In this post I'll provide actionable intelligence and some additional details and domain portfolios behind the recently sanctioned Media Land bulletproof hosting provider.
Sample domains known to have been involved in the campaign include:
hxxp://vhost-vps.ru
hxxp://mobirevolutconfirmation.com
hxxp://sdfsdfsdfsdfdsfsdf.ru
hxxp://7h.ru
hxxp://googleclouddns.com
hxxp://gasorr.com
hxxp://affiliatemarketingletters.com
hxxp://amazkonto.info
hxxp://sikescomposites.com
hxxp://hardwarebajaar.com
hxxp://ksplsoft.com
hxxp://setechnowork.com
hxxp://medicare-cost.com
hxxp://intradayinvestment.com
hxxp://imsensors.com
hxxp://wedoaccounting.ru
hxxp://makemoneyonlinefrom-home.com
hxxp://optiontradingsignal.com
hxxp://technicollit.com
hxxp://discountshadesdirect.com
hxxp://wasfatsahla.com
hxxp://clippershipintl.com
hxxp://propertyexpoandshowcase.com
hxxp://couponbrothers.com
hxxp://mad-colour.com
hxxp://briansclub.cm
hxxp://cardhouse.cc
hxxp://crdclub.su
hxxp://club2crd.cc
hxxp://min0taur.ru
hxxp://boxodns.info
hxxp://rocodns.info
hxxp://cntdnsnet.info
hxxp://fullzinfo.com
hxxp://swipestore.cc
hxxp://bidencash.link
hxxp://bidencash.rip
hxxp://volosovichkov-taxi.info
hxxp://volosovichkov.info
hxxp://ffv2panelbot.info
hxxp://brianscrabs.de
hxxp://vesperdns.info
hxxp://nicedomainname.info
hxxp://dndpark.info
hxxp://dnsmhere.ru
hxxp://newserversdns222.info
hxxp://11.info
hxxp://pspark.info
hxxp://verified.mn
hxxp://amazondeutschland.info
hxxp://googleup.ru
hxxp://fablirsgd.ru
hxxp://dnspods.ru
hxxp://microsoft-windows-defender-update.ru
hxxp://googleu.ru
hxxp://xmrdealshere.ru
hxxp://carshome.info
hxxp://targetpost.info
hxxp://greatdor.info
hxxp://greatdor.ru
hxxp://mydnsserver.info
hxxp://lambdadns.com
hxxp://besdns.ru
hxxp://cptdns.info
hxxp://lincomap.ru
hxxp://jackladamada.info
hxxp://jackladamadab.info
hxxp://dmsmanagereu.info
hxxp://mydnshelpers.info
hxxp://protonommail.info
hxxp://fifdns.info
hxxp://proxy-dns2.ru
hxxp://fatraf.info
hxxp://unitednstools.info
hxxp://chemobyldns.info
hxxp://s3dns.com
hxxp://setdnsnet.info
hxxp://vipedron.ru
hxxp://dsfgghgsfadfgh.info
hxxp://publicdns.ru
hxxp://publicdns.info
hxxp://domain4dns.info
hxxp://protonomail.info
excellins@gmail.com
dbinar@mail.ru
support@ipage.com
asaleem@clippershipintl.com
support@quickfixindia.com
salah@agisol.com
Sample domains known to have been involved in the campaign include:
hxxp://apply-forms.com
hxxp://apply-details.com
hxxp://cibc-mobile-online.com
hxxp://rc3-notifications.com
hxxp://5limitnews.com
hxxp://paylife-bestaetigungonline-id412312.xyz
hxxp://jload05.xyz
hxxp://jload08.xyz
hxxp://buhjike.host
alex.kitai@gmail.com
18394_alex@sshvps.net
alex@sshvps.net
zakaz@sshvps.net
fan@mail.ru
billing@abushost.ru
nishebrod@abushost.ru
abuse@sshvps.net
Bubbagurnpshrimpco@exploit.im
alex.kitai@gmail.com
abuse@sshvps.net
medialand.regru@gmail.com
webnic@gmail.com
alex.kitai@gmail.com
ertsupport@gmail.com
Sample domains known to have been involved in the campaign include:
hxxp://mobzijecherry.xyz
hxxp://theostingros.site
hxxp://runefast.xyz
hxxp://patpatskads.xyz
hxxp://cadscadstats.xyz
hxxp://hatefraud.xyz
hxxp://androidset.xyz
hxxp://kelarkads.xyz
hxxp://inmasetting1.xyz
hxxp://perviaypriz.xyz
hxxp://microandroid.xyz
hxxp://bancochlie.icu
hxxp://tropadja.xyz
hxxp://cdn-plugintemplates.site
hxxp://intervpn.xyz
hxxp://blueivyrgnend.xyz
hxxp://mirrorbooks.icu
hxxp://nasrowat.icu
hxxp://nasaretbooks.icu
hxxp://afterbookins.icu
hxxp://apenopenbook.icu
hxxp://asastimebook.icu
hxxp://asbooktime.icu
hxxp://aperscroolboks.icu
hxxp://winstatics.xyz
hxxp://sservices24.xyz
hxxp://ayysasay.xyz
hxxp://nigernasa.icu
hxxp://naskartbing.icu
hxxp://neseseroboki.icu
hxxp://nowatornwp.icu
hxxp://norbinwsp.icu
hxxp://auth24h.xyz
hxxp://thewapstrapnads.xyz
hxxp://brakalalrakds.xyz
hxxp://tatatargears.xyz
hxxp://uralakads.xyz
hxxp://uni-cliente.site
hxxp://gerradsrich.xyz
hxxp://refstip.xyz
hxxp://presentwall.xyz
hxxp://gostrid.xyz
hxxp://heretransect.xyz
hxxp://mafin.ml
hxxp://bookandroid.xyz
hxxp://boookandroid.xyz
hxxp://dfgdfg234yhfgdf.xyz
hxxp://baraksdashakasds.xyz
hxxp://ahaha45454545787.xyz
hxxp://thevansproads.xyz
hxxp://yogurtcedars.xyz
hxxp://keepkey.store
hxxp://nuhjir.site
hxxp://buhjike.host
hxxp://bingoshow.xyz
hxxp://foloveros321.xyz
hxxp://tdeasywebonline.site
hxxp://purchase.ru.com
hxxp://stableupdater.ru.com
hxxp://carsprohibity.icu
hxxp://demesiontree.best
hxxp://correosapp.xyz
hxxp://harrysgameworld.xyz
hxxp://bloktcharm.site
hxxp://amerlcanexpress.space
hxxp://muteviewer.site
hxxp://honkong-news24.xyz
hxxp://pickme111.xyz
hxxp://datprofgirls.xyz
hxxp://retg234hy.xyz
hxxp://year1theof.xyz
hxxp://at-sicherheitsid18619002.xyz
hxxp://at-sicherheitsid18619001.icu
hxxp://holidaycheckin.xyz
hxxp://amazingfreetoo.rest
hxxp://amarob.xyz
hxxp://notduckduckg.xyz
hxxp://lbgyn15pchoit03azhs.xyz
hxxp://jgu16cbxdr03ehqvx.xyz
hxxp://correos-app.icu
hxxp://newsprodayly.xyz
hxxp://microsoft-windows-defender-update.xyz
hxxp://devprofiweb.xyz
hxxp://ebankingbawagpsk-identverfahren-onlineid893123111.xyz
hxxp://ebankingbawagpsk-identverfahren-onlineid89413121.xyz
hxxp://ebankingbawagpsk-identverfahren-onlineid89341421.xyz
hxxp://testdomainforme.xyz
hxxp://microsofttop.wiki
hxxp://ebanking-easybank-sicherheitsid198810.xyz
hxxp://ebanking-easybank-sicherheitsid198834787.xyz
hxxp://real-de.site
hxxp://bincnce.xyz
hxxp://frimware.icu
hxxp://bawagpsk-bestaetigungsid193121.xyz
hxxp://bawagpsk-bestaetigungsid15421121.icu
hxxp://ebankingbawagpsk-identverfahren-onlineid8912313.xyz
hxxp://ebankingbawagpsk-identverfahren-onlineid89431112.xyz
hxxp://ebankingbawagpsk-identverfahren-onlineid894881672.icu
hxxp://ebankingbawagpsk-identverfahren-onlineid8941231.xyz
hxxp://bawagpsk-bestaetigungsid164652771.xyz
hxxp://bawagpsk-bestaetigungsid746982771.xyz
hxxp://bawagpsk-bestaetigungsid54371.xyz
hxxp://bawagpsk-bestaetigungsid132182771.icu
hxxp://com-signin-encoding-utf8-ignore-authstate.bar
hxxp://domencounternet.xyz
hxxp://vobakunde.xyz
hxxp://blockchain-com.rest
hxxp://golokolosqwer.xyz
hxxp://safdgf.xyz
hxxp://zigfire.site
hxxp://insperegrow.site
hxxp://bawagpsk-bestaetigungsid1312312771.xyz
hxxp://bawagpsk-bestaetigungsid16472771.xyz
hxxp://bawagpsk-bestaetigungsid5982771.xyz
hxxp://bawagpsk-bestaetigungsid65982771.xyz
hxxp://cardhouse.best
hxxp://volksbank-girocard.xyz
hxxp://meine-deutsche-bank.xyz
hxxp://amahv0518zp1.xyz
hxxp://legolasovka.xyz
hxxp://legolovol.xyz
hxxp://thedirtysa.xyz
hxxp://v5zkjbrz97g9v3yw.xyz
hxxp://intoolkom.at
hxxp://premium-bikes.store
hxxp://wornegmot.space
hxxp://q1s0oci49jo.xyz
hxxp://d7fv8iu3ovn.xyz
hxxp://verify-helpcenter.xyz
hxxp://verify-client.xyz
hxxp://fastwood.xyz
hxxp://fgd6hfgs5fdhcrvsed.site
hxxp://domencounterinet.space
hxxp://counterstartnet.site
hxxp://correosapp.site
hxxp://zeerogravite.host
hxxp://qmembers.space
hxxp://cardhouse.store
hxxp://correosapp.space
hxxp://ebankingbawagpsk-identverfahren-onlineid895642131.xyz
hxxp://ebankingbawagpsk-identverfahren-onlineid895641312.xyz
hxxp://ebankingbawagpsk-identverfahren-onlineid895641314.xyz
hxxp://ebankingbawagpsk-identverfahren-onlineid81211112.xyz
hxxp://travelcoachers.online
hxxp://ssndob.pw
hxxp://owoblow.website
hxxp://goldhistory.online
hxxp://fbernhard13uo.ru.com
hxxp://nicolette7107gq.ru.com
hxxp://3zecall6cyr.xyz
hxxp://jerry-dibbert16ih.ru.com
hxxp://fondovbob.xyz
hxxp://kolokola2021.xyz
hxxp://accountcheckverify.us.com
hxxp://accueilmonhomepage.online
hxxp://reschedule.site
hxxp://al3mn2ghlm5asova.xyz
hxxp://kihn-delaney30gn.ru.com
hxxp://nodeapi.ru.com
hxxp://kemard12e.ru.com
hxxp://passportcentral.xyz
hxxp://paufderhar07ol.ru.com
hxxp://ninjacrypter.xyz
hxxp://babyvatrjraw.gb.net
hxxp://paynspray2day.xyz
hxxp://cooperative-online.site
hxxp://cardhouse.site
hxxp://askmiask.pw
hxxp://aesbrute.pw
hxxp://amazon-konto.site
hxxp://yc1op3jh39r.xyz
hxxp://b2eku2azm5mx2nmq.xyz
hxxp://c8ttr56xdhe26hmr.xyz
hxxp://teererer.xyz
hxxp://reeett.xyz
hxxp://emybtdom.xyz
hxxp://rabo-app.site
hxxp://ninjacrypterbot.xyz
hxxp://threebilling.com
hxxp://apple-restore.com
hxxp://bmo-onlinebanking.com
hxxp://optus-bonus.com
hxxp://w1b2s3d4.com
hxxp://limitnewstoday.com
hxxp://mintreston.com
hxxp://hankbano.website
hxxp://nintendo-swltch.com
hxxp://gonmissin.icu
hxxp://account-billing.com
hxxp://secure-banking-updt.com
hxxp://securedamericanexpressvalidation.xyz
hxxp://limited-services-paypal.com
hxxp://m2cristy.icu
hxxp://three-mybilling.com
hxxp://facebook-s3.com
hxxp://facebook-s6.com
hxxp://facebook-restore.com
hxxp://facebook-state.com
