ClickFix: Exploiting Compromised WordPress Sites with a Polygon-Based C2 Infrastructure

Domains/URLs

www.authorization-cdn-press-enter.info

authorization-cdn-press-enter.info

www.authorization-id-code.info

authorization-id-code.info

www.authorization-code.info

www.authorization-code.beer

www.codeverificatrorcl.info

authorization-code.beer

mail.thewellformedwoman.com

s1.thewellformedwoman.com

ftp.thewellformedwoman.com

autodiscover.thewellformedwoman.com

autoconfig.thewellformedwoman.com

codeverificatrorcl.info

authorization-code.info

www.idverification-cdn.info

idverification-cdn.info

www.verificationscodes.beer

verificationscodes.beer

www.verification-claude-cdn.beer

verification-claude-cdn.beer

code.verification-claude-cdn.beer

www.claudverification-id.beer

claudverification-id.beer

www.idverification-code.beer

idverification-code.beer

www.codecerification.beer

www.code-verification-js.beer

www.verification-code-js.beer

codecerification.beer

code-verification-js.beer

verification-code-js.beer

www.svs-verificationdate.beer

svs-verificationdate.beer

www.cdn-verification-cloud.boats

cdn-verification-cloud.boats

www.verification-js-cdn.boats

verification-js-cdn.boats

www.framework-css-styles-js.beer

www.thewellformedwoman.com

framework-css-styles-js.beer

www.ethercdnns.beer

ethercdnns.beer

www.clhfgcomacdn.beer

clhfgcomacdn.beer

www.ladydosug.love

www.istounscnnd.beer

www.trunnsns.beer

www.mstclaudens.beer

www.xdavnode.pro

istounscnnd.beer

mstclaudens.beer

trunnsns.beer

www.hftplcnsns.beer

www.lskannsserv.beer

thewellformedwoman.com

hftplcnsns.beer

lskannsserv.beer

www.hasmeverdcdn.beer

xdavnode.pro

hasmeverdcdn.beer

www.claufancdn.beer

www.srtydnnc.beer

www.bhfgtrns-js.beer

srtydnnc.beer

bhfgtrns-js.beer

claufancdn.beer

www.tescdnlast.beer

www.smfcdnbb.beer

www.shssshdscn.beer

www.snccdn-framework.beer

www.testapi34726.sbs

tescdnlast.beer

testapi34726.sbs

smfcdnbb.beer

www.nstdcs.beer

snccdn-framework.beer

shssshdscn.beer

nstdcs.beer

www.framework-jsoncdn.beer

www.gppcdnns.beer

framework-jsoncdn.beer

www.ladydosug.live

www.ladydosug.top

www.hpscdn.beer

gppcdnns.beer

ladydosug.live

ladydosug.love

hpscdn.beer

www.nvbfcdnclaud.beer

www.lnfcdnclad.beer

ladydosug.top

nvbfcdnclaud.beer

lnfcdnclad.beer

www.clainasns.beer

www.nshtjscdn.beer

www.nfstsrcdn.beer

nshtjscdn.beer

clainasns.beer

www.gdnssljs.beer

www.biyaconserver.beer

www.npanssltejs.beer

nfstsrcdn.beer

www.bootstrup-framework-js.beer

biyaconserver.beer

gdnssljs.beer

npanssltejs.beer

www.nshostvps.beer

www.chekbrow.beer

nshostvps.beer

bootstrup-framework-js.beer

www.smtnscerver.beer

smtnscerver.beer

chekbrow.beer

www.sns-clauder-cdn.beer

www.anlytic-js-cloud.beer

www.visual-ns-portal.beer

visual-ns-portal.beer

sns-clauder-cdn.beer

www.slndcdnclaud.beer

anlytic-js-cloud.beer

www.bootstrup-cdnmaper.beer

www.nsserv-bootstru.beer

www.ns1cdnclaude.beer

slndcdnclaud.beer

bootstrup-cdnmaper.beer

nsserv-bootstru.beer

ns1cdnclaude.beer

www.slngftr.beer

slngftr.beer

www.travel-js-ns.beer

www.smetana-js.beer

www.mistraljs.beer

smetana-js.beer

travel-js-ns.beer

www.lsikjsns.beer

www.ssns-cdn-ns.beer

lsikjsns.beer

mistraljs.beer

ssns-cdn-ns.beer

www.sane-cdn-js.beer

www.sr-hostes-js.beer

www.darndcs-js.beer

www.bkscndclou.beer

sr-hostes-js.beer

sane-cdn-js.beer

