Shutting the Door on the XCPE Botnet

Domains/URLs

amhib.com

disview.com

prataw.com

auqee.com

alptk.com

mfiny.com

leisurepuz.com

earn.fm

geo-loadbalanced.com

collection.shixunsuda.com

analysis.shixunsuda.com

gtxvdqvuweqs.com

hiddeninplainsight.top

absolut.fit

alpivara.com

beepityping.com

beezlepongmad.com

bloopondle.com

blustpong.com

braigwshat.com

brisping.com

bronglepong.com

clapslpist.com

clapslport.com

craipivolta.com

creapslpinut.com

crodipolis.com

delpiverno.com

depomancy.com

dewswyra.com

drackpingcare.com

dramapi.com

drapithon.com

fawsilver.com

fawsindra.com

fizzlepong.com

flaigwern.com

flapilo.com

flapslwstorm.com

flawsino.com

flewsnark.com

floporin.com

floppipple.com

flumpipoodle.com

frosping.com

gapslpinch.com

gapslwsbor.com

glapoton.com

glewsnap.com

glippinger.com

gloobfnatch.com

gloopong.com

glowspar.com

grasplpond.com

grinapslpocal.com

hawsith.com

lapslponze.com

lepovia.com

limpingcare.com

lorapslpifyx.com

lowswyn.com

lunapiris.com

mopith.com

mudponger.com

nepiral.com

opostra.com

pibberflop.com

pikaroodle.com

ploponix.com

qepoth.com

rapinel.com

rapslpine.com

rapslponic.com

rapslwsweave.com

raspongle.com

ripotus.com

rowswyn.com

scapslwshell.com

snarpong.com

snorpdoodle.com

sofpilan.com

soporth.com

spopel.com

tawserin.com

tawswizzle.com

teowsmera.com

tepiol.com

tewsmariel.com

thaiporix.com

thapolex.com

torpoodle.com

trapslwsin.com

trawsica.com

tripikazu.com

twindping.com

vaiporun.com

vespilara.com

vorpolis.com

whispong.com

winklenark.com

wizzleplonk.com

wogglenift.com

yapodust.com

yewsara.com

zarflonk.com

zenapslpinic.com

zerapslpomat.com

zimpire.com

zingpingbees.com

zippypongbee.com

zoraipinex.com

zorapslwsnic.com

zrawsomble.com

bestipip.com

fecebbbk.xyz

guangzhouroot.com

bd-devmetrics.net

jaguar-distributor.logreporter.com

jaguar-distributor.syslogcollector.com

tx-devmetrics.net

linkfog.cn

cloudbrokerapi.xyz

dddlink.link

smrtai.cc

bkdomain.cn

columbus2024.com

dmurdce.xyz

edisajalsjfdfh.shop

fshuaons2.online

fuioahsdoa3.store

fuisans1.online

haimnsgsjhansj.shop

ishano456.sbs

ishuoabh3years.online

sdoisanadf.shop

shaiosjdaln.shop

shsuanalsjai.shop

ty4523.space

ty54fgd435.my

ue886578433.online

vrr8345.site

xmsae.sbs

xshaon123.sbs

dgjm.online

drgdj.top

spiritlib.cyou

traffmonetizer.com

anyevonline.com

intermedia-arts.tv

szbboys.com

ott.szbboys.com

mqtt.szbboys.com

github.com/Aviciiii/

github.com/Spink1984/

github.com/undowildcats-sketch/

github.com/szjkkax/

github.com/szsoft01/

github.com/ktpeng2026/

github.com/yf-videostrong/

github.com/vspeng/

github.com/szwzy43/

github.com/ChenHui1026/

github.com/zurant/

yokatvonline.com

IP Address

219.134.163.210

219.134.163.211

23.94.49.57

38.145.197.135

Hash

96146abb8c2a75dab8cc1bb46c323923