hxxp://kekydj68dfj45d.com
hxxp://olb-secure.com
hxxp://com-cgi-bin-3t5ufkygkl56-www-desjardins.com
hxxp://nlntendo-switch.com
hxxp://activehostcom.com
hxxp://activehostat.com
hxxp://rbcroyalbank.com.ng
hxxp://tiscalmail.website
hxxp://acc7201-statement-online.com
hxxp://hosting-pl.site
hxxp://facebook-s5.com
hxxp://5limitnews.com
hxxp://tangerine-en.com
hxxp://happy03.icu
hxxp://happy032.icu
hxxp://trackgo2.icu
hxxp://wustats.com
hxxp://tracker-visitors.com
hxxp://ms2v2.com
hxxp://restofoodquid.com
hxxp://wallet-trezor.website
hxxp://wallet-trezor.site
hxxp://trezor-wallets.site
hxxp://blacklizard.xyz
hxxp://sharkblack.xyz
hxxp://my3-bill.com
hxxp://reddragons.xyz
hxxp://zebizebi.at
hxxp://virgilio-it.host
hxxp://apple-appield.com
hxxp://static-facebook.com
hxxp://it-server.site
hxxp://priceless-life.us
hxxp://facebook-ss.com
hxxp://interia-pl.host
hxxp://trezor-wallet.website
hxxp://pikabooteam.com
hxxp://clickwebsite-rbc.com
hxxp://arubawebs.com
hxxp://securedvalidationonline.xyz
hxxp://banohank.website
hxxp://wp-pl.site
hxxp://wp-pl.host
hxxp://securepay.host
hxxp://afha23ufwhkf03ajxy.xyz
hxxp://fegr23ylwp03yfvm.xyz
hxxp://xsd22aeofw03lqzf.xyz
hxxp://wnsx22gdouo03tuyu.xyz
hxxp://yzq24meogxq03bsvfu.xyz
hxxp://zqykg24numnvu03cqebye.xyz
hxxp://vandcr22.xyz
hxxp://prce24izsje03aioy.xyz
hxxp://qvqy23thdsed03xjeqtf.xyz
hxxp://olfs23kvri03wyyb.xyz
hxxp://mtk23gqakwj03bzds.xyz
hxxp://lvv23blili03ujrxcp.xyz
hxxp://aworkst1.xyz
hxxp://drt22uhfjmz03ltxc.xyz
hxxp://newtraffse.xyz
hxxp://ovesf23knfg03eixqds.xyz
hxxp://sparkasse-secure.ink
hxxp://sparkasse-secure.icu
hxxp://microsoftupdate.ink
hxxp://tvzhp22pzrh03vdawn.xyz
hxxp://wsbc23imtnnc03lrmpxa.xyz
hxxp://ulxd22wzca03znctpg.xyz
hxxp://rcwj22jxyvt03swnlt.xyz
hxxp://rsjb23tnxjng03dgiy.xyz
hxxp://client-area.site
hxxp://hydra2wed.fun
hxxp://facebook-s4.com
hxxp://ww1royalbank.com.ng
hxxp://ire22wndw03opoq.xyz
hxxp://beg23crlsak03wwzwc.xyz
hxxp://aath22rzmo03mvewdj.xyz
hxxp://sparkasse-secure.rest
hxxp://vad12mhpfp03vyfl.xyz
hxxp://nvelj12qyyfi03kqxy.xyz
hxxp://ipok12bcame03shzpiq.xyz
hxxp://gcfxb12aefoyn03epdoji.xyz
hxxp://icjmm22logc03ufhjmr.xyz
hxxp://ewiak22wbzmpq03ysileo.xyz
hxxp://pickredd21.xyz
hxxp://zltw15tzezi03nbmru.xyz
hxxp://ykv16cmtign03mfeen.xyz
hxxp://workhards24.xyz
hxxp://fqzzj16gndioz03mxadr.xyz
hxxp://wquwb16swlxr03miuell.xyz
hxxp://bpxe15jijmh03ubiwhh.xyz
hxxp://traffiunder9.xyz
hxxp://trafpop22.xyz
hxxp://jolokina278.xyz
hxxp://klhlh16zldwun03vlpq.xyz
hxxp://hotstarred14.xyz
hxxp://frankfurtersparkasse.design
hxxp://frankfurtersparkasse.art
hxxp://bqx12lnjk03rrdio.xyz
hxxp://asflred22.xyz
hxxp://ardtot21.xyz
hxxp://ddkiilefmjim.xyz
hxxp://fqtk24zhwwj03soioea.xyz
hxxp://cremavv21.xyz
hxxp://astart88.xyz
hxxp://astartbidi.xyz
hxxp://uqw16atsxge03cbwwx.xyz
hxxp://uqtgo16datx03ejjz.xyz
hxxp://rcj16whwaqg03pmrp.xyz
hxxp://rdraj16rwjw03xnli.xyz
hxxp://vitya01.xyz
hxxp://au-a.icu
hxxp://lakeshor.xyz
hxxp://co-operative-bank.website
hxxp://copmartog.xyz
hxxp://maramarket.site
hxxp://jopagolova.xyz
hxxp://weedtime.space
hxxp://tendermails.space
hxxp://unicefla.space
hxxp://indestructibles.xyz
hxxp://hpsuppor.site
hxxp://inbox-injs.site
hxxp://prothtrack.site
hxxp://irpp.site
hxxp://secureappscompany.host
hxxp://floadd.xyz
hxxp://omnipotent.xyz
hxxp://ragnar0k.xyz
hxxp://in-post.site
hxxp://dragonflyss.site
hxxp://cookiepolicy.site
hxxp://ilovesmoke.space
hxxp://tsb.best
hxxp://dewebinfo.space
hxxp://r7ssh1ng.xyz
hxxp://dksexprofile.fun
hxxp://otisprii2020de.site
hxxp://btccxx.website
hxxp://otispride.site
hxxp://educationalstufs.xyz
hxxp://thisisthebestb.fun
hxxp://nicehaskple.icu
hxxp://nicokposte.icu
hxxp://fullzstore.pw
hxxp://cardcomplete-sicherheitsid12771829.xyz
hxxp://cardcomplete-sicherheitsid187271829.xyz
hxxp://complete-sicherheitsservice-id1871770.icu
hxxp://musicspeakss.xyz
hxxp://guest01.xyz
hxxp://looo01.xyz
hxxp://educationalstuff.xyz
hxxp://sec01.xyz
hxxp://pupupyane.xyz
hxxp://newsongingfe.icu
hxxp://newdomfrees.icu
hxxp://klasabooki.icu
hxxp://1nasprod.icu
hxxp://updatesoft.site
hxxp://4lmighty.xyz
hxxp://jload06.xyz
hxxp://uspcapital.website
hxxp://thisisthebestb.host
hxxp://thisisthebestb.xyz
hxxp://llload01.xyz
hxxp://llload02.xyz
hxxp://sec02.xyz
hxxp://cocaineboy.space
hxxp://jload05.xyz
hxxp://cxvchjvhgfgcvjhvj.xyz
hxxp://btcstat.xyz
hxxp://jload07.xyz
hxxp://margload.xyz
hxxp://looo02.xyz
hxxp://insetuing2.xyz
hxxp://instrunel.xyz
hxxp://asteckbook.icu
hxxp://contimer.icu
hxxp://cersanti.icu
hxxp://costnere.icu
hxxp://kremlpost.icu
hxxp://karnelsets.icu
hxxp://cardcomplete-sicherheitsid1412322.icu
hxxp://paylife-bestaetigungonline-id412312.xyz
hxxp://bawagpsk-bestaetigungsid1982771.xyz
hxxp://karabook.icu
hxxp://korasbook.icu
hxxp://promiseload1.xyz
hxxp://promiseload2.xyz
hxxp://mankamona.icu
hxxp://paylife-bestaetigungonline-id54161.xyz
hxxp://paylife-bestaetigungonline-id521661.xyz
hxxp://cardcomplete-sicherheitsid18771829.xyz
hxxp://bawagpsk-bestaetigungsid2182771.xyz
hxxp://aliensend101.xyz
hxxp://aliensave101.xyz
hxxp://cardcomplete-sicherheitsid12771829.icu
hxxp://bawagpsk-bestaetigungsid12982571.icu
hxxp://at-sicherheitsid199288.xyz
hxxp://complete-sicherheitsservice-id1871770.xyz
hxxp://netkoruma.xyz
hxxp://cardcomplete-sicherheitsid155134229.xyz
hxxp://bawagpsk-bestaetigungsid1982571.xyz
hxxp://cardcomplete-sicherheitsid14129.xyz
hxxp://cardcomplete-sicherheitsid18721829.xyz
hxxp://cardcomplete-sicherheitsid187718292.xyz
hxxp://tararfararta.xyz
hxxp://hoptrakds.xyz
hxxp://jopa1.xyz
hxxp://mankament2.icu
hxxp://negarnekbook.icu
hxxp://nasabooksini.icu
hxxp://nestbokin.icu
hxxp://counterstarnet.xyz
hxxp://23bnl.xyz
hxxp://ewfr4g5dh6gsfgd.xyz
hxxp://pineskopbosa.icu
hxxp://radsqas.icu
hxxp://fasdqqa.icu
hxxp://raweqwcx.icu
hxxp://triada.fun
hxxp://kolokolovhjjj.best
hxxp://jopa7.xyz
hxxp://jopa6.xyz
hxxp://dobssn.pw
hxxp://slvnhssq.xyz
hxxp://aghzznbn.xyz
hxxp://paylbocn.xyz
hxxp://redirect-wellsfargo-secure07.xyz
hxxp://connect-wellsfargo-secure07.xyz
hxxp://kimanbop.icu
hxxp://clopskops.icu
hxxp://kirusbost.icu
hxxp://copcopsko.icu
hxxp://bonsupers.icu
hxxp://periskopeboos.icu
hxxp://curacurpops.icu
hxxp://spectrabookings.icu
hxxp://crooks-cooper24g.xyz
hxxp://brannon-powlowski25d.xyz
hxxp://bkxf24hfvt03ftrd.xyz
hxxp://evz15lmlir03sygmyr.xyz
hxxp://kolonostra394.xyz
hxxp://zoltss12.xyz
hxxp://treutel-jamir25ju.xyz
hxxp://rgleason25s.xyz
hxxp://amsterd123.xyz
hxxp://blogerblya.xyz
hxxp://katelynn9506a.ru.com
hxxp://dennis-hill25lw.xyz
hxxp://zqqzp2.xyz
hxxp://xherzog24pv.xyz
hxxp://rosenbaum-jaida24nz.xyz
hxxp://kassandra5024d.xyz
hxxp://bardecuba.xyz
hxxp://boehm-kavon15lc.ru.com
hxxp://rosenbaum-milan15y.ru.com
hxxp://runolfsson-jayde07s.ru.com
hxxp://amazon-de.pw
hxxp://toputa.xyz
hxxp://dogydogy.xyz
hxxp://canadianis.xyz
hxxp://alexandrea-friesen16ka.ru.com
hxxp://stiedemann-alvah30hq.ru.com
hxxp://wstanton12qn.ru.com
hxxp://corwin-tommie06f.ru.com
hxxp://xrussianhitman.xyz
hxxp://wifoweijijfoiwjweoi.xyz
hxxp://halle-auer20h.ru.com
hxxp://decompanion.xyz
hxxp://rootforme33.xyz
hxxp://blockchain-com.bar
hxxp://mensiskayl22.xyz
hxxp://tonitrus.pw
hxxp://windef.icu
hxxp://businesssday.tech
hxxp://blockchain-com.website
hxxp://blockchain-com.pw
hxxp://sibs-system.icu
hxxp://paucek-jerel26n.xyz
hxxp://humberto7126dt.xyz
hxxp://rbcroyalbankrewards.com
hxxp://wwwa4c.com
hxxp://koronakorona.host
hxxp://gjhaksdfjw453r.xyz
hxxp://365onlinealert.com
hxxp://brekke-gerald26s.xyz
hxxp://usy15wycqme03dymh.xyz
hxxp://amr16pzcp03omerd.xyz
hxxp://csanford13i.ru.com
hxxp://cremin-ian07u.ru.com
hxxp://de-umstellung.icu
hxxp://de-sibs.icu
hxxp://sibs-verfahren.icu
hxxp://hamill-nikolas24e.xyz
hxxp://zambii41.xyz
hxxp://hprosacco25i.xyz
hxxp://dana8826ig.xyz
hxxp://wolf-stephon26k.xyz
hxxp://pmann26pi.xyz
hxxp://ekirlin26c.xyz
hxxp://corwin-francisca26z.xyz
hxxp://rybacywedkarze.space
hxxp://vegetto.xyz
hxxp://dragonflys.website
hxxp://tisprii2020de.site
hxxp://blockchain-com.host
hxxp://onlinebusinessday.best
hxxp://leonoro.website
hxxp://uspcapitals.space
hxxp://vsevles.xyz
hxxp://amerlcanexpress.website
hxxp://dewebinfo.blog
hxxp://adsapomg.space
hxxp://kaszanke.space
hxxp://ropucha11.space
hxxp://lososie-sandacze.space
hxxp://kapustke.space
hxxp://cemkeskin.xyz
hxxp://avnjila.website
hxxp://cemkeskinck.xyz
hxxp://lloysss.xyz
hxxp://bonkiaes.xyz
hxxp://louysss.xyz
hxxp://benkaei.xyz
hxxp://siunurandom.xyz
hxxp://xn--leder-m1a.com
hxxp://iofunpw.fun
hxxp://365online-reactivation.com
hxxp://capitalsavto.fun
hxxp://anonymous.rest
hxxp://dfzgfxjhklhlhgcjkrd32.pw