bkscndclou.beer

darndcs-js.beer

www.bcncdncl-ns.beer

bcncdncl-ns.beer

www.viscdnclaud.beer

www.ldnscreatejs.beer

viscdnclaud.beer

www.testerlau.lat

ldnscreatejs.beer

testerlau.lat

www.nfsclaudecdn.beer

nfsclaudecdn.beer

www.ssjscrybootstrup.beer

ssjscrybootstrup.beer

www.clacndjsvulnarbi.beer

clacndjsvulnarbi.beer

www.las-js-claud.beer

www.claudjaframework.beer

las-js-claud.beer

claudjaframework.beer

www.framesavecloudjs.beer

framesavecloudjs.beer

www.olnsclaud.beer

www.frameworkjsbns.beer

frameworkjsbns.beer

www.nsserdns.beer

www.claudesave.beer

www.nsbdnscloud.beer

olnsclaud.beer

claudesave.beer

nsbdnscloud.beer

nsserdns.beer

www.cloude-js-server.beer

www.best-claudns-js.beer

best-claudns-js.beer

cloude-js-server.beer

www.awesomeisojs.beer

awesomeisojs.beer

www.ns-claude-js.beer

www.ntsnsdns.beer

ns-claude-js.beer

ntsnsdns.beer

www.vjscloudjsns.beer

www.nslsconscloud.beer

vjscloudjsns.beer

nslsconscloud.beer

www.ns-server-jscdn.beer

www.lcstdnsns.beer

ns-server-jscdn.beer

lcstdnsns.beer

www.cloudcdnginx.beer

cloudcdnginx.beer

www.bootstrap-maxcdn.beer

www.dhnsdns.beer

bootstrap-maxcdn.beer

dhnsdns.beer

www.fijscdn.beer

www.bootstrup-cdn-ns.beer

www.bbdsnssserver.beer

www.lsnsdns.beer

www.fontawesome-js-cdn.beer

www.bilfojsclod.beer

bootstrup-cdn-ns.beer

fontawesome-js-cdn.beer

bbdsnssserver.beer

lsnsdns.beer

fijscdn.beer

bilfojsclod.beer

www.dreff-nsdns.beer

dreff-nsdns.beer

www.vsactivens.beer

vsactivens.beer

www.jsframeworkns.beer

www.nsservclod.beer

www.clnsdns.beer

nsservclod.beer

jsframeworkns.beer

clnsdns.beer

www.bnnsbdsdn-js.beer

www.polygon-date.beer

www.mnoskemp.beer

www.bnsclod.beer

bnnsbdsdn-js.beer

www.vnmstokns.beer

mnoskemp.beer

bnsclod.beer

polygon-date.beer

vnmstokns.beer

www.ghdnsserverns.beer

ghdnsserverns.beer

www.smnsdns.beer

www.sssndns.beer

www.vnmdnns.beer

smnsdns.beer

sssndns.beer

vnmdnns.beer

www.neiwteamcdn.beer

neiwteamcdn.beer

www.cgfuryclaud.shop

cgfuryclaud.shop

www.exdanteam.beer

www.l3cdnns.beer

exdanteam.beer

l3cdnns.beer

www.lenteam.beer

www.dncloteam.beer

lenteam.beer

www.sdnssmdf-js.beer

www.vsbnsbootstrup.beer

dncloteam.beer

www.teamcss.beer

www.siteamnsserv.beer

siteamnsserv.beer

vsbnsbootstrup.beer

sdnssmdf-js.beer

teamcss.beer

www.wpteamcdn.beer

www.js-server.beer

www.lndteam.beer

js-server.beer

www.sdhscndnssl.beer

www.stabcdnvlc.beer

www.lckcdnjs.beer

lndteam.beer

wpteamcdn.beer

lckcdnjs.beer

sdhscndnssl.beer

stabcdnvlc.beer

www.workcdnmass.beer

workcdnmass.beer

www.capcha-cdn-js.beer

www.cdn-plugin-js.beer

www.ssg-cdn.beer

ssg-cdn.beer

capcha-cdn-js.beer

cdn-plugin-js.beer

www.rpc-cloud.beer

rpc-cloud.beer

www.localcloudcss.sbs

localcloudcss.sbs

www.cdn-yethounds.beer

cdn-yethounds.beer

www.verification-cdn-cloud.beer

www.lcates-vs.beer

verification-cdn-cloud.beer

lcates-vs.beer

www.cloud-save-image.sbs

cloud-save-image.sbs

www.virtual-cdncloud.sbs

virtual-cdncloud.sbs

www.winecdn.sbs

www.cdn-2faclov.sbs

cdn-2faclov.sbs

winecdn.sbs

www.mandare.life

mandare.life

rpc-polygon.beer

www.rpc-polygon.beer

str-smcontrcats.cfd

www.ai-nexora.sbs

ai-nexora.sbs

www.all-imager-hst.click

www.store-image.shop

all-imager-hst.click

store-image.shop

www.nexus-server.click

nexus-server.click

IP Address

178.16.52.101

Detection Query 1 :

