Filter updated: Thu, 05 Sep 2019 00:21:32 UTC

urlhaus-filter.txt

@@ -1,5 +1,5 @@
 ! Title: abuse.ch URLhaus Malicious URL Blocklist
-! Updated: Wed, 04 Sep 2019 12:22:10 UTC
+! Updated: Thu, 05 Sep 2019 00:21:31 UTC
 ! Expires: 1 day (update frequency)
 ! Repo: https://gitlab.com/curben/urlhaus-filter
 ! License: https://creativecommons.org/publicdomain/zero/1.0/
@@ -474,6 +474,7 @@
 104.248.191.31
 104.248.197.246
 104.248.198.116
+104.248.198.14
 104.248.199.89
 104.248.2.56
 104.248.20.52
@@ -6894,7 +6895,7 @@
 2ndpub.com
 2ndscreensociety.com
 2nell.com
-2no.co/2amqu5
+2no.co
 2q3w.com
 2reis.fr
 2sdgfhjggg.ml
@@ -8731,7 +8732,6 @@
 59.47.72.34
 59.47.72.69
 59.80.44.99
-59.80.44.99/indonesias.me:9998/iexplore.exe
 59.90.247.38
 59.95.148.105
 59.98.44.226
@@ -9410,6 +9410,7 @@
 79.117.97.92
 79.120.157.92
 79.124.78.82
+79.134.225.70
 79.137.123.208
 79.137.127.216
 79.137.32.238
@@ -9984,13 +9985,7 @@
 887.basinbultenigonderimi.com
 887sconline.com
 888fx.pro
-88b.me/R/SURIA.arm
-88b.me/R/SURIA.arm5
-88b.me/R/SURIA.mips
-88b.me/dlk/upg/bf.mips
-88b.me/nbt/bf.arm
-88b.me/nbt/bf.mips
-88b.me/nbt/bf.mipsel
+88b.me
 88four8.com
 88fpw.com
 88hardwood.com
@@ -11127,6 +11122,7 @@ acsa17.org
 acsboda.com
 acsentials.com
 acsetup2.icu
+acsetup5.icu
 acsexpress.ml
 acsgroup-usa.com
 acsmia.com
@@ -11234,7 +11230,12 @@ adasnature.rodevdesign.com
 adastrawll.gq
 adax.us
 aday.haberkorfez.com
-adazing.com
+adazing.com/DHL-number/En/
+adazing.com/DOC/EHM76459484042P/525428/HQLA-OUAEH
+adazing.com/DOC/EHM76459484042P/525428/HQLA-OUAEH/
+adazing.com/Vos-factures-impayees/
+adazing.com/files/En_us/Jul2018/Invoice-469685754-072318/
+adazing.com/xebgo7d/
 adbee.tk
 adbord.com
 adcanudosnh.com.br
@@ -13585,7 +13586,7 @@ apotheekgids.org
 app-1536185165.000webhostapp.com
 app-1541815294.000webhostapp.com
 app-utd.nl
-app.casetabs.com
+app.casetabs.com/n/P7NX8575
 app.cloudindustry.net
 app.contentpress.io
 app.fastnck.com
@@ -14859,7 +14860,7 @@ autodavid.hr
 autodetali-161.ru
 autodevices.topterra.ru
 autodrim.pl
-autodwg.com
+autodwg.com/download/dwfinpro.exe
 autoecole-hammamet.tn
 autoecole.inchtechs.com
 autoescuelacontreras.es
@@ -15325,7 +15326,8 @@ babababy.ga
 babaiko.site
 babaldi.com
 babaloke.woundedwarriorscience.science
-babalublog.com
+babalublog.com/anatasio/PzmDp-HdzCluVtVxSdcM_TkwgWiLJc-qQ/
+babalublog.com/image/h5jo1ao23800/
 babaroadways.in
 babaunangdong.com
 babeltradcenter.ro
@@ -19848,7 +19850,7 @@ cdn.shopify.com/s/files/1/0062/6422/5910/files/RSB_Bill_01052019_00038847155344.