3768f470934a111f1c3e3d098eb1392a3cb6f3e298ef5fd2a6309e6a98ee1e18

4f860efa8d8b9b8f35f343d524500181607a0cdc9fac35394cf16b71ff4ad1d0

8365658b7c51d7b607fe83d862d05e619cad5249c96db61a3d33a95c615c8194

92326f3065273d619f866f76e3542b6271886f92b1342c5ccc27cb7150c75176

17d4929578dac90af7da3a9c8bbd6f516ade8cc803c82a0f64849fb2a346a894

76b4bf6f55aaab35428260a830ac9a2c437a09aefd521c5b51618db47beca3b2

05e2e32e08073081adcb8875c3b7350fff53e7ea8f36d6388fb3daa626015d22

da5246fb62db91eda31df0873835e1c96a3187df1a760ffc87abf9788ba69104

471e76cce87e280a2fe11046fcb58c0817558ffbc8a526d84fb40c45b03ac9bc

39792bed070b1128cd67178591804fafb82112d371ccdb2b51cd600b2d435922

2cdb1f0f0969766142f3debbab55eef5e24c15d49a513753f1f6b67bc3e8438b

dca25ff0d11d49e9969be3177b50aa8bf120b5ad3946409dedae143a8a69aa99

20af9e1538e1c211687c53e71318d9d265e36ce154457cade3266c7633fb953d

f451c0b770049c71fb0d8efd45115dfc3336f636fb6a0617ec5a5c58632196f4

0d90d0e5009d0c67e978dffb1f78278fa22f296ebc14add1fe338abea8690867

22c0279d23973fd9b3bfd9f42fd19ea1595c6e3f71a89b698828c79fa8e4edd2

6b55b8b3ff7bd31af93b59612f0800c09e49d3badc772e2395736616c87d5612

049b626ca9bc4cf552e675dd5bf6215753caa3a3d28fab17b2a8fa9e0c8421c0

bcf142ba37e897b7fcbb89353ec9b5a7c3bfb1d167838d3b91c347b9fdfb2230

1806a1a93a6bce28cc6e95e9001f06370eaef9c66846ade9aecaf220d7ac91a4

9216a0a460400403027d4dfc9a6193a776603b64735f174e74a89607567ac6f2

04ffe332458931d82c0503daba1859622540828302af1190d2d3c6447094428c

3e891f061daf73c2edc14ed98512cad008346679645e8165320bf96fb8b0e0d6

415d54757c2f96fd28404f1ab8da1e90297a381ec3d7fb47d33126644a0a421b

9df157f3975b582074033c80d0d586f3911fb6bd3813539e2edf87ada4eee9fb

be9990489fbf36100ec148f3a83795f2674d17063edb8accd560f1ce2f97dedd

8953f9013eb8c31b27c86ba90edbdb9ecba216ed2cb6a992508c1964d53b8eee

01b8c78f5509119b3e27ea4d628048985b94b5e00db0431d843519cf1d3e2cde

5ae5df84cdce0100eb957cf235d1f3fd85fa634592e7ca137de12535e9f8ad2a

085662ba43e22d04d6f69b7b5176c68cedee6507c5d34973c94459f324b44c8d

07b511a6f7715ccd2f77b5f51e4cf46542ccaada99564252711f4a142ac26179

02490fa9f472ec872723d64d03402967e77932d2df72c588b0d7a7df9e17ae62

6f7f4b22eb7841d2b828f1eda77173880d42267a33b387bee9cee983c03bf291

1de0a368599ab04b8863c0e61c2d5a75e00f742a3326325f2870a9a72ee8d200

486a784cbd6335d31214edd7bed7fcfb486b875374597c139826c77c91ccbbaa

350d6db477e8567cf9347c1144b3a0b25550e7ce63bb800b056b8a7a8ef56af4

2d4b5c50e57e3e9b57d4ee02bef1dcd56163550a5e01c966e0f0fb6d46b2aeed

99874d087e3f72a9d78439118361f438f7a156af318c788183d338cc315d7fa8

4fd0ddb15849137df77e8cb86cd951d2d220fd8dd5b8b03c5a7e23e815092fdd

cad908ad09d029971b24b4ad653fe680101ccaddd94b4e530c58bf45430fd1a4

3627f848804f49c041203e8d754e8d89f3ff6243b6d9e1ca6e50bbf08dbd9785

0ed2ec71901210b1100c6a4abee48ad36774962496d57577d58630072e30cc60

1c8408f80dcdac5c9cae5b2ac785e6f0aa97ad2ec6c8701e3ab661882e9fdd63