domainname like "www.authorization-cdn-press-enter.info" or siteurl like "www.authorization-cdn-press-enter.info" or url like "www.authorization-cdn-press-enter.info" or domainname like "authorization-cdn-press-enter.info" or siteurl like "authorization-cdn-press-enter.info" or url like "authorization-cdn-press-enter.info" or domainname like "www.authorization-id-code.info" or siteurl like "www.authorization-id-code.info" or url like "www.authorization-id-code.info" or domainname like "authorization-id-code.info" or siteurl like "authorization-id-code.info" or url like "authorization-id-code.info" or domainname like "www.authorization-code.info" or siteurl like "www.authorization-code.info" or url like "www.authorization-code.info" or domainname like "www.authorization-code.beer" or siteurl like "www.authorization-code.beer" or url like "www.authorization-code.beer" or domainname like "www.codeverificatrorcl.info" or siteurl like "www.codeverificatrorcl.info" or url like "www.codeverificatrorcl.info" or domainname like "authorization-code.beer" or siteurl like "authorization-code.beer" or url like "authorization-code.beer" or domainname like "mail.thewellformedwoman.com" or siteurl like "mail.thewellformedwoman.com" or url like "mail.thewellformedwoman.com" or domainname like "s1.thewellformedwoman.com" or siteurl like "s1.thewellformedwoman.com" or url like "s1.thewellformedwoman.com" or domainname like "ftp.thewellformedwoman.com" or siteurl like "ftp.thewellformedwoman.com" or url like "ftp.thewellformedwoman.com" or domainname like "autodiscover.thewellformedwoman.com" or siteurl like "autodiscover.thewellformedwoman.com" or url like "autodiscover.thewellformedwoman.com" or domainname like "autoconfig.thewellformedwoman.com" or siteurl like "autoconfig.thewellformedwoman.com" or url like "autoconfig.thewellformedwoman.com" or domainname like "codeverificatrorcl.info" or siteurl like "codeverificatrorcl.info" or url like "codeverificatrorcl.info" or domainname like "authorization-code.info" or siteurl like "authorization-code.info" or url like "authorization-code.info" or domainname like "www.idverification-cdn.info" or siteurl like "www.idverification-cdn.info" or url like "www.idverification-cdn.info" or domainname like "idverification-cdn.info" or siteurl like "idverification-cdn.info" or url like "idverification-cdn.info" or domainname like "www.verificationscodes.beer" or siteurl like "www.verificationscodes.beer" or url like "www.verificationscodes.beer" or domainname like "verificationscodes.beer" or siteurl like "verificationscodes.beer" or url like "verificationscodes.beer" or domainname like "www.verification-claude-cdn.beer" or siteurl like "www.verification-claude-cdn.beer" or url like "www.verification-claude-cdn.beer" or domainname like "verification-claude-cdn.beer" or siteurl like "verification-claude-cdn.beer" or url like "verification-claude-cdn.beer" or domainname like "code.verification-claude-cdn.beer" or siteurl like "code.verification-claude-cdn.beer" or url like "code.verification-claude-cdn.beer" or domainname like "www.claudverification-id.beer" or siteurl like "www.claudverification-id.beer" or url like "www.claudverification-id.beer" or domainname like "claudverification-id.beer" or siteurl like "claudverification-id.beer" or url like "claudverification-id.beer" or domainname like "www.idverification-code.beer" or siteurl like "www.idverification-code.beer" or url like "www.idverification-code.beer" or domainname like "idverification-code.beer" or siteurl like "idverification-code.beer" or url like "idverification-code.beer" or domainname like "www.codecerification.beer" or siteurl like "www.codecerification.beer" or url like "www.codecerification.beer" or domainname like "www.code-verification-js.beer" or siteurl like "www.code-verification-js.beer" or url like "www.code-verification-js.beer" or domainname like "www.verification-code-js.beer" or siteurl like "www.verification-code-js.beer" or url like "www.verification-code-js.beer" or domainname like "codecerification.beer" or siteurl like "codecerification.beer" or url like "codecerification.beer" or domainname like "code-verification-js.beer" or siteurl like "code-verification-js.beer" or url like "code-verification-js.beer" or domainname like "verification-code-js.beer" or siteurl like "verification-code-js.beer" or url like "verification-code-js.beer" or domainname like "www.svs-verificationdate.beer" or siteurl like "www.svs-verificationdate.beer" or url like "www.svs-verificationdate.beer" or domainname like "svs-verificationdate.beer" or siteurl like "svs-verificationdate.beer" or url like "svs-verificationdate.beer" or domainname like "www.cdn-verification-cloud.boats" or siteurl like "www.cdn-verification-cloud.boats" or url like "www.cdn-verification-cloud.boats" or domainname like "cdn-verification-cloud.boats" or siteurl like "cdn-verification-cloud.boats" or url like "cdn-verification-cloud.boats" or domainname like "www.verification-js-cdn.boats" or siteurl like "www.verification-js-cdn.boats" or url like "www.verification-js-cdn.boats" or domainname like "verification-js-cdn.boats" or siteurl like "verification-js-cdn.boats" or url like "verification-js-cdn.boats" or domainname like "www.framework-css-styles-js.beer" or siteurl like "www.framework-css-styles-js.beer" or url like "www.framework-css-styles-js.beer" or domainname like "www.thewellformedwoman.com" or siteurl like "www.thewellformedwoman.com" or url like "www.thewellformedwoman.com" or domainname like "framework-css-styles-js.beer" or siteurl like "framework-css-styles-js.beer" or url like "framework-css-styles-js.beer" or domainname like "www.ethercdnns.beer" or siteurl like "www.ethercdnns.beer" or url like "www.ethercdnns.beer" or domainname like "ethercdnns.beer" or siteurl like "ethercdnns.beer" or url like "ethercdnns.beer" or domainname like "www.clhfgcomacdn.beer" or siteurl like "www.clhfgcomacdn.beer" or url like "www.clhfgcomacdn.beer" or domainname like "clhfgcomacdn.beer" or siteurl like "clhfgcomacdn.beer" or url like "clhfgcomacdn.beer" or domainname like "www.ladydosug.love" or siteurl like "www.ladydosug.love" or url like "www.ladydosug.love" or domainname like "www.istounscnnd.beer" or siteurl like "www.istounscnnd.beer" or url like "www.istounscnnd.beer" or domainname like "www.trunnsns.beer" or siteurl like "www.trunnsns.beer" or url like "www.trunnsns.beer" or domainname like "www.mstclaudens.beer" or siteurl like "www.mstclaudens.beer" or url like "www.mstclaudens.beer" or domainname like "www.xdavnode.pro" or siteurl like "www.xdavnode.pro" or url like "www.xdavnode.pro"

Detection Query 2 :

