# Copyright (c) 2014-2025 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: clickfix

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2023-08-28-v10404/902

adqdqqewqewplzoqmzq.site
borbrbmrtxtrbxrq.site
komomjinndqndqwf.store
omdowqind.site
wffewiuofegwumzowefmgwezfzew.site
wnimodmoiejn.site

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2023-08-30-v10406/909

ewkekezmwzfevwvwvvmmmmmmwfwf.site
dust-0001.delorazahnow.workers.dev

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2023-09-01-v10408/915

pwwqkppwqkezqer.site

# Reference: https://threatfox.abuse.ch/ioc/1153349/

stats-best.site

# Reference: https://threatfox.abuse.ch/browse/tag/ClearFake/

921hapudyqwdvy.com
98ygdjhdvuhj.com
cczqyvuy812jdy.com
cdn-new-dwnl.site
indogevro22tevra.com
ioiubby73b1n.com
kjniuby621edoo.com
lminoeubybyvq.com
mnnoiuiuyttczchgv265d.com
nbvyrxry216vy.com
ngvcfrttgyu512vgv.net
ojhggnfbcy62.com
ojiwojdiuuywdnbhcby.com
oiuugyfytvgb22h.com
opkfijuifbuyynyny.com
owkdzodqzodqjefjnnejenefe.site
pklkknj89bygvczvi.com
poqwjoemqzmemzgqegzqzf.online
reedx51mut.com
sioaiuhsdguywqgyuhuiqw.org
ug62r67uiijo2.com
uygftdrvtygnyuhi8.com
vcrwtttywuuidqioppn1.com
vvooowkdqddcqcqcdqggggl.site
ytntf5hvtn2vgcxxq.com
ziucsugcbfyfbyccbasy.com
znqjdnqzdqzfqmfqmkfq.site

# Reference: https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
# Reference: https://otx.alienvault.com/pulse/64f1e91a2dd9db4bd3af8ce4

bgobgogimrihehmxerreg.site
gkrokbmrkmrxtmxrxr.space
oekofkkfkoeefkefbnhgtrq.space
ooinonqnbdqnjdnqwqkdn.space
trustdwnl.site
weomfewnfnu.site
winextrabonus.life

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2023-09-08-v10413/928

oiuytyfvq621mb.org

# Reference: https://threatfox.abuse.ch/browse/tag/ClearFake/ (# 2023-10-07)

boiibzqmk12j.com
nmbvcxzasedrt.com
oiouhvtybh291.com
wsexdrcftgyy191.com
zasexdrc13ftvg.com
/lander/chrome_1695206714/_cf.php
/lander/chrome_1695206714/_index.php
/chrome_1695206714/_index.php
/chrome_1695206714/_cf.php
/lander/chrome_1695206714/
/chrome_1695206714/

# Reference: https://threatfox.abuse.ch/ioc/1188153/

chromiumtxt.space

# Reference: https://threatfox.abuse.ch/ioc/1188713/

chromiumlink.site

# Reference: https://twitter.com/DonPasci/status/1713860495764062600

chromiumbase.site
hwthurmann.de/wp/chromium/

# Reference: https://twitter.com/karol_paciorek/status/1713910402302558281
# Reference: https://twitter.com/g0njxa/status/1713914026328031474

basechromium.space
chromiumengine.space
isaiahradio.com
mvpdigital.net

# Reference: https://blog.sekoia.io/clearfake-a-newcomer-to-the-fake-updates-threats-landscape/
# Reference: https://github.com/SEKOIA-IO/Community/blob/main/IOCs/clearfake/clearfake_iocs_20231016.csv

bookchrono8273.com
bpjoieohzmhegwegmmuew.online
brewasigfi1978.workers.dev
indogervo22tevra.com
oiqwbuwbwqznjqsdfsfqhf.site
opmowmokmwczmwecmef.site
sioaiuhsdguywqgyuhiqw.org

# Reference: https://twitter.com/g0njxa/status/1713919587996057847

altenara.com
doolittles.be
easymall.co.th
esmito.com
filmovita.ba
megacarwreckers.com.au
or-and.com
sistemajogodobicho.com
staging.armipour.com

# Reference: https://threatfox.abuse.ch/ioc/1189985/

nbvcdrtyup584wd.com

# Reference: https://twitter.com/g0njxa/status/1713646965840339438

33webtasarim.com

# Reference: https://twitter.com/JAMESWT_MHT/status/1714681019855450263

nazarenoagape.com.br/temp/

# Reference: https://twitter.com/DonPasci/status/1714925226985750832

lollyjayconcepts.com/wp-content/plugins/chromium/ChromiumEngine.zip

# Reference: https://threatfox.abuse.ch/browse/tag/ClearFake/ (# 2023-10-19)
# Reference: https://twitter.com/crep1x/status/1719433333686342027

02w65ijjohr1frm.com
3ol33lgbrvyjk3d.com
4m9q0m87vnmx0d1.com
b1omodh51hw6g3d.com
cnswg1vzx6heh0f.com
efmdwkmwke.xyz
efmdwkmwkq.xyz
eofjdo3zwxvbi57.com
hello-world-broken-dust-1f1c.brewasigfi1978.workers.dev
l0yolufbw5yeabs.com
lindodeusercontent.com
ocmtancmi2c5t.live
poibvyctm21e.com
server2-slabx.ocmtancmi2c5t.live

# Reference: https://threatfox.abuse.ch/browse/tag/FakeUpdateRU/

cbasechromium.space
placengine.site

# Reference: https://twitter.com/g0njxa/status/1717657394891669861

chrome-up.com
ggsdown.top
kcdq78.fit
update.chrome-up.com
updateload.live
y13xlt1d.xyz

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2023-11-03-v10457/1091

koolstoredeluxe.com
stats-tracked.com

# Reference: https://twitter.com/threatcat_ch/status/1721100855183634653

efmdwkmwk.xyz

# Reference: https://threatfox.abuse.ch/browse/tag/ClearFake/ (# 2023-11-07)

d693na2y4mpkhr34.vip
jonathanbonnici.com
longlakeweb.com
midatlanticlabel.com
mcguffinboots.com
thebestthings1337.online
ov.d693na2y4mpkhr34.vip
u513fdanj.online
u513fdanj.site
u513fdanj.website

# Reference: https://threatfox.abuse.ch/browse/tag/ClearFake/ (# 2023-11-23)

dfjoiners.com
howmuchtimeuneed.online
konstanzkom.com
theoptimistfirst.site

# Reference: https://twitter.com/crep1x/status/1727970391417635312
# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2023-11-27-v10473/1166

excellentpatterns.com
jagernaut.com
/hyk7789hgd/
/hyk7789hgd/_cf.php
/lander/hyk7789hgd/_cf.php

# Reference: https://twitter.com/threatcat_ch/status/1729430998394216450

alicortech.com

# Reference: https://threatfox.abuse.ch/browse/tag/ClearFake/ (# 2023-12-04)

acotechgh.com
akademipraktik.com
beksystems.com
brushremovalequipment.com
concgc.com
delaneymc.com
doctorkiki.me
easyloanbazzar.com
getwiththelingo.com
greatesttreatise.com
kronosmagazine.com
marybskitchen.com
/feqsdqdsq/_cf.php

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2023-12-14-v10486/1209

onewayskateboard.com

# Reference: https://www.bridewell.com/insights/blogs/detail/clearfake-campaign

awumnf.com
ulmoyc.com
zoolclaud.pw

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2024-05-07-v10591/1617

bandarsport.net
itemsdostawa.com
valentinedaycard.com

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2024-05-08-v10592/1622

currentsilverprice.com
debtavailable.com
listwisconsin.com
teachabletutorials.com
voicelesson.org
waytowealth.org

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2024-05-09-v10593/1628

consultantinsurance.net
skylinehigh.com
y9f6z0q1w2.xyz

# Reference: https://x.com/threatcat_ch/status/1799511973261922773

b9y3b7ner2.xyz
cv2b8uz46e.xyz
v7yen47u2e.xyz

# Reference: https://x.com/david_jursa/status/1799536449466909178

s9l0w7n3y5.xyz

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2024-06-21-v10624/1751/1

ryruhuu3.xyz

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2024-06-21-v10624/1751/1

cleanway.5asec.fr

# Reference: https://x.com/ffforward/status/1806669882991239378

daslkjfhi2.shop

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2024-07-18-v10648/1828

daslkjfhi2.pics
ndm2398asdlw.shop

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2024-06-25-v10627/1764

divyjai2.xyz

# Reference: https://x.com/4n6Bexaminer/status/1820718431257428297
# Reference: https://x.com/karol_paciorek/status/1820770887697649907

bannerbarter.com
bestcdnforfree.site
cejecuu4.xyz
cococuy8.xyz
d1x9q8w2e4.xyz
forgreatestgoal.site
gotthebestoffer.site
p4wq3e5r6t.xyz
polikarbonad.xyz
x52op6gt0i.xyz
/bvxny6r6

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2024-08-05-v10659/1875

dais7nsa.pics
dais7nsa.shop

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2024-08-21-v10671/1910

expertcloud.xyz

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2024-08-23-v10673/1914

skibidirizz.lol

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2024-08-26-v10674/1918

ajsdiaolke.shop

# Reference: https://threatfox.abuse.ch/browse/malware/js.clearfake/ (# 2024-09-09)

109.248.206.101:443
109.248.206.106:443
109.248.206.118:443
109.248.206.122:443
109.248.206.138:443
109.248.206.153:443
109.248.206.157:443
109.248.206.159:443
109.248.206.160:443
109.248.206.196:443
109.248.206.49:443
109.248.206.51:443
109.248.206.83:443
185.192.111.195:443
185.192.111.198:443
185.192.111.199:443
185.192.111.201:443
185.192.111.202:443
185.192.111.203:443
188.119.112.25:443
5.252.21.234:443
62.182.156.148:443
000111.org
beaulieuhome.com
bigdownload.lol
bigdownload.xyz
biginfo.xyz
biwumii5.xyz
businessresources.ltd
christmascookie.org
dais7nsa.lol
daslkjfhi2.homes
daslkjfhi2.lol
disypoy4.xyz
downloaddining.rest
drinkresources.rest
execresource.ltd
expertcloud.lol
file-transfer.xyz
filesoftdownload.shop
fileupdate.lol
fileupdate.pics
fileupdate.xyz
fufug.enterprisedownloads.ltd
ginidue5.xyz
gteairfone.com
ichiupdate.lat
informupdate.uno
jegyfuy0.xyz
karmaandfate.com
kibagendi.org
lifestylechoices.us
majordatabases.lat
mdasidy72.lol
mdasidy72.mom
mdasidy72.pics
mdasidy72.shop
ndas8m92.lol
ndm2398asdlw.homes
ndm2398asdlw.lol
ndm2398asdlw.mom
peskpdfgif.shop
pillowscrawler.xyz
playfulyogi.org
quickresource.lol
quickresource.xyz
rsmbscm.wikilogistics.wiki
salesoftskills.com
skibidirizz.mom
soft-download123file.xyz
test-1627838.shop
thecheapestcdn.site
ug62r67uiijo2.com
weoleycastletaxis.co.uk
whattotext.net
wikilogistics.wiki
x8f7a89.pics
x99y.xyz

# Reference: https://x.com/cocaman/status/1837455373420093755

gertioma.top

# Reference: https://www.proofpoint.com/au/blog/threat-insight/clipboard-compromise-powershell-self-pwn

oazevents.com

# Reference: https://www.proofpoint.com/us/blog/threat-insight/security-brief-actor-uses-compromised-accounts-customized-social-engineering

live-samsaratrucking.com

# Reference: https://x.com/unmaskparasites/status/1846975894415724807
# Reference: https://www.godaddy.com/resources/news/threat-actors-push-clickfix-fake-browser-updates-using-stolen-credentials

md928zs.shop
smolcatkgi.shop

# Reference: https://x.com/RussianPanda9xx/status/1851090918562201763
# Reference: https://urlscan.io/result/0e1972f5-bc53-43a8-8382-09219112c775/

inspyrehomedesign.com

# Reference: https://x.com/joe4security/status/1851914797350019510
# Reference: https://www.joesandbox.com/analysis/1545769/0/html#deviceScreen

thecopycat.biz
webdemo.biz

# Reference: https://x.com/tosscoinwitcher/status/1858588990678724873

porn-zoo.sbs

# Reference: https://x.com/RussianPanda9xx/status/1860398656651702683

addonclicks.com
adflowhubs.com
adpathsync.com
adslinker45.com
adstrails.com
adsvector.com
adsynergyz.com
adzcurrent.com
analytrex.com
andropalaces.com
beonebe.com
besidegamz.com
bestgetcontent.com
bestreceived.com
betterdirectit.com
betterthanit.com
blubelive.com
boltsreach.com
bonusawardz.com
brandswebs.com
branksite.com
brimoro.com
bristykalkuz.com
campaignpace.com
campaigntide.com
camplytic.com
campnudge.com
camptracer24.com
checkingspeed.com
checkpageonce.com
circuitsprime.com
clickcampaigner.com
clickforprocess.com
clickgravitate.com
clicksgauge.com
clicksroute.com
clickthistogo.com
clicktoreach.com
clickwavetracker.com
clickzstreamer.com
cloudzyra.com
clovixo.com
continuedownloader.com
continuefor.com
continueurl.com
countlessurl.com
creativityboss.com
cyrusdashboard.com
dateyouwant.com
digitalcurvetech.com
downloadsbeta.com
downloadstep.com
driftsparks.com
dynamotrack.com
editorcoms.com
eternalsurfing.com
fastclickgo.com
fineliveliness.com
firstigame.com
fresoma.com
futureconfirmed.com
galaxyofapps.com
gamebalri.com
gamingzonesup.com
glidronix.com
go2linktrack.com
godagichi.com
greatchoicing.com
helpmemoverand.com
hoststotrack.com
impressflow.com
inclinethem.com
instantclickflow.com
interwebonline.com
itstodayornever.com
jumpinter.com
justmytouch.com
kalamouse.com
kodekthungg.com
latifsnaps.com
licensedgetogeth.com
linksoptix.com
linkspans.com
linksqube.com
linksvibe.com
lnkfyre.com
loadingtab.com
logmypath.com
lovemeboy.com
lynciflow.com
managingeasily.com
matrixbridges.com
mediamanagerverif.com
megarises.com
minitracked.com
moldstrap.com
multitrackings.com
mylinkservice.com
mytrackflow.com
nanolinkpoint.com
nettrackway.com
nettrilo.com
netvaultix.com
newoneis.com
nexorpath.com
nextinclick.com
oceanbreezeget.com
onceletthemcheck.com
orbitgridline.com
pageintab.com
pathofclicks.com
pathsyncer.net
pixelpathsway.com
primarydrives.com
primelinkpulse.com
privatemeld.com
proceedtonext.com
promojet88.com
provenhandshakecap.com
pukiup.com
quantispath.com
quantumtrackers.com
quicklinkdrive.com
reachorax.com
ready4track.com
readyforwebsite.com
routedpulse.com
routegrids.com
rovynex.com
runtonext.com
safetransfering.com
satisfiedweb.com
scrutinycheck.cash
scrutinycheckout.com
searchmegood.com
secureporter.com
sendmewhere.com
servinglane.com
sheenglathora.com
sitebrank.com
smartykhan.com
sourceszone.com
speedlinkzone.com
speedywaygo.com
spintore.com
spotmyaction.com
statzeon.com
stream4core.com
streamingszone.com
stringwebber.com
successeditdone.com
suresignalflow.com
swapages.com
syncthewebs.com
synqchra.com
sysswap.com
tagsflare.com
takeandgonow.com
takemetoworld.com
taketheright.com
themovingfoster.com
tookmybest.com
toptierwebsite.com
trackblitzad.com
trackedcurl.com
trackgamess.com
tracklystic.com
tracksforge.com
trackspin32.com
tracksvista.com
trafficmorph.com
trailsift.com
trakingame.com
transfertonext.com
treeflame.com
treovax.com
trkallpages.com
tunneloid.com
urlignite.com
urlstreams.com
valbexo.com
velindor.com
vividconnects.com
webbazookaa.com
webconnectline.com
webdriveshere.com
westreamdaily.com
yourtruelover.com
zeplavibe.com
heroic-genie-2b372e.netlify.app
poetic-pixie-c95fb0.netlify.app

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2024-10-21-v10724/2066

srftjwrty6kew.shop

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2024-10-28-v10729/2083

bigops.s3.us-east-2.amazonaws.com
youcansay.s3.us-east-2.amazonaws.com

# Reference: https://x.com/DaveLikesMalwre/status/1879181121872593194
# Reference: https://app.validin.com/detail?find=reCAPTCHA%20Verification&type=raw#tab=host_pairs

angelopnavarro.com
bincbusd.site
briolaundry.com
coachcorral.com
csm4tqs.com
davidbergergroup.com
envirotekhomes.com
essvtch.site
fatura-pt-fdeldade.site
fdelidade-pt-com.site
fdelidade-pt-ng.site
fdelidadeptosl.site
fidelidateopt.site
fidelidept.site
fidelidlnpt.site
fididadpt-of.site
gr-nbd.site
gr-nboik.site
gravipod.com
idolmusiclimited.com
ifuckyourpc.win
ireneray.net
jcsalesteam.com
kaldi.run
l1nxx.para.rip
lnepytw.site
mapfr-es.site
maryrezek.com
mbresidencesbrickell.com
miabeachwaterfront.com
mississippiconcretecontractor.com
nashvillegranite.net
ndg-id.site
nxgengames.com
page-yoda.blog
para.rip
premiertents.com
primeden.com
pt-fdelidade.site
pt-fdelidader-egisto.site
pt-fideldideid.site
pt-fidelilde.site
roofingcontractorinutah.com
saltysolssurfschool.com
segurateam.com
thealexteamflorida.com
theworthgrouppalmbeach.com
treeservicerhodeislandpro.com
treeserviceshouston.net
trestlecreekspecklepark.com
wallpaper-engine.pro
whatcomsoccer.com
captcha.nxgengames.com

# Reference: https://x.com/ffforward/status/1879889672392040846
# Reference: https://www.virustotal.com/gui/file/8125ef032eadfc547bcdd2e311a1d4e2cb33e0383c3ac2d8eb40c43bc6d11634/detection

clintonmakes.com
motel6lax.com

# Reference: https://x.com/JAMESWT_MHT/status/1881346687014449202

proxyyy.pages.dev

# Reference: https://x.com/solostalking/status/1882429531111522585

http://83.217.209.224
83.217.209.224:443
93-95-230-135.1984.is
95.179.178.85.sslip.io
asdasljdlaksd.com
asideless.com
bibis.baby
biglicksssss.xyz
captcha.milkywayzone.xyz
content.milkywayzone.xyz
contents.milkywayzone.xyz
cool2229.com
deadpoolguard.icu
dimensled.com
fajnadomenapanajacka.site
freysaai.com
gamarayadt.com
gritvaxeds.com
hnasanpule.com
hollixyz.com
hujkurwaxxx.xyz
jastaraf.com
konchazaspa.baby
leastleads.com
licks999999.xyz
madebybmr.durban
madebybmr.mov
madebybmr.org
milkywayzone.xyz
minigitapp1.pages.dev
minigitapp2.pages.dev
nigga1nigga2.top
onsanfat.com
proxies.milkywayzone.xyz
proxy.milkywayzone.xyz
puppyleak.online
quickdistributionnetwork.com
safeguard-run.pages.dev
safeguardads.com
safeguardokc.com
safeguardportal.duckdns.org
safeguardsol-xyz.pages.dev
safeguardsol.xyz
saveguarder.life
shlaboi.com
telegram-logins.com
test38479587.xyz
validate.milkywayzone.xyz
validating.milkywayzone.xyz
verifying.milkywayzone.xyz
weibfstaa.com
xansdrae.com

# Reference: https://x.com/solostalking/status/1882429533212827650

http://20.197.226.148
http://147.45.44.201
http://84.32.191.176
147.45.44.201:443
20.197.226.148:443
84.32.191.176:443
dropbox.work.gd
rhsantander.com
mail.dropbox.work.gd

# Reference: https://x.com/JAMESWT_MHT/status/1882723100720308508

compltheroomchngnotific.com
booking.compltheroomchngnotific.com

# Reference: https://x.com/jiriatvirlab/status/1881100360456229017
# Reference: https://x.com/skocherhan/status/1883019370991071403

airdrop-gettrumpmemes.com
bsctrumpmeme.fun
claim-gettrumpmemes.com
claiming-trump.com
claimtrump.pages.dev
claim-trumpmemes.xyz
click.jittercore.art
demo222-eh4.pages.dev
evmtrumpmemes.com
gameslux.store
getcommunitytrumpmemes.com
getrumpmemes.cc
getrumpmemes.org
getstrumpmemes.lol
gettrampmeme.com
gettrampmeme.org
gettrampmemes.com
gettrummpmemes.com
gettrumpairdrop.web.app
gettrumpbutthole.com
gettrumpememes.com
get-trumpmeme.com
get-trump-meme.com
get-trumpmeme.info
get-trumpmeme.net
get-trumpmeme.org
gettrumpmeme.pages.dev
gettrumpmeme.web.app
get-trumpmeme.world
gettrumpmemes.click.jittercore.art
gettrump-memes.com
get-trumpmemes.com
gettrumpmemes.dev
gettrumpmemes.ink
gettrumpmemes.me
gettrumpmemes.run
gettrumpmemes.shop
gettrumpmemes.site
gettrumpmemesnow.com
gettrumpmemeth.com
gettrumpmemms.com
gettrumpmems.com
gettrupmems.com
gtetrumpmemes.com
jittercore.art
macatrumpmeme.pages.dev
memetrump.org
swaggy.pages.dev
trumclaim.org
trumpclaim.org
trumpfair.com
trumpmeme.info
trumptokenofficial.com
website-87e9feb8.quaaludes.io
worldofdypians.ch