 cdn.siv.cc
 cdn.slty.de
 cdn.top4top.net
-cdn.truelife.vn
+cdn.truelife.vn/webtube/201310/2139273/pianito.exe
 cdn.xiaoduoai.com
 cdn.zecast.com
 cdn4.css361.com
@@ -21046,8 +21048,7 @@ cloudflarrr.ml
 cloudhaste.com
 cloudhooks.com
 clouding-world.online
-cloudme.com/v1/ws2/:dr404/:22cted/22cted.exe
-cloudme.com/v1/ws2/:dr404/:MicrosoftOffice/MicrosoftOffice.exe
+cloudme.com
 cloudninedesign.com.au
 cloudphotos.party
 cloudresemblao.top
@@ -22681,6 +22682,7 @@ d210.cdn.m6web.fr
 d277t39ai1224644.impressoxpz86371.com
 d2al0xipq9hi4h.cloudfront.net
 d2comm.averydennison.com/Runcorn/TimbScanPrint_1_0_0_4/VFScanPrint.exe.deploy
+d2h2e7azvio4e7sp.com
 d2o.cn
 d2q0uw.bn.files.1drv.com
 d3.99ddd.com
@@ -23194,7 +23196,7 @@ dbalive.dk
 dbcomestic.com
 dbfuppsala.se
 dbinario.com
-dbo.ca.gov
+dbo.ca.gov/forms/tma/callreport_forms/Call_Report_NonNMLS_2018-04-17.xls
 dboyusa.online
 dbravo.pro
 dbs-ebank.com
@@ -23318,7 +23320,7 @@ dealertrafficgenerator.com
 dealmykart.com
 dealsammler.de
 dealsfantasy.com
-dealtimer.com
+dealtimer.com/AsIn9
 deam.cl
 deanhopkins.co.uk
 deathbat-jp.com
@@ -23529,27 +23531,7 @@ delivery.balanceado.com
 delivery.mn
 deliyiz.net
 delkaland.com
-dell1.ug/files/cost/3=====.exe
-dell1.ug/files/cost/4.exe
-dell1.ug/files/cost/41.exe
-dell1.ug/files/cost/5.exe
-dell1.ug/files/cost/51.exe
-dell1.ug/files/cost/updatewin1=.exe
-dell1.ug/files/cost/updatewin2=.exe
-dell1.ug/files/cost/updatewin=.exe
-dell1.ug/files/cost1/3=====.exe
-dell1.ug/files/cost1/41.exe
-dell1.ug/files/cost1/58.exe
-dell1.ug/files/cost1/updatewin.exe
-dell1.ug/files/cost1/updatewin1.exe
-dell1.ug/files/cost1/updatewin2.exe
-dell1.ug/files/penelop/3=====.exe
-dell1.ug/files/penelop/4.exe
-dell1.ug/files/penelop/41.exe
-dell1.ug/files/penelop/5.exe
-dell1.ug/files/penelop/updatewin.exe
-dell1.ug/files/penelop/updatewin1.exe
-dell1.ug/files/penelop/updatewin2.exe
+dell1.ug
 della.themeshigh.com
 dellaconnor.com
 dellarosa.com.au
@@ -24156,7 +24138,11 @@ dfd.zhzy999.net
 dffdds.club
 dffieo8ieo0380ieovsddsdff89r309ieo89334.com
 dffieo8ieo0380ieovsddsdfsdff89r309ieo89334.com
-dfgccv.ru
+dfgccv.ru/rfds234sdf32.exe
+dfgccv.ru/rfsd34gfd34.exe
+dfgccv.ru/rgf45cfg_signed.exe
+dfgccv.ru/rrr_output940674F.exe
+dfgccv.ru/rrr_outputD59B32F.exe
 dfgdfcfxsddf.ru
 dfgdfcfxsddfa.ru
 dfgdfcxsddf.ru
@@ -24183,17 +24169,7 @@ dgfd.ru
 dgkawaichi.com
 dgkhj.ru
 dglass.cl
-dgnet.com.br/DOC/Rech-00084/
-dgnet.com.br/FILE/Past-Due-invoice/
-dgnet.com.br/IRS-Accounts-Transcipts-June-2018-033/0
-dgnet.com.br/IRS-Accounts-Transcipts-June-2018-033/0/
-dgnet.com.br/Need-to-send-the-attachment-June/
-dgnet.com.br/iWuVO
-dgnet.com.br/iWuVO/
-dgnet.com.br/t5wb/
-dgnet.com.br/ups.com/WebTracking/AI-1829048912363/
-dgnet.com.br/wwvvv/En_us/Transactions/12_18
-dgnet.com.br/wwvvv/En_us/Transactions/12_18/
+dgnet.com.br
 dgnj.cn
 dgpratomo.com
 dgs.pni-me.com
@@ -25135,6 +25111,7 @@ dndisruptor.com
 dnenes.com.mx
 dnew242.com
 dnews.ro
+dngn3haywjlw75nc.com
 dni-p.ru
 dnmartin.net
 dnn.alibuf.com
@@ -25888,7 +25865,7 @@ door-craft.ru
 door-ma.com
 doordam.co.uk
 doordroppers.co.uk
-doordu.com/Jul2018/En/INVOICE-STATUS/Invoices/
+doordu.com
 doorlife.co.in
 doorspro.ie
 doosian.com
@@ -25992,8 +25969,7 @@ down.haote.com
 down.hognoob.se
 down.icafe8.com
 down.klldddiso.xyz
-down.kuwo.cn/KwLyric.exe
-down.kuwo.cn/mbox/wwwab/MBOX8.0.1.5/kuwo2015.exe
+down.kuwo.cn
 down.leyoucoc.cn
 down.my0115.ru
 down.pcclear.com
@@ -26139,7 +26115,7 @@ doyoucq.com
 doyoulovequotes.com
 dp5a.surabaya.go.id
 dpa-industries.com
-dpa.atos-nao.net