domainname like "istounscnnd.beer" or siteurl like "istounscnnd.beer" or url like "istounscnnd.beer" or domainname like "mstclaudens.beer" or siteurl like "mstclaudens.beer" or url like "mstclaudens.beer" or domainname like "trunnsns.beer" or siteurl like "trunnsns.beer" or url like "trunnsns.beer" or domainname like "www.hftplcnsns.beer" or siteurl like "www.hftplcnsns.beer" or url like "www.hftplcnsns.beer" or domainname like "www.lskannsserv.beer" or siteurl like "www.lskannsserv.beer" or url like "www.lskannsserv.beer" or domainname like "thewellformedwoman.com" or siteurl like "thewellformedwoman.com" or url like "thewellformedwoman.com" or domainname like "hftplcnsns.beer" or siteurl like "hftplcnsns.beer" or url like "hftplcnsns.beer" or domainname like "lskannsserv.beer" or siteurl like "lskannsserv.beer" or url like "lskannsserv.beer" or domainname like "www.hasmeverdcdn.beer" or siteurl like "www.hasmeverdcdn.beer" or url like "www.hasmeverdcdn.beer" or domainname like "xdavnode.pro" or siteurl like "xdavnode.pro" or url like "xdavnode.pro" or domainname like "hasmeverdcdn.beer" or siteurl like "hasmeverdcdn.beer" or url like "hasmeverdcdn.beer" or domainname like "www.claufancdn.beer" or siteurl like "www.claufancdn.beer" or url like "www.claufancdn.beer" or domainname like "www.srtydnnc.beer" or siteurl like "www.srtydnnc.beer" or url like "www.srtydnnc.beer" or domainname like "www.bhfgtrns-js.beer" or siteurl like "www.bhfgtrns-js.beer" or url like "www.bhfgtrns-js.beer" or domainname like "srtydnnc.beer" or siteurl like "srtydnnc.beer" or url like "srtydnnc.beer" or domainname like "bhfgtrns-js.beer" or siteurl like "bhfgtrns-js.beer" or url like "bhfgtrns-js.beer" or domainname like "claufancdn.beer" or siteurl like "claufancdn.beer" or url like "claufancdn.beer" or domainname like "www.tescdnlast.beer" or siteurl like "www.tescdnlast.beer" or url like "www.tescdnlast.beer" or domainname like "www.smfcdnbb.beer" or siteurl like "www.smfcdnbb.beer" or url like "www.smfcdnbb.beer" or domainname like "www.shssshdscn.beer" or siteurl like "www.shssshdscn.beer" or url like "www.shssshdscn.beer" or domainname like "www.snccdn-framework.beer" or siteurl like "www.snccdn-framework.beer" or url like "www.snccdn-framework.beer" or domainname like "www.testapi34726.sbs" or siteurl like "www.testapi34726.sbs" or url like "www.testapi34726.sbs" or domainname like "tescdnlast.beer" or siteurl like "tescdnlast.beer" or url like "tescdnlast.beer" or domainname like "testapi34726.sbs" or siteurl like "testapi34726.sbs" or url like "testapi34726.sbs" or domainname like "smfcdnbb.beer" or siteurl like "smfcdnbb.beer" or url like "smfcdnbb.beer" or domainname like "www.nstdcs.beer" or siteurl like "www.nstdcs.beer" or url like "www.nstdcs.beer" or domainname like "snccdn-framework.beer" or siteurl like "snccdn-framework.beer" or url like "snccdn-framework.beer" or domainname like "shssshdscn.beer" or siteurl like "shssshdscn.beer" or url like "shssshdscn.beer" or domainname like "nstdcs.beer" or siteurl like "nstdcs.beer" or url like "nstdcs.beer" or domainname like "www.framework-jsoncdn.beer" or siteurl like "www.framework-jsoncdn.beer" or url like "www.framework-jsoncdn.beer" or domainname like "www.gppcdnns.beer" or siteurl like "www.gppcdnns.beer" or url like "www.gppcdnns.beer" or domainname like "framework-jsoncdn.beer" or siteurl like "framework-jsoncdn.beer" or url like "framework-jsoncdn.beer" or domainname like "www.ladydosug.live" or siteurl like "www.ladydosug.live" or url like "www.ladydosug.live" or domainname like "www.ladydosug.top" or siteurl like "www.ladydosug.top" or url like "www.ladydosug.top" or domainname like "www.hpscdn.beer" or siteurl like "www.hpscdn.beer" or url like "www.hpscdn.beer" or domainname like "gppcdnns.beer" or siteurl like "gppcdnns.beer" or url like "gppcdnns.beer" or domainname like "ladydosug.live" or siteurl like "ladydosug.live" or url like "ladydosug.live" or domainname like "ladydosug.love" or siteurl like "ladydosug.love" or url like "ladydosug.love" or domainname like "hpscdn.beer" or siteurl like "hpscdn.beer" or url like "hpscdn.beer" or domainname like "www.nvbfcdnclaud.beer" or siteurl like "www.nvbfcdnclaud.beer" or url like "www.nvbfcdnclaud.beer" or domainname like "www.lnfcdnclad.beer" or siteurl like "www.lnfcdnclad.beer" or url like "www.lnfcdnclad.beer" or domainname like "ladydosug.top" or siteurl like "ladydosug.top" or url like "ladydosug.top" or domainname like "nvbfcdnclaud.beer" or siteurl like "nvbfcdnclaud.beer" or url like "nvbfcdnclaud.beer" or domainname like "lnfcdnclad.beer" or siteurl like "lnfcdnclad.beer" or url like "lnfcdnclad.beer" or domainname like "www.clainasns.beer" or siteurl like "www.clainasns.beer" or url like "www.clainasns.beer" or domainname like "www.nshtjscdn.beer" or siteurl like "www.nshtjscdn.beer" or url like "www.nshtjscdn.beer" or domainname like "www.nfstsrcdn.beer" or siteurl like "www.nfstsrcdn.beer" or url like "www.nfstsrcdn.beer" or domainname like "nshtjscdn.beer" or siteurl like "nshtjscdn.beer" or url like "nshtjscdn.beer" or domainname like "clainasns.beer" or siteurl like "clainasns.beer" or url like "clainasns.beer" or domainname like "www.gdnssljs.beer" or siteurl like "www.gdnssljs.beer" or url like "www.gdnssljs.beer" or domainname like "www.biyaconserver.beer" or siteurl like "www.biyaconserver.beer" or url like "www.biyaconserver.beer" or domainname like "www.npanssltejs.beer" or siteurl like "www.npanssltejs.beer" or url like "www.npanssltejs.beer" or domainname like "nfstsrcdn.beer" or siteurl like "nfstsrcdn.beer" or url like "nfstsrcdn.beer" or domainname like "www.bootstrup-framework-js.beer" or siteurl like "www.bootstrup-framework-js.beer" or url like "www.bootstrup-framework-js.beer" or domainname like "biyaconserver.beer" or siteurl like "biyaconserver.beer" or url like "biyaconserver.beer" or domainname like "gdnssljs.beer" or siteurl like "gdnssljs.beer" or url like "gdnssljs.beer" or domainname like "npanssltejs.beer" or siteurl like "npanssltejs.beer" or url like "npanssltejs.beer" or domainname like "www.nshostvps.beer" or siteurl like "www.nshostvps.beer" or url like "www.nshostvps.beer" or domainname like "www.chekbrow.beer" or siteurl like "www.chekbrow.beer" or url like "www.chekbrow.beer" or domainname like "nshostvps.beer" or siteurl like "nshostvps.beer" or url like "nshostvps.beer" or domainname like "bootstrup-framework-js.beer" or siteurl like "bootstrup-framework-js.beer" or url like "bootstrup-framework-js.beer" or domainname like "www.smtnscerver.beer" or siteurl like "www.smtnscerver.beer" or url like "www.smtnscerver.beer"

Detection Query 3 :