hxxp://knd1.xyz
hxxp://xn--ldger-j0a.com
hxxp://finncemnews.space
hxxp://adblockplus.tech
hxxp://thisisthebestb.website
hxxp://tomcrown.site
hxxp://educationalstuffs.xyz
hxxp://staitonfresk.site
hxxp://snibbedisnap.xyz
hxxp://syjohnnes.website
hxxp://marketads.space
hxxp://spaceball.host
hxxp://blockchain-com.fun
hxxp://jload08.xyz
hxxp://dksexprofile.space
hxxp://g0dproject.xyz
hxxp://sec03.xyz
hxxp://meliamilyblo.site
hxxp://blockchain-com.store
hxxp://privatehome.host
hxxp://heyrawnak1hq.xyz
hxxp://hhggbtgfe32345ytgf.xyz
hxxp://varbar.xyz
hxxp://damaged.xyz
hxxp://blockchaln.rest
hxxp://blockchaln.bar
hxxp://dasgamih.space
hxxp://radagohs.space
hxxp://revijacket.site
hxxp://coronafinder.rest
hxxp://4806e79dbfe.xyz
hxxp://marload.xyz
hxxp://tisprii202020de.site
hxxp://blockchain-com.tech
hxxp://sagepay-live.com
hxxp://banquebnp-paribas.com
hxxp://secure1-telpay.com
hxxp://sayhello.host
hxxp://qrwetyui76yt.xyz
hxxp://opkghytiii.space
hxxp://fit61j.space
hxxp://katamoto.space
hxxp://365online-notifications.com
hxxp://laliodan.fun
hxxp://rqqaaacx.icu
hxxp://canadapost-trackingnumber.com
hxxp://xn--ledgr-esa.com
hxxp://weqaacdaca.icu
hxxp://amerlcanvan.com
hxxp://rtzgvacxaa.icu
hxxp://manage-365online.com
hxxp://365online-expired.com
hxxp://365oniine.com
hxxp://mbdiversificationcentres.com
hxxp://live-sagepay.com
hxxp://365online-registerednumber.com
hxxp://deep-state.space
hxxp://365online-phonesettings.com
hxxp://365online-securityalert.com
hxxp://365online-amendphone.com
hxxp://supersite.xyz
hxxp://asanasgo.site
hxxp://ma-banquebnpparibas.com
hxxp://mabanquebnp-paribas.com
hxxp://mabanque-bnp-paribas.com
hxxp://online365-settings.com
hxxp://cdn-bat-bing.com
hxxp://amasingrow.space
hxxp://ereslindabb.space
hxxp://rippedspaces.xyz
hxxp://norwayinvest.space
hxxp://tracktracktrack.space
hxxp://goooood.space
hxxp://seinvest.space
hxxp://365online-updatephone.com
hxxp://365online-personalsettings.com
hxxp://365online-alert.com
hxxp://ausgezeichnet.online
hxxp://ji74r.site
hxxp://ma-banque-paribas.com
hxxp://steelgatesecurityltd.com
hxxp://defaultway.com
hxxp://apipack.host
hxxp://contactscript.com
hxxp://alima.fun
hxxp://bluewaters.space
hxxp://onlinesettings-aib.com
hxxp://onlinebanking-aib.com
hxxp://andherieastern.com
hxxp://alert-365online.com
hxxp://epost.com.ng
hxxp://boi-fraudalert.com
hxxp://bankofireland-fraudalert.com
hxxp://365online-activate.com
hxxp://mariogameover.fun
hxxp://vizer800.space
hxxp://sdfg4tgergdg.space
hxxp://cdnpack.site
hxxp://gerrybrookhimer.space
hxxp://updateflashplayer.icu
hxxp://boiphishing.com
hxxp://myetherwaliet.com
hxxp://de-sicherheitscenter-verifizierung-4af75a049706f09b-0.icu
hxxp://lentalnews.icu
hxxp://ghjhk45y4.xyz
hxxp://tracking-site.com
hxxp://bankofireland-security.com
hxxp://bankofireland-contactdetails.com
hxxp://bankofireland-settings.com
hxxp://365online-fraudalert.com
hxxp://ukinvest.space
hxxp://allinvest.space
hxxp://dieteng.space
hxxp://wearedeticatedtoserveyou.site
hxxp://mddeinv.space
hxxp://boisecurity.com
hxxp://365online-mobilephone.com
hxxp://boi-alert.com
hxxp://365onlinefraud.com
hxxp://365onlinephishing.com
hxxp://365online-securitycodes.com
hxxp://infodesklab.site
hxxp://boimobile.com
hxxp://365online-accesss.com
hxxp://deinvest.space
hxxp://365online-updatenumber.com
hxxp://365onlinecontrol.com
hxxp://365online-contactsettings.com
hxxp://greedyrates.com.ng
hxxp://mditinv.space
hxxp://365online-accountsettings.com
hxxp://rippedtyres.xyz
hxxp://365online-contactinfo.com
hxxp://wof78.site
hxxp://dartvedededed.site
hxxp://wazzz.website
hxxp://amerlcanexpress.xyz
hxxp://fitoldday.site
hxxp://cactuscooler.space
hxxp://mijn-digid.com
hxxp://apple-giftcard.icu
hxxp://itinvest.space
hxxp://365onlinepayees.com
hxxp://xn--mytherwallet-ydb.com
hxxp://365online-mobile.com
hxxp://365onlinemobile.com
hxxp://libero-safe.host
hxxp://systemserviceupdate.host
hxxp://yug0.net
hxxp://docsignonedrivedocssharingonline.store
hxxp://viewonlineonedriveaccess.space
hxxp://tomatupanel.fun
hxxp://terretoryfany.site
hxxp://online365-app.com
hxxp://xn--biochchan-75a.com
hxxp://secure-libero.website
hxxp://virgilio-secure.site
hxxp://fortunanasha.tech
hxxp://rawandrais.icu
hxxp://myetherevvalliet.com
hxxp://libero-myhost.site
hxxp://jeuxconsoles-discount.com
hxxp://365onlinereactive.com
hxxp://dhgfdg4576.space
hxxp://hgdhgfd253.space
hxxp://rasavagulle.site
hxxp://cxbcvxsgste.site
hxxp://droneisgood.site
hxxp://meine-db-account-i73983479.com
hxxp://keilaiel20eiskfli.icu
hxxp://com-hosting.site
hxxp://com-hosted.site
hxxp://telstra-bonus.site
hxxp://optusnet.site
hxxp://buycheapsslalmostfree.top
hxxp://facebook-s2.com
hxxp://facebook-s1.com
hxxp://whitepanda.xyz
hxxp://droneisgood.host
hxxp://readthisfile.site
hxxp://it-now.site
hxxp://blackpandas.xyz
hxxp://pinkpandas.xyz
hxxp://facebook-listings.com
hxxp://it-hosting.site
hxxp://facebook-st.com
hxxp://libero-it.host
hxxp://bluepandas.xyz
hxxp://it-hosts.site
hxxp://it-webs.site
hxxp://ksajda9ijlsadlkriilaoiiill.icu
hxxp://facebook-secure.com
hxxp://nabmobile.site
hxxp://whitepanthers.xyz
hxxp://nintendo-swltch.net
hxxp://loginonline-signup.host
hxxp://cibconline-cibc.host
hxxp://facebook-listing.com
hxxp://facebook-itm.com
hxxp://rbconlinebanking.icu
hxxp://cibconline.icu
hxxp://bmoonline.icu
hxxp://ffv2-test.icu
hxxp://prospera.fun
hxxp://biggertodayyes.com
hxxp://tomcat-ones.host
hxxp://rowashovel.top
hxxp://client-sofinco.net
hxxp://id198101.icu
hxxp://lves1.icu
hxxp://pinkpanthers.xyz
hxxp://blackpanthers.xyz
hxxp://mabanquepro-bnpparibas.com
hxxp://facebook-area.com
hxxp://scotiaonlinebanking.icu
hxxp://appletown.top
hxxp://p4a44.icu
hxxp://com-web.site
hxxp://myvodafone-billing.com
hxxp://a35hbflsefgegb33qa.xyz
hxxp://bootstrap-cdn.site
hxxp://icuuaiwqa.icu
hxxp://wrasawa.icu
hxxp://malaysidnspod.top
hxxp://kqopkfkdormiodldkgoyjojykjy.us
hxxp://jquery-dll.net
hxxp://electrumserver.space
hxxp://de-sicherheit09101.host
hxxp://secure-updt.online
hxxp://liev1.icu
hxxp://ludisfhiuasdnginkjeasgvr.us
hxxp://mabanque-paribas.host
hxxp://restore-limited-paypai.com
hxxp://mabanque-paribas.site
hxxp://tatalsecurity.icu
hxxp://libero-it-safe.site
hxxp://nibiru.fun
hxxp://libero-secure.site
hxxp://pablos.fun
hxxp://mailo2.website
hxxp://mailo2.site
hxxp://ghostxxl.icu
hxxp://123321234.online
hxxp://mabanqueparibas-pro.host
hxxp://carshome.icu
hxxp://myetherewaliet.com
hxxp://ghostwillneverdie.icu
hxxp://carrefourbanque-compte.com
hxxp://mail-onet.site
hxxp://teamviewer-device.com
hxxp://onet-mail.site
hxxp://restricted-users-paypai.com
hxxp://teamviewinfo.host
hxxp://ghost2go.icu
hxxp://fghjkmgru34.site
hxxp://sldomanuydsaidya.site
hxxp://primtuning.su
hxxp://shost.host
hxxp://pipkin.host
hxxp://trasolevelqvines.com
hxxp://mail-interi.site
hxxp://ghjk645u54.site
hxxp://ghjjkrte43y43.site
hxxp://virgilioweb.site
hxxp://serverisavaliable.host
hxxp://giewont2.site
hxxp://virgiliomail.site
hxxp://immoscout24web.site
hxxp://simplii.com.ng
hxxp://mail-tim.site
hxxp://activehostnet.com
hxxp://sysupdate.icu
hxxp://testingd.site
hxxp://myarubaweb.site
hxxp://slowkindea.space
hxxp://slowkinwkfl.icu
hxxp://petro-canada.com.ng
hxxp://tiscaliweb.site
hxxp://masterhost.icu
hxxp://sslsecure.host
hxxp://bigpond-bonus.com
hxxp://webmail-aruba.site
hxxp://webmail-aruba.host
hxxp://topgames22.online
hxxp://securedvalidationonline.icu
hxxp://wpwebmail.site
hxxp://msprotect.icu
hxxp://mabanqueparibas-pro.com
hxxp://metamask.site
hxxp://nabaccounts.com
hxxp://mabanqueparibas-pro.site
hxxp://myliberomail.site
hxxp://www-1royalbank.com
hxxp://ffpaneladmin.icu
hxxp://donatekids.host
hxxp://co-operative-bank.site
hxxp://addhfgxhcjkhkgzdfdh.xyz
hxxp://3n0rmous.xyz
hxxp://belangrijk-verifieren.site
hxxp://reports-service.site
hxxp://superone.host
hxxp://favor1.host
hxxp://rwadadcaasxc.website
hxxp://legmax.xyz
hxxp://astritbull.site
hxxp://sealproxypanel.website
hxxp://0ggun.xyz
hxxp://caravvan.xyz
hxxp://cuddlyy.xyz
hxxp://commercedate.online
hxxp://enterpriseperiod.store
hxxp://barbaramela.site
hxxp://amerlcanexpress.icu
hxxp://chachingconsignments.fun
hxxp://firebug.online
hxxp://pozhsoyuz.site
hxxp://alienlux.xyz
hxxp://emporarms.website
hxxp://crnightmare.at
hxxp://sendspace.fun
hxxp://injs777.site
hxxp://muchodinero.site
hxxp://dropmyddd.site
hxxp://jn31j81kjjwjk1999j21.fun
hxxp://ssaite.site
hxxp://j2888hennene.site
hxxp://kossmoss.space
hxxp://clients-boursorama.site
hxxp://clients-boursorama.host
hxxp://adidass.fun
hxxp://oddd02.xyz
hxxp://royalbankreward.com