+dpa.atos-nao.net/Download/ACSDPA.exe
 dpack365-my.sharepoint.com
 dpacorp.org
 dparmm1.wci.com.ph
@@ -27892,7 +27868,7 @@ eduhac.com
 edupath.edu.sa
 edurotations.com
 eduscore.org
-eduspiresolutions.org
+eduspiresolutions.org/94-891753-84184-638-ID.zip
 eduswiss.com
 eduvisionplus.ttstaging.com
 edv-salz.de
@@ -28540,8 +28516,7 @@ en.laserspark.ru
 en.modernizmgdyni.pl
 en.sign-group.ru
 en.sun-sen.com
-en.tag.ir/Amazon/Clients_transactions/012019/
-en.tag.ir/wp-admin/Clients_transactions/2019-01/
+en.tag.ir
 en.worthfind.com
 en.yallanesafer.net
 enaax.com
@@ -29097,7 +29072,7 @@ estomedic.com
 estore.qurvex.com
 estrategias-corporativas.com
 estrategiasdeaprovacao.com.br
-estreamnetworks.net/7GWTSLC/WIRE/Commercial
+estreamnetworks.net
 estrindesign.com
 estrom.es
 estrutura.eng.br
@@ -30392,7 +30367,10 @@ files.fm/pa/accts/Payroll/Cash_Disbursement_Report_Sept.doc
 files.fm/pa/accts/Payroll/Grace091155.exe
 files.fm/pa/accts/Payroll/OfficeViewer.exe
 files.fqapps.com
-files.gathercdn.com
+files.gathercdn.com/attachments/2018-09-07/01ffb03a-b2e4-4721-b5d7-e1c33addb301/YXR_QO_3324291_931552353_09_07_2018.doc
+files.gathercdn.com/attachments/2018-09-17/b6e5fbf0-7d1d-4ef6-8ba7-9e3e9a54e89d/AMS_GT_397%252FSFULF540938199_09_17_2018.doc
+files.gathercdn.com/attachments/2018-09-18/c3376b01-0c2f-414b-b1eb-169358a27a71/AVE_B_694_WJXJU5696931361_09_18_2018.doc
+files.gathercdn.com/attachments/2018-10-29/c05da777-1c47-4498-9c81-53470af9642e/Kowa.doc
 files.hrloo.com
 files.l-d.tech
 files.lashawnbarber.com
@@ -31784,7 +31762,7 @@ gaertl.com
 gaetanascucinaitaliananyc.com
 gafgfagf.co.vu
 gafrontke.de
-gagandevelopers.com/uyea_KEUXr-OCipjWa/IKq/Clients/01_19/
+gagandevelopers.com
 gagat.am
 gagsm.com
 gahagandds.com
@@ -32700,6 +32678,7 @@ gkmfx.net
 gkmsm.ru
 gkpaarl.org.za
 gksign.com
+gl6063f3cc237zqm.com
 glad.cab
 gladwynecapital.com
 glamoroushairextension.com
@@ -32731,7 +32710,8 @@ glfca.org
 glfishsuppliesgrimsby.co.uk
 glid.jp
 gligoricekofood.com
-glip-vault-1.s3-accelerate.amazonaws.com
+glip-vault-1.s3-accelerate.amazonaws.com/web/customer_files/1018812956684/IMAGE_020110333001001.zip?Expires=2075494478&AWSAccessKeyId=AKIAJROPQDFTIHBTLJJQ&Signature=YzxiWz8qYEyE%2FcRW%2FMpzw%2FoMHDg%3D&response-content-disposition=attachment
+glip-vault-1.s3-accelerate.amazonaws.com/web/customer_files/1019027505164/Outstanding%20Payment%20Copy.zip?Expires=2075494478&AWSAccessKeyId=AKIAJROPQDFTIHBTLJJQ&Signature=7tH4mckzx%2FeV0H5QoM7Yn5hJtuE%3D&response-content-disposition=attachment
 glip-vault-1.s3.amazonaws.com/web/customer_files/720950280204/ACH%20PAYMENT%20REMITTANCE.DOC.zip?Expires=2075494478&AWSAccessKeyId=AKIAJROPQDFTIHBTLJJQ&Signature=APQeJXVXqVwwtpv%2FU8BoHV3zWNs%3D&response-content-disposition=attachment
 glip-vault-1.s3.amazonaws.com/web/customer_files/720950280204/ACH%20PAYMENT%20REMITTANCE.DOC.zip?Expires=2075494478&AWSAccessKeyId=AKIAJROPQDFTIHBTLJJQ&Signature=APQeJXVXqVwwtpv/U8BoHV3zWNs=&response-content-disposition=attachment
 glitzygal.net
@@ -33065,7 +33045,7 @@ goodveiwhk.com
 goodwife.com
 goodwillhospital.org
 goodword.pro
-goodyearmotors.com/De/ZMIRQKWX6219588/Rechnungs-docs/DOC-Dokument/
+goodyearmotors.com
 goofdeckers.bid
 google-ads-expert.co.ua
 google-tokyo.info
@@ -33613,10 +33593,7 @@ gsm-timer.ru
 gsncloud-my.sharepoint.com
 gsoftclean.online
 gsoftclean.top
-gsoftclean.xyz/amix
-gsoftclean.xyz/koskos.exe
-gsoftclean.xyz/main.exe
-gsoftclean.xyz/settings.dll
+gsoftclean.xyz
 gsonlinetutorial.com
 gsportsgroup.co.kr
 gsraconsulting.com