domainname like "smtnscerver.beer" or siteurl like "smtnscerver.beer" or url like "smtnscerver.beer" or domainname like "chekbrow.beer" or siteurl like "chekbrow.beer" or url like "chekbrow.beer" or domainname like "www.sns-clauder-cdn.beer" or siteurl like "www.sns-clauder-cdn.beer" or url like "www.sns-clauder-cdn.beer" or domainname like "www.anlytic-js-cloud.beer" or siteurl like "www.anlytic-js-cloud.beer" or url like "www.anlytic-js-cloud.beer" or domainname like "www.visual-ns-portal.beer" or siteurl like "www.visual-ns-portal.beer" or url like "www.visual-ns-portal.beer" or domainname like "visual-ns-portal.beer" or siteurl like "visual-ns-portal.beer" or url like "visual-ns-portal.beer" or domainname like "sns-clauder-cdn.beer" or siteurl like "sns-clauder-cdn.beer" or url like "sns-clauder-cdn.beer" or domainname like "www.slndcdnclaud.beer" or siteurl like "www.slndcdnclaud.beer" or url like "www.slndcdnclaud.beer" or domainname like "anlytic-js-cloud.beer" or siteurl like "anlytic-js-cloud.beer" or url like "anlytic-js-cloud.beer" or domainname like "www.bootstrup-cdnmaper.beer" or siteurl like "www.bootstrup-cdnmaper.beer" or url like "www.bootstrup-cdnmaper.beer" or domainname like "www.nsserv-bootstru.beer" or siteurl like "www.nsserv-bootstru.beer" or url like "www.nsserv-bootstru.beer" or domainname like "www.ns1cdnclaude.beer" or siteurl like "www.ns1cdnclaude.beer" or url like "www.ns1cdnclaude.beer" or domainname like "slndcdnclaud.beer" or siteurl like "slndcdnclaud.beer" or url like "slndcdnclaud.beer" or domainname like "bootstrup-cdnmaper.beer" or siteurl like "bootstrup-cdnmaper.beer" or url like "bootstrup-cdnmaper.beer" or domainname like "nsserv-bootstru.beer" or siteurl like "nsserv-bootstru.beer" or url like "nsserv-bootstru.beer" or domainname like "ns1cdnclaude.beer" or siteurl like "ns1cdnclaude.beer" or url like "ns1cdnclaude.beer" or domainname like "www.slngftr.beer" or siteurl like "www.slngftr.beer" or url like "www.slngftr.beer" or domainname like "slngftr.beer" or siteurl like "slngftr.beer" or url like "slngftr.beer" or domainname like "www.travel-js-ns.beer" or siteurl like "www.travel-js-ns.beer" or url like "www.travel-js-ns.beer" or domainname like "www.smetana-js.beer" or siteurl like "www.smetana-js.beer" or url like "www.smetana-js.beer" or domainname like "www.mistraljs.beer" or siteurl like "www.mistraljs.beer" or url like "www.mistraljs.beer" or domainname like "smetana-js.beer" or siteurl like "smetana-js.beer" or url like "smetana-js.beer" or domainname like "travel-js-ns.beer" or siteurl like "travel-js-ns.beer" or url like "travel-js-ns.beer" or domainname like "www.lsikjsns.beer" or siteurl like "www.lsikjsns.beer" or url like "www.lsikjsns.beer" or domainname like "www.ssns-cdn-ns.beer" or siteurl like "www.ssns-cdn-ns.beer" or url like "www.ssns-cdn-ns.beer" or domainname like "lsikjsns.beer" or siteurl like "lsikjsns.beer" or url like "lsikjsns.beer" or domainname like "mistraljs.beer" or siteurl like "mistraljs.beer" or url like "mistraljs.beer" or domainname like "ssns-cdn-ns.beer" or siteurl like "ssns-cdn-ns.beer" or url like "ssns-cdn-ns.beer" or domainname like "www.sane-cdn-js.beer" or siteurl like "www.sane-cdn-js.beer" or url like "www.sane-cdn-js.beer" or domainname like "www.sr-hostes-js.beer" or siteurl like "www.sr-hostes-js.beer" or url like "www.sr-hostes-js.beer" or domainname like "www.darndcs-js.beer" or siteurl like "www.darndcs-js.beer" or url like "www.darndcs-js.beer" or domainname like "www.bkscndclou.beer" or siteurl like "www.bkscndclou.beer" or url like "www.bkscndclou.beer" or domainname like "sr-hostes-js.beer" or siteurl like "sr-hostes-js.beer" or url like "sr-hostes-js.beer" or domainname like "sane-cdn-js.beer" or siteurl like "sane-cdn-js.beer" or url like "sane-cdn-js.beer" or domainname like "bkscndclou.beer" or siteurl like "bkscndclou.beer" or url like "bkscndclou.beer" or domainname like "darndcs-js.beer" or siteurl like "darndcs-js.beer" or url like "darndcs-js.beer" or domainname like "www.bcncdncl-ns.beer" or siteurl like "www.bcncdncl-ns.beer" or url like "www.bcncdncl-ns.beer" or domainname like "bcncdncl-ns.beer" or siteurl like "bcncdncl-ns.beer" or url like "bcncdncl-ns.beer" or domainname like "www.viscdnclaud.beer" or siteurl like "www.viscdnclaud.beer" or url like "www.viscdnclaud.beer" or domainname like "www.ldnscreatejs.beer" or siteurl like "www.ldnscreatejs.beer" or url like "www.ldnscreatejs.beer" or domainname like "viscdnclaud.beer" or siteurl like "viscdnclaud.beer" or url like "viscdnclaud.beer" or domainname like "www.testerlau.lat" or siteurl like "www.testerlau.lat" or url like "www.testerlau.lat" or domainname like "ldnscreatejs.beer" or siteurl like "ldnscreatejs.beer" or url like "ldnscreatejs.beer" or domainname like "testerlau.lat" or siteurl like "testerlau.lat" or url like "testerlau.lat" or domainname like "www.nfsclaudecdn.beer" or siteurl like "www.nfsclaudecdn.beer" or url like "www.nfsclaudecdn.beer" or domainname like "nfsclaudecdn.beer" or siteurl like "nfsclaudecdn.beer" or url like "nfsclaudecdn.beer" or domainname like "www.ssjscrybootstrup.beer" or siteurl like "www.ssjscrybootstrup.beer" or url like "www.ssjscrybootstrup.beer" or domainname like "ssjscrybootstrup.beer" or siteurl like "ssjscrybootstrup.beer" or url like "ssjscrybootstrup.beer" or domainname like "www.clacndjsvulnarbi.beer" or siteurl like "www.clacndjsvulnarbi.beer" or url like "www.clacndjsvulnarbi.beer" or domainname like "clacndjsvulnarbi.beer" or siteurl like "clacndjsvulnarbi.beer" or url like "clacndjsvulnarbi.beer" or domainname like "www.las-js-claud.beer" or siteurl like "www.las-js-claud.beer" or url like "www.las-js-claud.beer" or domainname like "www.claudjaframework.beer" or siteurl like "www.claudjaframework.beer" or url like "www.claudjaframework.beer" or domainname like "las-js-claud.beer" or siteurl like "las-js-claud.beer" or url like "las-js-claud.beer" or domainname like "claudjaframework.beer" or siteurl like "claudjaframework.beer" or url like "claudjaframework.beer" or domainname like "www.framesavecloudjs.beer" or siteurl like "www.framesavecloudjs.beer" or url like "www.framesavecloudjs.beer" or domainname like "framesavecloudjs.beer" or siteurl like "framesavecloudjs.beer" or url like "framesavecloudjs.beer" or domainname like "www.olnsclaud.beer" or siteurl like "www.olnsclaud.beer" or url like "www.olnsclaud.beer" or domainname like "www.frameworkjsbns.beer" or siteurl like "www.frameworkjsbns.beer" or url like "www.frameworkjsbns.beer" or domainname like "frameworkjsbns.beer" or siteurl like "frameworkjsbns.beer" or url like "frameworkjsbns.beer"