hxxp://migs-mastercard.com
hxxp://greatdor.space
hxxp://amazon-client.icu
hxxp://mabanque-bnpparibas.host
hxxp://societegnerale.host
hxxp://gakserol.site
hxxp://islacangrejo.fun
hxxp://zefirone.fun
hxxp://amerlcanexpress.site
hxxp://everydayysl.space
hxxp://com-signin-encoding-utf8-ignoreauthstate-1.host
hxxp://societegnerale.website
hxxp://confvalid.site
hxxp://myloveworld.space
hxxp://jobpol.host
hxxp://flash-player.website
hxxp://nikes.fun
hxxp://anu-21.site
hxxp://holedeyklassik.art
hxxp://neep02.host
hxxp://neep01.host
hxxp://adsdasdee.icu
hxxp://sicherheitcenter-pp6627736432.xyz
hxxp://banquebnpparlbas.site
hxxp://apple10.host
hxxp://banquebnpparlbas.website
hxxp://banquebnpparlbas.host
hxxp://goga01.xyz
hxxp://reer02.xyz
hxxp://reer01.xyz
hxxp://cdnpack.net
hxxp://interstack.space
hxxp://account-365online.com
hxxp://sparkasse-spk.xyz
hxxp://wradascxa.icu
hxxp://vendorresgistrations.com
hxxp://looddd02.xyz
hxxp://otss02.xyz
hxxp://lodi01.xyz
hxxp://alcpuupdate.com
hxxp://tolunger.icu
hxxp://goga02.xyz
hxxp://lodi02.xyz
hxxp://qeqweadas.icu
hxxp://gdfasadas.xyz
hxxp://oddd01.xyz
hxxp://belangrijk-alerts.icu
hxxp://belangrijk.site
hxxp://mastercard-migs.com
hxxp://hunthoster.icu
hxxp://google-query.com
hxxp://betterliverightnow.com
hxxp://homses.xyz
hxxp://netsocket.space
hxxp://looddd01.xyz
hxxp://jennyspopfunsite.com
hxxp://suncorenergycorp.com
hxxp://rbc-rewards.com
hxxp://radqdeasda.icu
hxxp://monikadate.space
hxxp://per02.xyz
hxxp://per02.fun
hxxp://facebook-bay.com
hxxp://facebook-us.com
hxxp://postecartaonline.com
hxxp://restore-facebook.com
hxxp://recover-facebook.com
hxxp://uppan.site
hxxp://jquery-assets.com
hxxp://kkkk03.site
hxxp://loodd01.xyz
hxxp://loodd02.xyz
hxxp://bestlifelivingnow.com
hxxp://royalbank-rewards.com
hxxp://petrocanada-giftcard.com
hxxp://sparkasse-spk.host
hxxp://dnspods.space
hxxp://rtfadsqsc.icu
hxxp://berline-sparkasse.site
hxxp://quitameloya1980.fun
hxxp://winstatic.host
hxxp://abrozhpavel.com
hxxp://berliner-sparkasse.site
hxxp://rqweasdsas.icu
hxxp://canadapost-delivery.com
hxxp://epost-canadapost.com
hxxp://aradfwass.icu
hxxp://kff02.host
hxxp://kff01.host
hxxp://gstaticapi.com
hxxp://faceapiget.com
Sample domains known to have been involved in the campaign include:
hxxp://blackmoneyonline.su
hxxp://asggf.su
hxxp://netflix-payment-update.com
hxxp://infosalerts-scotia.com
hxxp://claims-alert.com
hxxp://rc6-notification.com
hxxp://vancity-alerts.net
hxxp://uk-auth-c47.com
hxxp://13bmo-online.com
hxxp://wellsfargolive.us
hxxp://velyntawa.su
hxxp://brickgeld24k.su
hxxp://ghostandmo.su
hxxp://tmpower.su
hxxp://idletevengcaltan.net
hxxp://billing3289.com
hxxp://cnfrmmobile.com
hxxp://confrmobilee.com
hxxp://olekwindykacja.com
hxxp://download-adobe.online
hxxp://rc08-notifications.com
hxxp://rc07-notifications.com
hxxp://www-td-easyweb.net
hxxp://bmo1337.su
hxxp://www1-netflix.com
hxxp://wellsverifyamerican.com
hxxp://jonaszkurier.com
hxxp://www-easyweb-td.com
hxxp://www-1netflix.com
hxxp://rc-04notifications.com
hxxp://notification-01.com
hxxp://rc7-notification.com
hxxp://uk-auth-c52.com
hxxp://dorotkakurier.com
hxxp://krasnodar14.su
hxxp://1bmo-info.com
hxxp://uk-auth-c49.com
hxxp://leoskurier.com
hxxp://leonekkurier.com
hxxp://refund-file.com
hxxp://golden-hour.info
hxxp://usakozliblaha.info
hxxp://skoroviboriunas.info
hxxp://cashconsultconsult.info
hxxp://cryptinvestcash.info
hxxp://cashinvestcashby.info
hxxp://moneyprofitmoneyby.info
hxxp://apply-details.com
hxxp://nadjakurier.com
hxxp://1payments-netflix.com
hxxp://scotiainfos-alerts.net
hxxp://renewal-alert.com
hxxp://debit-alert.com
hxxp://billing-alert.com
hxxp://secure-refunds.com
hxxp://update-alerts.com
hxxp://rc5-notification.com
hxxp://verify-link.com
hxxp://gb-secureform.com
hxxp://secure-debit.com
hxxp://repay-details.com
hxxp://failed-billing.com
hxxp://apply-forms.com
hxxp://hecahedttoftoft.com
hxxp://5-notifications.com
hxxp://notifications-2.com
hxxp://www-netflix-payment.com
hxxp://uk-auth-c60.com
hxxp://scotiamobileonline.com
hxxp://rc3-notifications.com
hxxp://cibc-mobile-online.com
hxxp://alankurier.com
hxxp://card-house.su
hxxp://updat3s.com
hxxp://tax-files.com
hxxp://blockchain-com.su
hxxp://3uploxd.com
hxxp://uk-auth-c46.com
hxxp://rc09-notifications.com
hxxp://netflix-qc.com
hxxp://uk-auth-c50.com
hxxp://just-etm.com
hxxp://kentuckycloud.com
hxxp://uk-auth-c37.com
hxxp://uk-auth-c38.com
hxxp://uk-auth-c53.com
hxxp://reclaim-alerts.com
hxxp://nl-www-rabobank.net
hxxp://1online-scotia.com
hxxp://claims-site.com
hxxp://uk-auth-c54.com
hxxp://uk-auth-c45.com
hxxp://apply-tax-returns.com
hxxp://notifications-01.com
hxxp://maintenance-enlignenetbnx.com
hxxp://4rbc-notification.com
hxxp://nl-knab.xyz
hxxp://giffgaff-new1.com
hxxp://netflix-infos.com
hxxp://notifications-8.com
hxxp://diankakurier.com
hxxp://plsdontkillthisoneihaveafamily.xyz
hxxp://seriouslyigotkidsdontkillthisdomain.xyz
hxxp://salomeakurier.com
hxxp://yellpt.bid
hxxp://cryptpress.bid
hxxp://shoutpt.bid
hxxp://yellgold.bid
hxxp://homecrypt.bid
hxxp://shoutplatinum.bid
hxxp://criped.bid
hxxp://www-netflixinfo.com
hxxp://6-notifications.com
hxxp://errorpayment-netflixinfo.com
hxxp://tax-alert-service.com
hxxp://login-my.com
hxxp://9notifications.com
hxxp://start-reclaim.com
hxxp://notify-bill.com
hxxp://rc-07verify.com
hxxp://netflix-1info.com
hxxp://failed-debit.com
hxxp://tax-site.com
hxxp://8-notifications.com
hxxp://rc-1notifications.com
hxxp://tv-licensing02.com
hxxp://vodaphone-au.com
hxxp://www-tdeasyweb.com
hxxp://rc-8verify.com
hxxp://rastreo-correos.com
hxxp://connectdns1.su
hxxp://gackokurier.com
hxxp://nl-asnbank.xyz
hxxp://blockchaln.su
hxxp://uk-auth-c42.com
hxxp://hotgirlsmeet.info
hxxp://fastinvestment.bid
hxxp://investcrypt.bid
hxxp://linkinside.bid
hxxp://primtuning.su
hxxp://cdndns.su
hxxp://sshvps.site
hxxp://long118.cn
hxxp://cryptgroup.bid
hxxp://girlsmyygirls.info
hxxp://prettygirlsprettymy.info
hxxp://girlsmysweetygirls.info
hxxp://moneycashcryptinvestpay.info
hxxp://datinggirlsweetmy.info
hxxp://investcryptmoney.info
hxxp://investcrypt1.info
hxxp://cryptproduction.bid
hxxp://pr0st0br0.info
hxxp://girlsmygirls.info
hxxp://microsoftdatacentreupdate.info
hxxp://newcrypt.bid
hxxp://cryptministries.bid
hxxp://farcrypt.bid
hxxp://cryptllc.bid
hxxp://seacrypt.bid
hxxp://cryptg.bid
hxxp://hotcrypt.bid
hxxp://ptfromanalysts.bid
hxxp://lustcrypt.bid
hxxp://cryptenterprises.bid
hxxp://yellpts.bid
hxxp://cryptdesign.bid
hxxp://allowinvest.bid
hxxp://krasnayaarmiyavsexsilney.su
hxxp://primtuning.com
hxxp://tmnjgpifhtqy.com
hxxp://ru-tv-in-china.com
hxxp://failed-login.com
hxxp://claim-myrefund.com
hxxp://kingakurier.com
hxxp://worldinvest.bid
hxxp://allcrypt.bid
hxxp://weepsilver.bid
hxxp://bodycrypt.bid
hxxp://shoutgold.bid
hxxp://callpt.bid
hxxp://weepgold.bid
hxxp://goinvestment.bid
hxxp://cryptservice.bid
hxxp://gmoneymachine.bid
hxxp://clickinvoice.bid
hxxp://arrowcash.bid
hxxp://optinsider.bid
hxxp://bestworldcrypt.bid
hxxp://clickarrow.bid
hxxp://machinecashx.bid
hxxp://swwatch.su
hxxp://zinvest.bid
hxxp://bestinsider.bid
hxxp://btcxcash.bid
hxxp://popinvest.bid
hxxp://keyinsiders.bid
hxxp://bestcashinvest.bid
hxxp://btcinsider.bid
hxxp://metabankonlines.info
hxxp://meetgerlsmeetmeet.info
hxxp://moneycryptmoneyinvest.info
hxxp://cryptmoneycashpay.info
hxxp://earncryptprofi.info
hxxp://profitcryptproffi.info
hxxp://cryptincrypt.info
hxxp://hotmeethotgerls.info
hxxp://slickinsiders.info
hxxp://fundgestia.com
hxxp://fondgestia.com
hxxp://wintercorp.info
hxxp://argenta-online.info
hxxp://bluetek1.com
hxxp://redtek0.com
hxxp://greentek2.com
hxxp://fastgenius.info
hxxp://metabankonline.info
hxxp://metabankonlin.info
hxxp://onlinesmetabank.info
hxxp://onlinemetabank.info
hxxp://easyfinancias.info
hxxp://clicktogethers.info
hxxp://investogo.info
hxxp://profitearnmoneycashinvest.info
hxxp://leakfinance.info
hxxp://duralcrypt.info
hxxp://gocenstersite.info
hxxp://nothstreams.info
hxxp://quasyclick.info
hxxp://breathclick.info
hxxp://cloackinvesting.info
hxxp://investininvest.info
hxxp://return-pay1.com
hxxp://americanexpressus.com
hxxp://loginmijning.com
hxxp://en-gb-user-update.com
hxxp://santatotta.com
hxxp://tottasanta.com
hxxp://login-user-panel.com
hxxp://investsoinvest.info
hxxp://moneyconsultearn.info
hxxp://investprofitbprofit.info
hxxp://profitbymoney.info
hxxp://profitbprofit.info
hxxp://cashmybycash.info
hxxp://investmmminvest.info
hxxp://profitaprofit.info
hxxp://cryptmycryptmycrypt.info
hxxp://investdinvest.info
hxxp://investcinvest.info