1c34f551cea557b24f6f3776de7fecaf40536c749d5b9734242acde4dd578c53

1c989cef1b9cc5a39715d172e3f3acb574a958765f4a9df50c952c0a359826cd

498d0862ce2ce972e9ac9bd3ea592b9f9cd8c5119dcc90fcb1b14a547889e9f9

b2e55884c819c210eaf46aeb7970a1ec623944b5d1a8c2178904f998b9682ac0

1f2ab93c35f0c37d9b88f82268183a2f77491aa6b142a48381524b18e217b960

a552bcb7d37c2bdb5c71e923157571598643de4051bfa3e5158fde3cb8709de7

3295d193ac405112ad076d7fab23274d44f8d0be6614a250a474c5ed7c95356f

c0e1fad801d87531ee889fa6ec344f14868e7cdac06c93d2d3de742f1a9293c5

0135b69bab304564628488829b825050d1dd6dab98e86ec6776839dac9365af9

83b3cfb7655483e0d421737c2bed707fdd1747f105deca6980233c011aaaea30

02b94ae4ee0fd2bab915fe2911d15ee70e51ca0564ba43c746593e7fe0b7ccd3

69116e8f681ea312e7e9e3a8a436f66b3e98566c621412599ecaaa25348daadb

7eb1afbf4428a9a3b41a6faf9a7497aab1d7768a8370d475f580e574145a9e7d

d4011b684ba389bf0b2dd8ded74fe8a4729b1cad4e6c18cfd928cb99a625a6e4

e25616a0c64734f00d1f6dfb064d8f7bf1e4b95aac8b2e4aabb44b2950751bd0

cd8ef4ba20823b926b45a04946f24e45a7bcd4bf2bfc439cac8061a43f146903

08edc09f4465cd784360c223275c45a5e95d7dc8a5e796537ea5251848b3d2f1

fda3c8fdf7849814e270bbbc00adfa1e15ba8977f5b2508df5febf5dbd3075b2

b3690b3b013ac60752a6d05c3f53ea1f3e844d4603c5b90d258a30c596d0691b

ebcca22b96f7a30ae155efa2f25af29a369c6e9cfc99cb3bb0b72f35bc5528ed

42be8f18d6006ca092de191331d38e70a0d8383db701a759466dec59a0986135

7830ce3c3222dd9b25a77a16116dcf832a24b4b9a0bc998501e12415a828fb42

d4011b684ba389bf0b2dd8ded74fe8a4729b1cad4e6c18cfd928cb99a625a6e4

cd8ef4ba20823b926b45a04946f24e45a7bcd4bf2bfc439cac8061a43f146903

331d3a1cf85656c3657e97bab6f15b6e4ce30bf319069b22e8356dccac230321

d3b94a74121e885bc698c8f56b9433247139be29b40ae1d0655dd558ecf5f9fa

e2bfca7225af84f116de7ed10e4ad425d0ebfd6e19903d226b9768282865700f

d48cffc6d7e7c06f2d3db34ce6d4a53d5c25636179b7087a1e762f5d6bfa07f5

d3b94a74121e885bc698c8f56b9433247139be29b40ae1d0655dd558ecf5f9fa

69116e8f681ea312e7e9e3a8a436f66b3e98566c621412599ecaaa25348daadb

f2ed4a40fbb21d0560e82bdd2e85e825970d32052348241b487dd93191ebef2a

f2ed4a40fbb21d0560e82bdd2e85e825970d32052348241b487dd93191ebef2a

f2ed4a40fbb21d0560e82bdd2e85e825970d32052348241b487dd93191ebef2a

d48cffc6d7e7c06f2d3db34ce6d4a53d5c25636179b7087a1e762f5d6bfa07f5

8cb62b3a9b74ca8b907aef7d83fee65f3ab80e0f4acbf4b2415ea1c2a6caf796

a63757715b35ddd99916b63a1354de1ec05ac5855a480fe9a547b002e2091dcb

701f57169f3968bf412d33ec09fa6f2c11ece632aed9f44efa38eaf4fa2e08c6

f2ed4a40fbb21d0560e82bdd2e85e825970d32052348241b487dd93191ebef2a

9e18c113eb8d2ba813199c7f90e26d80af3124d871fc31eea7253319a8406e8e

742b7ad8b95d4e0784c914f2b84706124f5a86a404e0fd479a0a97a784c2bb9e

a6c7ef9b6d5277dada145361164ff79e1e6c6be1cd28f6739113c72ee30ea4cc

ff96f093bbac32654db62ebb33276c64cd30eb25a0bc11e66608ca40efb1bbdc

71f52519aae77fb20448ea065caa55750bcd73cf425aab203277032e260a1981

Detection Query 1 :

