-
Notifications
You must be signed in to change notification settings - Fork 14
/
Copy pathlist.txt
1012 lines (942 loc) · 25.1 KB
/
list.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
# Various telemetry endpoints (hosts and domains) used by mobile location tracking libraries
# Contact: mobiletrackers [at] protonmail.ch
# See: https://github.com/craiu/mobiletrackers/
# Version 1.46 - 2024-02-07
#
# xmodesocial - e65912e897bd9e6f41865a8ab0eb9b15fef4bc0af68eb8217f5360fb1c53f423 - 13.1Trainer_95.19-.apk
bin5y4muil.execute-api.us-east-1.amazonaws.com
# unknown, possibly xmodesocial - e65912e897bd9e6f41865a8ab0eb9b15fef4bc0af68eb8217f5360fb1c53f423 - 13.1Trainer_95.19-.apk
8balwalz1i.execute-api.us-east-2.amazonaws.com
# unknowns - e65912e897bd9e6f41865a8ab0eb9b15fef4bc0af68eb8217f5360fb1c53f423 - 13.1Trainer_95.19-.apk
api.smartechmetrics.com
ck-running-apps-700f1.firebaseio.com
pie.wirelessregistry.com
# unknowns - 010f7bb33f35cc650b7d6104b07102eb0dbaf79bcec1f1c6255fdcaffefe6b68 - com.davidsukhin.com.sukhin.snowdaycalculator.SnowDay
# URLs below stored as base64 and encrypted xor 0x09 ->
udata.elephantdata.net
atb.bearclod.com
#pDNS data for the IPs associated with atb.bearclod.com ->
alb.bearclod.com
aly.bearclod.com
alz.bearclod.com
atb.bearclod.com
bivitis.bearclod.com
brt.bearclod.com
brul.bearclod.com
hfstat.bearclod.com
hkn01.bearclod.com
ply.bearclod.com
zoo.bearclod.com
# crashlytics - 4711634730d5367756bba4d776d846b01b8d0373336ea877a2c20b1da0a95477 - com.sgiggle.production_5.2.229629_1538560344.apk
settings.crashlytics.com
e.crashlytics.com
# starbolt - cb9b9de8616e55849b9140e7915b2ba237818625828acfa55b59f5268f589e91 - com.kellytechnology.Forecast_Now
sdk.starbolt.io
dmp.starbolt.io
devices.starbolt.io
# sense360 ? - cb9b9de8616e55849b9140e7915b2ba237818625828acfa55b59f5268f589e91 - com.kellytechnology.Forecast_Now
android-quinoa-config-prod.sense360eng.com
survey-notify-event.sense360eng.com
quinoa-personal-identify-prod.sense360eng.com
# appmeasurement - cb9b9de8616e55849b9140e7915b2ba237818625828acfa55b59f5268f589e91 - com.kellytechnology.Forecast_Now
app-measurement.com
# newrelic - 2d4c9c037db43704f52968c9c363cbdf382cbb6a4b9143825f6e8b523b7c0c01 - com.crowdcompass.appmQaIam3e7C.apk
mobile-collector.newrelic.com
mobile-crash.newrelic.com
# Xiao mi related telemetry endpoints - see https://twitter.com/hookgab/status/1255859289945780225
data.mistat.india.xiaomi.com
data.mistat.intl.xiaomi.com
data.mistat.rus.xiaomi.com
tracking.rus.miui.com
tracking.intl.miui.com
tracking.india.miui.com
# from https://twitter.com/cybergibbons/status/1256703550954057729
sa.api.intl.miui.com
sa.api.india.miui.com
sa.api.rus.miui.com
# new xmodesocial - from https://mobile.twitter.com/guardianiosapp/status/1262545645941874689
api.myendpoint.io
# aggressive advertisers - https://securelist.com/in-app-advertising-in-android/97065/
# 1eeda6306a2b12f78902a1bc0b7a7961 – com.android.ggtoolkit_tw_xd
# 134283b8efedc3d7244ba1b3a52e4a92 – com.xprodev.cutcam
# 3aba867b8b91c17531e58a9054657e10 – com.powerd.cleaner
ti.domainforlite.com
uu.domainforlite.com
# pDNS resolutions for uu.domainforlite.com, hosting on 47.252.80.195
adserver.hahamobi.com