# Reference: https://x.com/skocherhan/status/1883352572339392719

dating-lab.ru
download-video.online

# Reference: https://x.com/solostalking/status/1884251494901506467

cracanada.org

# Reference: https://x.com/JAMESWT_MHT/status/1885211956635750899

badrewies-guste.com
nurturepetwellness.com
booking.badrewies-guste.com

# Reference: https://www.malwarebytes.com/blog/news/2025/01/clickfix-vs-traditional-download-in-new-darkgate-campaign
# Reference: https://app.validin.com/detail?find=ClickUp%20Commerce%20Hub&type=raw&ref_id=ef4f97767ae#tab=host_pairs (# 2025-02-03)

clickup.news
notionbox.org
s2notion.com

# Reference: https://threatfox.abuse.ch/browse/malware/js.clearfake/ (# 2025-02-04)

ams82.mom
d21m87a.mom
dpqx.org
eiui.org
eyuy.org
feqy.org
fola.bet
gesz.org
gyke.org
haxy.org
iyuu.org
kxlv.org
lnww.org
lqwt.org
nohz.org
nrxk.org
ooeu.org
qabi.org
qace.bet
qlpb.org
qoze.bet
reqy.bet
rlvw.org
rywi.org
skiiin.club
tyro.bet
uayy.org
ueeu.org
viewphoto.lol
vjgh.org
vsdd.org
vyzu.bet
waqj.org
wbth.org
wuga.bet
wyji.org
xclb.org
xgnv.org
yiie.org
zera.bet
zexd.org
zyde.org
microsoft-dns-reload-5q.pages.dev
recaptha-verify-5q.pages.dev
solve.dpqx.org
solve.eiui.org
solve.eyuy.org
solve.feqy.org
solve.fola.bet
solve.gesz.org
solve.gyke.org
solve.haxy.org
solve.iyuu.org
solve.kxlv.org
solve.lnww.org
solve.lqwt.org
solve.nohz.org
solve.nrxk.org
solve.ooeu.org
solve.qabi.org
solve.qace.bet
solve.qlpb.org
solve.qoze.bet
solve.reqy.bet
solve.rlvw.org
solve.rywi.org
solve.tyro.bet
solve.uayy.org
solve.ueeu.org
solve.vjgh.org
solve.vsdd.org
solve.vyzu.bet
solve.waqj.org
solve.wbth.org
solve.wuga.bet
solve.wyji.org
solve.xclb.org
solve.xgnv.org
solve.yiie.org
solve.zera.bet
solve.zexd.org
solve.zyde.org

# Reference: https://x.com/DaveLikesMalwre/status/1887660334699192584
# Reference: https://app.any.run/tasks/9c5f1af8-7b88-4280-8062-251bf4393d37

al3b.duckdns.org
mine.moroccoex.com

# Reference: https://x.com/skocherhan/status/1888401820063871138

alibbaa.shop
id0cu93izlqm.objectstorage.mx-monterrey-1.oci.customer-oci.com

# Reference: https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution

eveverify.com
findkik.com
lynxcm.com
sapeconomico.com

# Reference: https://threatfox.abuse.ch/browse/malware/js.clearfake/ (# 2025-02-15)

aaao.site
activaterants.agency
aeiee.site
agility.website
aiaui.site
alienable.shop
alku.ink
amda.ink
aoaee.shop
aoouu.site
aotoa.site
auaaa.icu
autistic.store
auuae.icu
auyo.site
ayoaa.icu
backup-xvc.pages.dev
banking1.shop
barun.icu
beft.run
bejim.icu
bghsf.site
bitew.icu
bkktp.icu
boguj.icu
boxiq.icu
budu.site
bxayj.site
bypan.icu
byzi.site
cape1.space
cedar1.online
cesspool.shop
check.aaao.site
check.aeiee.site
check.agility.website
check.aiaui.site
check.alienable.shop
check.alku.ink
check.amda.ink
check.aoouu.site
check.aotoa.site
check.auaaa.icu
check.autistic.store
check.auuae.icu
check.auyo.site
check.ayoaa.icu
check.banking1.shop
check.barun.icu
check.beft.run
check.bejim.icu
check.bghsf.site
check.bitew.icu
check.bkktp.icu
check.boguj.icu
check.boxiq.icu
check.budu.site
check.bxayj.site
check.bypan.icu
check.byzi.site
check.cape1.space
check.cedar1.online
check.cesspool.shop
check.cigog.icu
check.cmtkk.site
check.cufflink1.xyz
check.cvdub.site
check.defendant.store
check.dejh.run
check.dibeq.icu
check.djtvx.online
check.dodua.icu
check.ducar.icu
check.duwon.icu
check.dyfut.icu
check.edmer.site
check.eiau.site
check.eject1.online
check.encrust2.online
check.eoeou.icu
check.esscv.tech
check.euuue.site
check.eybiu.site
check.falih.icu
check.gbfbh.site
check.gesom.icu
check.giky.site
check.gity.site
check.givoh.icu
check.guhv.run
check.gxswc.icu
check.gyfai.site
check.hobx.run
check.hpcxb.site
check.hrrld.site
check.husa.site
check.iavau.site
check.identity1.shop
check.ioyyu.icu
check.iueyo.icu
check.iyeeu.icu
check.iyiao.icu
check.iyyye.icu
check.jabyk.icu
check.jaceq.icu
check.jcchr.site
check.jefx.shop
check.jeka.site
check.jime.site
check.jisai.site
check.jokingly.store
check.jwkzh.icu
check.kakif.icu
check.kamaj.icu
check.kisut.icu
check.kybax.icu
check.limev.icu
check.lolp.ink
check.lyvc.run
check.mepyw.icu
check.mmjdh.site
check.mujf.run
check.munz.run
check.myvyt.icu
check.ngsft.icu
check.nhvdr.site
check.nugyd.icu
check.nuviq.icu
check.oeoou.site
check.oeuia.site
check.oink2.space
check.oiwea.site
check.ooia.site
check.ooyou.icu
check.ooyu.site
check.opossum.online
check.ouayu.icu
check.ouhoi.site
check.ououe.icu
check.ouyo.site
check.owacq.site
check.oyiui.site
check.pesa.run
check.plentiful2.space
check.popp.ink
check.puvt.run
check.pylo.site
check.qahov.icu
check.qejym.icu
check.qekr.run
check.qojyx.icu
check.qomay.icu
check.reentry.website
check.repw.run
check.reqy.digital
check.retold2.online
check.reunite.online
check.rexie.icu
check.riverbed.online
check.rofai.site
check.roqoi.icu
check.showing.pw
check.smfd.ink
check.socu.run
check.stand1.online
check.stench.site
check.stress2.xyz
check.swung.site
check.tonev.icu
check.tugy.run
check.uayyo.icu
check.ueiiy.icu
check.ueyu.site
check.uhxkj.space
check.uiayi.icu
check.unmovable.online
check.uoyou.icu
check.uueye.icu
check.uydaa.site
check.vidad.icu
check.vizam.icu
check.volp.run
check.vukh.run
check.vusy.run
check.vybio.site
check.vyrh.run
check.waking.pro
check.waxof.icu
check.wozy.site
check.wubav.icu
check.wvqnj.site
check.xecy.run
check.xibal.icu
check.xony.site
check.xqzcf.icu
check.xufx.run
check.xyms.run
check.yejuo.site
check.yenai.site
check.yiui.site
check.yiyy.site
check.yusio.site
check.yuyoi.icu
check.yyiue.icu
check.yyuuo.icu
check.zelez.icu
check.zovof.icu
check.zovy.site
check.zwxhm.icu
check.zxdsq.site
check.zyfu.site
cigog.icu
cmtkk.site
cufflink1.xyz
cvdub.site
defendant.store
dejh.run
dibeq.icu
djtvx.online
dns-resolver-es8.pages.dev
dodua.icu
ducar.icu
duwon.icu
dyfut.icu
edmer.site
eiau.site
eject1.online
encrust2.online
eoeou.icu
esscv.tech
euuue.site
eybiu.site
falih.icu
gbfbh.site
gesom.icu
giky.site
gity.site
givoh.icu
guhv.run
gxswc.icu
gyfai.site
heck.aoouu.site
heck.oyiui.site
hobx.run
hpcxb.site
hrrld.site
husa.site
iavau.site
identity1.shop
ioyyu.icu
ip-provider.pages.dev
iueyo.icu
iyeeu.icu
iyiao.icu
iyyye.icu
jabyk.icu
jaceq.icu
jcchr.site
jefx.shop
jeka.site
jime.site
jisai.site
jokingly.store
jwkzh.icu
kakif.icu
kamaj.icu
kisut.icu
kybax.icu
landladyscreenconnected.shop
limev.icu
lmlm.activaterants.agency
lolp.ink
ly.aoaee.shop
lyvc.run
mepyw.icu
microsoft-dns-reload-1n.pages.dev
mmjdh.site
mujf.run
munz.run
myvyt.icu
ngsft.icu
nhvdr.site
nugyd.icu
nuviq.icu
oeoou.site
oeuia.site
oink2.space
oiwea.site
ooia.site
ooyou.icu
ooyu.site
opossum.online
ouayu.icu
ouhoi.site
ououe.icu
ouyo.site
owacq.site
oyiui.site
pesa.run
plentiful2.space
popp.ink
praisingtummyunless.shop
puvt.run
pylo.site
qahov.icu
qejym.icu
qekr.run
qojyx.icu
qomay.icu
recaptcha-0d-verify.pages.dev
recaptcha-dns-d9.pages.dev
recaptcha-dns-o5.pages.dev
recaptcha-manual.shop
recaptcha-verify-1t.pages.dev
recaptcha-verify-7z.pages.dev
recaptcha-verify-9n.pages.dev
recaptcha-verify-me-1c.pages.dev
recaptha-verify-1n.pages.dev
recaptha-verify-2w.pages.dev
recaptha-verify-3m.pages.dev
recaptha-verify-4z.pages.dev
recaptha-verify-6l.pages.dev
recaptha-verify-7u.pages.dev
recaptha-verify-7y.pages.dev
recaptha-verify-9o.pages.dev
recaptha-verify-c1.pages.dev
recaptha-verify-q3.pages.dev
reentry.website
repw.run
reqy.digital
retold2.online
reunite.online
rexie.icu
riverbed.online
rofai.site
roqoi.icu
showing.pw
smfd.ink
snorehedging.shop
socu.run
solve.pesa.run
solve.reqy.digital
solve.socu.run
solve.tugy.run
solve.vusy.run
solve.vyzu.digital
solve.xecy.run
stand1.online
stench.site
stress2.xyz
subtyperesource.shop
sulkuntie.shop
swung.site
tonev.icu
tugy.run
u1.landladyscreenconnected.shop
u1.praisingtummyunless.shop
u1.snorehedging.shop
u1.subtyperesource.shop
u1.sulkuntie.shop
u1.wroughtunrulysteed.shop
uayyo.icu
ueiiy.icu
ueyu.site
uhxkj.space
uiayi.icu
unmovable.online
uoyou.icu
updatetroubleunloaded.shop
uueye.icu
uydaa.site
vidad.icu
vizam.icu
volp.run
vukh.run
vusy.run
vybio.site
vyrh.run
vyzu.digital
waking.pro
waxof.icu
wozy.site
wroughtunrulysteed.shop
wubav.icu
wvqnj.site
xecy.run
xibal.icu
xony.site
xqzcf.icu
xufx.run
xyms.run
yejuo.site
yenai.site
yiui.site
yiyy.site
yusio.site
yuyoi.icu
yyiue.icu
yyuuo.icu
zelez.icu
zovof.icu
zovy.site
zwxhm.icu
zxdsq.site
zyfu.site

# Reference: https://app.validin.com/detail?find=Safeguard&type=raw&ref_id=c7749314e0d#tab=host_pairs (# 2025-02-15)

0012939283203ga71yq1q27g1s79s02l0291.xyz
0dy.me
2bee3qst34-web.com
365diascommaria.xyz
7-m3swa3p.com
adbot.baby
airdrop-fullhouse.online
alhudassc.com
an-post.rest
asideless.xyz
asoufidyhosaijkl.xyz
author-safeguard.com
balancefun-reward.org
basedaiclaimhubs.online
bmw530i-pls.live
bordeluxclassic.com
browserprotector.dev
ceskaposta.help
citadelempire.org
claim-order.online
claim-seedworlrd.online
claim-solvbtcbbn.online
claim-strayynift.site
claim-wlf.com
claims-puffer.online
coldenfrozenorlando.fun
cool2228.com
dhlfast-de.top
dogsplayhouse.com
doxachurchny.org
elta-updates.info
emotions.baby
ethernetsafeguard.com
evriev.com
f-corp.cyou
gamarayadt.xyz
gavas.baby
glitchxyz.zip
goldmask.team
heysiemanko1.xyz
iloveeatingsananas.xyz
inshallahbiglick.xyz
integritypavingtx.com
jolismooguard.pages.dev
kailide.top
kupkaguwienko.xyz
lampertamp.xyz
leastleads.xyz
lolguwnopolicja.xyz
madebybmr.click
madebybmr.cymru
madebybmr.dad
madebybmr.eu
madebybmr.fans
madebybmr.fyi
madebybmr.in
madebybmr.link
madebybmr.tel
madebybmr.wales
madebybmr.zip
mavonsol.com
minitech.pages.dev
mint-blockchain.online
nemezzbot.com
niggersforsale.lol
packagetracking.click
peipeicoin.top
pwntter.com
quickcaptcha.tel
randitcoper.com
resturgest.com
retcander.xyz
safeguard-backend.com
safeguard-verification.xyz
safeguard-verifications.xyz
safeguard.direct
safeguard.guru
safeguardbk.com
safeguards.run
safeguardverification.com
safehueta.baby
safes-go.digital
safever.live
safguadrebot.com
sdfsdfdasfsdfsdf.shop
sfghthgfhxz.io
sfgrd.lol
snowhost.org
soniclabs-claim.online
spongegift.vip
summary-driveshare.store
talisrenta.xyz
tandertaste.xyz
teezderh.com
tg-397.pages.dev
torbudels.com
tristatesouvenir.info
tuk-tuk.baby
uahjta.top
urdesto.com
urdesto.xyz
verify-safeguard.link
verifypagealpha.com
versahestbot.com
virtulbsl.com
workerfarm.baby
workspaceclouds365.com
worldmobile-migration.online
xxxpornusek.xyz
yong1.top
yong4.top
zigchain-claim.online
tg.sodium.tools

# Reference: https://www.esentire.com/blog/fake-deepseek-site-infects-mac-users-with-poseidon-stealer
# Reference: https://github.com/eSentire/iocs/blob/main/PoseidonStealer/PoseidonStealer-2-12-2025.txt

browser-storage.com
calendly-storage.com
chatgpt-storage.com
deepseek-storage.com
jobstreet-storage.com

# Reference: https://x.com/solostalking/status/1894083043012309018

windows-update.site
ns1.windows-update.site
ns2.windows-update.site

# Reference: https://x.com/solostalking/status/1894754082134643067

gov-tax.icu
solgiftx.com
irs.fax.gov-tax.icu

# Reference: https://x.com/wbmmfq/status/1900942989792604427

verifycation.mooo.com

# Reference: https://x.com/JAMESWT_MHT/status/1901147192053596414

booking-sup-march4154.com

# Reference: https://app.validin.com/detail?find=Verify%20Your%20Request&type=raw&ref_id=13dfc70e9c5#tab=host_pairs (# 2025-03-20)

0x1bookiendief-4561.com
0xbookindifent-5818.com
1xbookidient-4981.com
1xbookidientf-5912.com
adaeara.space
adm-reservation-lang-en.com
allseasonsinn5235.cfd
ancestrelle.run
atndrfdrms092346.world
atndsrevrooms.world
attendesvstrms952.world
attendesvstrms993242.world
bloomupterra.com
book-lang-adm-de.com
book-lang-adm-eng.com
booked-hotelid-4912.com
booking-capcha524356.com
booking-captcha-109583941.com
booking-captcha-54367.com
booking-captcha-71749395.com
booking-captcha-88392064.com
booking-captcha-95009853.com
booking-human-captha.com
booking-human-test8593890532.com
booking-human-verify407204983.com
booking-human-verify47898935.com
booking-human-verify8593890532.com
booking-human-verify9658843.com
booking-sup-lang-eng.com
booking-supports.com
booking.compliteguest5215.shop
booking.procedeed-verific.com
comlpt7721.cyou
comlpt7721.icu
commentsvisitor58100.world
commentsvisitor58160.world
commentsvisitor589360.world
complaint.digital
complaint.id5512.com
complaintguest2.com
complaintguest4.com
complaintidguest1.com
complaintreservaid1.com
complaints99831.cyou
complaints99831.sbs
complaintsidguest1.com
complaintsidguest2.com
compliteguest5215.sbs
compliteguestid1.com
compliteguestid4.com
complte62346743.cfd
complte62346743.cyou
complte62346743.icu
confirmation-reserv.com
confirmstay6094034.world
consume-policy.com
consumer-policy.world
customervideo58493034.world
darkteenporn.net
darwinstownhouse5335.cfd
dragas.space
feedbackguest4851004.world
feedbackpage91293.world
feedbackvisitroom44419.world
fuckjews.top
goodreviews192947.world
goodreviws09884.world
google.com.vpn123.xyz
gstrview991284.world
guestid3329912.cyou
guestid3329912.icu
guestid3329912.sbs
guestid73436.cyou
guestid73436.sbs
guestid734523.cyou
guestid734523.icu
guestid734523.sbs
guestid734523.shop
guestreporting4039203.world
guestreviews888824.world
iamhuman-2394991.world
id-reservation.com
id01xbookiendt.com
idbookindief-4021.com
idbookingreserva1123.cyou
idbookingreserva1123.icu
idcomplaint1.com
idcomplaint2.com
idguest2.com
idguest44215.cyou
idguest44215.icu
idguest44215.sbs
idguest44215.shop
idguest5647352.com
idguest7325.cfd
idguest99366623.cyou
idguest99366623.icu
idguest99366623.sbs
idguestbooking623tsd.cyou
idguestbooking623tsd.icu
idguestres1.com
idguestres72346.cfd
idguestres72346.cyou
idguestres72346.icu
idguestres72346.sbs
idguestres72346.shop
idguestreserva12462.cyou
idguestreserva12462.icu
idguestreserva12462.sbs
idguestreserva12462.shop
idhuman-49865967.com
idhuman-78211412.world
idres123.live
idreserv7323.sbs
idreservaguest52341.sbs
idreserverationguest72353456.icu
idreserverationguest72353456.sbs
idreserverationguest967234.cyou
idreserverationguest967234.icu
imhuman-0491921.world
imhuman-49129293.world
imhumans-3501234.world
incidentguest560954022.world
infogrievnc.world
inhuman-04929139.world
inhuman-274718381.world
inhuman-38382850.world
issueguesrfd.world
issueguest422039.world
issueguest423239.world
lanedentalservices.com
masthost.net
noreportingreserver544508.world
parner-id-16142.com
ptfgoodreviews192947.world
reportingreserv512658.world
reportingreserv559658.world
reqstgustrfg.world
reservagusetid645234.cyou
reservagusetid645234.icu
reservagusetid645234.sbs
reserveratinguestid662233.cyou
reserveratinguestid662233.icu
reserveratinguestid662233.sbs
review7289.info
rmsrfd200945.world
rqstreserrmsat.world
scollonllc.pro
sodashop.click
stayissueguest94682.world
todayissueguest99282.world
turegalo.com
vereficatin6124.icu
vereficatin6124.sbs
verefication731346.cyou
verefication731346.icu
wallet-sollare.com
wio-business.com
wio-io.site

# Reference: https://blog.sekoia.io/clearfakes-new-widespread-variant-increased-web3-exploitation-for-malware-delivery/

http://80.64.30.238
http://83.217.208.130
1a-a1.pages.dev
ads.green-pickle-jo.shop
b1-c1-k8.pages.dev
bsdfg-zmp-q-n.shop
bweqlkjr.shop
cleaning-devices-k.pages.dev
cleaning-room-device.shop
design-x.xyz
disable-data-collect-ai.pages.dev
discover-travel-agency.pro
ert67-o9.pages.dev
f003.backblazeb2.com
fresh-orange-juice.pages.dev
gdfg-23rwe.pages.dev
ghost-name.pages.dev
hostme.pages.dev
human-verify-7u.pages.dev
hur.bweqlkjr.shop
iuksdfb-f.shop
macos-browser-update-5i.pages.dev
macos-browser-update-9n.pages.dev
microsoft-dns-reload-1r.pages.dev
mnjk-jk.bsdfg-zmp-q-n.shop
nbhg-v.iuksdfb-f.shop
niopg.pages.dev
note1.nz7bn.pro
nz7bn.pro
recaptcha-verify-1r.pages.dev
recaptcha-verify-2e.pages.dev
recaptcha-verify-4h.pro
recaptcha-verify-9m.pages.dev
sandbox.yunqof.shop
sdfwefwg.pages.dev
sha-11x.pages.dev
start.cleaning-room-device.shop
tour-agency-media.pages.dev
travel.image-gene-saver.it.com
tumbl.design-x.xyz
yob.yrwebsdf.shop
you-insk-bad.pages.dev
yrwebsdf.shop
yunqof.shop

# Reference: https://x.com/cloudsek/status/1904799207195894250
# Reference: https://x.com/salmanvsf/status/1905644338052464796
# Reference: https://x.com/salmanvsf/status/1911714728231211095
# Reference: https://www.cloudsek.com/blog/youtube-creators-under-siege-again-clickflix-technique-fuels-malware-attacks
# Reference: https://www.virustotal.com/gui/file/afa819c9427731d716d4516f2943555f24ef13207f75134986ae0b67a0471b84/detection

365-docx.com
cart-newlocate.xyz
cat-watches-site.xyz
docs-edit.com
docx-365.com
docx-clouds.com
docx-edit.com
docx-editor.com
docx-online.com
docx-share.com
docx-shared.com
docx-space.com
findfakesnake.xyz
hold-me-finger.xyz
office-note.com
share-docx.com
sync-docx.com
what-is-game.xyz
cdn.cart-newlocate.xyz
cdn.findfakesnake.xyz
flowers.hold-me-finger.xyz
flowers.what-is-game.xyz
ondrive.docx-edit.com
onedrive.docs-edit.com
onedrive.docx-editor.com
onedrive.docx-online.com
onedrive.docx-shared.com
onedrive.docx-space.com
onedrive.office-edit.com
onedrive.office-note.com
onedrive.sync-docx.com
onenote.docs-edit.com
onenote.docx-share.com
onenote.docx-space.com
onenote.sync-docx.com
sharepoint.365-docx.com
sharepoint.docx-365.com
sharepoint.docx-edit.com
sharepoint.docx-space.com
sharepoint.office-note.com
sharepoint.sync-docx.com
/apiboom/a2l0gh0g
/a2l0gh0g