domainname like "amhib.com" or siteurl like "amhib.com" or url like "amhib.com" or domainname like "disview.com" or siteurl like "disview.com" or url like "disview.com" or domainname like "prataw.com" or siteurl like "prataw.com" or url like "prataw.com" or domainname like "auqee.com" or siteurl like "auqee.com" or url like "auqee.com" or domainname like "alptk.com" or siteurl like "alptk.com" or url like "alptk.com" or domainname like "mfiny.com" or siteurl like "mfiny.com" or url like "mfiny.com" or domainname like "leisurepuz.com" or siteurl like "leisurepuz.com" or url like "leisurepuz.com" or domainname like "earn.fm" or siteurl like "earn.fm" or url like "earn.fm" or domainname like "geo-loadbalanced.com" or siteurl like "geo-loadbalanced.com" or url like "geo-loadbalanced.com" or domainname like "collection.shixunsuda.com" or siteurl like "collection.shixunsuda.com" or url like "collection.shixunsuda.com" or domainname like "analysis.shixunsuda.com" or siteurl like "analysis.shixunsuda.com" or url like "analysis.shixunsuda.com" or domainname like "gtxvdqvuweqs.com" or siteurl like "gtxvdqvuweqs.com" or url like "gtxvdqvuweqs.com" or domainname like "hiddeninplainsight.top" or siteurl like "hiddeninplainsight.top" or url like "hiddeninplainsight.top" or domainname like "absolut.fit" or siteurl like "absolut.fit" or url like "absolut.fit" or domainname like "alpivara.com" or siteurl like "alpivara.com" or url like "alpivara.com" or domainname like "beepityping.com" or siteurl like "beepityping.com" or url like "beepityping.com" or domainname like "beezlepongmad.com" or siteurl like "beezlepongmad.com" or url like "beezlepongmad.com" or domainname like "bloopondle.com" or siteurl like "bloopondle.com" or url like "bloopondle.com" or domainname like "blustpong.com" or siteurl like "blustpong.com" or url like "blustpong.com" or domainname like "braigwshat.com" or siteurl like "braigwshat.com" or url like "braigwshat.com" or domainname like "brisping.com" or siteurl like "brisping.com" or url like "brisping.com" or domainname like "bronglepong.com" or siteurl like "bronglepong.com" or url like "bronglepong.com" or domainname like "clapslpist.com" or siteurl like "clapslpist.com" or url like "clapslpist.com" or domainname like "clapslport.com" or siteurl like "clapslport.com" or url like "clapslport.com" or domainname like "craipivolta.com" or siteurl like "craipivolta.com" or url like "craipivolta.com" or domainname like "creapslpinut.com" or siteurl like "creapslpinut.com" or url like "creapslpinut.com" or domainname like "crodipolis.com" or siteurl like "crodipolis.com" or url like "crodipolis.com" or domainname like "delpiverno.com" or siteurl like "delpiverno.com" or url like "delpiverno.com" or domainname like "depomancy.com" or siteurl like "depomancy.com" or url like "depomancy.com" or domainname like "dewswyra.com" or siteurl like "dewswyra.com" or url like "dewswyra.com" or domainname like "drackpingcare.com" or siteurl like "drackpingcare.com" or url like "drackpingcare.com" or domainname like "dramapi.com" or siteurl like "dramapi.com" or url like "dramapi.com" or domainname like "drapithon.com" or siteurl like "drapithon.com" or url like "drapithon.com" or domainname like "fawsilver.com" or siteurl like "fawsilver.com" or url like "fawsilver.com" or domainname like "fawsindra.com" or siteurl like "fawsindra.com" or url like "fawsindra.com" or domainname like "fizzlepong.com" or siteurl like "fizzlepong.com" or url like "fizzlepong.com" or