analytics.hahamobi.com
analytics.salmonads.com
api.salmonads.com
dat.funheroic.com
lg.luckyforworlds.com
lg.requestads.com
lg.smardroid.com
log.adywind.com
log.mobpowertech.com
net.hahamobi.com
net.salmonads.com
us01.salmonads.com
uu.domainforlite.com
# mobile ads, 2020-07-07, additions from https://securelist.com/pig-in-a-poke-smartphone-adware/97607/
www.ywupscsff.com
www.mzeibiyr.com
i151125.infourl.net
www.jueoxdr.com
ufz.doesxyz.com
htapi.getapiv8.com
stable.icecyber.org
404mobi.com
51ginkgo.com
lbjg7.com
bigdata800.com
apd1.warnlog.com
apd1.thunup.com
# mintegral, 2020-08-30, described at: https://snyk.io/research/sour-mint-malicious-sdk/
n.systemlog.me
setting.rayjump.com
analytics.rayjump.com
# from pDNS on n.systemlog.me ->
net.cleverjp.com
# from fake NEXTALIVE (moonfair) application - https://www.zdnet.com/article/google-removes-android-app-that-was-used-to-spy-on-belarusian-protesters/
arcpi.nextialive.roimaster.site
api.nextialive.roimaster.site
ws.nextialive.roimaster.site
nextialive.roimaster.site
api.dev.chat.roimaster.site
dev.chat.roimaster.site
# Joker download URLs / hosts as described by ZScaler - https://www.zscaler.com/blogs/security-research/joker-playing-hide-and-seek-google-play
2j1i9uqw.oss-eu-central-1.aliyuncs.com
blackdragon03.oss-ap-southeast-5.aliyuncs.com
blackdragon.oss-ap-southeast-5.aliyuncs.com
fgcxweasqw.oss-eu-central-1.aliyuncs.com
jk8681oy.oss-eu-central-1.aliyuncs.com
laodaoo.oss-ap-southeast-5.aliyuncs.com
laodaoo.oss-ap-southeast-5.aliyuncs.com
n47n.oss-ap-southeast-5.aliyuncs.com
nineth03.oss-ap-southeast-5.aliyuncs.com
proxy48.oss-eu-central-1.aliyuncs.com
rinimae.oss-ap-southeast-5.aliyuncs.com
sahar.oss-us-east-1.aliyuncs.com
# Cerberus C2s as described by BitDefender - https://labs.bitdefender.com/2020/09/apps-on-google-play-tainted-with-cerberus-banker-malware/
2fapass.club
androidradio.life
downdating.club
fitnessstrategy.xyz
groovefitness.xyz
loversfinder.xyz
positivefitness.club
safeyourdata.xyz
sport4ever.club
vipyoga.today
weatherclub.club
yoga4u.xyz
# unknown (?) telemetry receiving endpoints from:
# 066de93f181e9cbcb8611c675bbcb0fc - com.speedcamera.detector.radar.detector.direction
yqchpwxvbg.execute-api.us-east-1.amazonaws.com
pn8sm7rjuc.execute-api.us-east-1.amazonaws.com
# venntel / gravy analytics from https://github.com/sociam/PROWISH/blob/master/data/200appsdynamic.csv
# venntel / gravy analytics from https://fil.forbrukerradet.no/wp-content/uploads/2020/01/2020-01-14-out-of-control-final-version.pdf
# gravy analytics docs - http://developers.findgravy.com/products/gold-api/docs/index2.html
api.findgravy.com
nwzhmwux-api.findgravy.com
zmq5ytc1-api.findgravy.com
mtm1nwmx-api.findgravy.com
gravyanalytics.com
# 51ec8159efb88a852005b94f0fd9891016b75f4b40d24608ee8a5c8d34826a3e - com.usatoday.android.news
ws.findgravy.com
api.foozor.com
testapi.foozor.com
# potentially related hosts on top of findgravy.com
img01.findgravy.com
img02.findgravy.com
img03.findgravy.com
img04.findgravy.com
# 51ec8159efb88a852005b94f0fd9891016b75f4b40d24608ee8a5c8d34826a3e - com.usatoday.android.news
pushapi.localytics.com
analytics.localytics.com
profile.localytics.com