Detection Query 4 :

domainname like "www.nsserdns.beer" or siteurl like "www.nsserdns.beer" or url like "www.nsserdns.beer" or domainname like "www.claudesave.beer" or siteurl like "www.claudesave.beer" or url like "www.claudesave.beer" or domainname like "www.nsbdnscloud.beer" or siteurl like "www.nsbdnscloud.beer" or url like "www.nsbdnscloud.beer" or domainname like "olnsclaud.beer" or siteurl like "olnsclaud.beer" or url like "olnsclaud.beer" or domainname like "claudesave.beer" or siteurl like "claudesave.beer" or url like "claudesave.beer" or domainname like "nsbdnscloud.beer" or siteurl like "nsbdnscloud.beer" or url like "nsbdnscloud.beer" or domainname like "nsserdns.beer" or siteurl like "nsserdns.beer" or url like "nsserdns.beer" or domainname like "www.cloude-js-server.beer" or siteurl like "www.cloude-js-server.beer" or url like "www.cloude-js-server.beer" or domainname like "www.best-claudns-js.beer" or siteurl like "www.best-claudns-js.beer" or url like "www.best-claudns-js.beer" or domainname like "best-claudns-js.beer" or siteurl like "best-claudns-js.beer" or url like "best-claudns-js.beer" or domainname like "cloude-js-server.beer" or siteurl like "cloude-js-server.beer" or url like "cloude-js-server.beer" or domainname like "www.awesomeisojs.beer" or siteurl like "www.awesomeisojs.beer" or url like "www.awesomeisojs.beer" or domainname like "awesomeisojs.beer" or siteurl like "awesomeisojs.beer" or url like "awesomeisojs.beer" or domainname like "www.ns-claude-js.beer" or siteurl like "www.ns-claude-js.beer" or url like "www.ns-claude-js.beer" or domainname like "www.ntsnsdns.beer" or siteurl like "www.ntsnsdns.beer" or url like "www.ntsnsdns.beer" or domainname like "ns-claude-js.beer" or siteurl like "ns-claude-js.beer" or url like "ns-claude-js.beer" or domainname like "ntsnsdns.beer" or siteurl like "ntsnsdns.beer" or url like "ntsnsdns.beer" or domainname like "www.vjscloudjsns.beer" or siteurl like "www.vjscloudjsns.beer" or url like "www.vjscloudjsns.beer" or domainname like "www.nslsconscloud.beer" or siteurl like "www.nslsconscloud.beer" or url like "www.nslsconscloud.beer" or domainname like "vjscloudjsns.beer" or siteurl like "vjscloudjsns.beer" or url like "vjscloudjsns.beer" or domainname like "nslsconscloud.beer" or siteurl like "nslsconscloud.beer" or url like "nslsconscloud.beer" or domainname like "www.ns-server-jscdn.beer" or siteurl like "www.ns-server-jscdn.beer" or url like "www.ns-server-jscdn.beer" or domainname like "www.lcstdnsns.beer" or siteurl like "www.lcstdnsns.beer" or url like "www.lcstdnsns.beer" or domainname like "ns-server-jscdn.beer" or siteurl like "ns-server-jscdn.beer" or url like "ns-server-jscdn.beer" or domainname like "lcstdnsns.beer" or siteurl like "lcstdnsns.beer" or url like "lcstdnsns.beer" or domainname like "www.cloudcdnginx.beer" or siteurl like "www.cloudcdnginx.beer" or url like "www.cloudcdnginx.beer" or domainname like "cloudcdnginx.beer" or siteurl like "cloudcdnginx.beer" or url like "cloudcdnginx.beer" or domainname like "www.bootstrap-maxcdn.beer" or siteurl like "www.bootstrap-maxcdn.beer" or url like "www.bootstrap-maxcdn.beer" or domainname like "www.dhnsdns.beer" or siteurl like "www.dhnsdns.beer" or url like "www.dhnsdns.beer" or domainname like "bootstrap-maxcdn.beer" or siteurl like "bootstrap-maxcdn.beer" or url like "bootstrap-maxcdn.beer" or domainname like "dhnsdns.beer" or siteurl like "dhnsdns.beer" or url like "dhnsdns.beer" or domainname like "www.fijscdn.beer" or siteurl like "www.fijscdn.beer" or url like "www.fijscdn.beer" or domainname like "www.bootstrup-cdn-ns.beer" or siteurl like "www.bootstrup-cdn-ns.beer" or url like "www.bootstrup-cdn-ns.beer" or domainname like "www.bbdsnssserver.beer" or siteurl like "www.bbdsnssserver.beer" or url like "www.bbdsnssserver.beer" or domainname like "www.lsnsdns.beer" or siteurl like "www.lsnsdns.beer" or url like "www.lsnsdns.beer" or domainname like "www.fontawesome-js-cdn.beer" or siteurl like "www.fontawesome-js-cdn.beer" or url like "www.fontawesome-js-cdn.beer" or domainname like "www.bilfojsclod.beer" or siteurl like "www.bilfojsclod.beer" or url like "www.bilfojsclod.beer" or domainname like "bootstrup-cdn-ns.beer" or siteurl like "bootstrup-cdn-ns.beer" or url like "bootstrup-cdn-ns.beer" or domainname like "fontawesome-js-cdn.beer" or siteurl like "fontawesome-js-cdn.beer" or url like "fontawesome-js-cdn.beer" or domainname like "bbdsnssserver.beer" or siteurl like "bbdsnssserver.beer" or url like "bbdsnssserver.beer" or domainname like "lsnsdns.beer" or siteurl like "lsnsdns.beer" or url like "lsnsdns.beer" or domainname like "fijscdn.beer" or siteurl like "fijscdn.beer" or url like "fijscdn.beer" or domainname like "bilfojsclod.beer" or siteurl like "bilfojsclod.beer" or url like "bilfojsclod.beer" or domainname like "www.dreff-nsdns.beer" or siteurl like "www.dreff-nsdns.beer" or url like "www.dreff-nsdns.beer" or domainname like "dreff-nsdns.beer" or siteurl like "dreff-nsdns.beer" or url like "dreff-nsdns.beer" or domainname like "www.vsactivens.beer" or siteurl like "www.vsactivens.beer" or url like "www.vsactivens.beer" or domainname like "vsactivens.beer" or siteurl like "vsactivens.beer" or url like "vsactivens.beer" or domainname like "www.jsframeworkns.beer" or siteurl like "www.jsframeworkns.beer" or url like "www.jsframeworkns.beer" or domainname like "www.nsservclod.beer" or siteurl like "www.nsservclod.beer" or url like "www.nsservclod.beer" or domainname like "www.clnsdns.beer" or siteurl like "www.clnsdns.beer" or url like "www.clnsdns.beer" or domainname like "nsservclod.beer" or siteurl like "nsservclod.beer" or url like "nsservclod.beer" or domainname like "jsframeworkns.beer" or siteurl like "jsframeworkns.beer" or url like "jsframeworkns.beer" or domainname like "clnsdns.beer" or siteurl like "clnsdns.beer" or url like "clnsdns.beer" or domainname like "www.bnnsbdsdn-js.beer" or siteurl like "www.bnnsbdsdn-js.beer" or url like "www.bnnsbdsdn-js.beer" or domainname like "www.polygon-date.beer" or siteurl like "www.polygon-date.beer" or url like "www.polygon-date.beer" or domainname like "www.mnoskemp.beer" or siteurl like "www.mnoskemp.beer" or url like "www.mnoskemp.beer" or domainname like "www.bnsclod.beer" or siteurl like "www.bnsclod.beer" or url like "www.bnsclod.beer" or domainname like "bnnsbdsdn-js.beer" or siteurl like "bnnsbdsdn-js.beer" or url like "bnnsbdsdn-js.beer" or domainname like "www.vnmstokns.beer" or siteurl like "www.vnmstokns.beer" or url like "www.vnmstokns.beer" or domainname like "mnoskemp.beer" or siteurl like "mnoskemp.beer" or url like "mnoskemp.beer" or domainname like "bnsclod.beer" or siteurl like "bnsclod.beer" or url like "bnsclod.beer"