domainname like "flaigwern.com" or siteurl like "flaigwern.com" or url like "flaigwern.com" or domainname like "flapilo.com" or siteurl like "flapilo.com" or url like "flapilo.com" or domainname like "flapslwstorm.com" or siteurl like "flapslwstorm.com" or url like "flapslwstorm.com" or domainname like "flawsino.com" or siteurl like "flawsino.com" or url like "flawsino.com" or domainname like "flewsnark.com" or siteurl like "flewsnark.com" or url like "flewsnark.com" or domainname like "floporin.com" or siteurl like "floporin.com" or url like "floporin.com" or domainname like "floppipple.com" or siteurl like "floppipple.com" or url like "floppipple.com" or domainname like "flumpipoodle.com" or siteurl like "flumpipoodle.com" or url like "flumpipoodle.com" or domainname like "frosping.com" or siteurl like "frosping.com" or url like "frosping.com" or domainname like "gapslpinch.com" or siteurl like "gapslpinch.com" or url like "gapslpinch.com" or domainname like "gapslwsbor.com" or siteurl like "gapslwsbor.com" or url like "gapslwsbor.com" or domainname like "glapoton.com" or siteurl like "glapoton.com" or url like "glapoton.com" or domainname like "glewsnap.com" or siteurl like "glewsnap.com" or url like "glewsnap.com" or domainname like "glippinger.com" or siteurl like "glippinger.com" or url like "glippinger.com" or domainname like "gloobfnatch.com" or siteurl like "gloobfnatch.com" or url like "gloobfnatch.com" or domainname like "gloopong.com" or siteurl like "gloopong.com" or url like "gloopong.com" or domainname like "glowspar.com" or siteurl like "glowspar.com" or url like "glowspar.com" or domainname like "grasplpond.com" or siteurl like "grasplpond.com" or url like "grasplpond.com" or domainname like "grinapslpocal.com" or siteurl like "grinapslpocal.com" or url like "grinapslpocal.com" or domainname like "hawsith.com" or siteurl like "hawsith.com" or url like "hawsith.com" or domainname like "lapslponze.com" or siteurl like "lapslponze.com" or url like "lapslponze.com" or domainname like "lepovia.com" or siteurl like "lepovia.com" or url like "lepovia.com" or domainname like "limpingcare.com" or siteurl like "limpingcare.com" or url like "limpingcare.com" or domainname like "lorapslpifyx.com" or siteurl like "lorapslpifyx.com" or url like "lorapslpifyx.com" or domainname like "lowswyn.com" or siteurl like "lowswyn.com" or url like "lowswyn.com" or domainname like "lunapiris.com" or siteurl like "lunapiris.com" or url like "lunapiris.com" or domainname like "mopith.com" or siteurl like "mopith.com" or url like "mopith.com" or domainname like "mudponger.com" or siteurl like "mudponger.com" or url like "mudponger.com" or domainname like "nepiral.com" or siteurl like "nepiral.com" or url like "nepiral.com" or domainname like "opostra.com" or siteurl like "opostra.com" or url like "opostra.com" or domainname like "pibberflop.com" or siteurl like "pibberflop.com" or url like "pibberflop.com" or domainname like "pikaroodle.com" or siteurl like "pikaroodle.com" or url like "pikaroodle.com" or domainname like "ploponix.com" or siteurl like "ploponix.com" or url like "ploponix.com" or domainname like "qepoth.com" or siteurl like "qepoth.com" or url like "qepoth.com" or domainname like "rapinel.com" or siteurl like "rapinel.com" or url like "rapinel.com" or domainname like "rapslpine.com" or siteurl like "rapslpine.com" or url like "rapslpine.com" or domainname like "rapslponic.com" or siteurl like "rapslponic.com" or url like "rapslponic.com"