# cuebiq location sdk from ->
# 2dc269d7237c97edefa653a379eca897a23f46adcf14705801041817bf5d1e7e - net.androgames.compass
in.cuebiq.com
ingestion-api.kiwi.sand.cuebiq.ai
# nodle.io sdk from ->
# 2dc269d7237c97edefa653a379eca897a23f46adcf14705801041817bf5d1e7e - net.androgames.compass
dev.nodle.io
us-central1-production-242307.cloudfunctions.net
# unknown sdk from 2dc269d7237c97edefa653a379eca897a23f46adcf14705801041817bf5d1e7e - net.androgames.compass possibly xmode related
api.smartechmetrics.com
# more crashlytics hosts from 2dc269d7237c97edefa653a379eca897a23f46adcf14705801041817bf5d1e7e - net.androgames.compass
firebase-settings.crashlytics.com
update.crashlytics.com
reports.crashlytics.com
# 2dc269d7237c97edefa653a379eca897a23f46adcf14705801041817bf5d1e7e - net.androgames.compass ->
pixelprose.fr
# appsflyer from b8ce13566a048108b4321f5277e4d95a5d5743da4f082fbca30074439acf5a15 - com.unacademyapp
onelink.me
onelnk.com
app.aflink.com
t.appsflyer.com
# other various telemetry endpoints (not necessarily location related) from from b8ce13566a048108b4321f5277e4d95a5d5743da4f082fbca30074439acf5a15 - com.unacademyapp
api.mixpanel.com
decide.mixpanel.com
cdn.optimizely.com
logx.optimizely.com
outline.truecaller.com
api4.truecaller.com
c.webengage.com
p.webengage.com
api.branch.io
bnc.lt
cdn.branch.io
e.crashlytics.com
settings.crashlytics.com
js.intercomcdn.com
mobile-sdk-api.intercom.io
# Clevertap's wzrkt.com - also see https://twitter.com/fs0c131y/status/977267255309463554
wzrkt.com
in.wzrkt.com
# subdomains from wzrkt.com - https://subdomainfinder.c99.nl/scans/2020-04-19/wzrkt.com
api.wzrkt.com
cb.wzrkt.com
eu1-spiky.wzrkt.com
eu1.alb.wzrkt.com
eu1.wzrkt.com
in.cb.wzrkt.com
in1-spiky.wzrkt.com
in1.alb.wzrkt.com
in1.wzrkt.com
sg1-spiky.wzrkt.com
sg1.cb.wzrkt.com
sg1.wzrkt.com
sk1-spiky.wzrkt.com
sk1-staging-1.wzrkt.com
sk1-staging-10.wzrkt.com
sk1-staging-2.wzrkt.com
sk1-staging-3.wzrkt.com
sk1-staging-4.wzrkt.com
sk1-staging-5.wzrkt.com
sk1-staging-6.wzrkt.com
sk1-staging-7.wzrkt.com
sk1-staging-8.wzrkt.com
sk1-staging-9.wzrkt.com
sk1.wzrkt.com
us1-spiky.wzrkt.com
us1.cb.wzrkt.com
us1.wzrkt.com
# from cb9f6bb72a9766ba8c805c25769b47c46751052706bb41ed333db0b42cd586ff - com.byjus.thelearningapp
# also see https://digitalwatchdog.org/wp-content/uploads/2020/09/IDAC-Ed-Tech-Report_AppendixB_SensitiveData.pdf
api.tllms.com
marketing.tllms.com
# from 09f5bcadde3351eb3f509f5a471cbd7bb00536292da560bcf8ee59eb73116f00 - luo.speedometergps
# teragence ->
control.teragence.net
pfsense02-01.is-61194.teragence.net
# tutela ->
upload-tutelawest.s3-accelerate.amazonaws.com
reporting-util.tutelatechnologies.com
hail-reporting.tutelatechnologies.com
thepopulator.tutelatechnologies.com
# huq (also from 9c53a29a7e6a871f57b20097185a09afd2ff818455a42792d502f1eb8f2e3679) ->
api.huqindustries.co.uk
report.huqindustries.co.uk
charles.huqindustries.co.uk
# IOCs from https://www.whiteops.com/blog/somewhere-over-the-rainbowmix
api.pythonexample.com
# Predicio - from Funny Weather - pl.lawiusz.funnyweather.release.apk - 6d23151e69a57f67111d4969594316576577ae8a2015aff336ab6ef0fb2a07b4
# see https://www.vice.com/en/article/epdpdm/ice-dhs-fbi-location-data-venntel-apps
sdk.predic.io