Detection Query 5 :

domainname like "polygon-date.beer" or siteurl like "polygon-date.beer" or url like "polygon-date.beer" or domainname like "vnmstokns.beer" or siteurl like "vnmstokns.beer" or url like "vnmstokns.beer" or domainname like "www.ghdnsserverns.beer" or siteurl like "www.ghdnsserverns.beer" or url like "www.ghdnsserverns.beer" or domainname like "ghdnsserverns.beer" or siteurl like "ghdnsserverns.beer" or url like "ghdnsserverns.beer" or domainname like "www.smnsdns.beer" or siteurl like "www.smnsdns.beer" or url like "www.smnsdns.beer" or domainname like "www.sssndns.beer" or siteurl like "www.sssndns.beer" or url like "www.sssndns.beer" or domainname like "www.vnmdnns.beer" or siteurl like "www.vnmdnns.beer" or url like "www.vnmdnns.beer" or domainname like "smnsdns.beer" or siteurl like "smnsdns.beer" or url like "smnsdns.beer" or domainname like "sssndns.beer" or siteurl like "sssndns.beer" or url like "sssndns.beer" or domainname like "vnmdnns.beer" or siteurl like "vnmdnns.beer" or url like "vnmdnns.beer" or domainname like "www.neiwteamcdn.beer" or siteurl like "www.neiwteamcdn.beer" or url like "www.neiwteamcdn.beer" or domainname like "neiwteamcdn.beer" or siteurl like "neiwteamcdn.beer" or url like "neiwteamcdn.beer" or domainname like "www.cgfuryclaud.shop" or siteurl like "www.cgfuryclaud.shop" or url like "www.cgfuryclaud.shop" or domainname like "cgfuryclaud.shop" or siteurl like "cgfuryclaud.shop" or url like "cgfuryclaud.shop" or domainname like "www.exdanteam.beer" or siteurl like "www.exdanteam.beer" or url like "www.exdanteam.beer" or domainname like "www.l3cdnns.beer" or siteurl like "www.l3cdnns.beer" or url like "www.l3cdnns.beer" or domainname like "exdanteam.beer" or siteurl like "exdanteam.beer" or url like "exdanteam.beer" or domainname like "l3cdnns.beer" or siteurl like "l3cdnns.beer" or url like "l3cdnns.beer" or domainname like "www.lenteam.beer" or siteurl like "www.lenteam.beer" or url like "www.lenteam.beer" or domainname like "www.dncloteam.beer" or siteurl like "www.dncloteam.beer" or url like "www.dncloteam.beer" or domainname like "lenteam.beer" or siteurl like "lenteam.beer" or url like "lenteam.beer" or domainname like "www.sdnssmdf-js.beer" or siteurl like "www.sdnssmdf-js.beer" or url like "www.sdnssmdf-js.beer" or domainname like "www.vsbnsbootstrup.beer" or siteurl like "www.vsbnsbootstrup.beer" or url like "www.vsbnsbootstrup.beer" or domainname like "dncloteam.beer" or siteurl like "dncloteam.beer" or url like "dncloteam.beer" or domainname like "www.teamcss.beer" or siteurl like "www.teamcss.beer" or url like "www.teamcss.beer" or domainname like "www.siteamnsserv.beer" or siteurl like "www.siteamnsserv.beer" or url like "www.siteamnsserv.beer" or domainname like "siteamnsserv.beer" or siteurl like "siteamnsserv.beer" or url like "siteamnsserv.beer" or domainname like "vsbnsbootstrup.beer" or siteurl like "vsbnsbootstrup.beer" or url like "vsbnsbootstrup.beer" or domainname like "sdnssmdf-js.beer" or siteurl like "sdnssmdf-js.beer" or url like "sdnssmdf-js.beer" or domainname like "teamcss.beer" or siteurl like "teamcss.beer" or url like "teamcss.beer" or domainname like "www.wpteamcdn.beer" or siteurl like "www.wpteamcdn.beer" or url like "www.wpteamcdn.beer" or domainname like "www.js-server.beer" or siteurl like "www.js-server.beer" or url like "www.js-server.beer" or domainname like "www.lndteam.beer" or siteurl like "www.lndteam.beer" or url like "www.lndteam.beer" or domainname like "js-server.beer" or siteurl like "js-server.beer" or url like "js-server.beer" or domainname like "www.sdhscndnssl.beer" or siteurl like "www.sdhscndnssl.beer" or url like "www.sdhscndnssl.beer" or domainname like "www.stabcdnvlc.beer" or siteurl like "www.stabcdnvlc.beer" or url like "www.stabcdnvlc.beer" or domainname like "www.lckcdnjs.beer" or siteurl like "www.lckcdnjs.beer" or url like "www.lckcdnjs.beer" or domainname like "lndteam.beer" or siteurl like "lndteam.beer" or url like "lndteam.beer" or domainname like "wpteamcdn.beer" or siteurl like "wpteamcdn.beer" or url like "wpteamcdn.beer" or domainname like "lckcdnjs.beer" or siteurl like "lckcdnjs.beer" or url like "lckcdnjs.beer" or domainname like "sdhscndnssl.beer" or siteurl like "sdhscndnssl.beer" or url like "sdhscndnssl.beer" or domainname like "stabcdnvlc.beer" or siteurl like "stabcdnvlc.beer" or url like "stabcdnvlc.beer" or domainname like "www.workcdnmass.beer" or siteurl like "www.workcdnmass.beer" or url like "www.workcdnmass.beer" or domainname like "workcdnmass.beer" or siteurl like "workcdnmass.beer" or url like "workcdnmass.beer" or domainname like "www.capcha-cdn-js.beer" or siteurl like "www.capcha-cdn-js.beer" or url like "www.capcha-cdn-js.beer" or domainname like "www.cdn-plugin-js.beer" or siteurl like "www.cdn-plugin-js.beer" or url like "www.cdn-plugin-js.beer" or domainname like "www.ssg-cdn.beer" or siteurl like "www.ssg-cdn.beer" or url like "www.ssg-cdn.beer" or domainname like "ssg-cdn.beer" or siteurl like "ssg-cdn.beer" or url like "ssg-cdn.beer" or domainname like "capcha-cdn-js.beer" or siteurl like "capcha-cdn-js.beer" or url like "capcha-cdn-js.beer" or domainname like "cdn-plugin-js.beer" or siteurl like "cdn-plugin-js.beer" or url like "cdn-plugin-js.beer" or domainname like "www.rpc-cloud.beer" or siteurl like "www.rpc-cloud.beer" or url like "www.rpc-cloud.beer" or domainname like "rpc-cloud.beer" or siteurl like "rpc-cloud.beer" or url like "rpc-cloud.beer" or domainname like "www.localcloudcss.sbs" or siteurl like "www.localcloudcss.sbs" or url like "www.localcloudcss.sbs" or domainname like "localcloudcss.sbs" or siteurl like "localcloudcss.sbs" or url like "localcloudcss.sbs" or domainname like "www.cdn-yethounds.beer" or siteurl like "www.cdn-yethounds.beer" or url like "www.cdn-yethounds.beer" or domainname like "cdn-yethounds.beer" or siteurl like "cdn-yethounds.beer" or url like "cdn-yethounds.beer" or domainname like "www.verification-cdn-cloud.beer" or siteurl like "www.verification-cdn-cloud.beer" or url like "www.verification-cdn-cloud.beer" or domainname like "www.lcates-vs.beer" or siteurl like "www.lcates-vs.beer" or url like "www.lcates-vs.beer" or domainname like "verification-cdn-cloud.beer" or siteurl like "verification-cdn-cloud.beer" or url like "verification-cdn-cloud.beer" or domainname like "lcates-vs.beer" or siteurl like "lcates-vs.beer" or url like "lcates-vs.beer" or domainname like "www.cloud-save-image.sbs" or siteurl like "www.cloud-save-image.sbs" or url like "www.cloud-save-image.sbs" or domainname like "cloud-save-image.sbs" or siteurl like "cloud-save-image.sbs" or url like "cloud-save-image.sbs"