Detection Query 2 :

domainname like "rapslwsweave.com" or siteurl like "rapslwsweave.com" or url like "rapslwsweave.com" or domainname like "raspongle.com" or siteurl like "raspongle.com" or url like "raspongle.com" or domainname like "ripotus.com" or siteurl like "ripotus.com" or url like "ripotus.com" or domainname like "rowswyn.com" or siteurl like "rowswyn.com" or url like "rowswyn.com" or domainname like "scapslwshell.com" or siteurl like "scapslwshell.com" or url like "scapslwshell.com" or domainname like "snarpong.com" or siteurl like "snarpong.com" or url like "snarpong.com" or domainname like "snorpdoodle.com" or siteurl like "snorpdoodle.com" or url like "snorpdoodle.com" or domainname like "sofpilan.com" or siteurl like "sofpilan.com" or url like "sofpilan.com" or domainname like "soporth.com" or siteurl like "soporth.com" or url like "soporth.com" or domainname like "spopel.com" or siteurl like "spopel.com" or url like "spopel.com" or domainname like "tawserin.com" or siteurl like "tawserin.com" or url like "tawserin.com" or domainname like "tawswizzle.com" or siteurl like "tawswizzle.com" or url like "tawswizzle.com" or domainname like "teowsmera.com" or siteurl like "teowsmera.com" or url like "teowsmera.com" or domainname like "tepiol.com" or siteurl like "tepiol.com" or url like "tepiol.com" or domainname like "tewsmariel.com" or siteurl like "tewsmariel.com" or url like "tewsmariel.com" or domainname like "thaiporix.com" or siteurl like "thaiporix.com" or url like "thaiporix.com" or domainname like "thapolex.com" or siteurl like "thapolex.com" or url like "thapolex.com" or domainname like "torpoodle.com" or siteurl like "torpoodle.com" or url like "torpoodle.com" or domainname like "trapslwsin.com" or siteurl like "trapslwsin.com" or url like "trapslwsin.com" or domainname like "trawsica.com" or siteurl like "trawsica.com" or url like "trawsica.com" or domainname like "tripikazu.com" or siteurl like "tripikazu.com" or url like "tripikazu.com" or domainname like "twindping.com" or siteurl like "twindping.com" or url like "twindping.com" or domainname like "vaiporun.com" or siteurl like "vaiporun.com" or url like "vaiporun.com" or domainname like "vespilara.com" or siteurl like "vespilara.com" or url like "vespilara.com" or domainname like "vorpolis.com" or siteurl like "vorpolis.com" or url like "vorpolis.com" or domainname like "whispong.com" or siteurl like "whispong.com" or url like "whispong.com" or domainname like "winklenark.com" or siteurl like "winklenark.com" or url like "winklenark.com" or domainname like "wizzleplonk.com" or siteurl like "wizzleplonk.com" or url like "wizzleplonk.com" or domainname like "wogglenift.com" or siteurl like "wogglenift.com" or url like "wogglenift.com" or domainname like "yapodust.com" or siteurl like "yapodust.com" or url like "yapodust.com" or domainname like "yewsara.com" or siteurl like "yewsara.com" or url like "yewsara.com" or domainname like "zarflonk.com" or siteurl like "zarflonk.com" or url like "zarflonk.com" or domainname like "zenapslpinic.com" or siteurl like "zenapslpinic.com" or url like "zenapslpinic.com" or domainname like "zerapslpomat.com" or siteurl like "zerapslpomat.com" or url like "zerapslpomat.com" or domainname like "zimpire.com" or siteurl like "zimpire.com" or url like "zimpire.com" or domainname like "zingpingbees.com" or siteurl like "zingpingbees.com" or url like "zingpingbees.com" or domainname like "zippypongbee.com" or siteurl like "zippypongbee.com" or url like "zippypongbee.com" or domainname like "zoraipinex.com" or siteurl like "zoraipinex.com" or url like "zoraipinex.com" or domainname like "zorapslwsnic.com" or siteurl like "zorapslwsnic.com" or url like "zorapslwsnic.com" or domainname like "zrawsomble.com" or siteurl like "zrawsomble.com" or url like "zrawsomble.com" or domainname like "bestipip.com" or siteurl like "bestipip.com" or url like "bestipip.com" or domainname like "fecebbbk.xyz" or siteurl like "fecebbbk.xyz" or url like "fecebbbk.xyz" or domainname like "guangzhouroot.com" or siteurl like "guangzhouroot.com" or url like "guangzhouroot.com" or domainname like "bd-devmetrics.net" or siteurl like "bd-devmetrics.net" or url like "bd-devmetrics.net" or domainname like "jaguar-distributor.logreporter.com" or siteurl like "jaguar-distributor.logreporter.com" or url like "jaguar-distributor.logreporter.com" or domainname like "jaguar-distributor.syslogcollector.com" or siteurl like "jaguar-distributor.syslogcollector.com" or url like "jaguar-distributor.syslogcollector.com" or domainname like "tx-devmetrics.net" or siteurl like "tx-devmetrics.net" or