# Kinesis endpoint from Funny Weather:
kinesis.ap-southeast-1.amazonaws.com
# Complementics endpoints from 4ba50272718c95af20940912c7968410d797fbc07dcce2bad8183b94887b0ab4
sdk-as.complementics.com
static.complementics.com
# Goontact from https://blog.lookout.com/lookout-discovers-new-spyware-goontact-used-by-sextortionists-for-blackmail
redvios.com
v-talk.top
v-talk.vip
ladysizi.top
mmbox.top
oncamera.top
oncast.top
mimibox.top
voicecontrol.top
signaltalk.top
oncamera.vip
dalbam.vip
mimimsg.net
signal-live.vip
tele-gram.vip
vtalk.vip
a-video.vip
livetalk.vip
livetalk.top
download-file.top
grd77.cn
mimicwt.net
super-voice.vip
mimi18s.top
momomsg.top
live-live.vip
zerobyte.top
zerobt.net
w-video.vip
ser-chat.com
tocast.vip
videosound.vip
twi-tter.vip
my-player.vip
voicesupport.vip
# Joker from https://research.checkpoint.com/2020/new-joker-variant-hits-google-play-with-an-old-trick/
gd-1301476296.cos.na-toronto.myqcloud.com
# Related to: https://github.com/greatsuspender/thegreatsuspender/issues/1175
# and: https://www.theregister.com/2021/01/07/great_suspender_malware/
cdn.owebanalytics.com
static.trckingbyte.com
static.trckpath.com
static.privacytrck.com
rctphvxwnjhx.pw
hanstrackr.com
# Postlo spyware - https://twitter.com/ESETresearch/status/1374889857403785218?s=20
api.mainrepo.org
# EvilEye malware C2s mentioned at https://about.fb.com/news/2021/03/taking-action-against-hackers-in-china/
anayurt.net
apkprue.info
geo2ipapi.org
gotossl.ml
icptime.com
istiqlaihaber.com
misran.org
newyorkingsite.com
playgoog1e.com
preservtyg.com
sslportservices.com
strunhvgpk.com
uhtpuerdfbnm.com
uyghur-news.com
uyghur-soft-market.com
uyghurhaber.com
www.apkhl.pw
apkhl.pw
www.apkpure.bz
apkpure.bz
# Xcodespy - https://labs.sentinelone.com/new-macos-malware-xcodespy-targets-xcode-developers-with-eggshell-backdoor/
www.liveupdate.cc
www.appmarket.co
www.recentnews.cc
www.truckrental.cc
www.everestnote.com
www.alinbox.co
www.suppro.co
# APKPure compromise by Triada malware - https://securelist.com/apkpure-android-app-store-infected/101845/
wcf.seven1029.com
foodin.site
# Triada from https://securelist.com/triada-trojan-in-whatsapp-mod/103679/
# Trojan.AndroidOS.Triada.ef b1aa5d5bf39fee0b1e201d835e4dc8de
t1k22.c8xwor.com
dgmxn.c8xwor.com
# Tutela technologies - f9db002cbc6e5b6de37fb15aefaaf3934a700a7a2f9d5949f3cd6bb8c7dfc1bc - org.speedspot.speedanalytics
upload-tutelawest.s3-accelerate.amazonaws.com
reporting.tutelatechnologies.com
video-url.tutelatechnologies.com
hail-reporting.tutelatechnologies.com
d3clybje3sun07.cloudfront.net
# speedspot - reports GPS location, other data - SpeedtestResultViews.java - inside f9db002cbc6e5b6de37fb15aefaaf3934a700a7a2f9d5949f3cd6bb8c7dfc1bc
api.speedspot.org
www.speedcheck.org
net.etrality.com
a2.etrality.com
a1.etrality.com
c4.etrality.com
b3.etrality.com
c3.etrality.com
b2.etrality.com
c2.etrality.com
b1.etrality.com
c1.etrality.com
wpc.A3CD.edgecastcdn.net
speedspot.speedspot.netdna-cdn.com
www.speedspot5.com
www.speedspot1.com
www.speedspot7.com
www.speedspot2.com
www.speedspot3.com
www.speedspot4.com
www.speedspot6.com
#Kochava endpoints, from rugabunda https://beta.pithus.org/report/844aa271ef47f7807ab3ccc63952e2215298701a6851857c22456317927f08fd