@@ -35277,7 +35254,7 @@ honeyman.ca
 honeymanhomes.co.uk
 honeymoon-egypt.com
 honeymoonlady.com
-honeynet.org/sites/default/files/files/1309361194_eschweiler_forensic_challenge_8.zip
+honeynet.org
 honeywax.ir
 hongcheng.org.hk
 hongkongrestaurant.com.au
@@ -35424,7 +35401,7 @@ hosting.tlink.vn
 hosting113979.a2f57.netcup.net
 hostingboom.com
 hostingbypierre.com
-hostingcloud.science/6NQq.js
+hostingcloud.science
 hostinggiarenhat.com
 hostmktar.com
 hostn.co
@@ -36687,7 +36664,7 @@ india24x7.zeecdn.com
 india9am.com
 indiaautentica.es
 indiagolive.com
-indianagoods.club/cl.exe
+indianagoods.club
 indianblog.info
 indianceramicsourcing.com
 indiangirlsnude.com
@@ -36720,9 +36697,7 @@ indodentist.com
 indokku.com
 indonesiafte.com
 indonesiakompeten.com
-indonesias.me:9998/333.exe
-indonesias.me:9998/64.exe
-indonesias.me:9998/c64.exe
+indonesias.me
 indonesiaumroh.com
 indoorpublicidade.com.br
 indoqualitycleaning.com
@@ -37326,27 +37301,7 @@ ip01reg.myjino.ru
 ip1.bcorp.fun
 ip1.qqww.eu
 ip105.ip-142-44-251.net
-ip113.ip-147-135-124.us/bins/aarch64be.cloudbot
-ip113.ip-147-135-124.us/bins/arc.cloudbot
-ip113.ip-147-135-124.us/bins/arcle-750d.cloudbot
-ip113.ip-147-135-124.us/bins/arcle-hs38.cloudbot
-ip113.ip-147-135-124.us/bins/arm.cloudbot
-ip113.ip-147-135-124.us/bins/arm5.cloudbot
-ip113.ip-147-135-124.us/bins/arm6.cloudbot
-ip113.ip-147-135-124.us/bins/arm7.cloudbot
-ip113.ip-147-135-124.us/bins/fritzbox.cloudbot
-ip113.ip-147-135-124.us/bins/haarch64.cloudbot
-ip113.ip-147-135-124.us/bins/hnios2.cloudbot
-ip113.ip-147-135-124.us/bins/hopenrisc.cloudbot
-ip113.ip-147-135-124.us/bins/linksys.cloudbot
-ip113.ip-147-135-124.us/bins/m68k-68xxx.cloudbot
-ip113.ip-147-135-124.us/bins/microblazebe.cloudbot
-ip113.ip-147-135-124.us/bins/microblazeel.cloudbot
-ip113.ip-147-135-124.us/bins/mips.cloudbot
-ip113.ip-147-135-124.us/bins/mips2.cloudbot
-ip113.ip-147-135-124.us/bins/mpsl.cloudbot
-ip113.ip-147-135-124.us/bins/x86.cloudbot
-ip113.ip-147-135-124.us/bins/x86_64.cloudbot
+ip113.ip-147-135-124.us
 ipa.viamedia.ba
 ipack.pugmarker.com
 ipadplaybooks.com
@@ -38789,6 +38744,9 @@ jppost-se.top
 jppost-si.top
 jppost-so.com
 jppost-su.top
+jppost-tu.top
+jppost-wo.co
+jppost-yo.co
 jppygfot.sha58.me
 jpqr.my
 jpro.jiwa-nala.org
@@ -39875,7 +39833,7 @@ kinetics.hk
 kineziolog.si
 king-dom101.net
 king-lam.com
-king.myapp.com/myapp/Kingroot/webapp_kingroot/solution_test/00000000000000000001457946048278.jar
+king.myapp.com
 kingaardvark.com
 kingasgroup.co.uk
 kingcoffeetni.com
@@ -40516,9 +40474,7 @@ krmar.ru
 kroha-vanna.ru
 krohm.net
 kroisospennanen.fi
-krokas.info/41qilngy38303743/app.exe
-krokas.info/app/app.exe
-krokas.info/app/updateprofile-0128.exe
+krokas.info
 krolewskasandomierz.pl
 krolog.com
 krolog.net
@@ -40705,6 +40661,7 @@ kuzina-teatr.ru
 kuzminala.ru
 kuznetsane.bpmb.ru
 kv0yg9f024w5uj5t.com
+kv4gfnj59y0r9q6l.com
 kvadrat-s.ru
 kvarta-m.by
 kvartersakutenab.se
@@ -44758,7 +44715,7 @@ medicalweb.ir
 medicarehospital.org
 medicationsafetyconference.com
 medicci.ru
-medicina.uanl.mx/salamuseo/wp-content/uploads/jplc6-tzv7k-fpewx.view/
+medicina.uanl.mx
 medicinaesteticaorlandini.it
 medicinageriatrica.com.br
 medicinaonline.rjsrwaco.watchdogdns.duckdns.org
@@ -44920,7 +44877,7 @@ meltonairservices.com.au
 melwanilaw.com
 melyanna.nl
 memap.co.uk
-members.chello.nl
+members.chello.nl/g.dales2/b.exe
 members.iinet.net.au/~sambo75/FedEx--shipping(ecopy)22-3235-44-Labels.jar
 members.iinet.net.au/~sambo75/FedEx-shipping(ecopy)22-3235-44-Labels.jar