# Reference: https://x.com/rpargman/status/1906780355132006758

service-faedback.com
booking.service-faedback.com

# Reference: https://x.com/1ZRR4H/status/1907842967529824579
# Reference: https://app.validin.com/detail?find=43f71d0f3e351237fe9224ece2e20413&type=hash&ref_id=e71e4288b5e#tab=host_pairs (# 2025-04-03)
# Reference: https://app.validin.com/detail?find=8b826522d02e09dd38cab8a822a8d3e3&type=hash&ref_id=38c0127dee1#tab=host_pairs (# 2025-04-03)
# Reference: https://app.validin.com/detail?find=e4e083a118ad8505fee3&type=hash&ref_id=38c0127dee1#tab=host_pairs (# 2025-04-03)

alosym.icu
aytuna.icu
azaler.icu
bebir.press
bejoq.icu
bipyv.press
bobuq.press
bopuc.icu
bufok.icu
bukuu.icu
bumac.icu
canez.icu
check.alosym.icu
check.aytuna.icu
check.bopuc.icu
check.bukuu.icu
check.canez.icu
check.cofat.icu
check.cymyv.icu
check.dazyc.icu
check.dobai.icu
check.dymab.icu
check.eezedu.icu
check.eozusa.icu
check.equcym.icu
check.eucudo.icu
check.fenin.icu
check.fepub.icu
check.fidec.icu
check.fihoj.icu
check.gihua.icu
check.giriq.icu
check.hequf.icu
check.higuh.icu
check.hydod.icu
check.ioqoda.icu
check.jehim.icu
check.jetex.icu
check.jexat.icu
check.kywau.icu
check.lacoa.icu
check.lafae.icu
check.libij.icu
check.ligaz.icu
check.maxec.icu
check.mipak.icu
check.nagec.icu
check.nifom.icu
check.nuxiy.icu
check.oegebo.icu
check.ohuxah.icu
check.oibupi.icu
check.opie6.icu
check.ozotuk.icu
check.pijuk.icu
check.poxuv.icu
check.qewid.icu
check.quzis.icu
check.rajuy.icu
check.sabyw.icu
check.sorix.icu
check.taxaq.icu
check.taxiz.icu
check.telavya8.icu
check.ticyb.icu
check.tivadiu1.icu
check.ugarob.icu
check.uzuqed.icu
check.vased.icu
check.wewit.icu
check.wumih.icu
check.xamuy.icu
check.xelan.icu
check.xujamio2.icu
check.xuxyf.icu
check.yonuga.icu
check.ysozim.icu
check.zahyt.icu
check.zymol.icu
check.zynyx.icu
cofat.icu
cohor.icu
cunon.icu
cymyv.icu
dasoc.icu
dazyc.icu
dobai.icu
doguw.icu
dolav.icu
donau.icu
dymab.icu
dysoh.press
eezedu.icu
eozusa.icu
equcym.icu
eucudo.icu
femar.icu
fenin.icu
fepub.icu
fidec.icu
fihoj.icu
fohatua9.icu
fyqup.icu
gekan.icu
gicaz.icu
gihua.icu
giriq.icu
gytat.icu
helij.icu
hequf.icu
hezob.press
higuh.icu
hobex.icu
hodef.press
hodyl.icu
hulak.icu
hydod.icu
hypyh.icu
ioqoda.icu
jarringshrink.shop
jehim.icu
jetex.icu
jexat.icu
kedep.icu
kywau.icu
lacoa.icu
lafae.icu
lagivey1.icu
ledax.icu
libij.icu
ligaz.icu
lipog.icu
lysez.press
maxec.icu
mebwg.press
mipak.icu
munyw.icu
nafih.icu
nagec.icu
napgh.press
nawym.icu
nifom.icu
nikys.icu
novax.icu
nuxiy.icu
nygek.icu
oegebo.icu
ohuxah.icu
oibupi.icu
opie6.icu
ozotuk.icu
pijuk.icu
poxuv.icu
qaxyn.icu
qewid.icu
qopup.icu
qoqon.icu
qusixoy6.icu
quzis.icu
rajuy.icu
rezag.icu
ryqyn.icu
sabyw.icu
sacyd.icu
sanyq.icu
sorix.icu
sosys.icu
taxaq.icu
taxiz.icu
telavya8.icu
ticyb.icu
tisub.icu
tivadiu1.icu
topuwoy1.icu
tumut.icu
tuqad.icu
tywip.icu
ugarob.icu
ugodat.icu
uzuqed.icu
vased.icu
vaviq.press
viqon.icu
wedofoe7.icu
wejyj.icu
wewit.icu
wubys.press
wumih.icu
wuxoq.press
xamuy.icu
xelan.icu
xemyrai6.icu
xeqnm.press
xujamio2.icu
xuxyf.icu
yonuga.icu
ysozim.icu
zahyt.icu
zaqob.icu
zeryjeo6.icu
zesuz.press
zimwl.press
zivad.press
zymol.icu
zynyx.icu

# Reference: https://hunt.io/blog/clickfix-pages-proactive-threat-hunting
# Reference: https://app.validin.com/detail?find=94.181.229.250&type=ip4&ref_id=01058e995e1#tab=host_pairs (# 2025-04-04)

airdrop-dungeons.com
alloc-me.com
alloc-soniclabs.com
allocation-movementlabs.xyz
allocation-wc.com
angorouteam.com
api-land.com
authentication-safeguard.com
authentications-safeguard.com
beckerpresales.com
beckerpresales.net
berachain-community.com
bigcatllover123.cfd
binu-bnb.com
catlover123.cfd
check-soniclabs.com
check-usualmoney.com
check-walletconnect.com
check-wct.com
check-wenwencoin.com
claiming-near.org
claims-0x0.com
claims-lingocoin.com
coinspaceteam.com
collab.api-land.com
daram-claim.cc
defi-dungeons.com
defi-dungeons.live
distribution-berachain.net
distribution-hyperfoundation.net
distribution-pawstokens.com
distributions-basedai.com
distributions-hyperfoundation.net
drop-movementlabs.com
drop-pawscoin.com
earn-drops.app
ethena-rewards.com
events-bomechain.com
events-usualmoney.com
exchange-0x0.com
gcr-sale.com
get-hyperfoundation.net
get-maneki.com
get-michisolana.com
gifts-usualmoney.com
gordon-private.com
grass-foundation.org
home-dioneprotocol.com
hyperliquiid.com
infernoenjoyer.cfd
info-ramen.com
informationhuman.com
informboomk.com
informepartne.com
isp5.dedic.pro
join-animecoin.com
kelp-vote.com
kernelclaim.com
lineaquestmaster.com
meltmetu.live
micropedik.in
mikropedik.in
monkyclaims.com
murad-claim.com
murad-giga.com
murad-live.com
murad-sale.com
murad-sales.com
neotokyo-back.com
participate-hyperfoundation.com
participate-magiceden.com
participate-pnutsol.com
particle-network.com
plsverif.cfd
points-pendle.com
pool-velodrome.com
presale-wizztokens.com
pyth-dao.com
reg-animecoin.app
reg-apuapustaja.com
reg-chillguy.com
reg-chillguy.net
reg-floki.com
reg-ice.com
reg-milkyway.com
reg-thena.com
reg-vana.org
reward-usualdao.com
ripple2025.info
safeguard-authentication.com
safeguard-verify.icu
securedmicrosoft365.com
seoul-ripple.com
shares-paalai.com
sign-sophon.com
site-plumenetwork.xyz
site-realio.network
soubtcevent.com
spacex-giveaways.com
static-ip.ru
staticpage-dispatch.s3.pl-waw.scw.cloud
swellnetwork-claim.com
tele-verify.com
teslaevents.org
titis.cam
tlgrm-redirect.icu
tlgrmverif.cyou
tokens-hyperfoundation.net
tokens-usualmoney.com
tvl-basedai.com
tvl-magamemecoin.com
tvl-mogcoin.com
verification-safeguard.com
verifications-safeguard.com
vote-overprotocol.com
votes-solvprotocol.com
votes-usualmoney.com
web3.monkyclaims.com
wlfi-community.com
xrp-giveaways.com
xrp-jp.net
xrp-korean.com
xrp-rewards.com
xrp-tokyo.net
xrp-tokyo.org
xrp-xrp.org
xrp2025.com
xrpdrop.net
xrpevent2025.com
xrpevent2025.info
xrpgiveaways.com
xrprewards.info
zircult-app.com

# Reference: https://app.validin.com/detail?find=reCAPTCHA%20Verification&type=raw&ref_id=17d30666c74#tab=host_pairs (# 2025-04-04)

202409.live
4256.live
46-247-108-86.cprapid.com
50-116-38-215.ip.linodeusercontent.com
abizz0.ssafileaccess.ru
account.securedmicrosoft365.com
accountarmaicoyvuc-secondary.z13.web.core.windows.net
agbzstore.com
ak0amca.24secur.ru
aovcsrw.ssafileaccess.ru
api.securedmicrosoft365.com
at-uniqa.info
b0erwi.ssafileaccess.ru
bd9eb.ssafileaccess.ru
blessdayservices.org
bo8c3i.24secur.ru
boa-verify-account.pages.dev
callwiegand.com
cdn.securedmicrosoft365.com
cold-limit-4543.malith.workers.dev
comnfigrationclientpanel.securessafiles.ru
contentwaves.com
courses-ai.com
cpak25sjz.ssafileaccess.ru
cve38.ssafileaccess.ru
di4xa.ssafileaccess.ru
drmarlenemd.com
dt57pmy.ssafileaccess.ru
elnas.com
fi3leas.ssafileaccess.ru
g-recaptcha.live
gosw01uw.ssafileaccess.ru
greenbayconcretecontractor.com
h8z7mz.ssafileaccess.ru
hasll.com.my
haushawihakanwj.z13.web.core.windows.net
hbnievis.com
hcaz2.ssafileaccess.ru
i9xir.24secur.ru
ipv6.46-247-108-86.cprapid.com
jessespridecharters.com
jfstixyaocyixacoyx.z13.web.core.windows.net
jis70w.ssafileaccess.ru
juliokoppel.org
leak-my-tits.linkpc.net
ledgersecurity.paulvanross.com
lifesabeacham.com
likeme.co.in
login.securedmicrosoft365.com
lovingcaredisabilityservices.com.au
lwh3632.github.io
m2ds.securessadownloads.ru
mail.46-247-108-86.cprapid.com
mail.agbzstore.com
mail.hbnievis.com
mail.navolshop.com
mail.ogfbbstore.com
mail.waf.admindemo.com.tr
medi-at.site
microsoft.securedmicrosoft365.com
missiontrainingandconsulting.com
moroccoex.com
navolshop.com
new-8at.pages.dev
ogfbbstore.com
onsiterecon.com
outlook.securedmicrosoft365.com
polarclaw.bot.fiatpro.org
ranchiled.com
rbjs0ej.ssafileaccess.ru
recapatchav2.pages.dev
recaptcha.365deals.tech
recaptcha.parlomo.co.uk
recaptcha.xtendservices.tech
riverview-pools.com
scaryterry.space
securessadownloads.ru
small-truth-45f8.malith.workers.dev
ssnagov-report.claimbestdeals.com
statement.getmyssafile.com
statement.myssafile.com
storage.securedmicrosoft365.com
stuauathaztja1hsu.z13.web.core.windows.net
support.havlv.us
telegram-connect.org
test.paulvanross.com
tutspace747.x10.bz
v31v2x.ssafileaccess.ru
v31v9v.ssafileaccess.ru
v98acd.ssafileaccess.ru
v9qbs5x.ssafileaccess.ru
vbeq0z.ssafileaccess.ru
veni02.ssafileaccess.ru
verspace24.elementfx.com
waf.admindemo.com.tr
waf.buyv.net
wow.mox.agency
xxxx23132.malith.workers.dev
zargleflump.x10.mx
zik4cs.ssafileaccess.ru
zoom.getmyssafile.com

# Reference: https://app.validin.com/detail?find=b09b3df2b9e1b0367f3ce278d8cf5099&type=hash&ref_id=bac6e6ee587#tab=host_pairs (# 2025-04-05)

ayaiu.online
boruq.icu
bxqhq.icu
bzhzm.icu
celir.icu
cumys.icu
datot.icu
ditez.icu
dndbv.icu
duvb.shop
fasod.icu
gevis.icu
gihiv.icu
hbskw.icu
hdfkc.icu
hoxif.icu
ieuoi.online
iyeui.online
jmnfp.icu
jojeg.icu
jojyq.icu
jtfsn.icu
kpwlp.icu
lmdgg.icu
ltxgh.icu
lymum.icu
nafeh.icu
nqzhn.icu
papeb.icu
pvhqg.icu
qukex.icu
qvdch.icu
riced.icu
socek.icu
somiv.icu
tuqyq.icu
vwfbm.icu
wezop.icu
xjlkm.icu
zitit.icu
check.ayaiu.online
check.bxqhq.icu
check.bzhzm.icu
check.celir.icu
check.cumys.icu
check.datot.icu
check.dndbv.icu
check.duvb.shop
check.fasod.icu
check.gevis.icu
check.hbskw.icu
check.hdfkc.icu
check.hoxif.icu
check.ieuoi.online
check.iyeui.online
check.jmnfp.icu
check.jojeg.icu
check.jojyq.icu
check.jtfsn.icu
check.kpwlp.icu
check.lmdgg.icu
check.ltxgh.icu
check.lymum.icu
check.nafeh.icu
check.nqzhn.icu
check.papeb.icu
check.pvhqg.icu
check.qukex.icu
check.qvdch.icu
check.socek.icu
check.somiv.icu
check.tuqyq.icu
check.vwfbm.icu
check.wezop.icu
check.xjlkm.icu
check.zitit.icu

# Reference: https://app.validin.com/detail?find=090cd31ea891a2d6dec790789ed0ef07&type=hash&ref_id=88de2115b96#tab=host_pairs (# 2025-04-05)

0.8o1.top
2htf.sbs
3dt.lordfilmak.fun
5m6wc.sbs
5playgame.fun
8o1.top
a6xuo.sbs
a9b8i.sbs
activejourney.world
aerothrive.mom
agility.website
alienable.shop
app.waking.pro
aquashine.world
aquasparkle.pics
artgalleryme.pics
au-blog.top
auranest.pics
autoglow.pics
barbernation.world
barberpro.world
bc2sn.sbs
beautyglow.mom
beautyhaven.world
beautysphere.mom
bertokwerth47.site
bestroofs.world
betterdaysqw.world
betterfuture1.world
betterlife1.world
betterplanet1.world
beyondboundariesq.world
biuabdha.top
bizconnected.world
bizpath.world
bizsuccess.world
blavorn.shop
blissoria.mom
blissova.mom
blockgrayoldflyliveway.world
bloomwithin.world
blueskyclean.world
boldbarbers.world
boldcrest.mom
boldfuture.world
boldideas.world
boldmovesgo.world
boldstep.world
boldsteps.mom
bravenew1.world
breakthroughzone.world
brevora.mom
brightertomorrow.world
brightfuturees1.world
brighthorizon.world
brightlightme.world
brightpathme.world
brightstart.world
brilliancehub.world
brilliancehubme.world
brilliantpath.mom
briskvertex.mom
bryniva.shop
budu.site
busymomhub.mom
c42u8.sbs
c98r.sbs
calvoria.mom
cesspool.shop
championmind.world
changemakerse.world
check.agility.website
check.alienable.shop
check.budu.site
check.cesspool.shop
check.cvdub.site
check.edmer.site
check.husa.site
check.identity1.shop
check.jeka.site
check.jime.site
check.lolp.ink
check.mmjdh.site
check.oiwea.site
check.owacq.site
check.waking.pro
chicsalon.world
cik2mn.sbs
cleanspark.world
cleardreams.world
clearhorizon.world
clearlens.world
clyvino.shop
com-blog.top
com-fr-r.life
com-iblogs.top
com-mainlog.top
connectedminds.world
connectedpath.world
connecthub.world
coolmoms.mom
coreluxe.mom
cosmicjourney.world
cosmicpulse.world
cosmovisionq.world
createchangeme.world
createsuccess.site
creativeimages.pics
creativemoms.pics
creativepulse.world
creativepulse1.world
crystalclearpro.world
crystalluxe.pics
crystalwash.pics
crystalwave.world
cz-loags.top
cz-logln.top
dekye.shop
discoveryzone.world
divineaura.pics
dorixa.shop
dreamershubm.world
dreammakers.lol
dreamquest.world
dreamscapeme.world
dreamtidy.world
dreamweddings.pics
drevalis.mom
dynamicshift.world
echofusion.mom
ecobreeze.world
ecocleanme.world
ecofriendly1.world
ecofriendlyq.world
ecojourney.world
ecospherebrigh.world
elbarber.pro
elevateyour.world
elitesphere.world
elitesphere1.world
elitesuccess.world
elitewash.pics
elitewashmy.world
empowerwave.world
endlesshope.world
endlessjourney.world
energizeyou.world
energylink.world
energysync.world
enterpriselife.world
epicadventures.pics
epiccuts.world
epicjourney1.world
epicmomentum.mom
epicmotion.world
epicventure.world
epicwash.pics
everlastingroof.world
eversaferoof.world
examplepage.top
expandingminds.world
expertroofers.world
explorebiz.world
exploreearth.world
explorevision.world
expressdetailing.pics
faint.lol
familymoments.pics
fastdetail.world
fastroofrepair.world
fastshine.pics
fearlessfuture.world
fivorae.shop
flawlesshair.world
flawlessnest.pics
flowforward.world
fluentorbit.mom
fm8t.sbs
forwardflow.world
forwardmind.world
fowefuie.top
frelno.shop
freshauto.pics
freshera.world
fresheuphoria.mom
freshglow.pics
freshlookme.world
freshnestme.world
freshora.mom
freshstart1.world
freshstartex.world
freshvibes2.world
frivex.shop
fryviro.shop
fu2ai.sbs
futurebuild.world
futureconnect.world
futurenow1.world
futurepulseyes.world
futurevisionse.world
fweeasfw.pics
gbmd3.sbs
globalfocus.world
globalwave1.world
glossyvibe.pics
glowautowash.mom
glowbeauty1.world
glowexpress.pics
glowinfinity.mom
glowixa.shop
glownest.pics
glowsia.mom
glowupsalon.world
goldenhorizon.world
goldenopportunities.world
goldenpath.world
goldenscissors.world
grandvision.world
gravity-falls-lordfilm.top
groominglounge.world
growthcircle.world
growthline.world
guardianroof.world
gzm4x.sbs
hairmagic1.world
hairmasters.world
hairstylehub.world
happymoments.mom
harmonyhubit.world
harmonyplanet.world
harmonyspaceme.world
hd.lordfilmov.fun
hdgo.lordfilmes.fun
hdgo.lordikserial.fun
healthfirst.world
healthway.world
hivua.shop
hkn0si.sbs
holistic2.world
horizonshift.world
horizonview.world
husa.site
hypernest.mom
i44c.sbs
i5lt3.sbs
i8ki.sbs
ibh9.sbs
identity1.shop
infinitedreams.world
infiniteglow.world
infinitegrowth.world
infinitepath.world
infinitevision.world
infiniteways.world
infinitydetail.world
infinityflow.world
infinityflow2.world
infinitypath.world
infinitywayme.world
inkeys.sbs
innovatenow.world
innovatepath.world
innovationpath.world
inspirdreamscape.world
inspirechangea.world
inspiredmoms.mom
inspiremore.world
inspirenow.world
inspirepath.world
inspireqw.world
inspiretoday.world
investzoneew.world
iohz6.sbs
iptv.mallutv.site
javrox.shop
jeka.site
jime.site
jorvex.mom
journeyzone.world
jovrin.shop
jr2f.sbs
keenthat.shop
kelvora.shop
kfjqf.site
kilemeao.top
kingroot.site
kramilo.shop
kybrin.shop
kylira.shop
legendaryroof.world
lemonlivewaynew.world
lemonwaylivenew.world
lifetopia.world
lifeunlocked.world
limitlessdreams.world
limitlessideas.world
limitlesslifew.world
limitlessway.world
lisay.shop
liveactive.world
livegreenyes.world
livelomonwaynew.world
livewayblockgrayoldfly.world
livewaynewlemon.world
lordfilma.fun
lordfilmak.fun
lordfilmes.fun
lordfilmets.fun
lordikserial.fun
lordserials3.fun
lorisa.shop
lovingmoms.mom
lumenexus.mom
lumetis.mom
lurino.shop
lushliving.world
lushliving1.world
luxedetailing.pics
luxeessence.pics
luxewashzone.mom
luxurylocks.world
luxuryride.world
lwxr6.sbs
magicglow.world
magicpoint.world
magictoucha.world
mail.agility.website
metalroofing.world
mindfulcare.world
mindfulgrowth.world
mindfulsteps.world
mindfulsteps1.world
modernmomstyle.pics
mommydiaries.pics
motherhoodadventures.mom
nanoleyu.top
naturalenergy.world
naturallifees.world
naturaltouch.world
naturerealm.world
natureshots.pics
neathaven.world
newlemonwaylive.world
newlivewaylemon.world
newpossibilities.world
newsdays.pro
newsonline.fun
newsplanet.world
newsworld.fun
newwaylemonlive.world
nexora.mom
nextchapter1.world
nexter.world
nexteramera.world
nextgenbarber.world
nextgenroof.world
nextgentech.world
nextgenwash.mom
nextgoal.world
nextlevel1.mom
nextlevelme.world
nextstep1.world
nextstepme.pics
nextwave1.world
nigger.bond
nigger.yachts
novaglow.world
novamotive.mom
novapeak.world
novatouch.world
noventra.mom
nysyxaeu.top
nzjmf.shop
oiwea.site
oldflylivewayblockgray.world
oneplaceer.world
openfutureme.world
openmind3.world
orbitaround.world
orvanna.mom
otchayannye-domohozyaiki-lordfilm.top
owacq.site
p8ri.sbs
peakmoment.world
peaktrail.mom
peakvision1.world
perfectfinish.world
perfecttrim.world
pet2.sbs
pi6z.sbs
plentora.mom
pn9p.sbs
posturefixcz.pro
povoa.shop
powercircle.world
powerfocus.world
powerfulvoices.world
powermindyou.world
primegleam.world
primehair.world
primesource.world
primesource1.world
pristineway.world
privatproxy.shop
procare1.world
proroofing.world
prostylist.world
ps9i.sbs
pubhouse247.life
pureessenceme.world
purefuture.world
pureglossauto.pics
pureglow.pics
purehealth.world
purehorizon1.world
puremotion.world
purepotential.world
purevision1.world
purevisionas.world
purevista.world
purewash.pics
pye9b.sbs
pyhai.shop
qhq.lordserialkin.fun
qualityroofing.world
quantumspace.world
r84i.sbs
radiantautospa.mom
radiantcharm.pics
radiantmind.world
radiantvision.world
rce3i.sbs
reliableroof.world
revivecharm.pics
riseaboveall.world
roofarmor.world
roofdefender.world
rooffix.world
roofguardian.world
roofingshield.world
roofingsolutions.world
roofrepairexperts.world
rot.lol
royalcuts.world
rph1s.sbs
rqz6x.sbs
ru.lordfilma.fun
sab8h.sbs
safehaven1.world
safehavenroof.world
safetop.world
sallkonline.site
salonempire.world
salonvibes.world
sanantonioshield.world
savexa.shop
serenityflow.pics
shapingtomorrow.world
sharpstyles.world
shieldforce.world
shieldpro.world
shieldroofing.world
shineauto.world
shinemaster.pics
shinemasters.world
shinesphere.world
shingleroofing.world
shinyautocare.mom
sidetrepolik.site
skylineedge.world
skyprotect.world
skyshield.world
smartchoiceme.world
smartchoices.world
smartedge.mom
smartfocusme.world
smartfuturewear.world
smarthubme.mom
smartplan.world
smartsolutionsme.world
smartvisionme.world
smartwash.world
sohya.shop
solidshield.world
sparkflow.world
sparkmind.world
specialoccasionsq.pics
speedydetail.pics
starconnect.world
startupworld.world
startupworldes.world
stormproofroof.world
stormsaferoof.world
stormshield.world
stunningviews.pics
stylecuts.world
successhub.world
successmap.world
successpatheq.world
supermomlife.mom
supremecare.world
supremeclean.world
supremedetail.pics
supremepath.world
supremeshinepro.pics
swiftharbor.mom
t9zs.sbs
techforward.world
techwave.world
themomjourney.pics
thriveglobal.world
thrivein.world
thryvexa.shop
tigrinhogreen.life
timelessflow.world
timelessphotography1.pics
titanroof.world
tranquilbeauty.mom
tranquilvibe.pics
travelmemories.pics
trazelle.mom
trevori.shop
truehorizon.world
truehorizon1.world
truepath1.world
truesync.mom
truewealth.world
tss.waking.pro
turbogloss.pics
turboshine.pics
tv.lordfilmak.fun
tv.lordfilmes.fun
tv.lordfilmets.fun
tv.lordfilmov.fun
tw.lordserialkin.fun
uk-blog.top
ulovzoerkk.site
ultimatecover.world
ultimatepower.world
ultimateroof.world
ultimateroofing.world
ultrashine.pics
ultrasphere.world
ultratidy.world
ultraven-mx.site
ultrawashhub.mom
unityspace.world
urbanflare.mom
urbanstyles.world
v7qax.sbs
vastopportunities.world
vintagevibes.pics
virello.mom
visionbuilders.world
visionnext.world
vitalcore.world
vitalluxe.pics
vitalpulse.world
vividdreams.world
vividpath.world
vividpulse.mom
vividrealm.world
vividshinecar.pics
voguecuts.world
vteq3.sbs
vygyu.shop
vyzenix.mom
waking.pro
wayblockgrayoldflylive.world
waylivenewlemon.world
waynewlemonlive.world
weatherproofroof.world
wellnessaura.mom
wergfi.world
wildlifeencounters.pics
winningmind.world
wogoe.shop
wonderedge.world
wonderflow.world
xn--80aqordz.shop
xolino.shop
xyqae.shop
yieldyogayellow.site
yourchoiceyes.world
yourfuturee.world
yourjourneye.world
zelphic.mom
zenharmony.mom
zenhorizon.pics
zenithclean.world
zenithglow.world
zenstate.world
zolyxo.shop
zovy.site