co.akisinn.info
co.dewrain.life
co.vaicore.site
co.vaicore.xyz
int.akisinn.info
int.akisinn.me
int.akisinn.site
int.dewrain.life
int.dewrain.site
int.dewrain.world
int.vaicore.site
int.vaicore.store
int.vaicore.xyz
int.vlancaa.site
int.vlancaa.fun
tok.vaicore.xyz
vaicore.xyz
web.ab-salute.com
smart.link
# Adeco and inappertising - see https://www.occrp.org/en/investigations/how-a-russian-mobile-app-developer-recruited-phones-into-a-secret-ad-watching-robot-army
# Ultimate-Mortal-Kombat-3-v1-1.apk - https://www.virustotal.com/gui/file/dc078b004830ff03a27371bbc1c4a7b5882d5a0fb577a8477c09e8b3bfe0d6d3/details
cfg.inappertising.org
stats.inappertising.org
app-stats.net2share.com
s.net2share.com
adeco.adecosystems.com
dd.adecosystems.com
# GriftHorse Android from - https://blog.zimperium.com/grifthorse-android-trojan-steals-millions-from-over-10-million-victims-globally/
hotofecro.com
alaiblompass.com
heartratteandpulsetracker.com
icoonectedtrack.com
ospocatracker.com
laalaslirayeblection.com
iblompass.com
smalllcalllrecorder.com
anguaganslatast.com
oroscopemestry.com
blompascator.com
leunoon.com
arindocation.com
rooitor.com
mychattranslator.club
rulapptoplan.com
rportranslator.com
muslimasauda.com
martpolocator.com
wfupppx.com
scandocnotes.com
freecoupon21.com
ponyvideochat.com
ludamec.com
chat-transa.com
soulscanneryh.com
d3cameraplan.com
qibla-ultima.com
zoofanimalm.com
ciaolvc.com
heartrateproxhealthmonitor.com
bus-metrolis.com
truck-rouddrive.com
locatinfind.com
camerdentifier.com
locatorqiafindlocation.com
cocachar.com
squishyp.com
antranslaro.com
ftphotom.com
lockul.com
fingerprihanger.com
locatorshar.com
kfcwsa.com
gpsphonuetrackerfamilylocator.com
cailrecorder.com
tqiblacompas.com
kvprojectop.com
pikchoeditor.com
streetprocarsracingss.com
nemaeovies.com
aecodero.com
ivlewepapallrbkragonucd.com
heartrateandmealtracker.com
phonecontrolblockspamcalls.com
etcotater.com
canopoument.com
locxfindxlocx.com
mnesytrlatr.com
huntcontactz.com
intelgenttran.com
facenalyer.com
fnbdeiegpslocoiatntcrkaer.com
trcalluecodr.com
qrreaderpro.com
itranstxtvoicepht.com
qiberiblaon.com
iconylc.com
lsepeanitor.com
fxkwboard.com
dehcoveanager.com
tickeakhatsp.com
phoneboster.com
phonfinbyclap.com
aralaper.com
qibdirctiowa.com
islsrickers.com
feartranslator.com
vpnzfep.com
snaplens-pt.com
qiblassirection.com
easyvshow.com
qibla-quran.com
qrcodesscan.com
hoolives.com
burivingsim.com
coupongiftsnstashop.com
fingdefend.com
projectormp.com
forzahmobile.com
artateulseonitor.com
sslasmr.com
bagscaner.com
phonecallerscreen.com
datingappswmt.com
lifeel-scan.com
colorizerset.club
expresscreditcash.com
ccallerx.com
transatitonneap.com
lasouncherio.com
claptfindzmphone.com
mirrorscreencasttvv.com
ircleocatinder.com
mobleingsder.com
proocallerr.com
frecalwolwid.com
allelpcoonmber.com
faspulhearratmoni.com
fincconttact.com
uncherdroid.com
iveilembercker.com
lepamcker.com
lockaaocker.com
onarchbylap.com
secontranslatpr.com
tgscontakcs.com
lockaaocker.com
callwhozdine.com
perargero.com
mylocatorplus.club
comclap.club
callerids.club
instantspeechtranslation.club
photoeditorbest.club
piction.club
driveriders.club
skycoachgg.club
