# Copyright (c) 2014-2019 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: roamingmantis, xloader, fakespy

# Reference: https://securelist.com/roaming-mantis-uses-dns-hijacking-to-infect-android-smartphones/85178/

haoxingfu01.ddns.net
shaoye11.hopto.org

# Reference: https://securelist.com/roaming-mantis-part-3/88071/

sagawa-otqwt.com
sagawa-polsw.com

# Reference: https://lukasstefanko.com/2018/10/video-analysis-of-android-sms-worm-spying-on-victims.html

sagawa-mama.com

# Reference: https://www.fortinet.com/blog/threat-research/fakespy-comes-back--new-wave-hits-japan.html

sagawa-ba.com
sagawa-wow.com
sagawa-iso.com

# Reference: https://securelist.com/roaming-mantis-part-iv/90332/
# Reference: https://otx.alienvault.com/pulse/5ca537055fe8d2200c37306e
# Reference: https://blog.trendmicro.com/trendlabs-security-intelligence/new-version-of-xloader-that-disguises-as-android-apps-and-an-ios-profile-holds-new-links-to-fakespy/
# Reference: https://blog.trendmicro.com/trendlabs-security-intelligence/a-look-into-the-connection-between-xloader-and-fakespy-and-their-possible-ties-with-the-yanbian-gang/
# Reference: https://securityaffairs.co/wordpress/83317/breaking-news/xloader-6-twitter.html

apple-icloud.qwq-japan.com
apple-icloud.zqo-japan.com
apple-icloud.qwe-japan.com
ffakecg.com
files.spamo.jp
mailsa-qau.com
mailsa-wqu.com
mailsa-qaw.com
mailsa-qae.com
mailsa-wqq.com
mailsa-qaf.com
mailsa-wqe.com
mailsa-wqp.com
mailsa-wqw.com
mailsa-wqo.com
mailsa-qau.com
mailsa-qaf.com
nttdocomo-qae.com
nttdocomo-qaw.com
nttdocomo-qar.com
nttdocomo-qaq.com
nttdocomo-qat.com
sagawa-mqd.com
sagawa-bz.com
sagawa-mwm.com
sagawa-reg.com
759383.com
711231.com
923525.com
923915.com
975685.com
104.160.191.190:8822
61.230.204.87:28833
61.230.204.87:28855
61.230.205.122:28833
61.230.205.122:28844
61.230.205.122:28855
61.230.205.132:28833
61.230.205.132:28844
61.230.205.132:28855
61.230.204.87:28844
http://38.27.99.11/xvideo/

# Reference: https://twitter.com/makflwana/status/1087626405075050496

sagawa-ozi.com

# Reference: https://twitter.com/ninoseki/status/1115061669929992192

softbank-b.com
jppost-to.com
nttdocomo-ki.com
id-auone.com