hxxp://investbyinvest.info
hxxp://investbinvest.info
hxxp://investsssinvest.info
hxxp://investainvest.info
hxxp://profitprofitprofitearn.info
hxxp://moneycryptinvestru.info
hxxp://profitprofitprofitby.info
hxxp://nightgirlsmeet.info
hxxp://consultcryptmycrypt.info
hxxp://sweetmeethothot.info
hxxp://meetgirlsmeets.info
hxxp://sweetgirlshotmeet.info
hxxp://cashcryptivestmy.info
hxxp://secretpath.xyz
hxxp://rbc3-notification.com
hxxp://claims-gb.com
hxxp://silverticket.xyz
hxxp://blackbug.xyz
hxxp://myfamilyissufferingfromcoronavirus.xyz
hxxp://brotherinlawwbutwhatlawbro.xyz
hxxp://pay-sagepay.com
hxxp://rc2-refunds2.com
hxxp://fullzinfo.su
hxxp://rc-forms1.com
hxxp://uk-auth-c13.com
hxxp://playmarketupdated.su
hxxp://uk-auth-c14.com
hxxp://dreamleader.xyz
hxxp://uk-auth-c16.com
hxxp://return-pay.com
hxxp://weryfikacja-kosmetyczki.com
hxxp://rc1-refund1.com
hxxp://rc2-refund2.com
hxxp://1-rc-returns1.com
hxxp://rabobank-update.com
hxxp://rabobank-app.com
hxxp://netflix-access.com
hxxp://chargeback-365online.com
hxxp://rc1-refunds1.com
hxxp://uk-auth-c17.com
hxxp://particu-bancosantander.net
hxxp://myfirstdomain.xyz
hxxp://paymentinfo-uk.com
hxxp://ottokurier.com
hxxp://belasting-achterstand.su
hxxp://mistermacambomacaorolefirst.xyz
hxxp://nl-www-rabobank.xyz
hxxp://aaronkurier.com
hxxp://scotiabank-notification.com
hxxp://allankurier.com
hxxp://1payment-netflix.com
hxxp://myclaim-form.com
hxxp://info-bill1.com
hxxp://rc-8notification.com
hxxp://login-policy-engb.com
hxxp://en-gb-login.com
hxxp://en-gb-policy.com
hxxp://bomerganghinigni.xyz
hxxp://marqueruqueqnf.xyz
hxxp://uk-auth-c25.com
hxxp://www-scotia-bank.com
hxxp://ignacykurier.com
hxxp://antivirusufuckingbastardpieceofshit.xyz
hxxp://maqueriamqueri.xyz
hxxp://refund-form351.com
hxxp://rebate170520.com
hxxp://nl-knab.com
hxxp://gkoaksooaosdkax.xyz
hxxp://paczkaadam.com
hxxp://anzsecure-message.online
hxxp://kosmakurier.com
hxxp://uk-ref7z2i.com
hxxp://lifikurier.com
hxxp://liedger.com
hxxp://leigder.com
hxxp://tax027refund.com
hxxp://uk-auth-c35.com
hxxp://rbcroyalbank-onlinebanking.com
hxxp://deutschland-sicher-v1.su
hxxp://sicherheitsverfahren-v2-cust238473838.su
hxxp://update-no234938-23.su
hxxp://billing-return-info.com
hxxp://kuberpain.com
hxxp://re32ff5game.com
hxxp://patriciakurier.com
hxxp://fromatodor.com
hxxp://incartupseii.com
hxxp://quezstresser.su
hxxp://evri-missed-shipment.com
hxxp://signin-twilio.com
hxxp://brickedpack.com
hxxp://packedbrick.com
hxxp://vancity-cu.net
hxxp://arbuthnotlathum.com
hxxp://fraudprevention-365online.com
hxxp://security-hsbc-cancelpayeess.com
hxxp://uk-forms2.com
hxxp://911-s5.su
hxxp://withdrawal-procedure.com
hxxp://assets-withdrawal.com
hxxp://blockfi-procedure.com
hxxp://bill-revise1.com
hxxp://bartlomiejkurier.com
hxxp://bastiankurier.com
hxxp://2rbc-notification.com
hxxp://alexkurier.com
hxxp://employee-twilio.com
hxxp://e-thesbank.com
hxxp://mlclo.com
hxxp://update-bill1.com
hxxp://sarakurier.com
hxxp://sabinakurier.com
hxxp://rbc1-notification.com
hxxp://salmakurier.com
hxxp://rc-7notifications.com
hxxp://rc8-notifications.com
hxxp://pamelakurier.com
hxxp://oksanakurier.com
hxxp://rbc-notification.com
hxxp://rc-4notifications.com
hxxp://nelikurier.com
hxxp://nicolakurier.com
hxxp://nadiakurier.com
hxxp://aleksykurier.com
hxxp://notification-scotiabank.com
hxxp://nelakurier.com
hxxp://notifcations-9.com
hxxp://noemikurier.com
hxxp://ninakurier.com
hxxp://heronimkurier.com
hxxp://nexpro.su
hxxp://rbcmobile-notification.com
hxxp://rc-verifications5.com
hxxp://claim-rebate.com
hxxp://rc-verification05.com
hxxp://netflix-payments.net
hxxp://verification9.com
hxxp://reclaim-taxs.com
hxxp://payment-failed.com
hxxp://update-claim.com
hxxp://update-data.com
hxxp://verifications3.com
hxxp://verify-now.com
hxxp://verify-updates.com
hxxp://uk-auth-c63.com
hxxp://swipestore.su
hxxp://update-my-bill.com
hxxp://uk-auth-c61.com
hxxp://7-verification.com
hxxp://fghj.su
hxxp://02verifications.com
hxxp://soyjuancamaneipapayork.com
hxxp://renew-bills.com
hxxp://bill-failed.com
hxxp://claim-updates.com
hxxp://update-my3.com
hxxp://kesjakurier.com
hxxp://kaylakurier.com
hxxp://rewardscenter-royalbank.com
hxxp://rc-verifications08.com
hxxp://rebate-returns.com
hxxp://acc-update.com
hxxp://8-verification.com
hxxp://7-verifications.com
hxxp://inetbank-secure.com
hxxp://rabobank-verificatie.com
hxxp://refund-alert.com
hxxp://florentynakurier.com
hxxp://verifications-8.com
hxxp://uk-auth-c76.com
hxxp://verifications2.com
hxxp://rc-verification2.com
hxxp://8-verifications.com
hxxp://petrocanada-suncorp.com
hxxp://process-01.com
hxxp://rc-verifications7.com
hxxp://refund-details.com
hxxp://rc-verification02.com
hxxp://rc3-process3.com
hxxp://rc-7verification.com
hxxp://adsbanner.su
hxxp://cdn-clients.su
hxxp://rc-verifications3.com
hxxp://uk-auth-c65.com
hxxp://verification2.com
hxxp://notice-refund.com
hxxp://verifications-03.com
hxxp://upgrade-subscription.com
hxxp://claim-details.com
hxxp://rc-verifications1.com
hxxp://rc-1process1.com
hxxp://uk-auth-c67.com
hxxp://5-verifications.com
hxxp://failed-notice.com
hxxp://7verifications.com
hxxp://renew-claim.com
hxxp://chouse.su
hxxp://chase-online.net
hxxp://myclaim-details.com
hxxp://365boi-service.com
hxxp://cerbernice.com
hxxp://ewakurier.com
hxxp://boi-settings.com
hxxp://365onlinecontact.com
hxxp://03-verification.com
hxxp://refund-alerts.com
hxxp://reclaim-alert.com
hxxp://quitameloya1980.com
hxxp://franciszkakurier.com
hxxp://mynetdata.su
hxxp://5verifications.com
hxxp://verification05.com
hxxp://rc4-verification.com
hxxp://failed-payment.com
hxxp://verify-alert.com
hxxp://rc-3verifications.com
hxxp://check-claim.com
hxxp://rebate-return.com
hxxp://update-form.com
hxxp://update-renew.com
hxxp://mbtc.su
hxxp://bill-update.com
hxxp://1-verifications.com
hxxp://boi-online365.com
hxxp://rc1-process.com
hxxp://bcuk-secure.com
hxxp://myposte-sicurezza.net
hxxp://verifications-4.com
hxxp://uk-security1.com
hxxp://process-0.com
hxxp://pro-cess1.com
hxxp://rc4-process.com
hxxp://refund-support.com
hxxp://user-recovery-panel.com
hxxp://tlbcorporation.su
hxxp://benjaminkurier.com
hxxp://securitybanking-bofa.com
hxxp://claim-alert.com
hxxp://rc-processes1.com
hxxp://bill-alerts.com
hxxp://www-bnpparibasbe.xyz
hxxp://myclaim-update.com
hxxp://365-online-boi.com
hxxp://verifcations01.com
hxxp://verify365online.com
hxxp://rc-process1.com
hxxp://boi-365-online.com
hxxp://boi-365online.com
hxxp://majakurier.com
hxxp://1-proccesses1.com
hxxp://rc1-processes1.com
hxxp://s-panel.su
hxxp://uk-forms1.com
hxxp://uk-auth-c09.com
hxxp://dobssn.su
hxxp://uk-auth-c12.com
hxxp://fullzdaddy.su
hxxp://access-mybarclaycard.com
hxxp://uk-auth-c01.com
hxxp://blockchain-wallet.su
Sample domains known to have been involved in the campaign include:
hxxp://jewelnetspacecon2.com
hxxp://grelkafestivales.com
hxxp://greenlandsurround.com
hxxp://gyeonggidoo.com
hxxp://termscenter.com
hxxp://paunsaugunt.com
hxxp://precambrianera.com
hxxp://naumokukea.com
hxxp://gunnisonandco.com
hxxp://bariomowel.com
hxxp://kiribatirepublic.com
hxxp://thekavango.com
hxxp://katananestwate.com
hxxp://jquerycloud.com
hxxp://mangroveforests.com
hxxp://molothunsen.com
hxxp://google-checkout.com
hxxp://google-apic.com
hxxp://steerdemens.com
hxxp://longvoyages.com
hxxp://klegrandlichgrum.com
hxxp://keitbeschutzen.com
hxxp://societegnerale.net
hxxp://germsguide.com
hxxp://msquirms.com
hxxp://escadrenalcortex.com
hxxp://dawkspace.com
hxxp://gebrauchlichtal.com
hxxp://crarepo.com
hxxp://pineloseesrae.com
hxxp://statexplore.com
hxxp://cdndeskpro.com
hxxp://updatestic.com
hxxp://com-signin-ap.com
hxxp://one85.net
hxxp://acrelop.com
hxxp://martinlloyd.net
hxxp://autarla.com
hxxp://autojspack.com
hxxp://sectionget.com
hxxp://fbpixelget.com
hxxp://olarkcdn.com
hxxp://natiapropoint.com
hxxp://opendoorcdn.com
hxxp://brucewayneint.com
hxxp://bbenttexas.com
hxxp://artatighab.com
hxxp://airsarald.com
hxxp://archessee.com
hxxp://toptrendclub.com
hxxp://prototipussnewssoft.com
hxxp://ww1royalbankacess.com
hxxp://jomarako.com
hxxp://jfqiv58gvqw23.com
hxxp://aiiesspress.com
hxxp://updatester.com
hxxp://neonwise.com
hxxp://signon-telstra.com
hxxp://bestbtcchange.com
hxxp://penthausebrones.com
hxxp://sectionio.com
hxxp://myxintad.com
hxxp://bestpolandhotels.com
hxxp://telstra-email.com
hxxp://lumatimesquare.net
hxxp://kt7u5i6dffvb6.com
hxxp://ww1royalbank.com
hxxp://clientsignin-royalbank.com
hxxp://w1b2s3.com
hxxp://royalbankbanking.com
hxxp://electrumsuppor.com
hxxp://rapidbtcinvest.com