url like "tx-devmetrics.net" or domainname like "linkfog.cn" or siteurl like "linkfog.cn" or url like "linkfog.cn" or domainname like "cloudbrokerapi.xyz" or siteurl like "cloudbrokerapi.xyz" or url like "cloudbrokerapi.xyz" or domainname like "dddlink.link" or siteurl like "dddlink.link" or url like "dddlink.link" or domainname like "smrtai.cc" or siteurl like "smrtai.cc" or url like "smrtai.cc" or domainname like "bkdomain.cn" or siteurl like "bkdomain.cn" or url like "bkdomain.cn" or domainname like "columbus2024.com" or siteurl like "columbus2024.com" or url like "columbus2024.com" or domainname like "dmurdce.xyz" or siteurl like "dmurdce.xyz" or url like "dmurdce.xyz" or domainname like "edisajalsjfdfh.shop" or siteurl like "edisajalsjfdfh.shop" or url like "edisajalsjfdfh.shop" or domainname like "fshuaons2.online" or siteurl like "fshuaons2.online" or url like "fshuaons2.online" or domainname like "fuioahsdoa3.store" or siteurl like "fuioahsdoa3.store" or url like "fuioahsdoa3.store" or domainname like "fuisans1.online" or siteurl like "fuisans1.online" or url like "fuisans1.online" or domainname like "haimnsgsjhansj.shop" or siteurl like "haimnsgsjhansj.shop" or url like "haimnsgsjhansj.shop" or domainname like "ishano456.sbs" or siteurl like "ishano456.sbs" or url like "ishano456.sbs" or domainname like "ishuoabh3years.online" or siteurl like "ishuoabh3years.online" or url like "ishuoabh3years.online" or domainname like "sdoisanadf.shop" or siteurl like "sdoisanadf.shop" or url like "sdoisanadf.shop" or domainname like "shaiosjdaln.shop" or siteurl like "shaiosjdaln.shop" or url like "shaiosjdaln.shop" or domainname like "shsuanalsjai.shop" or siteurl like "shsuanalsjai.shop" or url like "shsuanalsjai.shop" or domainname like "ty4523.space" or siteurl like "ty4523.space" or url like "ty4523.space" or domainname like "ty54fgd435.my" or siteurl like "ty54fgd435.my" or url like "ty54fgd435.my" or domainname like "ue886578433.online" or siteurl like "ue886578433.online" or url like "ue886578433.online" or domainname like "vrr8345.site" or siteurl like "vrr8345.site" or url like "vrr8345.site" or domainname like "xmsae.sbs" or siteurl like "xmsae.sbs" or url like "xmsae.sbs" or domainname like "xshaon123.sbs" or siteurl like "xshaon123.sbs" or url like "xshaon123.sbs" or domainname like "dgjm.online" or siteurl like "dgjm.online" or url like "dgjm.online" or domainname like "drgdj.top" or siteurl like "drgdj.top" or url like "drgdj.top" or domainname like "spiritlib.cyou" or siteurl like "spiritlib.cyou" or url like "spiritlib.cyou" or domainname like "traffmonetizer.com" or siteurl like "traffmonetizer.com" or url like "traffmonetizer.com" or domainname like "anyevonline.com" or siteurl like "anyevonline.com" or url like "anyevonline.com" or domainname like "intermedia-arts.tv" or siteurl like "intermedia-arts.tv" or url like "intermedia-arts.tv" or domainname like "szbboys.com" or siteurl like "szbboys.com" or url like "szbboys.com" or domainname like "ott.szbboys.com" or siteurl like "ott.szbboys.com" or url like "ott.szbboys.com" or domainname like "mqtt.szbboys.com" or siteurl like "mqtt.szbboys.com" or url like "mqtt.szbboys.com" or domainname like "github.com/Aviciiii/" or siteurl like "github.com/Aviciiii/" or url like "github.com/Aviciiii/" or domainname like "github.com/Spink1984/" or siteurl like "github.com/Spink1984/" or url like "github.com/Spink1984/" or domainname like "github.com/undowildcats-sketch/" or siteurl like "github.com/undowildcats-sketch/" or url like "github.com/undowildcats-sketch/" or domainname like "github.com/szjkkax/" or siteurl like "github.com/szjkkax/" or url like "github.com/szjkkax/" or domainname like "github.com/szsoft01/" or siteurl like "github.com/szsoft01/" or url like "github.com/szsoft01/" or domainname like "github.com/ktpeng2026/" or siteurl like "github.com/ktpeng2026/" or url like "github.com/ktpeng2026/" or domainname like "github.com/yf-videostrong/" or siteurl like "github.com/yf-videostrong/" or url like "github.com/yf-videostrong/" or domainname like "github.com/vspeng/" or siteurl like "github.com/vspeng/" or url like "github.com/vspeng/" or domainname like "github.com/szwzy43/" or siteurl like "github.com/szwzy43/" or url like "github.com/szwzy43/" or domainname like "github.com/ChenHui1026/" or siteurl like "github.com/ChenHui1026/" or url like "github.com/ChenHui1026/" or domainname like "github.com/zurant/" or siteurl like "github.com/zurant/" or url like "github.com/zurant/" or domainname like "yokatvonline.com" or siteurl like "yokatvonline.com" or url like "yokatvonline.com"