ffitnesstrainer.club
racerscardriver.club
fitnessdias.club
meetingonlinechat.club
fitnessgymup.club
editsbackground.club
cutcutpro.club
drivingexpiriencesimulator.club
clipbuddy.club
horoscopefortune.club
ludospeakeasy.club
fitnesspoint.club
wallvoluminousfourk.club
cvectorart.club
ludospeakv2.club
callrecordpro.club
carracer.club
slimesimulator.club
offroaderssurvive.club
lending-online.club
controlcenterios.club
callerids.club
carracer.club
streetracingg.club
checkheart.club
keyboardthemes.club
whatsmesticker.club
batterychargingeffect.club
luxoreditor.club
lionflix.club
amazingvideoeditor.club
zodiachand.club
zeusalmighty.club
pharaohsadventure.club
batterylivewallpaperhd.club
comqubla.club
safelock.club
heartrhythm.club
easybassbooster.club
comphotolab.club
# GriftHorse Second-Stage Domain
678ikmbtui.com
# GriftHorse Third-Stage Domains
safe-link.mobi
at.gogameportal.club
activate-your-account-now.com
continue-to-get-content-now.com
your-access-here.com
app.buenosocial.club
join.crazymob.co
vl.denrok.space
www.timpromos.com.br
campaignmanager.fun.moobig.com
get-your-access-now.com
v.mobzones.com
mt2-sdp4.mt-2.co
go.whatabookmark.com
lp.shoopadoo.com
es.mobiplus.me
af.to.123games.club
be.startdownload.mobi
za.startdownload.mobi
n.appspool.net
wap.trend-tech.net
fr.chillaxgames.mobi
tracking.hexilo.com
# Suspected GriftHorse from pDNS 185.255.179.131 / 185.255.179.132 ->
1g7kvrv.xyz
2fnoqifq.com
2g8cvdii.com
2oafxcbq.xyz
5rfvbnji9.com
7lc6jc.xyz
7nvdx0.xyz
8sghnct.xyz
berf4o.xyz
blfnf9y.com
brlyp4pg.com
chulahfi.xyz
cmvkvncsse.xyz
cophico.pw
cwkjravqsj.xyz
dhfvbsihjf.com
dsfhskln.com
eksndtpf.org
emraiyz.xyz
eok8wd5v.net
erbfzk.com
ersokbkj.com
fdfjhks.com
ffnbafc.xyz
hrvxkxq.xyz
il0baz.com
jduzuyd.com
jsdfbhsa.com
jydfoafcaf.xyz
kgr0aixa.xyz
krkmyvlmdg.xyz
lgdzbch.com
liahkhe.xyz
lljmbbk.com
lmbbnrhiuj.xyz
lwvurdsjk.org
lxghjoxzns.com
mnfbodivbv.com
mt5vsuf1.net
nfrmg1y.xyz
nwluoodzct.xyz
ocheyhv.xyz
okjojihgv.com
olimob.net
ortn13der.xyz
poiuwhejgr.com
pwtgnp.pw
qtwjhuj.com
rfjdhxbz.com
sjkfsdkg.com
trfvbnji7.com
urtyhfds.com
v9czaci.xyz
vortnomade.net
w9x7itu.xyz
www.mnfbodivbv.com
www.okjojihgv.com
y0vvbm.xyz
yq0z3d.xyz
# additional suspected GriftHorse from pDNS - 2021-10-21
down.tracksz.co
go.creativemobilemarketing.com
go.fastfinderworld.com
go.grandprizewinners.com
go.interlinkinternet.com
go.protectyoursearch.com
go.trackitalltheway.com
go.trackiteazy.com
go.watchwiser.com
# TangleBot domains, research based on - https://www.cloudmark.com/en/blog/mobile/tanglebot-new-advanced-sms-malware-targets-mobile-users-across-us-and-canada-covid-19
covid19-ca.link
hydro-ca.link
sock.godforgiveuss.live
sock.hhhhrkanandda.xyz
sock.nmnmnmfsamsfan.xyz
socktest.ankatras.xyz
vaccine-appointment.link
# Donot / Origami Elephant / APT-C-35 IOCs from Amnesty - https://github.com/AmnestyTech/investigations/blob/master/2021-10-07_donot/domains.txt
bulk.fun
apkv5.ppadaolnwod.xyz
apkv6.endurecif.top
getelements.xyz
fiddaz.club
lif0.top
fif0.top
chipp.pw
mimestyle.xyz
mangasiso.top
and.retardrattle.website
help.domainoutlet.site
whynotworkonit.top
spectronet.pw
full.naturalpercent.life
mimeversion.top
rythemsjoy.club
lowlight.xyz
inapturst.top