hxxp://com-cgi-bin-4vyr6xsikedj-www-desjardins.com
hxxp://online-simplii.com
hxxp://checkout-sagepay.com
hxxp://thomasuncas.com
hxxp://airshum.com
hxxp://thepleasurelive.com
hxxp://mybookflightonline.com
hxxp://smksite.com
hxxp://topapigate.com
hxxp://lbirineswket.com
hxxp://kvarttet.com
hxxp://bigpond-login.com
hxxp://5bignewsites.com
hxxp://robotsrobotrss.com
hxxp://electrumsupportbtccrypt.com
hxxp://electrumsupp.com
hxxp://electrumsupports.com
hxxp://electrumsuppo.com
hxxp://prometai.com
hxxp://kztmail.com
hxxp://helptts.com
hxxp://go1go1go1go2.com
hxxp://priceapigate.com
hxxp://hardyqeeens.com
hxxp://ssl-load-i3943488930284.com
hxxp://bonus-prepaid.com
hxxp://profilazionecarige.top
hxxp://brazzb.top
hxxp://ksajda9jsadlkriilaoiii.top
hxxp://ffv2-test.top
hxxp://myethvvallet.com
hxxp://gma00il.com
hxxp://cryptonback.com
hxxp://mildibsilgip.com
hxxp://allpaysru.com
hxxp://dlrowwen.com
hxxp://eroomia.com
hxxp://a1lgon.com
hxxp://iloveshaus.com
hxxp://youlifesucks.wang
hxxp://youlifemylife.wang
hxxp://readmefile.top
hxxp://resilchird.com
hxxp://tuckong.com
hxxp://turedneez.com
hxxp://rineialav.com
hxxp://swiloodex.com
hxxp://sastabiak.com
hxxp://towagen.com
hxxp://dns16-microsoft-healths.com
hxxp://hublids.com
hxxp://baminamum.com
hxxp://prohomedevs.com
hxxp://torinboo.com
hxxp://marinechil.com
hxxp://asianspades.com
hxxp://gpsdrlow.net
hxxp://gomisacar.com
hxxp://id3892.com
hxxp://nextmirage2.com
hxxp://velma-harber30ku.com
hxxp://re8v7iew-n0w.com
hxxp://3-netflx.com
hxxp://1-rogers.com
hxxp://kitemimbe.com
hxxp://lawrencemaths.com
hxxp://electrumsupport.com
hxxp://electrumsupportbtc.com
hxxp://com-cgi-bin-1rjncvcdfgjs-www-desjardins.com
hxxp://com-cgi-bin-2a3jdsf4yfgj-www-desjardins.com
hxxp://1-netflx.com
hxxp://2-netflx.com
hxxp://5-netflx.com
hxxp://4-netflx.com
hxxp://cuyahogav.com
hxxp://upokachi.net
hxxp://odiuspack.net
hxxp://piedmontteem.com
hxxp://bigbrozz.com
hxxp://bristleconepin.com
hxxp://futboolspaceesk.com
hxxp://bystinkasjhpop.com
hxxp://jokenoiam.net
hxxp://jgu7-dkan-5827-asd.com
hxxp://kuskokwimca.com
hxxp://serviclodecorreos.com
hxxp://chumashpeople.com
hxxp://naturewood-com-my-sharepoint.com
hxxp://greatsmokym.com
hxxp://naturewood-my-sharepoint.com
hxxp://google-worlds.com
hxxp://google-thumbs.com
hxxp://google-codes.com
hxxp://dhlapk.com
hxxp://911-s5.com
hxxp://fastmycdn.com
hxxp://centos10.com
hxxp://barddistocor.com
hxxp://promakerboi.com
hxxp://canonical-cloud.com
hxxp://kpdfacu.net
hxxp://obghius.net
hxxp://ms-health-monitors.net
hxxp://didudida.net
hxxp://mills-skyla30ec.com
hxxp://laura9630fr.com
hxxp://maineacadia.com
hxxp://badlandsparks.com
hxxp://depotband.com
hxxp://lightgetjs.com
hxxp://cuyahogarave.com
hxxp://naukluftp.com
hxxp://rattlesnakespr.com
hxxp://ssltlsv2.com
hxxp://confirmssystems.com
hxxp://besfdooorkoora.com
hxxp://barjamanis.com
hxxp://biscayneinn.com
hxxp://uspcapitalss.com
hxxp://paypal-worldpay.com
hxxp://congareesc.com
hxxp://admin-autorization.com
hxxp://xdxdsd.net
hxxp://yuyuyups.net
hxxp://xyxyxt.net
hxxp://usbasd.net
hxxp://japanweterans.com
hxxp://sumliomicna.com
hxxp://brokercdn.com
hxxp://biderkomoso.com
hxxp://jolietamandatenasta.com
hxxp://dodidu.net
hxxp://bilaneped.com
hxxp://bonesta223s.com
hxxp://waterpocketfold.com
hxxp://amon-machinery.com
hxxp://cyberpunkstories.com
hxxp://interludeeurope.com
hxxp://blackhawkmining-my-sharepoint.com
hxxp://bhmining-my-sharepoint.com
hxxp://bhawkmining-my-sharepoint.com
hxxp://gjkajdjfj53.com
hxxp://maudqueen.com
hxxp://anwrsafari.com
hxxp://naturwood-my-sharepoint.com
hxxp://hpienergy-my-sharepoint.com
hxxp://carlsbadmx.com
hxxp://blackhawk-my-sharepoint.com
hxxp://blackhawkm-my-sharepoint.com
Sample domains known to have been involved in the campaign include:
hxxp://r3imburs3ment.com
hxxp://taxcra.com
hxxp://cobroserfinansa.com
hxxp://scotiainfos-alerts.com
hxxp://accountinforeviews.com
hxxp://poste-pratica.com
hxxp://mobiel-verlengen.com
hxxp://gruppo-bper-sicurezza.com
hxxp://bper-sicura.com
hxxp://poste-italiane-sicurezza.net
hxxp://com-cgi-bin-4aq05nksd-www-desjardins.com
hxxp://www-tdeasyweb.net
hxxp://supportdomainrev.com
hxxp://secure1-sessions.com
hxxp://rc2-apply2.com
hxxp://claim-verify.com
hxxp://hayateisland.com
hxxp://mijndigid-nl.com
hxxp://swimmingpoolz.com
hxxp://ethdv.com
hxxp://claim-uk89.com
hxxp://rebate-notice.com
hxxp://claim-notice.com
hxxp://uk-auth-v98.com
hxxp://bpost-pakket.com
hxxp://service1-account.com
hxxp://account1-service.com
hxxp://mijning-inlog-site.com
hxxp://wwwsns-bank.com
hxxp://bevestiginginfo-3d.com
hxxp://omgevingbeveiliging-3d.com
hxxp://mying-inlog.com
hxxp://greenwidow.xyz
hxxp://nlwww-knab.com
hxxp://wwwnl-knab.com
hxxp://account-bill1.com
hxxp://service-1account.com
hxxp://beveiligingopname-info.com
hxxp://bevestiginginfo-beveiliging.com
hxxp://1-processes.com
hxxp://rc-process2.com
hxxp://vb345.com
hxxp://vb67.com
hxxp://zippolighter.xyz
hxxp://mying-login.com
hxxp://tv-1licensing.com
hxxp://nab-verification.online
hxxp://rc-7verify.com
hxxp://rc-4verify.com
hxxp://ogusiakurier.com
hxxp://vb355.com
hxxp://uk-auth-c43.com
hxxp://www-bunq.net
hxxp://vb697.com
hxxp://vb939.com
hxxp://my-inglogin.com
hxxp://doublebatterys.com
hxxp://vb937.com
hxxp://claims-support.com
hxxp://cuenta-id.com
hxxp://fod-betalen.com
hxxp://mijning-login-site.com
hxxp://ethfd.com
hxxp://work-infos.com
hxxp://site-refund.com
hxxp://ethvg.com
hxxp://www-nlrabobank.com
hxxp://vb2021.com
hxxp://assistverify10.com
hxxp://ethdf.com
hxxp://ethvk.com
hxxp://pal-restricted.com
hxxp://wwwnlrabobank.com
hxxp://verify2-assist.com
hxxp://uk-claim102.com
hxxp://guerillathieves.com
hxxp://beveiligde-rekening.com
hxxp://three-5gnetwork.com
hxxp://verify-assist1.com
hxxp://rc-08verify.com
hxxp://1wwwnetflix.com
hxxp://meinelogin.com
hxxp://www-netfix.com
hxxp://rc-09verify.com
hxxp://fraud365online.com
hxxp://uk-auth-c44.com
hxxp://www-netflixsupport.com
hxxp://accountservice-1.com
hxxp://6xrp.com
hxxp://365chargeback.com
hxxp://1scotia-infos.com
hxxp://brajankurier.com
hxxp://emilkurier.com
hxxp://bernardkurier.com
hxxp://arminkurier.com
hxxp://bill-revise2.com
hxxp://voda-verify.com
hxxp://simonakurier.com
hxxp://sarahkurier.com
hxxp://rc-notifications7.com
hxxp://penelopekurier.com
hxxp://pelagiakurier.com
hxxp://iwokurier.com
hxxp://rebates-claims.com
hxxp://www-netflix.net
hxxp://www1-netflix.net
hxxp://claims-rebate.com
hxxp://9-verifications.com
hxxp://payments-netflix.net
hxxp://catharsis.site
hxxp://renew-bill.com
hxxp://chase-alerts.net
hxxp://start-refund.com
hxxp://aliakurier.com
hxxp://lolakurier.com
hxxp://petrocanada-personal.com
hxxp://rc-5verifications.com
hxxp://claim-apply.com
hxxp://rewards-rbcbank.com
hxxp://van-city-alerts.com
hxxp://rc-notifications1.com
hxxp://rc-9verification.com
hxxp://rc-verifications9.com
hxxp://tax-apply.com
hxxp://verify-bills.com
hxxp://refund-returns-info.com
hxxp://verification-5.com
hxxp://uk-auth-c74.com
hxxp://uk-auth-c72.com
hxxp://uk-auth-c68.com
hxxp://account-renewal.com
hxxp://tax-application.com
hxxp://bankofmontreai.com
hxxp://lisakurier.com
hxxp://lilakurier.com
hxxp://lailakurier.com
hxxp://rbcroyalbank-privacysecurity.com
hxxp://klarakurier.com
hxxp://klaudiakurier.com
hxxp://jutakurier.com
hxxp://rewards-royalbank.com
hxxp://update-bills.com
hxxp://bankingtriodos.com
hxxp://claim-repay.com
hxxp://tax-repay.com
hxxp://elenakurier.com
hxxp://ohmygodronnie3.com
hxxp://security-uk1.com
hxxp://faustynakurier.com
hxxp://serviceaccount-1.com
hxxp://claim-renewal.com
hxxp://wehailczar.com
hxxp://billing1-account.com
hxxp://account-billing1.com
hxxp://three5gnetwork.com
hxxp://rebate-report.com
hxxp://nl-www-kpn.com
hxxp://meinepostk.com
hxxp://rc-applications012.com
hxxp://nld2c.com
hxxp://kajakurier.com
hxxp://irakurier.com
hxxp://hestiakurier.com
hxxp://toysizabawki.com
hxxp://1-procces1.com
hxxp://aib-review-purchase.com
hxxp://aib-purchase-review.com
hxxp://uk-auth-c73.com
hxxp://submit-bill.com
hxxp://rebate-payment.com
hxxp://rc4-verifications.com
hxxp://alicjakurier.com
hxxp://verify-my-details.com
hxxp://uk-auth-c70.com
hxxp://gretakurier.com
hxxp://claim-repayment.com
hxxp://florencjakurier.com
hxxp://felicjakurier.com
hxxp://fatimakurier.com
hxxp://filomenakurier.com
hxxp://prosoftorgg.com
hxxp://www3-netflix.com
hxxp://02verification.com
hxxp://rebate-alert.com
hxxp://1rc-apply.com
hxxp://1-application.com
hxxp://vb497.com
hxxp://somelanes.com
hxxp://vb637.com
hxxp://rc1-process1.com
hxxp://vbeth.com
hxxp://1-application-1.com
hxxp://access-accounts1.com