# Reference: https://app.validin.com/detail?find=9e980da369235319ad4ed6798209f9f2&type=hash&ref_id=37ce58ff816#tab=host_pairs (# 2025-04-05)

bajys.icu
bibyn.icu
bicue.icu
bipyl.icu
botuh.icu
bqfcv.icu
ccmfs.icu
chat-whatsapp3023.neweb.icu
chat-whatsapp3438.neweb.icu
chat-whatsapp4275.neweb.icu
chat-whatsapp4620.neweb.icu
chat-whatsapp9503.neweb.icu
check.bajys.icu
check.bipyl.icu
check.botuh.icu
check.darax.icu
check.debij.icu
check.fvqxp.icu
check.gozun.icu
check.jakoc.icu
check.jaxim.icu
check.jixal.icu
check.kekid.icu
check.kibof.icu
check.kosif.icu
check.laqyk.icu
check.lavow.icu
check.lemaw.icu
check.lijam.icu
check.losex.icu
check.losyb.icu
check.lybuk.icu
check.mevif.icu
check.neweb.icu
check.newyf.icu
check.ngrdr.icu
check.pedaz.icu
check.pekyy.icu
check.rehoe.icu
check.rlcbb.icu
check.segir.icu
check.sijuh.icu
check.tefee.icu
check.tisof.icu
check.tovac.icu
check.tunep.icu
check.tymis.icu
check.vijaw.icu
check.vykud.icu
check.wobym.icu
check.wohur.icu
check.woqym.icu
check.xajax.icu
check.xylor.icu
check.zalyr.icu
check.zixeq.icu
check.zoxog.icu
cipeb.icu
codashop-freefire-gratis2296.neweb.icu
comyk.icu
cpanel.neweb.icu
cpcalendars.neweb.icu
cpcontacts.neweb.icu
darax.icu
debij.icu
doxux.icu
dyjij.icu
fafen.icu
fiwoe.icu
foquh.icu
fvqxp.icu
ggkwt.icu
gozun.icu
hataa.icu
hecup.icu
hubyj.icu
hytah.icu
jakoc.icu
jaxim.icu
jixal.icu
jywaf.icu
kekid.icu
kibof.icu
kiwbm.icu
kolav.icu
kosif.icu
laqyk.icu
lasux.icu
lavow.icu
lemaw.icu
lijam.icu
losex.icu
losyb.icu
lybuk.icu
mail.neweb.icu
mevif.icu
mobilelegends-free-skin3564.neweb.icu
moqak.icu
neweb.icu
newyf.icu
ngrdr.icu
pakaz.icu
pedaz.icu
pekyy.icu
rehoe.icu
rlcbb.icu
segir.icu
sijuh.icu
tefee.icu
tisof.icu
tovac.icu
tulod.icu
tunep.icu
tymis.icu
uaeia.online
vijaw.icu
vkdfk.icu
vykud.icu
wafag.icu
webdisk.neweb.icu
webmail.neweb.icu
wobym.icu
wohur.icu
woqym.icu
xajax.icu
xylor.icu
yayei.online
zalyr.icu
zatij.icu
zdnwf.icu
zixeq.icu
zixit.icu
zoxog.icu
zypyd.icu

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2025-03-07-v10874/2502

cpth-cant.com
lydbonkersbimpjc.blogspot.com
bookimanagerev.com

# Reference: https://community.emergingthreats.net/t/ruleset-update-summary-2025-03-13-v10878/2518

open-connect-to-cdn.cc
westmaidentrue.click
connection.click
main-connection.click
security-confirmation.help
authentication-to.help

# Reference: https://x.com/EncapsulateJ/status/1909243275938066897
# Reference: https://app.validin.com/detail?find=edc1d53342cfcd8bfd1f&type=hash&ref_id=2617ee61cbf#tab=host_pairs (# 2025-04-07)

24wash-center.cfd
24wash-center.cyou
24wash-center.icu
24wash-center.sbs
adp-me-in.icu
adult-hub1990.cfd
adult-hub1990.cyou
adult-hub1990.icu
adult-hub1990.sbs
adult-hub1990.shop
antibot-check.cfd
bakinask365.org
booking.gjuestidrewiew.com
booking.guestsitemsreview.com
booking.itemidguests.com
booking.rewieeswsbeedtouwn.com
booking.rewiescommand.com
booking.rewiesgueste.com
booking.rewiesrate.com
cardrive356days.cfd
cardrive356days.sbs
cfd380click.cfd
eu-gangbang24.cyou
eu-gangbang24.icu
eu-gangbang24.sbs
externet-acess.lol
extnt-partner.com
fjghe8tygt49.icu
gjuestidrewiew.com
guestsitemsreview.com
i2493check.cfd
i2493check.click
i2493check.cyou
i2493check.icu
i2493check.rest
i2493check.sbs
i2493check.shop
i2493check.world
itemidguests.com
join-to-12-homework.cfd
join-to-12-homework.icu
llnkdsin.com
p360dash.cfd
payhexx.icu
pro-housewasher.cfd
pro-housewasher.cyou
pro-housewasher.icu
pro-housewasher.sbs
q750jump.cfd
q880boost.cfd
r580drive.cfd
r590move.cfd
rewieeswsbeedtouwn.com
rewiescommand.com
rewiesgueste.com
rewiesrate.com
rrrr0385kfsd.cfd
s10-serv-0483.com
s820way.cfd
sk365oninebokn.com
t360glide.cfd
t680run.cfd
test90sdfksdfjsdf.cfd
token999.bet
v770shift.cfd
vacum-cleaner24.com
verify-s1.icu
w210speed.cfd
w290mice.cfd
w290mice.cyou
w290mice.icu
w290mice.sbs
www-iinkedln.com
www-mindersite.com
x450track.cfd
y440go.cfd380click.cfd
z550flow.cfd

# Reference: https://app.validin.com/detail?find=%3A%3A%3A%27GENERATOR%27%3A%27The&type=raw&ref_id=b28f0be6099#tab=host_pairs (# 2025-04-08)

cardrive356days.icu
eu-gangbang24.cfd
join-to-12-homework.cyou
join-to-12-homework.sbs
m720fast.cfd
r360drive.cfd
x240go.cfd
y440go.cfd
z380click.cfd

# Reference: https://x.com/JAMESWT_WT/status/1909963906270834742

brokpolok.shop
colidt-frend-cheap.cfd
empizolo.rest
firtsaigoing.xyz
lacukurk.it.com
meteoforecast.icu
pcnoworlater.live
phonenowglass.website
sonorous-horizon-cfd.cfd
tenacious-axiom-8.cfd
uno-cdn-update.buzz
velvet5nssrv.shop
wakapundaa.shop
werito.cyou
world-of-guides.buzz
younowoutyes.website

# Reference: https://x.com/moneroon/status/1910672445670842395
# Reference: https://www.virustotal.com/gui/file/63b56da83ddf792c7753515af5e5b25816a54e1fc10bcc6693b7028e645df2a6/detection

signin.clouddomainservice.com

# Reference: https://x.com/JAMESWT_WT/status/1910964823522705752

cpthclks.info
partner-id125481.com

# Reference: https://x.com/Gi7w0rm/status/1911838153654042718
# Reference: https://www.virustotal.com/gui/file/b9adae0c45fae156183d42b1fba8e916bf3d1c796136e1a36eb8193a1b7ea001/detection

amoliera.org
analytiwave.com
closecufre.com
flargyard.com
goclouder.com
secuclauf.com
security.closecufre.com
security.flargyard.com
security.secuclauf.com

# Reference: https://x.com/joe4security/status/1912072320392310805
# Reference: https://www.joesandbox.com/analysis/1665160/0/html

newflave.rf.gd

# Reference: https://www.validin.com/blog/finding_booking_themed_clickfix/
# Reference: https://app.validin.com/detail?find=6018807017afead14417566f975ffdb4&type=hash&ref_id=dd4a4895e1b#tab=host_pairs (# 2025-04-18)

2019.secure-service.pro
2020.secure-service.pro
ad.secure-service.pro
airbnb.support-25.ru
airbnb.support-26.ru
airbnb.support-28.ru
apartamentrebotckick.com
apartamentveryf.com
aria51.nl
aria51.online
arnhemsejongens.com
backup.secure-service.pro
bazarsk.secure-service.pro
bazoscz.secure-service.pro
bazossk.secure-service.pro
blablacarcz.secure-service.pro
blablacarpl.secure-service.pro
blablacarsk.secure-service.pro
blocket.secure-service.pro
bloemendaal-aan-zee.nl
bloemendaalammeer.de
blog.secure-service.pro
bnb.confirm5318.com
bokcentrpart.com
bokpipa.click
book-decision-one.click
book-scan-robot.click
bookcenterpa.com
bookcpche.click
bookhumanpage.com
booking-invoices.strongsd.com
booking-pre-approved-192m45n21n.3598422.top
booking-pre-approved-2nj6j3n4j2.379876334.xyz
booking-pre-approved-5jnm5k24n5.9784738.homes
booking-pre-approved-list.g958190.live
booking-pre-approved-list.m958197.space
booking-pre-approved-list.t897019.space
booking-pre-approved.b75199h.live
booking-pre-approved.h5199b2.space
booking-request-list.m95828f.live
bookingofertas.com
bookinterpages.com
booklistingmanage.com
bookpartcenter.com
bookseereserve.com
bookviewinforeserve.click
carousell-pay.secure-service.pro
carousell-payment.secure-service.pro
carousell.secure-service.pro
chanelpbkng.com
cheapdays.nl
clientpagebook.com
coachestrainers.nl
coachpraktijktwente.com
com-confirmation.live
com-confirmationid.live
com-confirms.life
com-confirms.live
confirm5320.com
confirmation-id1780.com
confirmation-id1800.com
confirmedckick.com
correos.secure-service.pro
cotr.nl
dev.secure-service.pro
dgaf.nl
dimensionseven.nl
dpd.secure-service.pro
facebook-pay.secure-service.pro
facebook-payment.secure-service.pro
flapdrol.nl
formcentrebo.com
globetravelt.com
gumtree-pay.secure-service.pro
gumtree-payment.secure-service.pro
hostmaster.flapdrol.nl
id-hotel7367165.com
iformacontorlbkng.com
in2media.nl
inbockhuman.com
inform-centreb.com
iphone-store.secure-service.pro
issue-booking1285927.com
jfkfm.nl
jofogas.secure-service.pro
josverschaeren.nl
laendleanzeiger.secure-service.pro
lighting-shop.secure-service.pro
madebymin.com
madebymin.nl
mbi.dev.ke
milanuncios-pay.secure-service.pro
milanuncios-payment.secure-service.pro
mqw.zbc.mybluehost.me
mybooking.today
nodedeploy.vnmeirelles.dev
nosebook.nl
olxbg.secure-service.pro
olxpl.secure-service.pro
olxro.secure-service.pro
parthumbook.com
partner-id655421.com
pay-carousell.secure-service.pro
payment-carousell.secure-service.pro
posta.secure-service.pro
postasi.secure-service.pro
qatarliving-pay.secure-service.pro
qatarliving-payment.secure-service.pro
request-booking-accepted.com
request-confirm-booking.com
sbazarcz.secure-service.pro
sbazarsk.secure-service.pro
secure-service.pro
selfnet.nl
shieldme-pros.net
staging.secure-service.pro
star-bookings.net
star-bookings.org
star-kkbooking.com
star-mercadolibres.com
star-mercadolibrevip.cc
support-25.ru
support-26.ru
support-28.ru
test.secure-service.pro
thca.eu
thebellagiolasvegas.com
themandalaybay.com
travellingwell.zwaait.nl
treinhobbyclub.nl
trip-planner.demonstration.space
twents-talent.nl
u381da7.nf.clienthost.co
verificationapartamet.com
visitorverefapartment.com
we2you.nl
wordpress.secure-service.pro
wp.secure-service.pro
zwaait.nl

# Reference: https://x.com/skocherhan/status/1912941291857490015

apartsid231.com
badrewiesaccomader.com
boxiesreservguste.com
cheaskguestrooms.com
guestidreviews.com
informupcent.com
itemsidguest.com
partner-id-1177539.com
partner-id-6456457.com
partner-id-67111982.com
partner-id-6856757.com
partner-id-68567577.com
partner-id-7053271.com
partner-id-7695265.com
partner-id-769795.com
partner-id-799272685.com
partner-id-7992975.com
partner-id-805746.com
partner-id-8073451.com
partner-id-807451.com
partner-id-9993112.com
partner-id128125.com
partner-id2341.info
partner-id29834.com
partner-id345871.com
partner-id365411.com
partner-id3695.com
partner-id3695.world
partner-id369551.com
partner-id42.world
partner-id435.info
partner-id651315.com
partner-id655421.com
partner-id7192.world
partner-id729.com
partner-id729.world
partner-id7292.world
partner-id742.world
partner-id751.world
partner-id755421.com
partner-id834.world
partner-id9832.info
partner-id985.world
roombedsrewiews.com
booking.badrewiesaccomader.com
booking.boxiesreservguste.com
booking.cheaskguestrooms.com
booking.guestidreviews.com
booking.itemsidguest.com
booking.partner-id345871.com
booking.partner-id365411.com
booking.partner-id651315.com
booking.roombedsrewiews.com

# Reference: https://app.validin.com/detail?find=43f71d0f3e351237fe9224ece2e20413&type=hash#tab=host_pairs (# 2025-04-19)
# Reference: https://app.validin.com/detail?find=8b826522d02e09dd38cab8a822a8d3e3&type=hash#tab=host_pairs (# 2025-04-19)
# Reference: https://app.validin.com/detail?find=9e980da369235319ad4ed6798209f9f2&type=hash#tab=host_pairs (# 2025-04-19)
# Reference: https://app.validin.com/detail?find=d508a09d517fc709d079030663a51c0a&type=hash#tab=host_pairs (# 2025-04-19)

