ink

# Generic

/evilginx-linux-amd64.tar.gz