 members.iinet.net.au/~sambo75/svvchost.exe
@@ -46199,9 +46156,7 @@ moscow44.online/KeyMoscow44.35.exe
 moscow44.online/KeyMoscow44.40.exe
 moscow55.online/KeyMoscow55.35.exe
 moscow66.online/KeyMoscow55.35.exe
-moscow77.online/GetDataAVK.exe
-moscow77.online/KeyMoscow77.35.exe
-moscow77.online/KeyMoscow77.40.exe
+moscow77.online
 moscowvorota.ru
 moseler.org
 moselink.xyz
@@ -47271,9 +47226,7 @@ nasdembjm.000webhostapp.com
 nase-rodina.cz
 nashikproperty.tk
 nashobmen.org
-nashobmenfiles.com/get/2948273/1856276
-nashobmenfiles.com/get/2948273/1856276/wifi_hack-wap_sasisa_ru.exe
-nashobmenfiles.com/get/2948273/wifi_hack-wap_sasisa_ru.exe
+nashobmenfiles.com
 nashpersonal.com.ua
 nasikotak.id
 nasilsing.com
@@ -47445,12 +47398,7 @@ neatappletech.readysetselfie.com
 nebesnaya-sotnya.site
 nebraskacharters.com.au
 nebrodiescursionileanza.com
-nebula-ent.com/doc/EN_en/STATUS/HRI-Monthly-Invoice
-nebula-ent.com/doc/EN_en/STATUS/HRI-Monthly-Invoice/
-nebula-ent.com/files/En_us/Jul2018/Invoice-849834311-
-nebula-ent.com/files/En_us/Jul2018/Invoice-849834311/
-nebula-ent.com/t3
-nebula-ent.com/t3/
+nebula-ent.com
 nebula.ee
 neccotweethearts.com
 necessary-evil.com
@@ -47744,7 +47692,7 @@ newparadise.com.vn
 newpavanchatcorner.com
 newpioneerschool.com
 newportedu.org
-newradio.it/personalplayer/rvl/rvl.exe
+newradio.it
 newreport.info
 newrockchurchconyers.org
 news-week.ru
@@ -48182,7 +48130,7 @@ nodearts.com
 noel-cafe.com
 noelportelles.com
 noerrebrogade45.hostedbyaju.com
-nofile.io/f/ED4pTB5VkUd/purchase+order.zip
+nofile.io
 nofy-nosybe.com
 noi.nu
 noico.vcard.pl
@@ -48979,7 +48927,7 @@ old.firecom.pro
 old.gkinfotechs.com
 old.hello5.kr
 old.hinz.se.prison01.dalnix.se
-old.honeynet.org/scans/scan33/0x90.exe
+old.honeynet.org
 old.klinika-kostka.com
 old.norsec.kz
 old.oleglukanov.com
@@ -50791,8 +50739,7 @@ periscope.es
 peritofinanceiro.tk
 perkasa.ddns.net
 perkasa.undiksha.ac.id
-perkasa.warzonedns.com:8080/bin/chiefo.exe
-perkasa.warzonedns.com:8080/bin/pdf.exe
+perkasa.warzonedns.com
 perkim.bondowosokab.go.id
 perlage.net
 perlage.us
@@ -50819,7 +50766,12 @@ persianruggallery.com
 persiapanieltstoefl.com
 persiapet.net
 persimmonforge.com
-perso.wanadoo.es
+perso.wanadoo.es/cartaouol/uolcartoes.exe
+perso.wanadoo.es/gracig02/atualizado098476verifica.exe
+perso.wanadoo.es/grande000001/csrs.jpg
+perso.wanadoo.es/provedoresbrasil/relatorioemails2006.exe
+perso.wanadoo.es/stjsites/stj.exe
+perso.wanadoo.es/tdfgr/350RONPXJ65Y47.exe
 personal.nwolb.user.log.security.cod.issue.fondue-at-the-fountain.com
 personalized-weddings.com
 personalshopper-salzburg.com
@@ -51570,7 +51522,7 @@ politicasdocus.com
 politicot.com
 politinsky.000webhostapp.com
 poljimenez.com
-polk.k12.ga.us
+polk.k12.ga.us/userfiles/13/Classes/2473/8thPSsyllabus.doc
 polka32.ru
 polkolonieb4k.pl
 pollovideo.cf
@@ -51626,7 +51578,7 @@ pontoacessoweb.com.br
 pontoduplo.com.br
 pontotocdistrictba.com
 pony.s-p-y.ml
-pony.warzonedns.com/RFQ/RFQ-TC002651.zip
+pony.warzonedns.com
 ponytales.nostalgicbookshelf.com
 poojasingh.me
 pool.ug
@@ -53036,7 +52988,7 @@ r-klecker.de
 r-martin.fr
 r-sharks.com
 r-web.pl
-r.chaoxin.com/d29889e/2018-10-19_14/9ebbc/7e408/1539931621_225246.exe
+r.chaoxin.com
 r.kuai-go.com
 r.thephmdxb.ae
 r00ts.hitherenoodle.tk
@@ -53572,6 +53524,7 @@ rdk.kz
 rdk.victoria-makeup.kz
 rdkavitha.com
 rdkrussia.ru
+rdmapperels.com
 rdmarmotte.net
 rdnetworkdesign.co.uk
 rdproject.kz
@@ -55205,8 +55158,10 @@ sachbau.de
 sachcubanme.bmt.city
 sachindutta.com
 sacm.net
-sacmsgmgw001a.delta.org
-sacmsgmgw001b.delta.org