012x6.barev.icu
04nmf.barev.icu
0kvgp.barev.icu
0vny2.barev.icu
11.barev.icu
11751839.barev.icu
1325895.barev.icu
143693.barev.icu
14513848.barev.icu
1454246.barev.icu
14697.barev.icu
14866.barev.icu
15721199.barev.icu
15763744.barev.icu
15872152.barev.icu
16347.barev.icu
16738.barev.icu
17432.barev.icu
18517.barev.icu
19517797.barev.icu
1cher.ru
1ck5p.barev.icu
1irugznl.barev.icu
1ugq.barev.icu
1wmkk.barev.icu
2119.barev.icu
21553.barev.icu
21687.barev.icu
21924.barev.icu
22616552.barev.icu
23171.barev.icu
23456392.barev.icu
23672599.barev.icu
23794.barev.icu
24293.barev.icu
2449.barev.icu
2573326.barev.icu
25941.barev.icu
27219.barev.icu
27638.barev.icu
27729723.barev.icu
28346237.barev.icu
28471978.barev.icu
28659114.barev.icu
2957859.barev.icu
29618719.barev.icu
29882.barev.icu
2dmsv4fx.barev.icu
2e015.barev.icu
2hm282lc.barev.icu
2lvgla3r.barev.icu
2pqq9dxh.barev.icu
31317.barev.icu
31771.barev.icu
32274879.barev.icu
32516.barev.icu
32856981.barev.icu
34499.barev.icu
34937.barev.icu
34965.barev.icu
351.barev.icu
35955518.barev.icu
36451.barev.icu
36498.barev.icu
36554348.barev.icu
36973664.barev.icu
36jwz.barev.icu
38dipohp.barev.icu
39458588.barev.icu
3a83nh26.barev.icu
3hqzq.barev.icu
3iqb2.barev.icu
3lep.barev.icu
3rqh.barev.icu
3tja.barev.icu
3vdmbpkq.barev.icu
41288.barev.icu
41756223.barev.icu
421y2swh.barev.icu
4231372.barev.icu
42652379.barev.icu
43.barev.icu
43739179.barev.icu
43991262.barev.icu
44421.barev.icu
44985498.barev.icu
45.barev.icu
45187356.barev.icu
45996853.barev.icu
45l1o.barev.icu
46455393.barev.icu
46659.barev.icu
46697643.barev.icu
46w2ua3s.barev.icu
48129.barev.icu
48349.barev.icu
48711517.barev.icu
48732224.barev.icu
48775.barev.icu
492.barev.icu
49526.barev.icu
4954.barev.icu
49555896.barev.icu
49642738.barev.icu
49728.barev.icu
4ayws.barev.icu
4j4r.barev.icu
4kan.barev.icu
4uc7.barev.icu
4xbii66u.barev.icu
51152221.barev.icu
51294665.barev.icu
52317.barev.icu
52974.barev.icu
53423.barev.icu
53433432.barev.icu
53to.barev.icu
56455.barev.icu
56873155.barev.icu
57492788.barev.icu
57579334.barev.icu
58523675.barev.icu
58588.barev.icu
5941.barev.icu
59929865.barev.icu
5oyc7.barev.icu
5um7aviw.barev.icu
5yt0v.barev.icu
61814629.barev.icu
622g.barev.icu
62454.barev.icu
62498.barev.icu
62912427.barev.icu
63763.barev.icu
641.barev.icu
64166.barev.icu
64275.barev.icu
64486418.barev.icu
64543.barev.icu
64777344.barev.icu
64934983.barev.icu
65851.barev.icu
66318.barev.icu
66664175.barev.icu
66867161.barev.icu
67995754.barev.icu
67d8g.barev.icu
682.barev.icu
68555916.barev.icu
68565955.barev.icu
68845639.barev.icu
69359.barev.icu
6hwwb.barev.icu
6owf3xtz.barev.icu
6rawknz7.barev.icu
71266.barev.icu
72726.barev.icu
73149923.barev.icu
73444215.barev.icu
7365295.barev.icu
739qarsb.barev.icu
74796.barev.icu
754292.barev.icu
76127.barev.icu
76291198.barev.icu
76569757.barev.icu
76925387.barev.icu
77426.barev.icu
77981.barev.icu
7824557.barev.icu
78272.barev.icu
78451.barev.icu
791764.barev.icu
79346137.barev.icu
7dr8.barev.icu
7elb8.barev.icu
7gbjd.barev.icu
7jx4lrsi.barev.icu
7k5nm.barev.icu
7yum0uo5.barev.icu
82317.barev.icu
83893797.barev.icu
84317.barev.icu
84723.barev.icu
85836177.barev.icu
86544266.barev.icu
873.barev.icu
87863368.barev.icu
879uv9j5.barev.icu
88187.barev.icu
88538.barev.icu
89299.barev.icu
89438.barev.icu
897.barev.icu
8v3loy36.barev.icu
902n67ye.barev.icu
91795759.barev.icu
92651.barev.icu
92836.barev.icu
93115.barev.icu
93811.barev.icu
93919759.barev.icu
94681.barev.icu
94r2.barev.icu
9536.barev.icu
95437.barev.icu
95539541.barev.icu
95581397.barev.icu
95853.barev.icu
96539959.barev.icu
96785.barev.icu
9692743.barev.icu
97415216.barev.icu
97497.barev.icu
97547.barev.icu
979.barev.icu
97957882.barev.icu
9796.barev.icu
98267.barev.icu
98649294.barev.icu
98958.barev.icu
9942723.barev.icu
999.barev.icu
9n1z.barev.icu
9pfwf.barev.icu
9uc5.barev.icu
9x2df.barev.icu
9yz6.barev.icu
a7ene.barev.icu
a7mh9.barev.icu
amkgf44j.barev.icu
aoyai.online
at7xctic.barev.icu
atf2n3g4.barev.icu
b0sp.barev.icu
b896.barev.icu
b9uvu.barev.icu
babuc.icu
barev.icu
baruy.icu
becyz.icu
beksr.press
bm8gv9le.barev.icu
bo8ia.barev.icu
bogig.icu
bscvir5o.barev.icu
bugix.icu
bugyx.icu
buqoc.icu
campsitegradually.ru
carin.icu
casog.icu
ccbn.barev.icu
cgplk.press
check.aoyai.online
check.babuc.icu
check.barev.icu
check.baruy.icu
check.bogig.icu
check.bugix.icu
check.bugyx.icu
check.casog.icu
check.cisyn.icu
check.codux.icu
check.cudol.icu
check.cuved.icu
check.cuxor.icu
check.cybaf.icu
check.cyhym.icu
check.debul.icu
check.dehoz.icu
check.dycib.icu
check.dymyf.icu
check.dypit.icu
check.farur.icu
check.favop.icu
check.fegag.icu
check.fesuy.icu
check.firoc.icu
check.fyjig.icu
check.gerit.icu
check.guqev.icu
check.gytas.icu
check.gywic.icu
check.hacoj.icu
check.hegop.icu
check.hehoi.icu
check.hoqud.icu
check.hotuv.icu
check.huquw.icu
check.hyjaz.icu
check.jexem.icu
check.kolac.icu
check.kural.icu
check.kyrap.icu
check.kyzog.icu
check.lemox.icu
check.lezum.icu
check.lukus.icu
check.mavew.icu
check.mesen.icu
check.miwun.icu
check.mujan.icu
check.mulaq.icu
check.munen.icu
check.napef.icu
check.nejoc.icu
check.nejyd.icu
check.nokuv.icu
check.nyrar.icu
check.pawol.icu
check.pedyg.icu
check.pifos.icu
check.pilod.icu
check.qevub.icu
check.qowot.icu
check.qulin.icu
check.qutyd.icu
check.revuq.icu
check.rozox.icu
check.rulix.icu
check.sesaf.icu
check.sifum.icu
check.sinyx.icu
check.sipit.icu
check.sipyf.icu
check.symad.icu
check.talup.icu
check.tidag.icu
check.vasih.icu
check.vefim.icu
check.vegyt.icu
check.voded.icu
check.vosyr.icu
check.vuces.icu
check.vysub.icu
check.wetad.icu
check.wolum.icu
check.wyham.icu
check.wysaf.icu
check.wyzof.icu
check.xasad.icu
check.xiwaj.icu
check.xiwuc.icu
check.xufam.icu
check.xulap.icu
check.zaxys.icu
check.zeboa.icu
check.zevyg.icu
check.zudab.icu
cisyn.icu
codux.icu
colaj.icu
coonl.barev.icu
coxyz.press
ctcb.barev.icu
ctkz5f5a.barev.icu
ctpzd.press
cubuj.press
cufyz.icu
cuved.icu
cuxor.icu
cybaf.icu
cyxix.press
d0aj.barev.icu
d2pr.barev.icu
dafeq.icu
dbxl5zi0.barev.icu
debul.icu
dehoz.icu
didey.icu
dimmergauntlet.ru
divoc.press
djbaz.barev.icu
dk873.barev.icu
dmlfq.press
dosyh.top
doxaf.icu
dymyf.icu
dypit.icu
e2kj.barev.icu
e9rl.barev.icu
eln92cr5.barev.icu
emm7g.barev.icu
eqr0.barev.icu
er7q.barev.icu
f77lo.barev.icu
fafot.icu
faneg.icu
faqyw.icu
farur.icu
favop.icu
fdzkl.barev.icu
fegag.icu
fimy5.top
firoc.icu
foqin.press
fukuq.icu
fwj1vk2f.barev.icu
fwwls.press
fywuk.icu
g36sh.barev.icu
g7fyh.barev.icu
gcfl6yea.barev.icu
ginoz.icu
gubuj.icu
gujem.press
guket.press
guqev.icu
gutom.icu
gybop.icu
gytas.icu
gywic.icu
h1rfquqa.barev.icu
hacoj.icu
hcjrvwto.barev.icu
heva1hb3.barev.icu
hiwou.barev.icu
hixya.icu
hmjpk.barev.icu
hobir.icu
hosam.icu
huquw.icu
huwaq.icu
hyjaz.icu
hylur.icu
ib7geqr4.barev.icu
ie9oc3no.barev.icu
imqfdeaj.barev.icu
is5gkf1r.barev.icu
j2y6b.barev.icu
j382q.barev.icu
j6uu.barev.icu
j7p47.barev.icu
jahoc.icu
jamaz.press
jaweh.press
jelif.top
jemyq.icu
jexem.icu
jezyq.press
jfyac.barev.icu
jhkq5w6q.barev.icu
jiduh.press
jon7rrka.barev.icu
jpaom.barev.icu
juhup.icu
juket.icu
junyk.icu
k2mr2ye5.barev.icu
kajec.icu
kasej.icu
keno1.top
kf34.barev.icu
kizav.icu
klg8.barev.icu
kolac.icu
kqwrv.press
ktqv.barev.icu
kubab.icu
kuqob.top
kural.icu
kuve.barev.icu
kv2l.barev.icu
kvh22kam.barev.icu
kyrap.icu
kyzog.icu
l29h.barev.icu
l7k847z1.barev.icu
l84ghdtl.barev.icu
lapib.icu
lemox.icu
letoq.icu
lezum.icu
lgqecaxb.barev.icu
lizyf.top
lomac.icu
lukus.icu
lupuj.icu
lurup.press
lvmkb.barev.icu
lvvjo.barev.icu
lwhkr.press
lygal.icu
lyqej.press
lysez.press
lysyz.icu
mavew.icu
mbcrylvx.barev.icu
mdrvlqmd.barev.icu
mesen.icu
mesip.press
mopoj.icu
mujan.icu
mulaq.icu
munen.icu
muvom.press
mylan.press
mypah.press
myryh.icu
mysyv.icu
n4ov2.barev.icu
nak3h.barev.icu
napef.icu
nejoc.icu
nejyd.icu
nokuv.icu
nosux.icu
novow.press
nplsjlwh.barev.icu
ns1.symad.icu
nuwof.icu
nuxul.icu
nynoj.icu
nysew.press
o4rkv4bk.barev.icu
oflta.barev.icu
olirq.barev.icu
om4xw4va.barev.icu
oq51b.barev.icu
p43p.barev.icu
p4b0.barev.icu
pafoc.icu
palid.icu
pawol.icu
pebeg.icu
pedyg.icu
pejel.icu
pepjm.press
pepuq.icu
pifos.icu
pikip.icu
pilod.icu
pivum.icu
pivyt.icu
pnkvip0u.barev.icu
pocof.icu
pppfc.barev.icu
ppssl.press
pufoq.icu
pybal.icu
pypim.icu
q7m5.barev.icu
q8igcta1.barev.icu
qegyx.press
qevub.icu
qg0u3izv.barev.icu
qicon.icu
qisoz.icu
qngud.barev.icu
qolun.icu
qonit.icu
qowot.icu
qpmuq.barev.icu
qrczb.press
qutyd.icu
quzem.press
qypib.icu
qyver.icu
qyzoz.press
r1p3.barev.icu
r1v6.barev.icu
r2th.barev.icu
revuq.icu
rlvwc.barev.icu
rmbsr8vn.barev.icu
rocyg.icu
rozox.icu
rulix.icu
rutaw.icu
rxpqz.barev.icu
s1k6n.barev.icu
s3pv.barev.icu
saguf.icu
sajov.icu
sefeqevp.barev.icu
sesaf.icu
sfew.barev.icu
sifum.icu
sinyx.icu
sipit.icu
sipyf.icu
siuyp.barev.icu
slp9n.barev.icu
smgoccbh.barev.icu
srndp.press
symad.icu
tafoz.press
talup.icu
tazaz.icu
tepud.icu
tidag.icu
tighn.press
timov.icu
toa6.barev.icu
tolaj.press
tumyr.icu
ty9p.barev.icu
tycok.icu
tyfew.press
u1.1cher.ru
uecgs.barev.icu
uj6fphtc.barev.icu
ukbotgjb.barev.icu
uozeh.barev.icu
upwhbkpu.barev.icu
uswwa.barev.icu
usxf3ms0.barev.icu
uvb2s.barev.icu
v1czwn4h.barev.icu
v5kt.barev.icu
vaboz.icu
vadom.icu
vasih.icu
vefim.icu
vegyt.icu
voded.icu
vogos.press
volez.icu
vosyr.icu
vuces.icu
vukyp.icu
vumyr.icu
vuram.press
vynen.icu
vysub.icu
vytoz.press
vyzap.icu
w162.barev.icu
wakor.press
wetad.icu
wewum.icu
wltrr.barev.icu
wolum.icu
wrltc.press
wunep.icu
wyham.icu
wykvn.press
wysaf.icu
wyxam.icu
wyzof.icu
x44n.barev.icu
xasad.icu
xbiz.barev.icu
xeqnm.press
xi6cgl96.barev.icu
xisav.icu
xiwaj.icu
xiwuc.icu
xorhbg90.barev.icu
xufam.icu
xulap.icu
y5wk.barev.icu
y7lux.barev.icu
y7zer.barev.icu
y9m77uch.barev.icu
ya2v.barev.icu
yg89e.barev.icu
yktyp.barev.icu
yle7m45v.barev.icu
ynr012ng.barev.icu
yw7eq.barev.icu
yyuea.online
zarew.icu
zaxys.icu
zebat.icu
zevyg.icu
zezar.icu
zho629fj.barev.icu
zifnk.press
zuxar.press
zvtc.barev.icu

# Reference: https://x.com/JAMESWT_WT/status/1913828664027869377

partlet-id739847.com
booking.partlet-id739847.com

# Reference: https://darkatlas.io/blog/delivering-trojans-via-clickfix-captcha
# Reference: https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=043c2826360#tab=host_pairs (# 2025-04-20)

admin-booking-login.cfd
authentifycheck.com
booking-guset.help
booking-verification.help
bookingguesthelp.cfd
bookinghelpguestr.cfd
bookinglooking.cfd
bookisnd.it.com
booklngsecurity.com
bookpart1.com
bookpartn.com
bookskkas.xyz
captcha-cf.com
cf-captcha.com
cfcaptcha.com
cfcaptchas.com
cfcloudcaptcha.com
cl0udflare-verif-7645723.com
cloud.zispp.org
coffeepointperu.com
computonline.xyz
dignow.org
dlcrypt.net
fhdfgsdfdsfsd.cfd
fhfhjfhjfhejejrre.cfd
globaltalent.icu
kap.magicitbd.com
kmspico.1fin.uz
lllyoutube.com
mail.captcha-cf.com
mail.cfcaptcha.com
mail.janchowk.com
makeitwork.pages.dev
rambox.org
rmsattendvisitor.world
roomsattende99918.world
roomsverif99824.world
royaltrucklog.com
scrollcoin.org
socialchameleon.info
talentdock.world
talentstack.icu
verefication3123.world
viperrat.pages.dev
youtube-watch-vwt16hzkwhdy.com
youtude.net
cloudflare.eclassexperts.com

# Reference: https://threatfox.abuse.ch/browse/tag/FakeCaptcha/ (# 2025-04-20)

2ndfoundation.events.65-109-38-81.cprapid.com
abstract.claims
accountsecurity.email
adb-technique.com
adpservice.org
aemrt.live
airbnb.927484.cfd
alphaplumbingfw.com
alphaprmlanding.pages.dev
analytido.com
anerolki.com
anerolki.info
anerolki.org
app.evaluanom035.com
appeal.wiki
april-boking-recapt09993748.com
autoconfig.buyli.in
autodiscover.goregasm23.com
autodiscover.yanci.in
bckermeme.claims
berachain.support
bilaxy-exchange-login.com
boseyblox.pages.dev
bretux.com
broadsage.com
broadsage.net
broadsage.org
bvtechvn.com
byjs.live
captcha-re.direct
captcha.bz
captcha214.pages.dev
centerforregionalconnectivityanddevelopment.com
ceresenvironmental.com
cganet.com
chasegiveaway.site
chubbfs.com
claim-pamp.fun
claim.chloeonsol.world
claim.use-tapestry.world
claim.use-tapestrys.world
claim.usetapestry.world
clearheight.com
cloudflare.getsoftware.us
comolube.com
compliteguestid2.com
compliteguestid3.com
confirmbooking7.com
confirmm2.com
cpanel.buyli.in
cpanel.crixos.com
cpanel.free3dmaxmodel.com
cpanel.gaskks88amp.pro
cpanel.winstar365.in
cpcontacts.queticollc.com
cpcontacts.winstar365.in
crimson-sun-3ac5.foxiproxi.workers.dev
csgoempire.market
dacsi.cl
daoeidk.com
daoeidk.info
daoeidk.org
deepseekcaptcha.top
deturistaenjapon.com
dexscreener.moonshottrending.com
dextool.xyz
digi-captcha.hfl388066.workers.dev
digifilestorage.com
dopeonsolana.info
dunaluxablak.hu
e.elvax.live
ebaysolutions.com
education009.pages.dev
educational008.pages.dev
elvax.live
embabirealestate.com
enuff.live
expressgourmande.com
facebook.varifie.com
fb.com100112032113.link
folherc.com
folherc.info
folherc.org
fourthecuck.net
freshtubs.com
gate-io-desktop.com
ghibli-fi.com
ghibli-fi.org
gmgn-aitradingbot.com
goclouder.net
gocloudes.com
googlesupport.info
groundonemn.com
guardflare.org
heyues.live
hr-migros.pages.dev
hypixelhelp.com
iconichomestudios.com
id-ionos-de-webmail-appsuite-id5010.blogspot.com
id-ionos-de-webmail-appsuite.blogspot.com
id-ionos-de-webmail-id4039.blogspot.com
id-ionos-de-webmail-konto-system.blogspot.com
id-ionos-de-webmail-konto-updates.blogspot.com
id-ionos-de-webmail-kunden-system.blogspot.com
id-ionos-de-webmail-login.blogspot.com
id-ionos-de-webmail-system.blogspot.com
imhuman-97421521.world
ipsi.live
j00.lol
jehvkc.com
jehvkc.info
jehvkc.org
jlolaw.com
joinspencerstuart.us
jupuary.claims.65-109-38-81.cprapid.com
k.veuwb.live
kick.fo
kick.moi
kick.ngo
kick.ong
kick.us.com
kicklive.cc
kicklive.tv
klck.it.com
komi.cam
komo.lc
ladoicese.org
legderlive-desktop.org
linktree.bz
linktree.ec
linktree.si
login-safelink.com
lomerhs.com
lomerhs.info
lomerhs.org
mail.kakakslot88winamp.com
market.csgo-recovery.icu
masterspace.design
mein-gutschein.online
mspexteriors.com
netluc.live
njolekaz.com
njolekaz.info
njolekaz.org
o.coccos.live
onlyfans.bh
onlyfans.pe
onlyfans.so
pdfview.net
pokernet.dk
portaal.com.my
precorelampago.store
prihodafabricduct.com
prometheuspantheon.com
protectedsound.digital
pub-30caf6f8f73a40888d1e31d2ce495d94.r2.dev
pub-52a9867addd74f149bdde47139ba41ee.r2.dev
pub-8b65b4d5d27642419264ab33c38db17f.r2.dev
pub-a5d7fdd3aa9b494b88125ff1cef2effc.r2.dev
pub-bd53f9ae91ea4e9aa37d6a305c2fe7b7.r2.dev
quicklinks-online.com
r.enuff.live
r.netluc.live
raquelassessoriaasaibr.wallettrust.associates
recaptcha-phish.pages.dev
recaptcha.dpk-its-cl03.agoracalyce.net
remc.climate-connect.com
rolimonss.com
roomnum-998388.world
roomsvisitor999837.world
rtcs.live
rwsfixadores.com.br
saba.royalreturns.org
santa-todd.pages.dev
scollonllc.org
seafoundation.claims
security.claufgaurd.com
security.clodufgard.com
security.clodufshield.com
security.colkudflare.com
security.flaiegaurd.com
seedifly.fund
sharecloudes.com
shared.anteus.com
sofit-connect.org
solana-trending.com
studioupforma.com
svetvip.ru
symbitoic.foundation
talktalky.com
teamt.com
townofwayneok.org
tradearrabia.net
tradesync.dev
twitch.care
twitch.ist
twitch.miami
twitch.wales
twitch.ws
twitter.sh
twltter.dev
ubiosut.com
ubiosut.info
ubiosut.org
unazer.com
unazer.info
unazer.org
utils-cz97.onrender.com
vaultcord.net
veuwb.live
virtunforge.com
wallettrust.associates
webmail.buyli.in
webmail.goregasm23.com
webmail.kakakslot88ampcuan.org
webmail.yanci.in
wetransfer.game-net.site
whitefireexperience.com
win-shops-sh.com
wowi.live
xoebty.com
xoebty.info
xoebty.org
ytdownload.resources.ink

# Reference: https://x.com/JAMESWT_WT/status/1914735784395002323

booking-refguestitem-09064111.com

# Reference: https://x.com/NullPwner/status/1915082128364020085

ifkurmotherharder.cyou
ifkursisterhard.com

# Reference: https://x.com/NullPwner/status/1915467035037061578

http://3.15.137.25
3.15.137.25:443

# Reference: https://x.com/JAMESWT_WT/status/1915094944571703781

booking-visitorviewdetails-64464043.com

# Reference: https://x.com/ValidinLLC/status/1915790705080905793
# Reference: https://app.validin.com/detail?find=6018807017afead14417566f975ffdb4&type=hash&ref_id=0a9f296045d#tab=host_pairs (# 2025-04-25)

bokcenpage.com
bokpagehelp.com
bokparthub.com
bookfindreserve.click
booking-pre-approved-34j4j2l5n6.6543999.xyz
booking-pre-approved-3j56m43k34.67532345.xyz
booking-pre-approved-93n832mm32.2486953.xyz
booking-pre-approved.b581992.live
booking-pre-approved.d659190.live
booking-pre-approved.h871921.space
bookingpromocoes.com
bookinterpagecen.com
bookmanageview.click
bookreviewreserve.click
bookviewreserves.click
bookviewsreserve.click
bulkngcaptinfo.com
confirmation-id6618.com
klickcheker.click
pginforclliet.com
roomapartmentchek.com
roomcheck-id58.com
stresspreventie-twente.nl

# Reference: https://x.com/SI_FalconTeam/status/1915790818037698870

gutenortherad.click
koonenmagaziner.click
clients.contology.com

# Reference: https://x.com/OwnerProcessID_/status/1915855368044913021
# Reference: https://x.com/OwnerProcessID_/status/1917558834761195782

autoatendimento-apj-acesso.online
autoatendimento-apj-acesso.site
download-caixa-plugin.com
juridica-autoatendimento-c-ai-xa.com
juridica-autoatendimento-ca-i-xa.com
juridica-autoatendimento-ca-i-xa.online
juridica-autoatendimento-loginx.com
juridica-autoatendimento-sa-n-tander.com
plugin-securycx.com