hxxp://wwwsnsbank.com
hxxp://boguslawakurier.com
hxxp://rc2-processes2.com
hxxp://application1-uk.com
hxxp://vb527.com
hxxp://replay-alert.com
hxxp://tfuckantiviruscomingiprettyfastnow.xyz
hxxp://rc2-process.com
hxxp://fuckchanlderavg.xyz
hxxp://sslthree.com
hxxp://my3three.com
hxxp://yfieth.com
hxxp://elwirakurier.com
hxxp://elzbietakurier.com
hxxp://billing-1account.com
hxxp://coinbit-app.com
hxxp://chaseverificationupdate.com
hxxp://2application2.com
hxxp://prosoftorg.com
hxxp://nl-www-knab.com
hxxp://claims-form.com
hxxp://1rbc-online.net
hxxp://newloads.xyz
hxxp://samirakurier.com
hxxp://com-cgi-bin-4j56jkf48w3-www-desjardins.com
hxxp://gjd68ejdgkd567.com
hxxp://com-cgi-bin-1jht5ucdjsy-www-desjardins.com
hxxp://com-cgi-bin-257sdf3hq14-www-desjardins.com
hxxp://prntscrn.xyz
hxxp://quickuploader.xyz
hxxp://www-nl-knab.com
hxxp://qucikdownloadz.xyz
hxxp://www-ing-belgique.com
hxxp://bestload.xyz
hxxp://nl-rabobeheer.xyz
hxxp://www-videotron.com
hxxp://securemessage-cibc.com
hxxp://coolname.xyz
hxxp://www-cibconline.com
hxxp://lng-be.xyz
hxxp://bestwine.xyz
hxxp://www-ing-b.com
hxxp://tyrantthrone.xyz
hxxp://oldpocket.xyz
hxxp://nowheretogo.xyz
hxxp://netflixinfos.com
hxxp://www-ing-be.com
hxxp://scotiaonline-ca.net
hxxp://netflixpayment1.com
hxxp://albertkurier.com
hxxp://knab-koppelen.com
hxxp://correos-rastreo.com
hxxp://ineedtobringfoodonmykidstable.xyz
hxxp://unicredit-sicura.net
hxxp://thewitcherthree.xyz
hxxp://omgevingbeveiliging-ax.com
hxxp://my-ing-nl.com
hxxp://bevestiginginfo-ax.com
hxxp://digid-nl.com
hxxp://account-access1.com
hxxp://site-ing-login.com
hxxp://ing-site-nl.com
hxxp://csam-myebox-site.com
hxxp://uk-auth-v99.com
hxxp://site-mijning-nl.com
hxxp://rc-apply02.com
hxxp://rc-apply01.com
hxxp://rebate-service.com
hxxp://rc-application2.com
hxxp://online-renew.com
hxxp://societe-fraude.com
hxxp://anetakurier.com
hxxp://annakurier.com
hxxp://refunds-form.com
hxxp://site-mijning-inlog.com
hxxp://ref-393.com
hxxp://refund-renewal.com
hxxp://rc1process.com
hxxp://renew-form.com
hxxp://claims-renew.com
hxxp://1-process1.com
hxxp://rc-2application-02.com
hxxp://olakurier.com
hxxp://rc-2applications2.com
hxxp://rc-applications2.com
hxxp://2application2-uk.com
hxxp://returnref10.com
hxxp://returnform01.com
hxxp://1application1-uk.com
hxxp://rc2-applications2.com
hxxp://1rbc-mobile.com
hxxp://1-applications.com
hxxp://rc1-applications1.com
hxxp://reclaim-notice.com
hxxp://rc2-application2.com
hxxp://asiakurier.com
hxxp://1application-uk.com
hxxp://1rbc-web-banking.com
hxxp://rc2-application.com
hxxp://update-myee.com
hxxp://rc1-application1.com
hxxp://billing-giffgaff.com
hxxp://repay-alert.com
hxxp://1rc-apply1.com
hxxp://claims-supoort.com
hxxp://claim-alerts.com
hxxp://alerts-vancity.com
hxxp://rc1-apply1.com
hxxp://rc-application01.com
hxxp://uk-verify-now.com
hxxp://exsodus.net
hxxp://rc-forms2.com
hxxp://dcu-online.net
hxxp://rc-apply2.com
hxxp://1-royalbank.net
hxxp://rc-applications1.com
hxxp://rc-application1.com
hxxp://rc-apply1.com
hxxp://1rbc-banking.com
hxxp://9xrp.com
hxxp://bill-verif.com
hxxp://11xrp.com
hxxp://12xrp.com
hxxp://13xrp.com
hxxp://roamingonline.com
hxxp://kurierwujek.com
hxxp://rc2-returns2.com
hxxp://rc-refunds1.com
hxxp://rc-1refunds.com
hxxp://terms-rbc-updt.com
hxxp://rc-returns2.com
hxxp://rc-returns1.com
hxxp://uk1-returns1.com
hxxp://uk-returns2.com
hxxp://oldidea.xyz
hxxp://cibcmobile.com
hxxp://wongwong.xyz
hxxp://bloodborne.xyz
hxxp://newday.at
hxxp://return-rebate.com
hxxp://desjardinsmaintenanceaccw.com
hxxp://alert-activate-wf.com
hxxp://www-mijning.com
hxxp://lotekkurier.com
hxxp://rozakurier.com
hxxp://restore-id5889-paypai.com
hxxp://return-pay2.com
hxxp://uk-auth-c23.com
hxxp://restore-id7943-paypai.com
hxxp://rectify-user-paypai.com
hxxp://ref1297.com
hxxp://www1-royalbanking.com
hxxp://rebate-claim.com
hxxp://rc-6verification.com
hxxp://rc-verification8.com
hxxp://rc-verifications8.com
hxxp://rc-8verification.com
hxxp://igakurier.com
hxxp://genius-creditcard.com
hxxp://genowefakurier.com
hxxp://gloriakurier.com
hxxp://ilonakurier.com
hxxp://giuliakurier.com
hxxp://idakurier.com
hxxp://gajakurier.com
hxxp://gabrielakurier.com
hxxp://petrocanada-rewards.com
hxxp://idaliakurier.com
hxxp://optustoday.com
hxxp://billing-returns.com
hxxp://rebate-alerts.com
hxxp://payment-fail.com
hxxp://uk-auth-c64.com
hxxp://6-verification.com
hxxp://rc6-verification.com
hxxp://rc6-verifications.com
hxxp://verify-my-bill.com
hxxp://rewardsroyalbank.com
hxxp://suncorenergy-corp.com
hxxp://5-verification.com
hxxp://rc-verification5.com
hxxp://rc2-process2.com
hxxp://aib-cardpayment.com
hxxp://user-resolution-panel.com
hxxp://365cardfraud.com
hxxp://restore-user-functions.com
hxxp://rebate-01.com
hxxp://rectify-login-panel.com
hxxp://vancity-mobile.net
hxxp://restore-users-panel.com
hxxp://365-fraud.com
hxxp://fraudnotice-365online.com
hxxp://crisis-1.com
hxxp://bancochle.com
hxxp://fraudcheck-365online.com
hxxp://tottasant.com
hxxp://santantotta.com
hxxp://tottasantan.com
hxxp://stopfraud-365online.com
hxxp://santtotta.com
hxxp://qkjsaldkalkjfalk12312313.xyz
hxxp://login-engb.com
hxxp://signinmobile-secure.com
hxxp://restore-user-gb.com
hxxp://rabobanknlsecure.com
hxxp://rabsfkmsd.com
hxxp://njwefjsms.com
hxxp://betaalspass.com
hxxp://login-en-gb.com
hxxp://rectify-users-panel.com
hxxp://restore-user-panel.com
hxxp://www-netflix-alert.com
hxxp://secure-signinmobile.com
hxxp://refund-form323.com
hxxp://refund-form277.com
hxxp://case-id4927.com
hxxp://1209381203980aski.xyz
hxxp://case-id7628.com
hxxp://rbc-mobile.com
hxxp://lockbit-blog.com
hxxp://uk-auth-c26.com
hxxp://deepwhole.xyz
hxxp://www-netflix-update.com
hxxp://adasiapaczka.com
hxxp://uk-auth-c34.com
hxxp://ebankieren-be.com
hxxp://trezro.com
hxxp://trezior.com
hxxp://access-boa-secure.com
hxxp://www-login-blockchain.com
hxxp://www-netflix-support.com
hxxp://www-netflix-account.com
hxxp://adampaczka.com
hxxp://autovikup24.pw
hxxp://norbikurier.com
hxxp://abikurier.com
hxxp://refund-form347.com
hxxp://samantakurier.com
hxxp://scotiaonline-mobile.net
hxxp://apply-return1.com
hxxp://adkfjsadlkgjasdlkjaslkgjargq0rg.xyz
hxxp://bill-renew.com
hxxp://rc-01notifications.com
hxxp://online-beobank.com
hxxp://www-beobank.com
hxxp://cibc-securenotification.com
hxxp://scotiaonline-mobi.net
hxxp://rc06-notifications.com
hxxp://maintenance-enlignedsj.com
hxxp://www-bnp-paribas.com
hxxp://waniakurier.com
hxxp://claims-forms.com
hxxp://uk-auth-c57.com
hxxp://www-netflixpayment.com
hxxp://cyliakurier.com
hxxp://update-tv.com
hxxp://igorkurier.com
hxxp://www-bnpparibasfortis.com
hxxp://bunkercc.su
hxxp://payment1netflix.com
hxxp://ing-verlengen.pw
hxxp://netflix1-payment.com
hxxp://rebate-forms.com
hxxp://access-bofa-secure.com
hxxp://confirm-bill.com
hxxp://antkurier.com
hxxp://ebanking-be.com
hxxp://www-ingbelgium.com
hxxp://www-argenta.com
hxxp://secure-interac-updt.com
hxxp://poste-digitale-sicurezza.net
hxxp://postepay-sicurezza.net
hxxp://1royal-updt-secure.com
hxxp://unicreditsicurezza.net
hxxp://unicredit-titolari.net
hxxp://bomboomtactaky.xyz
hxxp://blacktotem.xyz
hxxp://bestquick.xyz
hxxp://inghomepay.com
hxxp://cassius.xyz
hxxp://heavywater.xyz
hxxp://nosunshine.xyz
hxxp://bill-form.com
hxxp://royal-securemessage.com
hxxp://posteitaliane-sicurezza-privati.net
hxxp://poste-italiane-sicurezza-privati.net
hxxp://uk-auth-c39.com
hxxp://gaff-details1.com
hxxp://aussi13eoskasd0p.xyz
hxxp://renewal-alerts.com
hxxp://poste-sicurezza-titolari.net
hxxp://armyoftwo.at
hxxp://7rbc-notification.com
hxxp://threeuk-1.com
hxxp://hughtree.at
hxxp://aanvraag-abnamro.info
hxxp://sappieportaal.info
hxxp://boomranch.at
hxxp://au-logon9.top
hxxp://quickload.xyz
hxxp://ivokurier.com
hxxp://www-netflixinfos.com
hxxp://au-logon8.top
hxxp://au-logon12.top
hxxp://au-logon11.top
hxxp://au-logon10.top
hxxp://dns-domaine.top
hxxp://bestdomain.site
hxxp://applessl.info
hxxp://sunsetsea.at
hxxp://rc-verify5.com
hxxp://www-abnamro.net
hxxp://askfjasfkjadfisdf.xyz
hxxp://rc-verify4.com
hxxp://rc-verify3.com
hxxp://claim-refund.com
hxxp://uk-auth-c51.com
hxxp://videotron-residential.com
hxxp://rc-verify2.com
hxxp://uk-auth-c40.com
hxxp://rc-verify1.com
hxxp://www-bunq.xyz
hxxp://morcin0o0o0.xyz
hxxp://aniuskurier.com
hxxp://rc-verify6.com
hxxp://1rbc-alerts.com
hxxp://1netflix-info.com
hxxp://unicredit-verifica.net
hxxp://poste-accesso.net
hxxp://www-ing-homepay.com
hxxp://returngov-1.com
hxxp://free-pc-soft-cracked.com
hxxp://www-abnamro.com
hxxp://sgkalkgnlakg.xyz
