# Copyright (c) 2014-2019 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://securelist.com/blog/research/72283/gaza-cybergang-wheres-your-ir-team/

downloadskype.cf
cbbnews.tk
store-legal.biz
chromeupdt.tk
depka.sytes.net
live.isasecret.com
bandao.publicvm.com
redirectlnk.redirectme.net
updatee.serveblog.net
ns2.negociosdesucesso.info
gov.uae.kim
ksm5sksm5sksm5s.zzux.com
downloadmyhost.zapto.org
googlecombq6xx.ddns.net
wallanews.sytes.net
safar.selfip.com
webfile.myq-see.com
offeline.webhop.net
rgoyfuadvkebxhjm.ddns.net
su.noip.us
goodday.zapto.org
deapka.sytes.net
nazer.zapto.org
up.uae.kim
kaliob.selfip.org
mp4.servemp3.com
safari.linkpc.net
backop.mooo.com
rotter2.sytes.net
lilian.redirectme.net
backjadwer.bounceme.net
bypasstesting.servehalflife.com
downloadlog.linkpc.net
cyber18.no-ip.net
test.cable-modem.org
noredirecto.redirectme.net
google.com.r3irv2ykn0qnd7vr7sqv7kg2qho3ab5tngl5avxi5iimz1jxw9pa9.uae.kim
wallanews.publicvm.com
tango.zapto.org
internetdownloadr.publicvm.com
update.ciscofreak.com
updato.ns01.info
test.ns01.info
ynet.ignorelist.com
tvnew.otzo.com
use.mooo.com
safara.sytes.net
removalmalware.servecounterstrike.com
uptime.uae.kim
fatihah.zapto.org
help2014.linkpc.net
dnsfor.dnsfor.me
gaonsmom.redirectme.net
thenewupdate.chickenkiller.com
cnaci8gyolttkgmguzog.ignorelist.com
mailchat.zapto.org
ynet.sytes.net
ajaxo.zapto.org
kaswer12.strangled.net
natco1.no-ip.net
justded.justdied.com
thenewupdatee.redirectme.net
kolabdown.sytes.net
cccam.serveblog.net
wcf6f0nqvjtup4un.mooo.com
duntat.zapto.org
lastmoon.mooo.com
spreng.vizvaz.com
updatee.hopto.org
nrehcnthrtfmyi.strangled.net
httpo.sytes.net
natco3.no-ip.net
download.likescandy.com
haartezenglish.strangled.net
natco5.no-ip.net
testcom.strangled.net
orango.redirectme.net
haartezenglish.redirectme.net
rotter2.publicvm.com
gq4bp1baxfiblzqk.mrbasic.com
fastbingcom.sytes.net
downloadskype.cf
cbbnews.tk
store-legal.biz
chromeupdt.tk
cyber-peace.org
depka.sytes.net
live.isasecret.com
bandao.publicvm.com
redirectlnk.redirectme.net
updatee.serveblog.net
ns2.negociosdesucesso.info
gov.uae.kim
ksm5sksm5sksm5s.zzux.com
downloadmyhost.zapto.org
wallanews.sytes.net
safar.selfip.com
webfile.myq-see.com
offeline.webhop.net
rgoyfuadvkebxhjm.ddns.net
su.noip.us
googlecombq6xx.ddns.net
deapka.sytes.net
nazer.zapto.org
up.uae.kim
kaliob.selfip.org
mp4.servemp3.com
safari.linkpc.net
backop.mooo.com
rotter2.sytes.net
lilian.redirectme.net
backjadwer.bounceme.net
bypasstesting.servehalflife.com
downloadlog.linkpc.net
cyber18.no-ip.net
test.cable-modem.org
noredirecto.redirectme.net
google.com.r3irv2ykn0qnd7vr7sqv7kg2qho3ab5tngl5avxi5iimz1jxw9pa9.uae.kim
wallanews.publicvm.com
tango.zapto.org
internetdownloadr.publicvm.com
update.ciscofreak.com
updato.ns01.info
test.ns01.info
ynet.ignorelist.com
tvnew.otzo.com
use.mooo.com
safara.sytes.net
removalmalware.servecounterstrike.com
goodday.zapto.org
uptime.uae.kim
fatihah.zapto.org
help2014.linkpc.net
dnsfor.dnsfor.me
gaonsmom.redirectme.net
thenewupdate.chickenkiller.com
cnaci8gyolttkgmguzog.ignorelist.com
mailchat.zapto.org
ynet.sytes.net
ajaxo.zapto.org
kaswer12.strangled.net
natco1.no-ip.net
justded.justdied.com
thenewupdatee.redirectme.net
kolabdown.sytes.net
cccam.serveblog.net
wcf6f0nqvjtup4un.mooo.com
duntat.zapto.org
lastmoon.mooo.com
spreng.vizvaz.com
updatee.hopto.org
nrehcnthrtfmyi.strangled.net
httpo.sytes.net
natco3.no-ip.net
download.likescandy.com
haartezenglish.strangled.net
natco5.no-ip.net
testcom.strangled.net
orango.redirectme.net
haartezenglish.redirectme.net
rotter2.publicvm.com
gq4bp1baxfiblzqk.mrbasic.com
fastbingcom.sytes.net
natco2.no-ip.net
natco4.no-ip.net
uae.kim

# Reference: https://ti.360.net/blog/articles/suspected-molerats-new-attack-in-the-middle-east/

smartweb9.com

# Reference: https://securelist.com/gaza-cybergang-updated-2017-activity/82765/

moreoffer.life
signup.updatesforme.club
ping.topsite.life
alasra-paper.duckdns.org
hamas-wathaq.duckdns.org
download.data-server.cloudns.club
upgrade.newshelpyou.com
manual.newphoneapp.com
hnoor.newphoneapp.com
lol.mynetav.org

# Reference: https://twitter.com/silv0123/status/1075047190819717122

microsoft10.compress.to
wiknet.wikaba.com
fulltest.yourtrap.com
checktest.www1.biz

# Reference: https://otx.alienvault.com/pulse/5cae20f3a01b640c6da1441e

fulltest.yourtrap.com
wiknet.wikaba.com
supports.mefound.com
checktest.www1.biz
testmace.compress.to
microsoft10.compress.to
mmh.ns02.us
saso10.myftp.biz
dji-msi.2waky.com
testhoward.mysecondarydns.com
time-loss.dns05.com
ramliktest.mynetav.org