# Reference: https://threatfox.abuse.ch/browse/tag/ClearFake/ (# 2025-04-26)

000-00-000.pages.dev
abye7.icu
aguu5.icu
allergyad.com
apoa3.icu
asiu4.icu
atuu7.icu
axei3.icu
bbb1-9we.pages.dev
becel.press
betiv.fun
biwiv.press
bobab.press
bojut.press
bootstrappa.pages.dev
boped.icu
bridge.tree-sock-rain.today
buywellbuysafe.com
buzaq.icu
bybur.icu
byqaj.press
cabym.press
caprofklfkzttripwith.com
cashcontrol.pe
cedarips.com.co
cepax.icu
cesiabs.com
cesiabs.info
cesiabs.org
check.abye7.icu
check.aguu5.icu
check.apoa3.icu
check.asiu4.icu
check.atuu7.icu
check.axei3.icu
check.azaler.icu
check.becyz.icu
check.bibyn.icu
check.boruq.icu
check.bufok.icu
check.bumac.icu
check.buzaq.icu
check.bybur.icu
check.carin.icu
check.cepax.icu
check.cicyb.icu
check.cijii.icu
check.cixop.icu
check.cohor.icu
check.colaj.icu
check.comyk.icu
check.dalut.icu
check.dasoc.icu
check.didey.icu
check.ditez.icu
check.doguw.icu
check.dolav.icu
check.donau.icu
check.dovoo.icu
check.doxaf.icu
check.dubix.icu
check.etau0.icu
check.fafot.icu
check.fajez.icu
check.faneg.icu
check.femar.icu
check.fetoq.icu
check.fibit.icu
check.fohatua9.icu
check.foquh.icu
check.fyfib.icu
check.fykut.icu
check.fyvuz.icu
check.gedub.icu
check.gefeq.icu
check.geguk.icu
check.gekan.icu
check.gibal.icu
check.gicaz.icu
check.gijuz.icu
check.gimyh.icu
check.givus.icu
check.gulov.icu
check.gyqav.icu
check.gytat.icu
check.havic.icu
check.havye.icu
check.helij.icu
check.henuo.icu
check.hexyf.icu
check.higun.icu
check.hixya.icu
check.hosam.icu
check.huhop.icu
check.hulak.icu
check.huwaq.icu
check.inea3.icu
check.jebir.icu
check.jemyq.icu
check.jiceo.icu
check.jilex.icu
check.jipaf.icu
check.jipuh.icu
check.jomea.icu
check.jorah.icu
check.juket.icu
check.juxoi.icu
check.jyheq.icu
check.kabuq.icu
check.kacoz.icu
check.kakib.icu
check.kedep.icu
check.kubab.icu
check.kutyl.icu
check.kynoc.icu
check.lapib.icu
check.latan.icu
check.ledax.icu
check.letoq.icu
check.lipog.icu
check.lixir.icu
check.lomac.icu
check.luzog.icu
check.lysyz.icu
check.matur.icu
check.mepum.icu
check.momas.icu
check.mopoj.icu
check.munyw.icu
check.muqey.icu
check.mydiw.icu
check.myquk.icu
check.myrap.icu
check.myryh.icu
check.nafih.icu
check.najem.icu
check.nawym.icu
check.nikys.icu
check.nocun.icu
check.novax.icu
check.nuhiq.icu
check.pafoc.icu
check.pajyg.icu
check.pejel.icu
check.peqah.icu
check.pikip.icu
check.pipyq.icu
check.pivuf.icu
check.pivum.icu
check.pivyt.icu
check.podyz.icu
check.pufoq.icu
check.qacot.icu
check.qalyj.icu
check.qaxyn.icu
check.qemut.icu
check.qicon.icu
check.qinah.icu
check.qolun.icu
check.qozab.icu
check.qusixoy6.icu
check.qypib.icu
check.qyver.icu
check.remez.icu
check.riced.icu
check.rygog.icu
check.ryqyc.icu
check.ryqyn.icu
check.sacyd.icu
check.saguf.icu
check.sanyq.icu
check.somyq.icu
check.sosys.icu
check.telyv.icu
check.tevoh.icu
check.togez.icu
check.togis.icu
check.tozuj.icu
check.tudim.icu
check.tumyr.icu
check.tuqad.icu
check.tyzof.icu
check.ugodat.icu
check.uhaa4.icu
check.vadom.icu
check.vavoj.icu
check.vevou.icu
check.vexij.icu
check.viqon.icu
check.votao.icu
check.vumyr.icu
check.vykyv.icu
check.wafag.icu
check.wanah.icu
check.wejyj.icu
check.wewum.icu
check.wigiz.icu
check.wypyq.icu
check.xagoe.icu
check.xofof.icu
check.xojyz.icu
check.xoxig.icu
check.xuceb.icu
check.zaqob.icu
check.zarew.icu
check.zatij.icu
check.zezar.icu
check.ziwel.icu
check.zixit.icu
check.zuxod.icu
check.zywig.icu
checkuserseverdday.cloud
cicyb.icu
cijii.icu
cixop.icu
cogov.press
core.cesiabs.com
core.cesiabs.info
core.cesiabs.org
creditpronola.com
cuxer.icu
dajajkfifofjfklaiotjapp.com
dalut.icu
dizec.press
dovoo.icu
dubix.icu
dubyl.press
easingaffix.site
etau0.icu
europlant.md
fajez.icu
farav.press
fetoq.icu
ffmqitnka.pages.dev
fibit.icu
fipuq.top
fisop.press
fivel.press
fleebunga.sbs
flexingoto.cloud
fliperetro.com
fluheror.run
fmoz.pages.dev
folew.press
forfsakencoilddxga.com
fyfib.icu
fykut.icu
fyquc.icu
fyvuz.icu
gebi.dorklifedubbed.shop
gedub.icu
gefeq.icu
geguk.icu
gibal.icu
gijuz.icu
gimyh.icu
givus.icu
gthfjdk.pages.dev
gulov.icu
gusex.press
gyner.icu
gyqav.icu
habyg.press
havic.icu
havye.icu
helloworld-f1f.pages.dev
henuo.icu
hexyf.icu
hfdjb.pages.dev
higun.icu
hikig.press
huhop.icu
iakdajskdaksjdkajd.com
imperialgrup.es
inea3.icu
jebir.icu
jiceo.icu
jilex.icu
jipaf.icu
jipuh.icu
jjiiiiiiiiijjjj.pages.dev
jomea.icu
jorah.icu
joyfulaiteam.com
jrtersdfg.pages.dev
jsacces.online
jsfiles-bqq.pages.dev
jusev.press
juxoi.icu
jyheq.icu
kabuq.icu
kacoz.icu
kakib.icu
kenut.press
know-knock-who-is-here.pages.dev
kutyl.icu
kynoc.icu
latan.icu
lixir.icu
luzog.icu
m2iapparels.com
mahaba.id.203-175-9-114.cprapid.com
mantequipos.com
matur.icu
matur.press
mepum.icu
mezom.icu
mixg-u.pages.dev
momas.icu
morbulao.sbs
mubub.press
muhoj.top
muqey.icu
mydiw.icu
myquk.icu
myrap.icu
najem.icu
napiv.press
ndgadfqwywqe.pages.dev
netnet.lol
nhgfdc-ok.pages.dev
nibum.top
nn11.pages.dev
nnoq.pages.dev
nocun.icu
nuhiq.icu
ooooi1.pages.dev
ototoiititiakkfkfk.com
ototoqtklktzlk.com
pajyg.icu
pegot.icu
penev.press
peqah.icu
pipyq.icu
piver.icu
pivuf.icu
podyz.icu
pptpooalfkakktl.com
pqoqllalll.com
pridefulamaretto.digital
puqum.press
putdownpopcorn.digital
puxup.press
qacot.icu
qalyj.icu
qemut.icu
qeqek.press
qinah.icu
qozab.icu
qq51f.short.gy
remez.icu
renovateai.pages.dev
rhfvjck.pages.dev
rugyg.top
rygog.icu
ryqyc.icu
sdfikguoriqoir.cloud
security-a2k8-go.com
securityverifservice.com
serviceauthfoap.com
serviceverifcaptcho.com
serviceverifcloudv.com
serviciosinformaticos.com.co
servverifcloud.com
sharecloud.click
somyq.icu
sound-designer-v21.pages.dev
spottyscary.top
stat.bundlehulu.com
sticker-88l.pages.dev
sunlight-11.pages.dev
sylaj.top
syvuk.press
tahip.press
tasig.icu
tc.easingaffix.site
tc1.easingaffix.site
telyv.icu
tevoh.icu
thefurrybazaar.biz
togez.icu
togis.icu
tozuj.icu
tracklist22.pages.dev
tudim.icu
tycyn.press
tyzof.icu
u1.pridefulamaretto.digital
u1.putdownpopcorn.digital
u1.spottyscary.top
uhaa4.icu
vavoj.icu
vegamanagementconsulting.com
vekeq.icu
verifcloudiservice.com
vevou.icu
vexij.icu
vezof.press
votao.icu
vv-ww-vv.pages.dev
vykyv.icu
wanah.icu
wigiz.icu
windowsdnsservicereload.icu
wudav.press
wypyq.icu
xagoe.icu
xofof.icu
xojyz.icu
xoxig.icu
xuceb.icu
xuvyc.top
xxx-xx-x-xxx.pages.dev
youpteck.com
yt3cvkj43ws.pages.dev
zatoh.press
zipuk.press
ziwel.icu
zuxod.icu
zywig.icu

# Reference: https://x.com/DaveLikesMalwre/status/1916202694932316656

angrybirds.world

# Reference: https://app.validin.com/detail?find=reCAPTCHA%20Verification&type=raw#tab=host_pairs (# 2025-05-04)

247supportsolutions.com
aiolocksmithstpetersburg.com
curvygirlliz.com
facilfi.com
fancontrol.pro
fantuner.pro
haushawihakanwj-secondary.z13.web.core.windows.net
highspring.247supportsolutions.com
kashmir-maryam.com
live-wallpaper.top
nahamcon2025asdasd.pages.dev
pgaestateltd.com
rraae.cedia.edu.ec
windows-update.zip
zfbezhefbzhbdfbzdufbuzbdf.pages.dev

# Reference: https://x.com/skocherhan/status/1917177880519262223
# Reference: https://www.virustotal.com/gui/ip-address/46.19.66.121/relations
# Reference: https://app.validin.com/detail?find=b5903cdd0f6c15ebaa7891d70f1145b1&type=hash&ref_id=8609365112d#tab=host_pairs (# 2025-04-29)

adm-booking-sign.com
api-notification-centeriones.com
bookig-agreementapil042025.com
booking-agreementaprilreviews042025.com
booking-agreementstatementapril0225.com
booking-confview-doc-00097503843.com
booking-reservationsdetail-id0025911.com
booking-viewdocdetails-0975031.com
reserv-captchaapril04152025.com
test-74939captcha.world

# Reference: https://x.com/JAMESWT_WT/status/1917985199112986652
# Reference: https://app.any.run/tasks/5972a8c5-5b87-4579-9cc5-8bc268abd6c0
# Reference: https://app.any.run/tasks/d9ba419a-d1cd-4912-b114-74a8f0416c75

partner-id892374.com
partner-id897123.com
parnters-secure.com
booking.partner-id892374.com
booking.partner-id897123.com

# Reference: https://x.com/NullPwner/status/1918969367586275803

sennheiser.ad

# Reference: https://app.validin.com/detail?type=raw&find=Verify+you+are+human#tab=host_pairs

namoet.de
matrix.namoet.de

# Reference: https://threatfox.abuse.ch/browse/tag/ClearFake/ (# 2025-05-04)

app.bytevista.cloud
app2.bytevista.cloud
barbellblurry.today
bluetroniq.vip
bytevista.cloud
dasopdoaodoaoaoao.com
fodxj.press
ho8.pages.de
hywod.press
javascript-67t.pages.dev
jumstor.cloud
marinescoatsnow.click
min-js-lib.pages.dev
ms2.rybos.fun
necscar.pro
otototototoqqlfk.com
paralegalchemicals.run
pigshow.digital
relmake.pages.dev
rybos.fun
salorttactical.top
sofyf.press
spiritismprotozoan.bet
stat.bluetroniq.vip
taciq.press
tnop.pages.dev
tuboos.pages.dev
u1.barbellblurry.today
u1.paralegalchemicals.run
u1.spiritismprotozoan.bet
xelop.press
yoloff.pages.dev
yuun.pages.dev
z1z.pages.dev
zynof.press

# Reference: https://app.validin.com/detail?find=edc1d53342cfcd8bfd1f&type=hash#tab=host_pairs (# 2025-05-04)

365-blanka.com
api.sunderteck.com
biz-controllhub.com
cpeclara.com
dash.nextagc.com
hr-controllhubs.com
hr-overview.com
minder-info.com
myapd.org
online.prolinkik.com
pay-overviews.com
sunderteck.com
wp.elbordo.com.mx
wp.laestacion.org.mx

# Reference: https://threatfox.abuse.ch/browse/tag/FakeCaptcha/ (# 2025-05-04)

admin-protect.help
arcaderiift.com
attendermsvstrr.world
banki.kancelariaoxford.pl
blockinsight.net
booking.partdet-id839847.com
chaintraderx.com
cloudflare.eradigitalibl.com
cloudflareapage.pages.dev
fansly.ad
partdet-id839847.com
pumpcommunity.pages.dev
pumpfunaaexposed.pages.dev
realtorpichardo.com
scollonllc.it.com
sky-shiiyu.moe
travelersi.com
we-will.servegame.com

# Reference: https://x.com/NullPwner/status/1919113969845108972

lbkequityexchange.com

# Reference: https://x.com/NullPwner/status/1919423538525503624
# Reference: https://badbyte.io/infostealer-macos-etherhiding/

technavix.cloud

# Reference: https://app.validin.com/detail?find=Verify%20You%20Are%20Human&type=raw#tab=host_pairs (# 2025-05-06)

1win.dizytals.com
acuchillocortedejamon.com
allureodonto.com.br
armadus.app
artistikacollective.com
autcon.com.br
baycontractingltd.com.ng
blueshouse.bigbearmusic.com
calgarylisting.net
catamarcafrio.com
catamarcafrio.com.ar
cuentosquenosecomen.com
daosafeturnstile.com
dev.sirefactura.com
easiheating.co.uk
exc.105.myftpupload.com
home2travel.com
ilyasdogan.com
invtes.cryptellegram.com
joiascortantes.com
mail.yukeetrading.com
mazad.ai
meersphysiotherapy.com
member.rkfd.com
mutlulukveparakariyeri.com
neuroandmotion.com
nexusofs.com
nusantarainfo.com
ontrendingnews.com
pakpansygroup.com.pk
pointfort-fichet.com
printing.co.th
quantumchloe.com
rehydratedatessenceoflove.com
rekrutpotensi.com
shared.cryptellegram.com
shared.docuprint.com.ar
shared.protelecon.com
shared.thrilladesign.com
smartwebm.com
spoof-verification.pages.dev
strategyhub.org
tapprint.io
teinology.com
thegeekwizard.com
thekutchhcourtyard.com
tifaouineshop.com
unitednebras.com
yukeetrading.com
zonasport.com.mx

# Reference: https://x.com/NullPwner/status/1919852181454311832
# Reference: https://www.virustotal.com/gui/file/7edadd2866022eea6e41904c5c632989f9cccfbd824ee200a2d8bd29c855f074/detection
# Reference: https://www.virustotal.com/gui/file/a224a35002afb6114ea479d21c6fcaae7bf0fa94bdbcfb276b5fcdd551fb15f0/detection

overallwobbly.ru
e.overallwobbly.ru
nc1.overallwobbly.ru

# Reference: https://x.com/JAMESWT_WT/status/1919926783316558250
# Reference: https://app.validin.com/detail?find=%2Fwin&type=raw&ref_id=9009bfead23#tab=host_pairs (# 2025-05-07)
# Reference: https://app.validin.com/detail?find=2cde7f3beeeb9d3a76e5e847c3ee80c3&type=hash&ref_id=b44ace55f87#tab=host_pairs (# 2025-05-12)
# Reference: https://app.any.run/tasks/c5de5d98-26ce-40a0-be15-2b04646b6c86

apartamentverifprooo.com
getsverif.com
ggetsvverif.com
1nspiricity.com
booking-lossitresn.com
bookitemlosses.com
booklilostsupp.com
booklng-id068734.it.com
booklng-id440574.it.com
booklng-id494714.com
booklng-id534807.it.com
booklng-id564875.it.com
booklostticket.com
extanet-parter.com
extnet-parter.com
extrent-resviews.com
geustreqstcanclres.com
parnter-id28934.com
partner-reseview.com
pather-cancels.com
pathers-respons.com
property-id157434.it.com
property-id357436.it.com
property-id675431.it.com
property-id557432.it.com
property-id956430.it.com
resrvre-quests.com
rewarsdadblii.com
rewiesbadnboo.com
rewuresgooostario.com
room-i3938053.com
room-id039054.com
room-id439574.shop
room-id739053.com
room-id893905.com
rsvn-i5934053.com
rsvn-id339757.com
rsvn-id439456.com
rsvn-id739057.com
rsvn-id835055.com
secrue-id90183.com
secure-partnernet.com
secure-partnet.com
step-panel-web.live
you2mp3.live

# Reference: https://x.com/NullPwner/status/1921156379059847602
# Reference: https://app.validin.com/detail?find=Checking%20if%20you%20are%20human&type=raw&ref_id=cd88c7e98d6#tab=host_pairs (# 2025-05-10)

akurasiibl.com
apartamentverifpro.com
charleskeith.it.com
consultorwebapps.business
din.akurasiibl.com
pivqmane.com
sparkdexx.pages.dev
suportes16.consultorwebapps.business
traderai.name
urmomonchain.xyz

# Reference: https://x.com/JAMESWT_WT/status/1922185649056100727
# Reference: https://github.com/km3dg3/IOCs/blob/main/2025-05-12%20%7C%20UNK%20Stealer%20%7C%20Booking%20ClickFix
# Reference: https://www.virustotal.com/gui/file/5c02bfe719c33a92eeb98c5e871f109b9b0f47b16b37969149f7e8bf052487aa/detection

apioeaesr.icu
book-available.com

# Reference: https://x.com/JAMESWT_WT/status/1922194176327745825
# Reference: https://app.any.run/tasks/c55103b4-f32e-418e-a313-5a94a9acd8ba
# Reference: https://www.virustotal.com/gui/ip-address/109.69.62.228/relations
# Reference: https://www.virustotal.com/gui/ip-address/62.60.227.65/relations
# Reference: https://www.joesandbox.com/analysis/1688631/0/html

asdkjczxmeuw.click
bookhub-id12231.com
bookhub-id12731.com
bookhub-id13731.com
bookhub-id148731.com
bookhub-id18731.com
getsveriff.com
getsveriff.xyz
ggetsveriff.xyz
hsjafklweqmn.click
lkjzmxnqpwer.click
lksmzqwenxop.click
mznvqiweurty.click
nmasdqwpeiru.click
partnthub-id19731.com
plmzxqwieruo.click
qowuensmzxcv.click
qpeuwmxnzvka.click
qpwalskdjzmx.click
qweiozmnxvla.click
qwenmzlxktyu.click
vxmnsdkjweqz.click
wqemzxncpiou.click
xnzwoeirplad.click
xpoiwnzqlaks.click
zbqwmnzxopru.click
zcnvqpweoriu.click
zmxncvaoiwqe.click
zxvnqwejlkgh.click

# Reference: https://x.com/skocherhan/status/1922304241302999510

admextraneethub.com
badgusetfeedback.com
chaeckotherooms.com
complaintsguest.com
kfhjufg9034854.cfd
patheer-guesters.com
pathessr-opesser.com
preview-chekaer.com
reserv-confims.com
review-extrasecure.com
rewiev-id90011.com
booking.kfhjufg9034854.cfd
booking.rewiev-id90011.com
booking.admextraneethub.com
booking.review-extrasecure.com
booking.badgusetfeedback.com
booking.preview-chekaer.com
booking.pathessr-opesser.com
booking.chaeckotherooms.com
booking.patheer-guesters.com
booking.complaintsguest.com

# Reference: https://x.com/skocherhan/status/1922316933048807601

reportingreserv54458.world
reqstgustrfldg.world
rprtgustrfdroms.world
viewmsrfd992945.world

# Reference: https://x.com/SquiblydooBlog/status/1922375875548320203
# Reference: https://x.com/Unit42_Intel/status/1924866530195427372
# Reference: https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2025-05-16-IOCs-on-recent-ClickFix-activity.txt
# Reference: https://www.virustotal.com/gui/file/94479572d99e07c50d39c46c8a96843e1c8ae80ce126ae3ba4c4fd223e3d731a/detection

atri.live
bjeb.live
cqsf.live
dlux.live
ekoz.live
rekx.live
thob.live
b.ekoz.live
m.bjeb.live

# Reference: https://x.com/JAMESWT_WT/status/1923634721566728326
# Reference: https://app.any.run/tasks/beeeceb6-4c62-4145-adbd-9b1307458441
# Reference: https://app.any.run/tasks/19dfa081-6b42-4cf7-879c-da1d50f40860

annageda.ru
booklostik.com
gettsveriff.com
gtsveriff.xyz
guestreviewes.com
hkfasfsafg.click
lbnte.com

# Reference: https://app.validin.com/detail?find=%2Fwin&type=raw&ref_id=95f00a4c680#tab=host_pairs (# 2025-05-18)
# Reference: https://app.validin.com/detail?find=edc1a0d79bb40ab8ba8c&type=hash&ref_id=dcb429bca05#tab=host_pairs (# 2025-05-18)

admingusestraprefers.com
allin99max.co
badreviewes.com
book-reservation3498.com
bookhotel-id898435.com
bookilostess.com
bookinlosesitemr.com
cheakrewies.com
checkrewiesgusta.com
connect-hub.world
evllo.com
evllo.icu
extrasnetgstrhtmil.com
guest-badreviewes.com
helpguestrevies.com
hotelaccountad.com
oneviivo.com
payhexx.com
prewiev-ide564301.com
recomplientotherhotel.com
resolve-lostproperty.com
rewardesbook.com
rewiesbadbood.com
rewiesidenficar.org
rewiewe-cheksdin.com
rewiewsforhotelportal.com
slavaukraini.pages.dev
smoovision.com
booking.admingusestraprefers.com
booking.checkrewiesgusta.com
booking.connect-hub.world
booking.extrasnetgstrhtmil.com
booking.helpguestrevies.com
booking.hotelaccountad.com
booking.prewiev-ide564301.com
booking.recomplientotherhotel.com
booking.resolve-lostproperty.com
booking.rewiesidenficar.org
booking.rewiewe-cheksdin.com
booking.rewiewsforhotelportal.com
slavaukraini.pages.dev
suw.staging.mediavita.co.uk

# Reference: https://x.com/BlinkzSec/status/1924665165863084282
# Reference: https://urlquery.net/report/fe5ec15e-e7ce-43ba-8312-8fb0977f856f

circlejobs.page.link
pub-5f0c5bf2b4ca48d6bc6e75876a259889.r2.dev

# Reference: https://x.com/JAMESWT_WT/status/1924724266597052580
# Reference: https://www.virustotal.com/gui/ip-address/89.110.93.160/relations

aaso12.duckdns.org
aasso12.duckdns.org
beeno.online
capchacklickbot.com
citrixdl.com
citrixget.com
ckickbotupd.com
coinbasexpromotion.com
confirm-id10.click
demo.beeno.online
dfjkhdsljkfhsd.com
logistica10.grupotecnomax.com
paygovision.icu
rblx.sale

# Reference: https://x.com/skocherhan/status/1924758355777646621
# Reference: https://www.virustotal.com/gui/ip-address/92.53.90.165/relations

apartamentverifproo.com
apartamentverifprooof.com
capchapartamentt.com
confirm-id1.click
confirm-id2.click
confirm-id3.click
confirm-id4.click
confirm-id5.click
confirm-id6.click
confirm-id7.click
confirm-id8.click
confirm-id9.click
confirmid8.click

# Reference: https://app.validin.com/lookalikes?limit=1000&lookback=90&depth=2&find=%2F%5Ebook%5Ba-z%5D%2B-id%5B0-9%5D%2B.com%24%2F (# 2025-05-21)

booking-id01.com
booking-id1384.com
booking-id1784.com
booking-id1984.com
booking-id2232.com
booking-id234.com
booking-id293.com
booking-id3084.com
booking-id3192491.com
booking-id33.com
booking-id3334.com
booking-id3344.com
booking-id335.com
booking-id3384.com
booking-id3584.com
booking-id4084.com
booking-id4584.com
booking-id46391.com
booking-id475.com
booking-id4814.com
booking-id4984.com
booking-id53281.com
booking-id5489.com
booking-id5784.com
booking-id673.com
booking-id7842.com
booking-id8281.com
booking-id8288.com
booking-id8293.com
booking-id845.com
booking-id8478.com
booking-id852.com
booking-id87812.com
booking-id882.com
booking-id8918.com
booking-id8931.com
booking-id9284.com
booking-id9348.com
booking-id9483.com
booking-id9486.com
booking-id9784.com