auth.forwardtoken.website
accounts.loginshare.info
seahome.top
imageview.xyz
flickry.xyz
apkv2.qwertykeypad.host
userauthen.pw
join.officeframe.work
zumba.tampotrust.agency
image.loadingmessage.info
# AbstractEmu hosts from https://blog.lookout.com/lookout-discovers-global-rooting-malware-campaign
jobs.illaewinstralinc.com
outline.abunddhighett.com
tags.illaryboucnc.com
cloud.nathompsstra.com
store.dianmpsoathom.com
fluency.ryboucoathom.com
csa.naaronegya.com
tips.ghetaldhighe.com
color.joarteauxelb.com
# Cynos hosts from https://vms.drweb.com/virus/?i=24972842 - 46bc4c6c87fcb519a8f315c0010b949d682ac3abee62b33bd624b251a3521b19
dns1.sdkbalance.com
dns2.sdkbalance.com
dns3.sdkbalance.com
sdk.sdkbalance.com
mg.sdkbalance.com
# PhoneSpy hosts from https://blog.zimperium.com/phonespy-the-app-based-cyberattack-snooping-south-korean-citizens/ and pDNS related
acd.kcpro.ga
aki.kcpro.ga
arr.kcpro.tk
b.freespy1.ml
b.freespy1.tk
c.freespy1.ml
c.freespy1.tk
cef.kcpro.tk
cfs.kcpro.ga
d.freespy1.ml
d.freespy1.tk
dto.kcpro.ga
e.freespy1.ml
ejn.kcpro.ga
ern.kcpro.ga
f.freespy1.ml
f.freespy1.tk
freespy.cf
g.freespy1.ml
g.freespy1.tk
h.freespy1.ml
h.freespy1.tk
hxg.kcpro.ga
i.freespy1.ml
i.freespy1.tk
j.freespy1.ml
j.freespy1.tk
k.freespy1.ml
k.freespy1.tk
koreavopi.kro.kr
l.freespy1.ml
l.freespy1.tk
m.freespy1.ml
m.freespy1.tk
mda.kcpro.ga
mgo.kcpro.ga
n.freespy1.ml
n.freespy1.tk
o.freespy1.ml
o.freespy1.tk
oso.kcpro.ga
p.freespy1.ml
p.freespy1.tk
pql.kcpro.ga
wvv.kcpro.ga
ydc.kcpro.ga
zqn.kcpro.ga
zsx.kcpro.ga
# https://blog.appcensus.io/2022/04/06/the-curious-case-of-coulus-coelib/
mobile.measurelib.com
measurelib.com
ami0wned.com
amiowned.com
arduous.work
attorney-client-privileged.com
attorney-client.org
attorneyclientprivileged.com
beachhackerspace.com
cloudwatchtower.com
consilio.lawyer
consiliolaw.com
darknetinfo.com
dataillusionist.com
easycalea.com
extremeexploits.com
extremeexploits.org
fraudpreventionsys.com
gleancorp.com
idme.org
indelibleblue.net
indelibleblueinc.net
internetcartography.com
internetcartography.net
internetcartography.org
littoralventures.com
marketinfo.tips
measurementsys.com
mxout.net
myaddress.today
ndagri.com
networkcartography.com
networkcartography.net
networkcartography.org
newdulcina.com
opensourcecontext.com
oppleman.org
oscontext.com
pathanalyzer.com
pathanalyzerpro.com
precise.fit
pwhois.net
pwhois.org
quietquell.com
trustcor.co
vbchs.com
vbchs.org
vbhacker.space
vbhackerspace.com
vbhackerspace.org
vostrom.ventures
whoisanalyzer.com
whoisanalyzerpro.com
mobile.fra2.measurelib.com
mobile.ams2.measurelib.com
# Telematicsdirect - from al-moazin-lite-prayer-times.apk - dcb56dc7b817dd65a1f5ebfe81cf36b85ad523990b8e4f69a4a1654d1cc8277c
nav.telematicsdirect.com
# SafeGraph / OpenLocate
# https://github.com/pablobaxter/openlocate-android
# https://www.vice.com/en/article/m7vymn/cdc-tracked-phones-location-data-curfews
api.safegraph.com
# daily-scratchers.apk / 22a80df1084af11129baef89bce0bafad0aaae41e58dc2bb6e7c27fd3f4bac49 / me.actv8.tvwallet
actv8technologies.com
api-production-v4.actv8technologies.com
sonar.actv8technologies.com
# Joker - RelaxingMusicSootheYourBody_signed.apk - 14c35d1158cc47cfb605fdd686603b0929d38c046dce03fd6033fb8a31433798
novasdk.oss-cn-beijing.aliyuncs.com