Detection Query 6 :

domainname like "www.virtual-cdncloud.sbs" or siteurl like "www.virtual-cdncloud.sbs" or url like "www.virtual-cdncloud.sbs" or domainname like "virtual-cdncloud.sbs" or siteurl like "virtual-cdncloud.sbs" or url like "virtual-cdncloud.sbs" or domainname like "www.winecdn.sbs" or siteurl like "www.winecdn.sbs" or url like "www.winecdn.sbs" or domainname like "www.cdn-2faclov.sbs" or siteurl like "www.cdn-2faclov.sbs" or url like "www.cdn-2faclov.sbs" or domainname like "cdn-2faclov.sbs" or siteurl like "cdn-2faclov.sbs" or url like "cdn-2faclov.sbs" or domainname like "winecdn.sbs" or siteurl like "winecdn.sbs" or url like "winecdn.sbs" or domainname like "www.mandare.life" or siteurl like "www.mandare.life" or url like "www.mandare.life" or domainname like "mandare.life" or siteurl like "mandare.life" or url like "mandare.life" or domainname like "rpc-polygon.beer" or siteurl like "rpc-polygon.beer" or url like "rpc-polygon.beer" or domainname like "www.rpc-polygon.beer" or siteurl like "www.rpc-polygon.beer" or url like "www.rpc-polygon.beer" or domainname like "str-smcontrcats.cfd" or siteurl like "str-smcontrcats.cfd" or url like "str-smcontrcats.cfd" or domainname like "www.ai-nexora.sbs" or siteurl like "www.ai-nexora.sbs" or url like "www.ai-nexora.sbs" or domainname like "ai-nexora.sbs" or siteurl like "ai-nexora.sbs" or url like "ai-nexora.sbs" or domainname like "www.all-imager-hst.click" or siteurl like "www.all-imager-hst.click" or url like "www.all-imager-hst.click" or domainname like "www.store-image.shop" or siteurl like "www.store-image.shop" or url like "www.store-image.shop" or domainname like "all-imager-hst.click" or siteurl like "all-imager-hst.click" or url like "all-imager-hst.click" or domainname like "store-image.shop" or siteurl like "store-image.shop" or url like "store-image.shop" or domainname like "www.nexus-server.click" or siteurl like "www.nexus-server.click" or url like "www.nexus-server.click" or domainname like "nexus-server.click" or siteurl like "nexus-server.click" or url like "nexus-server.click"

Detection Query 7 :

dstipaddress IN ("178.16.52.101") or srcipaddress IN ("178.16.52.101")