# Reference: https://app.validin.com/lookalikes?limit=1000&lookback=90&depth=2&find=%2F%5Econfirm%5Ba-z%5D%2B-id%5B0-9%5D%2B.com%24%2F (# 2025-05-21)

confirmation-id01573.com
confirmation-id0445045539.com
confirmation-id04824.com
confirmation-id0515.com
confirmation-id1219.com
confirmation-id1231837.com
confirmation-id123573263.com
confirmation-id12389.com
confirmation-id123897.com
confirmation-id1243613.com
confirmation-id1265198.com
confirmation-id12754.com
confirmation-id13568.com
confirmation-id1437340.com
confirmation-id17289.com
confirmation-id1749.com
confirmation-id17809.com
confirmation-id178716.com
confirmation-id1843.com
confirmation-id190238.com
confirmation-id2137.com
confirmation-id215712643.com
confirmation-id2159.com
confirmation-id2167.com
confirmation-id2178.com
confirmation-id2179.com
confirmation-id2342473427.com
confirmation-id23476.com
confirmation-id24555167.com
confirmation-id2519.com
confirmation-id25879.com
confirmation-id2719.com
confirmation-id2748.com
confirmation-id2759.com
confirmation-id2789.com
confirmation-id2798.com
confirmation-id2843.com
confirmation-id28590.com
confirmation-id30541.com
confirmation-id3319.com
confirmation-id3342.com
confirmation-id3358.com
confirmation-id3419.com
confirmation-id34297.com
confirmation-id34549.com
confirmation-id345569.com
confirmation-id345795.com
confirmation-id348.com
confirmation-id3483.com
confirmation-id34897.com
confirmation-id3681.com
confirmation-id3938.com
confirmation-id3940.com
confirmation-id4037.com
confirmation-id4219.com
confirmation-id4235.com
confirmation-id4285.com
confirmation-id43258.com
confirmation-id4493.com
confirmation-id4538.com
confirmation-id45437.com
confirmation-id4568.com
confirmation-id457.com
confirmation-id45768.com
confirmation-id45916.com
confirmation-id4637.com
confirmation-id473828.com
confirmation-id4828.com
confirmation-id4863.com
confirmation-id4881.com
confirmation-id4909.com
confirmation-id4993.com
confirmation-id5231.com
confirmation-id52342623623.com
confirmation-id5235.com
confirmation-id5236237.com
confirmation-id5238235.com
confirmation-id53457895.com
confirmation-id534578956.com
confirmation-id5345899.com
confirmation-id534895.com
confirmation-id538142.com
confirmation-id538145.com
confirmation-id5384685.com
confirmation-id538937.com
confirmation-id539345.com
confirmation-id539845.com
confirmation-id539895.com
confirmation-id5432.com
confirmation-id5463626166.com
confirmation-id5473226.com
confirmation-id5672.com
confirmation-id5821.com
confirmation-id61251.com
confirmation-id61256.com
confirmation-id61286.com
confirmation-id613672.com
confirmation-id61426346.com
confirmation-id6199.com
confirmation-id62342623.com
confirmation-id6234643734.com
confirmation-id6235.com
confirmation-id6235236.com
confirmation-id623571733.com
confirmation-id6344.com
confirmation-id63453721.com
confirmation-id634885.com
confirmation-id634895.com
confirmation-id635895.com
confirmation-id6386.com
confirmation-id6426333326.com
confirmation-id64433.com
confirmation-id64552267.com
confirmation-id6456458.com
confirmation-id6457.com
confirmation-id6521.com
confirmation-id65262663341.com
confirmation-id65521.com
confirmation-id6610.com
confirmation-id66235233.com
confirmation-id6711.com
confirmation-id67123.com
confirmation-id67193.com
confirmation-id672346163.com
confirmation-id6859838.com
confirmation-id68741.com
confirmation-id719171.com
confirmation-id7282.com
confirmation-id732362336.com
confirmation-id745345.com
confirmation-id7523647234.com
confirmation-id75237236.com
confirmation-id7524.com
confirmation-id7542.com
confirmation-id7543.com
confirmation-id7544.com
confirmation-id7545.com
confirmation-id7546.com
confirmation-id7547.com
confirmation-id7548.com
confirmation-id7549.com
confirmation-id7550.com
confirmation-id7551.com
confirmation-id7582.com
confirmation-id762631.com
confirmation-id76814.com
confirmation-id7816.com
confirmation-id7852.com
confirmation-id7853564.com
confirmation-id78991.com
confirmation-id7982.com
confirmation-id8082.com
confirmation-id82345742.com
confirmation-id825.com
confirmation-id8294.com
confirmation-id83518.com
confirmation-id83974.com
confirmation-id8421.com
confirmation-id8423.com
confirmation-id842526.com
confirmation-id8523.com
confirmation-id8631.com
confirmation-id8634538.com
confirmation-id8645.com
confirmation-id8672.com
confirmation-id8736.com
confirmation-id88237.com
confirmation-id888456424.com
confirmation-id889424.com
confirmation-id891722.com
confirmation-id891723.com
confirmation-id891742.com
confirmation-id89237.com
confirmation-id892734.com
confirmation-id897234.com
confirmation-id89724.com
confirmation-id8982.com
confirmation-id8983.com
confirmation-id90153.com
confirmation-id901823.com
confirmation-id9056423.com
confirmation-id91233.com
confirmation-id928133.com
confirmation-id92834.com
confirmation-id93013.com
confirmation-id937281.com
confirmation-id9376681.com
confirmation-id93778.com
confirmation-id9384025.com
confirmation-id946244163.com
confirmation-id9482.com
confirmation-id9631.com
confirmation-id9741.com
confirmation-id981237.com
confirmation-id981721.com
confirmation-id9827.com
confirmation-id982734.com
confirmation-id98374.com
confirmation-id9887363474.com
confirmation-id9971.com
confirmations-id47877182.com

# Reference: https://app.validin.com/lookalikes?limit=1000&lookback=90&depth=2&find=%2F%5Econfirm%2B-id%5B0-9%5D%2B.%5Ba-z%5D%7B3%2C%7D%24%2F (# 2025-05-21)

confirm-id04992.sbs
confirm-id12678.com
confirm-id17221.quest
confirm-id4132.quest
confirm-id4653.com
confirm-id4792.com
confirm-id6149.com
confirm-id7210.quest
confirm-id7594.com
confirm-id9594.com
confirm-id959493827.com

# Reference: https://app.validin.com/detail?find=Verify%20Your%20Request&type=raw#tab=host_pairs (# 2025-05-23)

apidnschangerdmnd.com
brightbitebox.com
brightbytesite.com
buildfromstar.com
building-and-forum.com
destoripsforicos.com
destormestor.com
destroiporland.com
domain-from-home.com
everygooodnews.com
formxinvestor.com
formxinvestors.com
forum-and-building.com
forum-from-hero.com
gestordeconfort.com
greenpulsebase.com
greenpulseland.com
healthboostspot.com
home-and-forum.com
homebuildstars.com
homeregisterediclude.com
homestarbuild.com
icludehomeregistered.com
icluderegisteredhome.com
isthecapital.com
lamejoropcionn.com
morebitro.com
mxbankerspro.com
mxbankpro.com
mxoilinvest.com
oxygenisempty.com
payment-verify.com
portalinorapair.com
proprtrmsvstr.world
registeredhomeiclude.com
registeredicludehome.com
romanbankro.com
rombankro.com
rominvesi.com
rominvestitor.com
somparlaned.com
termorina.com
verif-proccess.com
verification-proccess.com
verilication-proccess.com
verlfication-process.com
voidinsoul.com
voidtheboxs.com

# Reference: https://app.validin.com/detail?find=Verify%20You%20Are%20Human&type=raw#tab=host_pairs (# 2025-05-23)

143242.xyz
bestwoork.pages.dev
goopit100000000000.pages.dev
howtotellyourchild.com
rotallution.com
successchaserstars.com

# Reference: https://app.validin.com/detail?find=reCAPTCHA%20Verification&type=raw#tab=host_pairs (# 2025-5-23)

aiolocksmithclearwater.com
btecperu.com
chicagosgreentrappers.com
inmobiliariagrupogemar.com
linoszczel.com.pl
new-fazewith.pro
removebeesnow.com
removerodentsnow.com
rodentcontrolchicago.com
savvybracket.com
sklep-paren.pl
socialmatterz.com
solara-support.github.io
southfloridarodentcontrol.com
sparklifegh.org
tobu.ee
uvcdc.com
villascostabrava.club
wallstolife.com

# Reference: https://x.com/JAMESWT_WT/status/1926128492334268483
# Reference: https://x.com/skocherhan/status/1927978955652616210
# Reference: https://app.validin.com/detail?find=63c848e2f8f2ea28ad48861ddcc9c7e9&type=hash&ref_id=5747996fb16#tab=host_pairs (# 2025-05-24)

bamerokisa.top
bkngrvff.com
bkngrvffy.com
bkngvff.com
getsybkng.com
getsyv.com
gettrys.com

# Reference: https://x.com/skocherhan/status/1926229346194215061

tradingvievvprime.com
tradingviewprime.com

# Reference: https://x.com/skocherhan/status/1928870627944874416

sdfwer234.com

# Reference: https://x.com/MalasadaTech/status/1926471487403294805

toxintaxation.com
nsbalert.weebly.com

# Reference: https://x.com/skocherhan/status/1926717825143443718

airdropclaiming.lol
bullxtrade.lol
globalminute.xyz
t-axiom.trade

# Reference: https://app.validin.com/detail?find=reCAPTCHA%20Verification&type=raw#tab=host_pairs (# 2025-05-26)

bullpas.ru
captcha.zip
not-malware.zip
prodcount.life
9o7fiy.bullpas.ru
g43e0x.bullpas.ru
g43og.bullpas.ru

# Reference: https://app.validin.com/detail?find=Verify%20You%20Are%20Human&type=raw#tab=host_pairs (# 2025-05-26)

flipdish.workers.dev
hcaptcha-verification.flipdish.workers.dev

# Reference: https://www.virustotal.com/gui/ip-address/144.172.93.112/relations

doc.masplenedigitalworld.com
doc.northamericanlockandsafe.com
docs.cryptellegram.com
docs.desaindigital.com
docs.morlockaerospace.com
docs.scmdatasolution.com
docs.yourdigitaldoc.com
emails.sortadrunk.org
invites.cryptellegram.com
invites.desaindigital.com
invites.digitalmediac.com
invites.yourdigitaldoc.com
invtes.cryptellegram.com
member.rkfd.com
opt.aweejobby.com
project.yourdigitaldoc.com
projectsview.yourdigitaldoc.com
r.serverpit.com
register.biljobs.com
secureinvites.unids.com
share.ionexusa.com
share.lczipper.com
share.yourdigitaldoc.com
shared.anteus.com
shared.araccius.com
shared.cryptellegram.com
shared.docuprint.com.ar
shared.protelecon.com
shared.signalhut.com
shared.teamradicus.com
shared.thrilladesign.com
shared.yourdigitaldoc.com
shares.cryptellegram.com
shares.yourdigitaldoc.com
signed.anteus.com
signed.araccius.com
signed.desaindigital.com
web.unids.com

# Reference: https://app.validin.com/detail?find=Verify%20Your%20Request&type=raw#tab=host_pairs (# 2025-05-26)

tetraflowarmdo.com
verific-processing.com
viriffic-processing.com

# Reference: https://app.validin.com/detail?find=%2Fsign-in%3Fop_token%3DzXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI&type=raw&ref_id=d55b617ed02#tab=host_pairs (# 2025-05-26)

admin-guestinfo.com
adminnetpreferens.com
anothereguesteinfos.com
badreviewothrs.com
badreviewsguests.com
badrewiesguest.com
badrewiesroos.com
badrewievgustario.com
badsrewiesgusta.com
badsrwiewgusta.com
boxesaruisgusta.com
boxiesreservguste.com
chaeckotherrooms.com
cheackgusrefrewiews.com
cheackreservhuse.com
checkin-guest.com
checkout-guest.com
chekedpartrewiwes.com
chekguesidportals.com
chngthemairaum.com
clientagusta.com
clientportalinfos.com
complaingustase.com
compleintrewiesgustar.org
complientogustario.org
contrlpanelsrwiev.com
datess-domeod.com
exnetgusteview.com
exnnetpirtalbook.com
exstranetuptadss.com
exteentpartner.com
externet-secure.com
extnothers.com
extrainetpropertu.com
extraneit-correct.com
extranemt-heosting.com
extranentselectin.com
extranetguests.com
extrannetshtumllabl.com
extrasnethtnmlu.com
extrntreview.com
gesstparnetportal.com
geuesteresrew.com
guesstersearch.com
guest-rentals.com
guest-stolen.com
guest-view-pat.com
guestadminportal.com
guestdocfound.com
guestereserfromhottel.com
guestitemsfound.com
guestitemsreview.com
guestquesionrewiews.com
guestreport-issue.com
guestrufrescort.com
guests-reservid.com
guesttpornarportal.com
guesytrewiewsited.com
gusbookingparter.com
gusreservaspartner.com
gusreservcme.com
gusreservsshoteel.com
gusteview.com
gustpartnersview.com
gyestrewies.com
haosesrewiewsdcast.com
helps-review.com
hm40euxk89.sucure-partners.com
home-checkin.com
hotelesreserveres.com
hoteltokenpreviev.com
huaregustario.com
id28293mas.com
ip-comfirm.com
itemguestsid.com
items-stolen.com
itemsfoundguest.com
negatory-rvviewsguest.com
otherguesrewievcheack.com
othersconfirms.com
othersguestesrewiews.com
othersreviews.com
pantherguetsalabels.com
parthelabeladm.com
parther-booknowid.com
parther-hubrewiews.com
partherspreferns.com
partner-guste.com
partnerrviews.com
partners-id32165.com
partners-id739847.com
partners-id89231.com
parttet-id6739847.com
parttner-othersad.com
patheres-infosa.com
pathersvisithub.com
pathesrtokkens.com
pathqerunknowns.com
portalrewiesguste.com
portaulguestexnet.com
portegustpartner.com
portexnetpartner.com
portnereservafromguest.com
preview-exttranet.com
prewiewacount.com
questionable-rviews.com
recentbedrewievs.com
reciestbadrewiewsother.com
rentals-home.com
requestrewies.com
reqweinguesatr.com
reservation-44827791.com
reservation-47389582.com
reservroomextnet.com
reservroomsgues.com
resewen-ceksenin.com
respond-rewiew.com
resrv-id89149.com
resvrv-udates.com
reviewcomenntsiite.com
reviewnowsiteadd.com
reviewpreferensid3234.com
revisws-badsrwievgusti.com
rewarsrewies.com
rewatchingaccnt.com
rewiepartnergusts.com
rewies-gustario.com
rewiesbadrate.com
rewiesbookpartner.com
rewiesbuks.com
rewiesgusteexn.com
rewiesretilate.com
rewiewcomplainothergust.com
rewiewe-optokens.com
rewiewfortalpartner.com
rewiewguescompls.com
rewiewguestextrnt.com
rewiewsguestforhouse.com
rewiewsohrbadhot.com
rewiwenewupdte.com
rewscomunicationgusty.com
riskguestfeedback.com
rserv-id98972.com
rsrvid-984235.com
rwiewotherportal.com
scure-partnernet.com
secure-externet.com
secure-extranets.com
secure-extrent.com
sucure-partners.com
testworddsddsd.cfd
unsatisfied-guest.com
updats-extranet.com
upedate-canclled.com
urgent-lostitems.com
vieews-reseesrvationis.com
viewothergust.com
weakergleang.com
booking.badrewievgustario.com
booking.badsrewiesgusta.com
booking.boxesaruisgusta.com
booking.clientagusta.com
booking.compleintrewiesgustar.org
booking.exteentpartner.com
booking.guest-stolen.com
booking.guestdocfound.com
booking.guestitemsfound.com
booking.guestitemsreview.com
booking.guestquesionrewiews.com
booking.guestreport-issue.com
booking.guests-reservid.com
booking.id28293mas.com
booking.itemguestsid.com
booking.pantherguetsalabels.com
booking.pathersvisithub.com
booking.portegustpartner.com
booking.respond-rewiew.com
booking.rewiewsguestforhouse.com
booking.rewscomunicationgusty.com
booking.rwiewotherportal.com
booking.testworddsddsd.cfd
booking.unsatisfied-guest.com
booking.upedate-canclled.com
i0ikaelies.sucure-partners.com
mfskbdak5w.gesstparnetportal.com
vxxrwj0leq.complaingustase.com

# Reference: https://x.com/JAMESWT_WT/status/1927975973179265369

extranet-listing.com
booking.extranet-listing.com

# Reference: https://www.trellix.com/blogs/research/cfo-spear-phishing-netbird-attack/

cloud-ed980.firebaseapp.com
googl-6c11f.firebaseapp.com
onlineview-5e3cf.web.app
web-16fe.app

# Reference: https://x.com/JAMESWT_WT/status/1928140983318769836
# Reference: https://app.validin.com/detail?find=c0ca17c6487f6d0b5b27d0965745b496&type=hash&ref_id=3c1e8cb878c#tab=host_pairs (# 2025-05-29)

aagolden.icu
apiklrdgd.icu
apioeks.icu
apioeser.icu
apioetdr.icu
apioofse.icu
apiyurtrr.icu
admin-booking-captcha.com
extranet-adminbooking.com

# Referecne: https://x.com/skocherhan/status/1928155425054286044
# Reference: https://www.virustotal.com/gui/ip-address/193.233.127.131/relations

activestay.world
admin-bookingcomplaintguestid61423.com
admin-bookingid5421623.com
admin-bookingid6421623.com
adminbookingid62342723.com
apiaesae.icu
apiklrdgd.icu
apioeaesr.icu
apioeslr.icu
apioofse.icu
attenvisitroom.world
bkroomingsrvcs.world
book-available.com
book-view-reserve.com
booking.hotel-review-guest41882.com
bookng-supportdesk.com
checkbkinghelp.world
guest-reviews-id73991.com
guests-review-id783661.com
recaptcha-pass-info.com
reservation-id4464234.com
reservationid341264737.com
reservationid441264737.com
reservationid541264737.com
reservationsfailed-id34361264.com
reservationsfailed-id44361264.com
reservationsfailed-id54361264.com
reservationsfailed-id64361264.com
reservhub.world
resvisitshub.world
review-guests-id32031.com
review-hotel-id15492.com
review-visitor-id56391.com
reviews-guest-id661723.com
reviews-visitant-id34112.com
x-booking-verification.com

# Reference: https://app.validin.com/detail?find=a74e030ac377778fee184a91df439d9d&type=hash&ref_id=b35110cd44a#tab=host_pairs (# 2025-05-29)

admin-bookingid4421623.com
admin-helpdesk-robot.com
admin-robot-property.com
aioporsts.icu
apioekjsem.icu
apiooeris.icu
attendbokngres.world
book-no-robot.blog
booking-customer-helpdesk.com
complaintguest32342.com
complaintguestid12452.com
complaintsguest562423.com
complaintsguest562424.com
complaintsguest62152.com
complaintsguest64123.com
complaintsguestid73246.com
complaintsguestid999871.com
extranet-no-bot.cloud
helpdesk-booking.com
hotel-review-guest41882.com
recaptcha-passinfo.com
reservationguestid62356.com
reservationid641264737.com
review-guest-id87130.com
stayattends.world
visitorstays.world

# Reference: https://x.com/JAMESWT_WT/status/1928306522880160045

paid-confirmations.com
property-paids.com
booking.property-paids.com
booking.paid-confirmations.com

# Reference: https://app.validin.com/lookalikes?limit=1000&lookback=90&depth=2&find=%2F%5Ea%5Ba-z%5D%7B7%7D%5C.icu%2F (# 2025-05-30)

aaaaavip.icu
aambawhe.icu
aasdexdf.icu
aaucqjhe.icu
abcdcore.icu
abcdmail.icu
abdallah.icu
abdullox.icu
abjgytdf.icu
acecarro.icu
acesslab.icu
acestock.icu
acmarket.icu
acplogin.icu
acuenlud.icu
adclickz.icu
addresss.icu
addszxxz.icu
adiecome.icu
adjpwpja.icu
admadmin.icu
admnsien.icu
admyvify.icu
adreedom.icu
adtactic.icu
adtarget.icu
adtrackr.icu
adtrends.icu
aefiwxuh.icu
aenbqkgo.icu
aesculus.icu
afcakatt.icu
affcakat.icu
afgzmhnn.icu
afithome.icu
afjfjjjk.icu
agentify.icu
agkndmwk.icu
agknzxew.icu
aglverse.icu
agreetok.icu
agyrtkhm.icu
ahcvhdjh.icu
ahcxnfhh.icu
ahihildy.icu
ahmzllfg.icu
aiastock.icu
aichenga.icu
aichengq.icu
aifengan.icu
aigueksg.icu
aiirdrop.icu
aikaexzu.icu
aimanage.icu
aindubai.icu
airlostg.icu
airtelsd.icu
airtelvb.icu
airtelza.icu
aisearch.icu
aisfpvqw.icu
aisports.icu
aistudio.icu
aitvpian.icu
ajhdyjfe.icu
ajzjscwm.icu
akinafan.icu
akppbtuj.icu
akrlgtst.icu
akshatam.icu
aktarmin.icu
akupeace.icu
akvjdlxs.icu
alcstore.icu
alebilet.icu
alexking.icu
alfheimr.icu
aliiraza.icu
alipayic.icu
alipayyi.icu
alirdrop.icu
alitrole.icu
aliyunla.icu
allizweb.icu
allototo.icu
alsakhra.icu
altincas.icu
altinlot.icu
altverse.icu
alysston.icu
amazonae.icu
amazonni.icu
amazonzn.icu
ambawhee.icu
amceowlq.icu
amehilus.icu
amicheck.icu
amilerko.icu
amjvguhd.icu
amlbottg.icu
amokiker.icu
amopenid.icu
amoqwelz.icu
amowlsan.icu
amoylupa.icu
amphibia.icu
amujmnjm.icu
amvjfdhk.icu
amyyrsgl.icu
anablock.icu
anacloud.icu
anamjagu.icu
anarhhub.icu
anaroads.icu
anathema.icu
andskers.icu
anfasuye.icu
anfjuffs.icu
angekjge.icu
angluzha.icu
animekai.icu
aniworld.icu
anjcvhgd.icu
ankvidya.icu
anlichao.icu
annspark.icu
anonibet.icu
anorbank.icu
ansedoli.icu
antibots.icu
antvbang.icu
anxiaoyi.icu
anydeske.icu
aocvmqxe.icu
aoqugcie.icu
aorugcuo.icu
aotvmiao.icu
aparcels.icu
apexloom.icu
apghvxou.icu
apioeses.icu
apiopwer.icu
apiversr.icu
apkzlife.icu
apkzsave.icu
apkztech.icu
aplhaweb.icu
appfnbfs.icu
applemus.icu
appmypcb.icu
apprankx.icu
appstart.icu
apruvkuc.icu
aqemtniv.icu
aqinkess.icu
arampost.icu
arbilrum.icu
arborune.icu
archeyes.icu
areamail.icu
aresflix.icu
arestock.icu
argairgi.icu
argesggt.icu
arithlab.icu
arkadium.icu
armodilo.icu
aronyang.icu
artchild.icu
artdecor.icu
artdream.icu
artfullx.icu
artpathx.icu
artsmile.icu
arulhome.icu
arwerdax.icu
asasgwqt.icu
ascentra.icu
asclinic.icu
ascszvsd.icu
asdexaff.icu
asdfasdd.icu
asdqwdwq.icu
asdxazda.icu
asdxxnre.icu
asegcorr.icu
aseguros.icu
asfbtxls.icu
asfdomen.icu
asfnlgna.icu
asfrfvwc.icu
asgasgas.icu
ashleyer.icu
ashworth.icu
asiabill.icu
asiagate.icu
asialive.icu
askfnbfs.icu
asosiasi.icu
asparcel.icu
aspostas.icu
asqgktfq.icu
assetace.icu
assister.icu
assitato.icu
assveaes.icu
astratts.icu
asuioadd.icu
aswerqqe.icu
atchange.icu
atoagovd.icu
atonhfur.icu
atracker.icu
atryxhdg.icu
atthetop.icu
atticuss.icu
augsburg.icu
aunabuhs.icu
auratest.icu
auroramf.icu
auscxzeu.icu
auspostv.icu
autfrais.icu
authmail.icu
automama.icu
avcesils.icu
aviabook.icu
aviohack.icu
avndokli.icu
avostelo.icu
avoziler.icu
avromins.icu
aweiwhod.icu
awitngoy.icu
axepedia.icu
axolotmc.icu
axvquest.icu
azdenals.icu
azegroup.icu
azerotaz.icu
azhekeji.icu
azhydgwj.icu
azimnier.icu
azndealo.icu
azneisoa.icu