# Joker - https://github.com/DoctorWebLtd/malware-iocs/tree/master/Android.Joker
# Note: domain offline since Feb 2022
ad.mobnv.com
# pDNS for 161.117.252.102
app.mobnv.com
aff.fortunnecat.com
# WhatsApp mod distributed through legitimate apps:
# https://securelist.com/malicious-whatsapp-mod-distributed-through-legitimate-apps/107690/?utm_source=everyonesocial&utm_medium=partner&utm_campaign=us_NA-newsletter_en0177&utm_content=sm-post&utm_term=us_everyonesocial_organic_an17748oyfteksz&es_id=cfde1a3994
wa.zcnewy.com
av2wg.rt14v.com
g1790.rt14v.com
# xnspy - 578a880848bc52bed83b2be817a148187fde129cc8ad50db49630c0ebf59102c - xnspyappv2.apk
# https://techcrunch.com/2022/12/12/xnspy-stalkerware-iphone-android/
alert.xiz4me.com
asset.xiz4me.com
sync.xiz4me.com
xiz4me.com
mydwnd.com
brilliant-flame-585.firebaseio.com
brilliant-flame-585.appspot.com
# xnspy - 7e3930771370ed111cdb83397a04fa7ee89f1ea35b7f5306bb1522b82bc6d38d
sync.bk128.com
alert.bk128.com
asset.bk128.com
bk128.com
# xnspy - 9114e561c42ea19b183ef5d8a36e743f2b873874e43d805b11e3753035c7900d
true-truck-86810.firebaseio.com
true-truck-86810.appspot.com
# Fleckpe - from https://securelist.com/fleckpe-a-new-family-of-trojan-subscribers-on-google-play/109643/
ac.iprocam.xyz
ad.iprocam.xyz
ap.iprocam.xyz
b7.photoeffect.xyz
ba3.photoeffect.xyz
f0.photoeffect.xyz
m11.slimedit.live
m12.slimedit.live
m13.slimedit.live
ba.beautycam.xyz
f6.beautycam.xyz
f8a.beautycam.xyz
ae.mveditor.xyz
b8c.mveditor.xyz
d3.mveditor.xyz
fa.gifcam.xyz
fb.gifcam.xyz
fl.gifcam.xyz
a.hdmodecam.live
b.hdmodecam.live
l.hdmodecam.live
vd.toobox.online
ve.toobox.online
vt.toobox.online
t1.twmills.xyz
t2.twmills.xyz
t3.twmills.xyz
api.odskguo.xyz
gbcf.odskguo.xyz
track.odskguo.xyz
#AhRat - see https://www.welivesecurity.com/2023/05/23/android-app-breaking-bad-legitimate-screen-recording-file-exfiltration/
order.80876dd5.shop
#AhRat - b2c1517e4b0e0b3286a5cde06310b2277da7333f5ab3c2828f08272e3f85b260 - iRecorder - Screen Recorder_2.0_apkcombo.com.apk
config.unityads.unity3d.com
config.unityads.unitychina.cn
init.supersonicads.com
logs.supersonic.com
outcome-ssp.supersonicads.com
supersonicads.com
# uBlock telemetry endpoint - adblock-stats.js inside a01ff7dac823f3666e7f38527739802e5a7ce3cb539b6a390ca99d423b5c9779
# data sent even if telemetry is disabled
ublocker-chrome.com
# Cytrox Predator domains, see - https://citizenlab.ca/2023/09/predator-in-the-wires-ahmed-eltantawy-targeted-with-predator-spyware-after-announcing-presidential-ambitions/
almal-news.com
chat-support.support
cibeg.online
notifications-sec.com
wa-info.com
whatssapp.co
wts-app.info
sec-flare.com
verifyurl.me
c.betly.me
betly.me
web.whatssapp.co
whatspp.wa-info.com
notifications.wa-info.com
t-bit.me
# PEACHPIT and BADBOX, extended infrastructure (expansion by @craiu), see - https://www.humansecurity.com/hubfs/HUMAN_Report_BADBOX-and-PEACHPIT.pdf
adbsc.flyermobi.com
adbsc.ikmytech.com
adbsdk.flyermobi.com
admin.dofunapps.com
ads.dofunapps.com
ads.flyermobi.com
apkcar.com
ats.flyermobi.com
ats.ikmytech.com
cbphe.com
cbpheback.com
dcylog.com
flyermobi.com
n1.flyermobi.com
sdk.dofunapps.com