+sacmsgmgw001a.delta.org/enduser/classify_url.html?url=bcj4vOoPS8B46Ud6gJMEtrSVpbK6kvOhzNoTP1Nkc9akCYldm5ysiiV042Pg5WhS/
+sacmsgmgw001a.delta.org/enduser/classify_url.html?url=gMQvjTDwF+23in+gr9bszmxgor7TYncykJbo+NUodQg6GgUL9qbt0DxSnpXzZCh6fb6C0XyiTaySpVP8B3UA2w/
+sacmsgmgw001b.delta.org/enduser/classify_url.html?url=vn1ThnzZihkgHFvBYSgQsXigd2FROhFqovuC9pBEzpiVgOuDF6NXNoa9h08sWe+d/
+sacmsgmgw001b.delta.org/enduser/classify_url.html?url=vn1ThnzZihkgHFvBYSgQsXigd2FROhFqovuC9pBEzpiVgOuDF6NXNoa9h08sWe+dWI6vgTagrNGo9imHFHKhlw==/
 saconets.com
 sacramentode.ml
 sacredheartwinnetka.com
@@ -55245,7 +55200,7 @@ safekar.online
 safekro.com
 safelinks-protection.com
 safemoneyamerica.com
-safentrix.com/adlink?cid=0
+safentrix.com
 saferoomreviews.com
 safesalesnembutal.com
 safeservicesfze.com
@@ -56085,6 +56040,7 @@ sdsdsdas.weebly.com/uploads/9/6/5/2/96520294/ioii.exe
 sdsdsdas.weebly.com/uploads/9/6/5/2/96520294/nesreen.exe
 sdsgdfsfas.xyz
 sdsgroup.co.il
+sdstat95xz.world
 sdveganecofriendly.com
 sdvf.kuai-go.com
 sdvg-impuls.ru
@@ -56730,6 +56686,7 @@ sgnewcondolaunch.com.sg
 sgokta.com
 sgov.rsmart-testsolutions.watchdogdns.duckdns.org
 sgpartneriai.lt
+sgpf.eu
 sgpspadrauna.in
 sgry.jp
 sgshopshop.com
@@ -57757,16 +57714,7 @@ slowianskawieza.pl
 slowmoneysocal.org
 slowtime.net
 slppoffice.lk
-slpsrgpsrhojifdij.ru/1.exe
-slpsrgpsrhojifdij.ru/2.exe
-slpsrgpsrhojifdij.ru/3.exe
-slpsrgpsrhojifdij.ru/c.exe
-slpsrgpsrhojifdij.ru/krablin.exe
-slpsrgpsrhojifdij.ru/krablin.exe?SZLIp
-slpsrgpsrhojifdij.ru/krablin.exe?VuNpZqS
-slpsrgpsrhojifdij.ru/o.exe
-slpsrgpsrhojifdij.ru/p.exe
-slpsrgpsrhojifdij.ru/t.exe
+slpsrgpsrhojifdij.ru
 slrent.com
 slrpros.com
 sls-eg.com
@@ -58264,6 +58212,7 @@ somalisuk.com
 somamradiator.com
 somanchainani.net
 somasteel.com
+somasterons.com
 somecars.xyz
 somelie.jp
 somerset.com.ar
@@ -61500,7 +61449,10 @@ support.homemakerideas.com
 support.imaitaly.biz
 support.indeed.com/attachments/token/RVDXKCofCmEb1PdT1WRikfMxN/
 support.jbrueggemann.com
-support.mdsol.com
+support.mdsol.com/attachments/token/H6YLkuGzQ4TB0Eu3WmzZGcwN4/
+support.mdsol.com/attachments/token/H6YLkuGzQ4TB0Eu3WmzZGcwN4/?name=WGY-709010.doc
+support.mdsol.com/attachments/token/PnCg6A0UiLcjvS1lwsK1RgAXQ/
+support.mdsol.com/attachments/token/PnCg6A0UiLcjvS1lwsK1RgAXQ/?name=WGY-709010.doc
 support.redbook.aero
 support.volkerstevin.ca
 support.zendesk.com/attachments/token/TW5zUt6d9VybjPh5w71EyZhMs/?name=Dat+3099+698948277.doc/
@@ -61606,6 +61558,7 @@ svaistore.ru
 svanshalsbygg.se
 svatba.erbak.com
 svazkickboxu.cz
+svc.darkhost.pro
 svenahrens.nl
 svenhedintravel.pl
 svenmader.com
@@ -61921,8 +61874,7 @@ tafe.org
 tafertergr.com
 tafftanzania.or.tz
 tafol.es
-tag.ir/rMTu-te1DJ_bfmkKC-tF9/Ref/25027654En/Inv-373736-PO-7Q385560/
-tag.ir/tag_old/wp-includes/js/Clients_information/2019-01/
+tag.ir
 tag520.com
 tagamol.com
 tagbanners.com
@@ -63025,10 +62977,11 @@ tharsisfilms.com
 thatavilellaoficial.com.br
 thatoilchick.com
 thats-amazing.com
-thaus.to/1.exe
-thaus.to/2.exe
+thaus.to
 thctiedye.com
-thdidm.zendesk.com
+thdidm.zendesk.com/attachments/token/90twtLKKvofUaiNKT8vhMBab4/
+thdidm.zendesk.com/attachments/token/i87knteqNN582AqG1Au1GQzvc/?name=new-contract-November.doc
+thdidm.zendesk.com/attachments/token/wtT4UmVAZ2oFlQshHDuiDRRGF/?name=Untitled_3LO318363.doc
 the-anchor-group.com
 the-bombay-summit.000webhostapp.com
 the-grizz.com
@@ -64180,7 +64133,7 @@ totalcommunicationinc.com
 totallyconneted.com
 totalnutritionflorida.com
 totalsigorta.com
-totalsystem.co.id/INV/BMQ-035909996015081/