hxxp://posteitaliane-sicurezza.net
hxxp://returntax-1.com
hxxp://fund-2020.com
hxxp://smallsun.at
hxxp://terazwindykacja.com
hxxp://eliaszkurier.com
hxxp://rc9-notifications.com
hxxp://1www-netflix.com
hxxp://toughdomain.xyz
hxxp://sweetblue.xyz
hxxp://smokesome.xyz
hxxp://longwaytohell.xyz
hxxp://secure-bm0-updt.com
hxxp://rc-3verify.com
hxxp://rc-2verify.com
hxxp://nl-snsbank.com
hxxp://scotia-infosalerts.com
hxxp://infoonlinerev.com
hxxp://com-cgi-bin-3m4usclse-www-desjardins.com
hxxp://com-cgi-bin-2a2l98ndg-www-desjardins.com
hxxp://com-cgi-bin-17jd5sxod-www-desjardins.com
hxxp://poste-sicurezza-mobile.com
hxxp://poste-italiane-sicurezza.com
hxxp://int-bmo-upt.com
hxxp://rebate-site.com
hxxp://poste-decreto-privati.com
hxxp://tv-licences1.com
hxxp://rbc5-notification.com
hxxp://netflix-payinfo.com
hxxp://reviewaccount.net
hxxp://mps-sicurezza.net
hxxp://domsupport.net
hxxp://importancehighactionrequired.com
hxxp://videotron-services.com
hxxp://poste-verifica-titolare.net
hxxp://6rbc-notification.com
hxxp://jodakurier.com
hxxp://netflix1-info.com
hxxp://form-details.com
hxxp://nadinekurier.com
hxxp://1www-netfix.com
hxxp://vervang-bankpas.net
hxxp://rc8-notification.com
hxxp://bpergroup-sicurezza.net
hxxp://scotiaonline-alerts.com
hxxp://secure-desj-updt.com
hxxp://accweb-mouv-desjardins.com
hxxp://rabobanknl.net
hxxp://verifymobsmsca.com
hxxp://knefelkurier.com
hxxp://paperline.xyz
hxxp://tecihdata.at
hxxp://verifymobille.com
hxxp://security-chase-updt.com
hxxp://msmsv2.com
hxxp://scotiaonline-alerts.net
hxxp://app-tangerine.com
hxxp://valleyfirst-cu.com
hxxp://frankokurier.com
hxxp://www-asnbank.net
hxxp://www-sns.com
hxxp://bper-sicurezza.com
hxxp://jibliaiptv.xyz
hxxp://kikokiko.xyz
hxxp://nl-rabo.com
hxxp://security-bofa-updt.com
hxxp://secure-royal-updt.com
hxxp://poste-verifica-digitale.net
hxxp://rc-05verify.com
hxxp://vancity-alerts.com
hxxp://bacuskurier.com
hxxp://uk-auth-c41.com
hxxp://www-rabomail.com
hxxp://cardfraud365.com
hxxp://login-id37378.com
hxxp://uk-auth-c24.com
hxxp://login-id9272.com
hxxp://rebates-uk1.com
hxxp://totta-san-verificado.com
hxxp://totta-superlinha.com
hxxp://assessment-uk1.com
hxxp://sant-superlinha.com
hxxp://rebate-uk1.com
hxxp://followtheorgy.xyz
hxxp://c-returns.com
hxxp://c-refunds.com
hxxp://anyrandomname.xyz
hxxp://policy-user-update.com
hxxp://santan-superlinha.com
hxxp://www-bancosantander.xyz
hxxp://rbcmobile.net
hxxp://www-creditagricole.xyz
hxxp://alkadiakurier.com
hxxp://santan-totta-verificado.com
hxxp://uk-rebates1.com
hxxp://wellsfart-security1.com
hxxp://totta-sant-verificado.com
hxxp://licensing-02.com
hxxp://totta-santan-verificado.com
hxxp://sant-totta.com
hxxp://login-panel-engb.com
hxxp://santan-totta.com
hxxp://totta-santan.com
hxxp://totta-santa.com
hxxp://cnfrmobile.com
hxxp://anitkakurier.com
hxxp://poste-decreto-titolari.com
hxxp://finestart.at
hxxp://lessnumbers.at
hxxp://tax06rebate.com
hxxp://autovikup24.online
hxxp://teichdata.at
hxxp://pick2pic.xyz
hxxp://mobile-official.com
hxxp://scotia-1info.com
hxxp://poste-accesso-digitale.com
hxxp://poste-verifica-digitale.com
hxxp://refund-form-gb.com
hxxp://alawindykacja.com
hxxp://smokingpot.xyz
hxxp://rc05-notifications.com
hxxp://scotia2-notification.com
hxxp://online-scotia.net
hxxp://shameonyou.xyz
hxxp://rc-03notifications.com
hxxp://www-td-easyweb.com
hxxp://notification-03.com
hxxp://pawelwindykacja.com
hxxp://netflix1-infos.com
hxxp://kaziawindykacja.com
hxxp://jakubawindykacja.com
hxxp://claim-alert-gb.com
hxxp://annawindykacja.com
hxxp://04-notifications.com
hxxp://profwindykacja.com
hxxp://olawindykacja.com
hxxp://staswindykacja.com
hxxp://majawindykacja.com
hxxp://snsbank.pw
hxxp://uk-auth-c48.com
hxxp://renewal-form.com
hxxp://netflix-1infos.com
hxxp://ewciakurier.com
hxxp://claim-refund-gb.com
hxxp://10-notifications.com
hxxp://mobile-scotia.net
hxxp://renew-detail.com
hxxp://ref8237.com
hxxp://ref1694.com
hxxp://edytkakurier.com
hxxp://emilkakurier.com
hxxp://mineminecraft.xyz
hxxp://deeppool.xyz
hxxp://blueflag.xyz
hxxp://germanypanzer.xyz
hxxp://warmsun.xyz
hxxp://www-td-authentication.com
hxxp://www-netflixca.net
hxxp://revision-bill.com
hxxp://jankomornik.com
hxxp://renew-login.com
hxxp://netflix-1watch.com
hxxp://gb-update.com
hxxp://02-notifications.com
hxxp://arletkakurier.com
hxxp://amelkakurier.com
hxxp://adziakurier.com
hxxp://randomone.xyz
hxxp://fatslimboy.xyz
hxxp://scotia-infos-alerts.com
hxxp://www-authentication-td.com
hxxp://michaskurier.com
hxxp://adobe-update.store
hxxp://zapchastyny.tech
hxxp://test4test2test.site
hxxp://uk-auth-c55.com
hxxp://nofitications-7.com
hxxp://claim03.com
hxxp://1netflix-update.com
hxxp://nataliakurier.com
hxxp://mythree-official.com
hxxp://uk-auth-c58.com
hxxp://alert-update.com
hxxp://uk-auth-c59.com
hxxp://update-payments.com
hxxp://start-rebate.com
hxxp://cofeetree.at
hxxp://slicetwice.at
hxxp://sso234.com
hxxp://workatft.com
hxxp://viio.top
hxxp://trialpartys.com
hxxp://customersupport.top
hxxp://susirain.com
hxxp://snowbunch.com
hxxp://milkbased.com
hxxp://newlamp.at
hxxp://secure-ob.com
hxxp://dudetto.top
hxxp://blackcar.site
Sample MD5s known to have participated in the campaign include:
f905e13e4173b729e04e4890cb4e43e6
8fda0f476fe5b5a6fadcc0d48c7aa723
163a79fe07ad55433db4c41746d88383
c09ef8f4abe67bca93c589b57099cda0
d395f31ef5c5b3b3131667d2a491c09e
e7547d95cdd234c76ffc3886c5686f7a
d2fce61d6af3591f2b4c325977618c34
55264f1e9967979aab361c514023879f
eb2a513ebdb0682f955cf3d3d694f53f
13712db9c1f4f8a736b6a13bb7b88750
7da88c6a76233073392eda3c0e194945
e9d8e4e7a9e04ed6de75d6595d76ef7f
f905e13e4173b729e04e4890cb4e43e6
1487873262ad3552538209464dcfa324
f9f125970d8449535f134e5640a0fb67
9f00149b9fe09dc6c6410dae0e0b4669
8fda0f476fe5b5a6fadcc0d48c7aa723
f0ae686efc2dc92f747032c0d32fa2d1
95b3dfa13121169342923988edfaf518
440391a6c1b34bbecbe3aff1919dedd6
e94d1fc780d53d5a46b71b9aab288add
c3798777ed4ca35bc1cdf5e285e7646a
2fd3d8eb0cbae77c212534dbdee4cf8e
8f0eb1e9493c9045be2113bd86860351
7de09a43c2da8bf92755b257e3b49f83
4a6be0ce4aa70578bdee550acbbf7414
69e5ed9aec279294e34997335ee6f993
2f800547483ae821dd249eec67ba7c42
791447f627a95f43f18120c2db4517dc
db47e70f12e2dd8992cd96bf45134a6b
a4f8b7616f811325402ea3728ac4f79b
59c15a0ea49a509b2f1b6f042959a9bc
56ec2eee9040813f1e505f476b1412f8
d660d625f66c694687458e1fbe875f2f
fe82e6c9502e469dbdea451625d895cb
5119183d6bb07255ac37f66030af2356
448e6a189eb3f4a66509d62050fa8bb0
9819d3fbecc5ccec8d6b9158757ab638
f3f03372adee0f44615e5a5e494990b3
85fb8229a2462c5e11db1adc5bcc6033
1ea8237bbab1f0c9ca95960beaf5d929
1986ee20286d3cc2ba9ed14b938ff45b
be6c2e2b475adfaeb6a26d9599e37a4e
8d1b328e45b2a733bcb82ecdd11019e6
1c88d29b72754e0153753a8d8e992bd5
e1a015a2bd60566a4a5085226db3a0a5
8df279ff2a32ea877b745dae7e0f813c
f38976adccf4b95be1efdcc37806d480
a42611d494e8eaa2acf53c6b20fde7a9
0be8650868f66537132973b52922d941
1727cbefa3df65dd6f1912dcc2b88c41
6aadf463b910a91a015b872b48366c48
107a1da4ec63ee1e07f8bdd642620cbf
1b4312449cd9da34e947b924deec6ca0
1037905e13b8bb3d78211ac1e67b0d48
42022c3b6b78c4ce91120c58a303ae89
418e9a5f23ec8b712b7715ba4ea552be
73ce2417b1e546613fd64cf38760465c
ec22c88764914db7f97065d451b0275d
7a707e4381ccac0ab105545e42896a3e
7a19996385152ac711085a6bcb7fb0f9
5cb839d05007ed68f33c5a2fe5b063cd
f7aaa317f34067232e0dc72cf2d4f8c1
d002c8eecdacbdc160e622164db556fa
ef38c638ea2d98b8ed94a8f1dff7115e
1fa11bb4b773f35d9e0b2bfdf9e30f15
843e34240b8b0867f2004282480120f8
8e4322eb184956e2eff2ec83bd99a3ae
6fb1d944c5808a77716649ab3efa1a7c
1c7be79dbeeaa081fee6eba01960cf2b
057954ec20ab94f8e18e040df502ff4c
d2b83bc55d05dc8392b9e3f01b2a1d6e
849e74f7360db975c6913665278225dc
bbbf580a4763341480392ed6c3f8b38d
2662d1c38c4e9ce6c25f728a2759aade
2b0870abcd44b08dfc8daf9e3feb4efc
46abce9cc2659d69fb22013cb50c179d
1f0847c144b90e59ffd6b15ce577f2c1
4808b9126edafa5d884a3584e231367a
4c812b2bce523ff5dd4d9da391b43d4a
45840b3e1bf86ba35bcc0db2b106bcdf
6800f5ba56ab885f44b683eb7459f879
9de9b352e83fdf73a702d60cd0d65134
9f0cc56747c3fe8e92c319165fa7fa7a
bda236614e7a2d166210f34eb8a9b279
5c8f58f5e2933affaba12f1f9b61a757
a2324b8460b4188552c8138f8bcdcd0a
744df50b8d795c50a220006b289e2672
8e1f89c74db9b9b919bfb8ed31aea833
b6acb3c13244515ec078ff24ea523713
81382f6d6c9920734f7c9c45df0b8c33
055b65ee5d713552507fad6961239ac3
b23d69f0e6c5d3e052feb3d7f2755464
f81a70f458e8fc6316290b5864dc7660
c3af9a48bfd978fbf9d16174dacd3f99
e12023a8cedd4437e040d4f1bab1e173
6a9a6949348ec70db1108453871e38ec
35a5ec11e1e2ac1e4ed4c8e3fa5fa361
4a3161191f24f0c0270c68f34de4ed33
ccc4e1584d834bf3e818d31e28ea3342
cd0c4e86c41d7fd573c7b1b7eafb605d