# Reference: https://app.validin.com/lookalikes?limit=1000&lookback=90&depth=2&find=%2F%5Eapi%5Ba-z%5D%7B5%2C6%7D%5C.icu%2F (# 2025-05-30)

apiconnect.icu
apifabric.icu
apilikewzh.icu
apioeses.icu
apiopwer.icu
apisoversa.icu
apiversr.icu

# Reference: https://x.com/skocherhan/status/1928438662506627192

0nau82s1.rest
3yg1lj.icu
5ognef.icu
67663verifycard-booking.com
82rab6.icu
beaconcast.icu
bigrollbet.com
bizor-space.icu
bkngvvfer.com
bookld-091233.com
buzzflare.icu
confirma-offer.icu
conflrmation-ld632895.com
conflrmation-ld634895.com
def3ndweb.com
eeq03.icu
etenetsevre.com
evator.icu
footballheroes.icu
guestinfo-aboutstay1205.com
guestsalerts.com
id164916.icu
id853292.rest
idpproxy-ucpathuniversityofcalifornia.com
insightlane.icu
itititiotooaoaoa.com
kaminofinance.icu
kategorie-inne-3619.icu
kategorie-inne741222102.icu
kategorie-proponowane.icu
kueduhr.com
legendarygame.icu
macusticlife.com
mfohur-tnus-ypfay.icu
oferta-3547247.icu
oferta-4102125.icu
oferta-512011.icu
oferta-9199068.icu
oferta8639464569.com
partner-notice.com
pl-380921.icu
pl-39650323.icu
pl-619.icu
pl-bilety-sprzedaz-resale.icu
pl-elektronika-328545.icu
pl-firmowe-234.icu
pl-firmowe-329.icu
pl-firmowe-7466.icu
pl-firmowe-9912.icu
pl-firmowe-oferty-4824.icu
pl-firmowe467.icu
pl-firmowe885.icu
pl-firmowe994.icu
pl-id2710522.icu
pl-kategoria-wyprzedaz-narzedzia-8.icu
pl-kategorie-inne-id26295.icu
pl-kategorie-inne.icu
pl-kategorie264195917.icu
pl-kategorie31283461284.icu
pl-kategorie3511985486.icu
pl-kategorie41273862.icu
pl-kategorie575172961.icu
pl-kategorie5945712732.icu
pl-kategorie61284682161.icu
pl-kategorie7263974163.icu
pl-kategorie7451724189.icu
pl-kategorie7518296163.icu
pl-kategorie785178237.icu
pl-kategorie8183217153.icu
pl-kategorie841083174.icu
pl-kategorie84124713.icu
pl-kategorie85612363.icu
pl-kategorie913291283187.icu
pl-kategorie9237462962.icu
pl-kategorie98265272.icu
pl-ofera420567.icu
pl-oferta1564386.icu
pl-oferta33281.icu
pl-oferta6373801.icu
pl-oferta6630782.icu
pl-oferta72198.icu
pl-oferta73581.icu
pl-oferta7892132.icu
pl-oferta8.icu
pl-oferta85559642.icu
pl-oferta89756.com
pl-ofery-4892.icu
pl-ogloszenie945567.icu
pl-ogrod-oferta-83472.icu
pl-ogrod-oferty-id7743.icu
pl-okazje-weekendowe-871244.rest
pl-prywatne-id111.icu
pl-prywatne-id129.icu
pl-prywatne-id192.icu
pl-prywatne-id577.icu
pl-prywatne-id894.icu
pll-kategorie8137269343.icu
plss5ljjrltda34gjk.icu
pressbeam.icu
quickburst.icu
radarline.icu
re3vpl3r.rest
safekindkind.com
stayattends7742.com
stayinfovstr.com
steamconmmunuty.com
steamecormmunnity.com
supportdesk-statmentview.icu
trendpath.icu
troubleinternetverif.com
u0kk8re.rest
u192.rest
ucpathca.com
ucpathserveunivers.com
udeymouzzme.com
verify312051-booking.com

# Reference: https://app.validin.com/lookalikes?limit=1000&lookback=90&depth=0&find=%2F%5Ebooking%5C.%5Ba-z0-9%5D%2B-%5Ba-z0-9%5D%2B%5C.com%24%2F (# 2025-05-30)

1000olive-terrace.com
195825-apple.com
3dsecure-2745936.com
8701-development.com
8point-okinawa.com
a3tech-ph.com
aarhus-housing.com
admin-extarnet.com
admin-verif409.com
admin-verif458.com
adria-concept.com
advant-ify.com
af-depot.com
aisa-grupo.com
ajaccio-tourisme.com
akashicrecords-academy.com
albrecht-hartmann.com
albret-tourisme.com
alla-media.com
alma-alpina.com
amari-bd.com
amaya-explorer.com
apointment-plus.com
arrival-confirm.com
asm-klaeng.com
astra-motor.com
astro-pool.com
atm-es.com
augustahotels-id.com
av-travel.com
axel-andre.com
azhuvancheri-thamprakkal.com
b-skin.com
barnes-venice.com
ben-givon.com
bloom-mktg.com
booked-process.com
bridge-madeira.com
business-banks.com
cabaia-sale.com
canyoning-jura.com
captains-choice.com
carhola-tenerife.com
cartology-api.com
cas-sant.com
chamonix-mobilite.com
cheap-direct.com
cheap-spectacles.com
check-in3535.com
check-in7545.com
chess-kingdom.com
christinadavis-photography.com
ci-1.com
citta-holistichaven.com
citydome-sinsheim.com
cleanslate-co.com
coaches-club.com
cocktail-connect.com
com-hoteprop.com
com-id837373.com
com-prisprop.com
confirm-autorization.com
confirmation-19438.com
confirmation-239471.com
confirmation-3842.com
confirmation-675103.com
confirmation-id01829.com
confirmation-id128937.com
confirmation-id4352.com
confirmation-id4726.com
confirmation-id7189.com
confirmationguest-928572.com
confirmstay-34614.com
conversational-german.com
cook-wareworld.com
cosmetique-totale.com
cozyfarm-resort.com
crime-reg.com
cx-place.com
daza-consulting.com
dc-dmv.com
dejavu-tokyo.com
destify-services.com
detail-ai.com
dev-amajigs.com
dic-sa.com
did-asa.com
divalux-bangkok.com
djabu-canggu.com
donafilipa-hotel.com
drive-life.com
e-companhia.com
e-mbj.com
ea-mission.com
east-third.com
easy-day.com
eda-edamame.com
eigentum-5092841.com
eigentum-91210372.com
ekn-marketing.com
elit-it.com
emet-magen.com
en-peniche.com
entrance-log.com
eterna-wellness.com
extranet-id32210.com
ez-cms.com
fab-fotography.com
fairway-hotel.com
feel-lisboa.com
ferienwohnungen-saalbach.com
fibernatic-dev.com
fishka-gold.com
flora-fusiongrow.com
fluxcore-agency.com
forja-tv.com
fortunelink-china.com
fukudaya-takeno.com
games-azartof.com
get-edgar.com
get-fleet.com
get-mobi.com
gloria-perouvoyages.com
golf-ranch.com
grandhotel-national.com
growtopower-digital.com
grupo-brustar.com
guest-idreserve.com
guest-reservationsinfos028524.com
guest-review823.com
gulf-trip.com
h2o-hospitality.com
hairmake-grow.com
hgrs-insurance.com
home-auth.com
hotel-ar.com
hotel-hubertus.com
hotel-nesrine.com
hotel-plovdiv.com
hotel-raurisertal.com
hotel-reservation254.com
hotel-reservation2558.com
hz-17.com
i-catalizer.com
i-thi.com
ic-researchdev.com
id-1300.com
id-22049.com
id-2495.com
id-2546.com
id-27558.com
id-37513.com
id-48028.com
id-49210.com
id-60331.com
id-6169.com
id-67123.com
id-72395.com
id-78271.com
id-82377.com
id-9433.com
idguesthome-739327.com
idguset-reserve.com
il-center.com
inbalance-wellbeeing.com
ingo-struck.com
invitation-approved.com
ipmart-forum.com
is-photobooth.com
jackpot-azartof.com
japan-reservation.com
joseph-turner.com
joshua-delrio.com
jvl-travel.com
k-rest.com
kairos-trogir.com
kcs-workshop.com
kokorono-resort.com
komi-design.com
kuma-election.com
kut-ritetools.com
lacannelle-lyon.com
laquinta-alta.com
lavish-hms.com
lead-harvesters.com
leeway-travels.com
level-max.com
liberty-int.com
light-bazaar.com
liquid-crm.com
lockbox-th.com
log-extranet.com
login-port.com
logins-secure.com
los-pipos.com
loxone-campus.com
ls-mitchell.com
ly-cygnus.com
m-devsecops.com
m-inn.com
mahjong-free.com
maison-selva.com
malang-guidance.com
manchesterairport-taxis.com
mandalay-media.com
marek-kopecky.com
mas-delabrousse.com
mcc-superclean.com
mds-wholesale.com
mein-schiffberater.com
meraki-resort.com
mercer-adams.com
meu-appbolsa.com
mirtrans-express.com
myt-tests.com
n-complete.com
nagaihama-resort.com
neitzert-chauffeur.com
neutomo-excursion.com
nexa-solutions.com
nexus-driver.com
nfd-group.com
ngtttc-official.com
nyadmcncserve-05y06a.com
oakleyshop-america.com
olympicholidays-preprod.com
olympicholidays-test.com
oniria-apartamentos.com
oq-managingproperties.com
palace-okinawa.com
palisades-cap.com
parteet-id539847.com
parther-rules.com
partners-id739847.com
partnet-id72023.com
pedialac-herobaby.com
phlebotomycourses-training.com
physicians-weightloss.com
pickle-bet.com
port-royal.com
prearrival-confirm.com
premium-rides.com
prop-hote.com
property-28391.com
property-log.com
q-resort.com
ra-hospitality.com
radio-columbia.com
random-developments.com
rarre-aesthetics.com
remedy-nh.com
rena-faucet.com
rentacar-sys.com
request-approved.com
reserv-confirms.com
reservation-5663234.com
reservation-62993541.com
reservation-authorisation.com
reservation-id758454.com
reuniting-yourself.com
revup-solutions.com
rinkan-studio.com
rr-rentacar.com
rsvn-id822134.com
rsvn-id992731.com
sat-fishers.com
saz-tech.com
scalp-ology.com
scandline-shop.com
scandlines-shop.com
scandlines-travel.com
scanline-shop.com
schengen-visa.com
schneider-sc.com
secure-logins.com
secure-partener.com
secure4-royalbank.com
sem-marketing.com
sendero-infinito.com
serendi-villas.com
servise-now.com
shellter-rentals.com
slovenia-transfer.com
southwest-rentals.com
spelll-checkx.com
sporthotel-alpina.com
studio-ino.com
studiow-wilson.com
supaserve-labs.com
support-ticket63546.com
thecleaning-box.com
tourisme-avesnois.com
toward-freedom.com
transform-pro.com
travel-dealz.com
travel-ups.com
travel-uts.com
triomotor-pelaihari.com
triperife-excursions.com
u-selfstorage.com
ukraine-hotel.com
us-autoglass.com
user-logins.com
vavada-eu.com
veritas-insurance.com
vietnam-home.com
villa-mauricette.com
violations-hotel.com
vip-travellers.com
vrf-proced985674202.com
vtc-market.com
wagners-aparthotel.com
webservice-alerts.com
win-29.com
wlc-gs.com
wns-orders1.com
www-75949.com
zen-lens.com
zero-item.com
booking.1000olive-terrace.com
booking.195825-apple.com
booking.3dsecure-2745936.com
booking.8701-development.com
booking.8point-okinawa.com
booking.a3tech-ph.com
booking.aarhus-housing.com
booking.admin-extarnet.com
booking.admin-guestinfo.com
booking.admin-verif409.com
booking.admin-verif458.com
booking.adria-concept.com
booking.advant-ify.com
booking.af-depot.com
booking.aisa-grupo.com
booking.ajaccio-tourisme.com
booking.akashicrecords-academy.com
booking.albrecht-hartmann.com
booking.albret-tourisme.com
booking.alla-media.com
booking.alma-alpina.com
booking.amari-bd.com
booking.amaya-explorer.com
booking.apointment-plus.com
booking.arrival-confirm.com
booking.asm-klaeng.com
booking.astra-motor.com
booking.astro-pool.com
booking.atm-es.com
booking.augustahotels-id.com
booking.av-travel.com
booking.axel-andre.com
booking.azhuvancheri-thamprakkal.com
booking.b-skin.com
booking.barnes-venice.com
booking.ben-givon.com
booking.bloom-mktg.com
booking.booked-process.com
booking.bridge-madeira.com
booking.business-banks.com
booking.cabaia-sale.com
booking.canyoning-jura.com
booking.captains-choice.com
booking.carhola-tenerife.com
booking.cartology-api.com
booking.cas-sant.com
booking.chamonix-mobilite.com
booking.cheap-direct.com
booking.cheap-spectacles.com
booking.check-in3535.com
booking.check-in7545.com
booking.checkin-guest.com
booking.checkout-guest.com
booking.chess-kingdom.com
booking.christinadavis-photography.com
booking.ci-1.com
booking.citta-holistichaven.com
booking.citydome-sinsheim.com
booking.cleanslate-co.com
booking.coaches-club.com
booking.cocktail-connect.com
booking.com-hoteprop.com
booking.com-id837373.com
booking.com-prisprop.com
booking.confirm-autorization.com
booking.confirmation-19438.com
booking.confirmation-239471.com
booking.confirmation-3842.com
booking.confirmation-675103.com
booking.confirmation-id01829.com
booking.confirmation-id1231837.com
booking.confirmation-id128937.com
booking.confirmation-id30541.com
booking.confirmation-id34897.com
booking.confirmation-id4352.com
booking.confirmation-id4726.com
booking.confirmation-id5284.com
booking.confirmation-id7189.com
booking.confirmation-id7852.com
booking.confirmation-id897234.com
booking.confirmation-id901823.com
booking.confirmation-id92834.com
booking.confirmationguest-928572.com
booking.confirmstay-34614.com
booking.conversational-german.com
booking.cook-wareworld.com
booking.cosmetique-totale.com
booking.cozyfarm-resort.com
booking.crime-reg.com
booking.cx-place.com
booking.daza-consulting.com
booking.dc-dmv.com
booking.dejavu-tokyo.com
booking.destify-services.com
booking.detail-ai.com
booking.dev-amajigs.com
booking.dic-sa.com
booking.did-asa.com
booking.divalux-bangkok.com
booking.djabu-canggu.com
booking.donafilipa-hotel.com
booking.drive-life.com
booking.e-companhia.com
booking.e-mbj.com
booking.ea-mission.com
booking.east-third.com
booking.easy-day.com
booking.eda-edamame.com
booking.eigentum-5092841.com
booking.eigentum-91210372.com
booking.ekn-marketing.com
booking.elit-it.com
booking.emet-magen.com
booking.en-peniche.com
booking.entrance-log.com
booking.eterna-wellness.com
booking.extranet-id32210.com
booking.ez-cms.com
booking.fab-fotography.com
booking.fairway-hotel.com
booking.feel-lisboa.com
booking.ferienwohnungen-saalbach.com
booking.ferry-booking.com
booking.fibernatic-dev.com
booking.fishka-gold.com
booking.flora-fusiongrow.com
booking.fluxcore-agency.com
booking.forja-tv.com
booking.fortunelink-china.com
booking.fukudaya-takeno.com
booking.games-azartof.com
booking.get-edgar.com
booking.get-fleet.com
booking.get-mobi.com
booking.gloria-perouvoyages.com
booking.golf-ranch.com
booking.grandhotel-national.com
booking.growtopower-digital.com
booking.grupo-brustar.com
booking.guest-idreserve.com
booking.guest-rentals.com
booking.guest-reservationsinfos028524.com
booking.guest-review823.com
booking.gulf-trip.com
booking.h2o-hospitality.com
booking.hairmake-grow.com
booking.hgrs-insurance.com
booking.home-auth.com
booking.hotel-ar.com
booking.hotel-hubertus.com
booking.hotel-nesrine.com
booking.hotel-plovdiv.com
booking.hotel-raurisertal.com
booking.hotel-reservation254.com
booking.hotel-reservation2558.com
booking.hz-17.com
booking.i-catalizer.com
booking.i-thi.com
booking.ic-researchdev.com
booking.id-1300.com
booking.id-22049.com
booking.id-2495.com
booking.id-2546.com
booking.id-27558.com
booking.id-37513.com
booking.id-48028.com
booking.id-49210.com
booking.id-60331.com
booking.id-6169.com
booking.id-67123.com
booking.id-72395.com
booking.id-78271.com
booking.id-82377.com
booking.id-9433.com
booking.idguesthome-739327.com
booking.idguset-reserve.com
booking.il-center.com
booking.inbalance-wellbeeing.com
booking.ingo-struck.com
booking.invitation-approved.com
booking.ip-ddns.com
booking.ipmart-forum.com
booking.is-photobooth.com
booking.jackpot-azartof.com
booking.japan-reservation.com
booking.joseph-turner.com
booking.joshua-delrio.com
booking.jvl-travel.com
booking.k-rest.com
booking.kairos-trogir.com
booking.kcs-workshop.com
booking.kokorono-resort.com
booking.komi-design.com
booking.kuma-election.com
booking.kut-ritetools.com
booking.lacannelle-lyon.com
booking.laquinta-alta.com
booking.lavish-hms.com
booking.lead-harvesters.com
booking.leeway-travels.com
booking.level-max.com
booking.liberty-int.com
booking.light-bazaar.com
booking.liquid-crm.com
booking.lockbox-th.com
booking.log-extranet.com
booking.login-port.com
booking.logins-secure.com
booking.los-pipos.com
booking.loxone-campus.com
booking.ls-mitchell.com
booking.ly-cygnus.com
booking.m-devsecops.com
booking.m-inn.com
booking.mahjong-free.com
booking.maison-selva.com
booking.malang-guidance.com
booking.manchesterairport-taxis.com
booking.mandalay-media.com
booking.marek-kopecky.com
booking.mas-delabrousse.com
booking.mcc-superclean.com
booking.mds-wholesale.com
booking.mein-schiffberater.com
booking.meraki-resort.com
booking.mercer-adams.com
booking.meu-appbolsa.com
booking.mirtrans-express.com
booking.myt-tests.com
booking.n-complete.com
booking.nagaihama-resort.com
booking.negatory-rvviewsguest.com
booking.neitzert-chauffeur.com
booking.neutomo-excursion.com
booking.nexa-solutions.com
booking.nexus-driver.com
booking.nfd-group.com
booking.ngtttc-official.com
booking.nyadmcncserve-05y06a.com
booking.oakleyshop-america.com
booking.olympicholidays-preprod.com
booking.olympicholidays-test.com
booking.oniria-apartamentos.com
booking.oq-managingproperties.com
booking.palace-okinawa.com
booking.palisades-cap.com
booking.parnter-id28934.com
booking.parteet-id539847.com
booking.parther-rules.com
booking.partner-id128125.com
booking.partner-id29834.com
booking.partner-id3695.com
booking.partner-id729.com
booking.partner-id755421.com
booking.partners-id739847.com
booking.partnet-id72023.com
booking.parttet-id6739847.com
booking.pedialac-herobaby.com
booking.phlebotomycourses-training.com
booking.physicians-weightloss.com
booking.pickle-bet.com
booking.port-royal.com
booking.prearrival-confirm.com
booking.premium-rides.com
booking.prop-hote.com
booking.property-28391.com
booking.property-log.com
booking.q-resort.com
booking.questionable-rviews.com
booking.ra-hospitality.com
booking.radio-columbia.com
booking.random-developments.com
booking.rarre-aesthetics.com
booking.remedy-nh.com
booking.rena-faucet.com
booking.rentacar-sys.com
booking.rentals-home.com
booking.request-approved.com
booking.reserv-confirms.com
booking.reservation-5663234.com
booking.reservation-62993541.com
booking.reservation-authorisation.com
booking.reservation-id758454.com
booking.resewen-ceksenin.com
booking.reuniting-yourself.com
booking.revup-solutions.com
booking.rinkan-studio.com
booking.rr-rentacar.com
booking.rsvn-id822134.com
booking.rsvn-id992731.com
booking.s-club.com
booking.sat-fishers.com
booking.saz-tech.com
booking.scalp-ology.com
booking.scandline-shop.com
booking.scandlines-shop.com
booking.scandlines-travel.com
booking.scanline-shop.com
booking.schengen-visa.com
booking.schneider-sc.com
booking.secure-logins.com
booking.secure-partener.com
booking.secure-partnet.com
booking.secure4-royalbank.com
booking.sem-marketing.com
booking.sendero-infinito.com
booking.serendi-villas.com
booking.servise-now.com
booking.shellter-rentals.com
booking.slovenia-transfer.com
booking.southwest-rentals.com
booking.spelll-checkx.com
booking.sporthotel-alpina.com
booking.studio-ino.com
booking.studiow-wilson.com
booking.supaserve-labs.com
booking.support-ticket63546.com
booking.thecleaning-box.com
booking.tourisme-avesnois.com
booking.toward-freedom.com
booking.transform-pro.com
booking.travel-dealz.com
booking.travel-ups.com
booking.travel-uts.com
booking.triomotor-pelaihari.com
booking.triperife-excursions.com
booking.u-selfstorage.com
booking.ukraine-hotel.com
booking.us-autoglass.com
booking.user-logins.com
booking.vavada-eu.com
booking.veritas-insurance.com
booking.vietnam-home.com
booking.villa-mauricette.com
booking.violations-hotel.com
booking.vip-travellers.com
booking.vrf-proced985674202.com
booking.vtc-market.com
booking.wagners-aparthotel.com
booking.webservice-alerts.com
booking.win-29.com
booking.wlc-gs.com
booking.wns-orders1.com
booking.www-75949.com
booking.zen-lens.com
booking.zero-item.com

# Generic

/a3A7qLVn/
/fEOV2v/
/vvmd54/
/wzfsr4f/
/ZgbN19Mx