+totalsystem.co.id
 totaltechi.com
 totaltek.cc
 totaltelecoms-ng.com
@@ -64655,7 +64608,7 @@ trompot.discusllc.net
 troncomed.ae
 troncustoms.cf
 troopchalkkids.com
-troopwebhost.blob.core.windows.net
+troopwebhost.blob.core.windows.net/troop114tallahassee/Hennfam_2018101861037770535.doc
 tropicalhawaii.com
 tropicalislandrealtyofflorida.com
 tropicarlimited.com
@@ -64897,11 +64850,7 @@ turbolader.by
 turbominebtcminer.com
 turboogates.com
 turbosonly.com
-turfsiteph.net/ACCOUNT/Invoices/
-turfsiteph.net/Facture-impayee/
-turfsiteph.net/IRS-Tax-Transcipts-062018-055T/5/
-turfsiteph.net/IRS-Transcripts-June-2018-09/19/
-turfsiteph.net/ups.com/WebTracking/AB-51161605617001/
+turfsiteph.net
 turfslayer.com
 turgentesdeficcion.org
 turginovo.ru
@@ -65586,6 +65535,7 @@ ukonlinejfk.ru
 ukool.com.my
 ukproductssylhet.com
 ukr-apteka.pp.ua
+ukr1.net
 ukrgv.com
 ukrmetkol.org
 uksamples.com
@@ -66043,7 +65993,7 @@ url.emailprotection.link/?ayL72bfBub-Dd-Y3yvvPpz8JfYmmIlgEjoSDUuj2vrnTpKguZ2uBjd
 url.emailprotection.link/?bcp_LQdELwbKhxKToIznR8rOuhtt9W4qlFovFOxc0z5zmN6k8ji5zi9v7qbCrvRGePrP065w1sneU27JfM6LqozRkXpWdzWXoQHCUebEUJx-pJ0FN_jIdanzNgIHD_CY1/
 url.emailprotection.link/?bgmviCpuhO15c9_q9HIofgnmKACO0q_lUjjCaeOwkfIK_HDtt1UqmBKpoVHxYkckgjOQoYTV_U0G2UMKhd4MBI9Ms8vO3Vliq2ClOuUAa6nO2a7Ij5lJFsouoEEMeMVmI/
 url.emailprotection.link/?biZyxbw1FdaGSfCC1n6EP1AwPdX9DR0BrNJjqWgYAOFpW98LiMviIPVrszjnZzLUCLpEqqdYWFxWNwUDvWRLjcUFuhL2_nHA0Bs8Wz9JmbaHccIIKBseLJEWayzbE_cnD/
-url2.mailanyone.net
+url2.mailanyone.net/v1/?m=1hIbcm-0003zV-63&i=57e1b682&c=sb1BLj46bK32u6f729r5T_SLVKX-hEeWXh20_zDn9-3kTcC0-kN35FykIlpydgeYVRBWqWb5H__fK383wTDaKQftjlElxZ06jbAGlRi5jmUjnYDjKaSqXwdTG2Hn-_BE1DzRnThVvhiGYHM_TVBeW342habp8DtiT9jjlIEUc2X-IPGDGiPe7y_c9jhe69532GmnXozB5wiFJfBSTZiCAgMtPg6YXMrEAF0sq2DgO-kSY54HetFhN6GwM4kIw2VvCQx17a9bM6yKN8BWpWDJwg/
 url3.mailanyone.net
 url5459.41southbar.com
 url9823.ville.labrecque.qc.ca
@@ -66075,7 +66025,8 @@ ury8297ridowoury833oe.com
 urzedniczatv.pl
 us-defense-department.ml
 us-trans.ru
-us-west-2.protection.sophos.com
+us-west-2.protection.sophos.com/?d=fergus.vn&u=aHR0cDovL2Zlcmd1cy52bi9UcmFuc2FjdGlvbl9kZXRhaWxzLzAxMjAxOQ==&e=bGhpY2tleUBtaXNzb3VsYWNvdW50eS51cw==&t=SW9UZyszNFBzSGZwOTZraUtENzJORnc2MWdEMm1ucVVwbUwxTmRVZStyUT0=/
+us-west-2.protection.sophos.com/?d=toools.es&u=aHR0cDovL3Rvb29scy5lcy9iYW5raW50ZXJfL3hEc2EtQzUxU0w4SXpCVGdMN2kxX3RyQllLS1ZqWS1WNS8=&e=c2tvZXBrZUBtaXNzb3VsYWNvdW50eS51cw==&t=QlZHM2FiNzVhbjFld3d5dVJWdnlDMXp6dHpxMU8vVW1FQlhLSTdremUxVT0=/
 us.cdn.persiangig.com
 us15.campaign-archive.com/pages?u=cd5e2bf0aa684eff0aeb54377&id=030032cee1f0
 us2.campaign-archive.com/pages?u=035496fc182d3cf5353219b28&id=03009ec6e1f0
@@ -66123,7 +66074,75 @@ users.telenet.be/rudiSB/prive/cgi-bin/run.sh
 users.telenet.be/rudiSB/prive/cgi-bin/xmrig
 users.telenet.be/rudiSB/public_html/cgi-bin/run.sh
 users.telenet.be/rudiSB/public_html/cgi-bin/xmrig
-users.tpg.com.au
+users.tpg.com.au//soniamatas/9302030002_993.zip
+users.tpg.com.au/ajsteel/222_737_81010.zip
+users.tpg.com.au/ajsteel/222_737_81011.zip
+users.tpg.com.au/ajsteel/222_737_81013.zip
+users.tpg.com.au/ajsteel/222_737_81015.zip
+users.tpg.com.au/ajsteel/222_737_81016.zip
+users.tpg.com.au/ajsteel/222_737_81017.zip
+users.tpg.com.au/ajsteel/222_737_81020.zip
+users.tpg.com.au/ajsteel/222_737_81021.zip
+users.tpg.com.au/ajsteel/222_737_81024.zip
+users.tpg.com.au/ajsteel/222_737_81025.zip
+users.tpg.com.au/ajsteel/222_737_81028.zip
+users.tpg.com.au/ajsteel/222_737_81029.zip
+users.tpg.com.au/ajsteel/222_737_81030.zip
+users.tpg.com.au/ajsteel/222_737_81032.zip
+users.tpg.com.au/ajsteel/222_737_81033.zip
+users.tpg.com.au/ajsteel/222_737_81035.zip
+users.tpg.com.au/ajsteel/222_737_81039.zip
+users.tpg.com.au/ajsteel/222_737_8104.zip
+users.tpg.com.au/ajsteel/222_737_81040.zip
+users.tpg.com.au/ajsteel/222_737_81042.zip
+users.tpg.com.au/ajsteel/222_737_8105.zip
+users.tpg.com.au/ajsteel/222_737_8107.zip
+users.tpg.com.au/ajsteel/222_737_8108.zip
+users.tpg.com.au/ajsteel/222_737_8109.zip
+users.tpg.com.au/apexdriving/1_11838_99_7287.zip
+users.tpg.com.au/apexdriving/1_2838_99_7287.zip
+users.tpg.com.au/apexdriving/1_29838_99_7287.zip
+users.tpg.com.au/apexdriving/1_41838_99_7287.zip
+users.tpg.com.au/apexdriving/1_42838_99_7287.zip
+users.tpg.com.au/apexdriving/1_53838_99_7287.zip
+users.tpg.com.au/apexdriving/1_5838_99_7287.zip
+users.tpg.com.au/apexdriving/1_75838_99_7287.zip
+users.tpg.com.au/apexdriving/1_8838_99_7287.zip
+users.tpg.com.au/dimcejim/7827_99_838.zip
+users.tpg.com.au/dimcejim/899848_0028.zip
+users.tpg.com.au/dmrennie/067_15651_8.zip
+users.tpg.com.au/dmrennie/067_16925_8.zip
+users.tpg.com.au/dmrennie/067_18199_8.zip
+users.tpg.com.au/dmrennie/067_20110_8.zip
+users.tpg.com.au/dmrennie/067_22021_8.zip
+users.tpg.com.au/dmrennie/067_25206_8.zip
+users.tpg.com.au/dmrennie/067_25843_8.zip
+users.tpg.com.au/dmrennie/067_27117_8.zip
+users.tpg.com.au/dmrennie/067_29665_8.zip
+users.tpg.com.au/dmrennie/067_30302_8.zip
+users.tpg.com.au/dmrennie/067_33487_8.zip
+users.tpg.com.au/dmrennie/067_34761_8.zip
+users.tpg.com.au/dmrennie/067_36035_8.zip
+users.tpg.com.au/dmrennie/067_38583_8.zip
+users.tpg.com.au/dmrennie/067_39220_8.zip
+users.tpg.com.au/dmrennie/067_42405_8.zip
+users.tpg.com.au/dmrennie/067_43042_8.zip
+users.tpg.com.au/dmrennie/067_47501_8.zip
+users.tpg.com.au/dmrennie/067_51323_8.zip
+users.tpg.com.au/dmrennie/067_55782_8.zip
+users.tpg.com.au/dmrennie/067_57056_8.zip
+users.tpg.com.au/dmrennie/067_6096_8.zip
+users.tpg.com.au/dmrennie/067_61515_8.zip
+users.tpg.com.au/dmrennie/067_63426_8.zip
+users.tpg.com.au/dmrennie/067_64063_8.zip
+users.tpg.com.au/dmrennie/067_8007_8.zip
+users.tpg.com.au/elainew8/CBG-3983-3885-0909.zip
+users.tpg.com.au/elainew8/CGB_INV_25.05.18.docx
+users.tpg.com.au/elainew8/Pdform-INVGSK.zip
+users.tpg.com.au/elainew8/o_inv_25.05.2018.html
+users.tpg.com.au/palipane/293902399023-39922.zip
+users.tpg.com.au/soniamatas/9302030002.993.zip
+users.tpg.com.au/soniamatas/9302030002_993.zip
 userslinks.xyz
 usgmsp.com
 usgoldusa.com
@@ -67598,8 +67617,7 @@ wartazone.com
 wartini.de
 warunknasakita.co.id
 warwickvalleyliving.com
-warzonedns.com/dll/upnp.exe
-warzonedns.com/upnp.exe
+warzonedns.com
 warzonesecure.com
 was-studio.com
 wasama.org
@@ -68044,7 +68062,7 @@ weronikasokolinskaya.pa.infobox.ru
 wertedits.com
 wertios.com
 werycloud.website
-wesco.com
+wesco.com/canada_terms_and_conditions_of_sale_english.pdf/
 wesconsultants.com
 weseleopole.pl
 weservehosting.net
@@ -68710,7 +68728,7 @@ wpdabiran.yousefi.pro
 wpdemo.sleeplesshacker.com
 wpdemo.wctravel.com.au
 wpdemo.weboost.website
-wpengine.zendesk.com
+wpengine.zendesk.com/attachments/token/QiGBj5OV2VIK5lcGBzKwa3wzH/?name=LY7995522-693.doc
 wpgtxdtgifr.ga
 wpldjxxxua.ga
 wpmom.co
@@ -70269,7 +70287,7 @@ ziziused.com
 zizu.com.mx
 zizzy.eu
 zj.9553.com
-zjjcmspublic.oss-cn-hangzhou.aliyuncs.com
+zjjcmspublic.oss-cn-hangzhou.aliyuncs.com/jcms_files/jcms1/web1898/site/attach/0/ad9ae31e86a9473c8836fbfd38462a8d.doc
 zjttkj.cn
 zk-orekhovoborisovo.ru
 zkdjezica.si