Detection Query 3 :

dstipaddress IN ("219.134.163.210","219.134.163.211","23.94.49.57","38.145.197.135") or srcipaddress IN ("219.134.163.210","219.134.163.211","23.94.49.57","38.145.197.135")

Detection Query 4 :

md5hash IN (“96146abb8c2a75dab8cc1bb46c323923”)

Detection Query 5 :

sha256hash IN ("3768f470934a111f1c3e3d098eb1392a3cb6f3e298ef5fd2a6309e6a98ee1e18","4f860efa8d8b9b8f35f343d524500181607a0cdc9fac35394cf16b71ff4ad1d0","8365658b7c51d7b607fe83d862d05e619cad5249c96db61a3d33a95c615c8194","92326f3065273d619f866f76e3542b6271886f92b1342c5ccc27cb7150c75176","17d4929578dac90af7da3a9c8bbd6f516ade8cc803c82a0f64849fb2a346a894","76b4bf6f55aaab35428260a830ac9a2c437a09aefd521c5b51618db47beca3b2","05e2e32e08073081adcb8875c3b7350fff53e7ea8f36d6388fb3daa626015d22","da5246fb62db91eda31df0873835e1c96a3187df1a760ffc87abf9788ba69104","471e76cce87e280a2fe11046fcb58c0817558ffbc8a526d84fb40c45b03ac9bc","39792bed070b1128cd67178591804fafb82112d371ccdb2b51cd600b2d435922","2cdb1f0f0969766142f3debbab55eef5e24c15d49a513753f1f6b67bc3e8438b","dca25ff0d11d49e9969be3177b50aa8bf120b5ad3946409dedae143a8a69aa99","20af9e1538e1c211687c53e71318d9d265e36ce154457cade3266c7633fb953d","f451c0b770049c71fb0d8efd45115dfc3336f636fb6a0617ec5a5c58632196f4","0d90d0e5009d0c67e978dffb1f78278fa22f296ebc14add1fe338abea8690867","22c0279d23973fd9b3bfd9f42fd19ea1595c6e3f71a89b698828c79fa8e4edd2","6b55b8b3ff7bd31af93b59612f0800c09e49d3badc772e2395736616c87d5612","049b626ca9bc4cf552e675dd5bf6215753caa3a3d28fab17b2a8fa9e0c8421c0","bcf142ba37e897b7fcbb89353ec9b5a7c3bfb1d167838d3b91c347b9fdfb2230","1806a1a93a6bce28cc6e95e9001f06370eaef9c66846ade9aecaf220d7ac91a4","9216a0a460400403027d4dfc9a6193a776603b64735f174e74a89607567ac6f2","04ffe332458931d82c0503daba1859622540828302af1190d2d3c6447094428c","3e891f061daf73c2edc14ed98512cad008346679645e8165320bf96fb8b0e0d6","415d54757c2f96fd28404f1ab8da1e90297a381ec3d7fb47d33126644a0a421b","9df157f3975b582074033c80d0d586f3911fb6bd3813539e2edf87ada4eee9fb","be9990489fbf36100ec148f3a83795f2674d17063edb8accd560f1ce2f97dedd","8953f9013eb8c31b27c86ba90edbdb9ecba216ed2cb6a992508c1964d53b8eee","01b8c78f5509119b3e27ea4d628048985b94b5e00db0431d843519cf1d3e2cde","5ae5df84cdce0100eb957cf235d1f3fd85fa634592e7ca137de12535e9f8ad2a","085662ba43e22d04d6f69b7b5176c68cedee6507c5d34973c94459f324b44c8d","07b511a6f7715ccd2f77b5f51e4cf46542ccaada99564252711f4a142ac26179","02490fa9f472ec872723d64d03402967e77932d2df72c588b0d7a7df9e17ae62","6f7f4b22eb7841d2b828f1eda77173880d42267a33b387bee9cee983c03bf291","1de0a368599ab04b8863c0e61c2d5a75e00f742a3326325f2870a9a72ee8d200","486a784cbd6335d31214edd7bed7fcfb486b875374597c139826c77c91ccbbaa","350d6db477e8567cf9347c1144b3a0b25550e7ce63bb800b056b8a7a8ef56af4","2d4b5c50e57e3e9b57d4ee02bef1dcd56163550a5e01c966e0f0fb6d46b2aeed","99874d087e3f72a9d78439118361f438f7a156af318c788183d338cc315d7fa8","4fd0ddb15849137df77e8cb86cd951d2d220fd8dd5b8b03c5a7e23e815092fdd","cad908ad09d029971b24b4ad653fe680101ccaddd94b4e530c58bf45430fd1a4","3627f848804f49c041203e8d754e8d89f3ff6243b6d9e1ca6e50bbf08dbd9785","0ed2ec71901210b1100c6a4abee48ad36774962496d57577d58630072e30cc60","1c8408f80dcdac5c9cae5b2ac785e6f0aa97ad2ec6c8701e3ab661882e9fdd63","1c34f551cea557b24f6f3776de7fecaf40536c749d5b9734242acde4dd578c53","1c989cef1b9cc5a39715d172e3f3acb574a958765f4a9df50c952c0a359826cd","498d0862ce2ce972e9ac9bd3ea592b9f9cd8c5119dcc90fcb1b14a547889e9f9","b2e55884c819c210eaf46aeb7970a1ec623944b5d1a8c2178904f998b9682ac0","1f2ab93c35f0c37d9b88f82268183a2f77491aa6b142a48381524b18e217b960","a552bcb7d37c2bdb5c71e923157571598643de4051bfa3e5158fde3cb8709de7","3295d193ac405112ad076d7fab23274d44f8d0be6614a250a474c5ed7c95356f","c0e1fad801d87531ee889fa6ec344f14868e7cdac06c93d2d3de742f1a9293c5","0135b69bab304564628488829b825050d1dd6dab98e86ec6776839dac9365af9","83b3cfb7655483e0d421737c2bed707fdd1747f105deca6980233c011aaaea30","02b94ae4ee0fd2bab915fe2911d15ee70e51ca0564ba43c746593e7fe0b7ccd3","69116e8f681ea312e7e9e3a8a436f66b3e98566c621412599ecaaa25348daadb","7eb1afbf4428a9a3b41a6faf9a7497aab1d7768a8370d475f580e574145a9e7d","d4011b684ba389bf0b2dd8ded74fe8a4729b1cad4e6c18cfd928cb99a625a6e4","e25616a0c64734f00d1f6dfb064d8f7bf1e4b95aac8b2e4aabb44b2950751bd0","cd8ef4ba20823b926b45a04946f24e45a7bcd4bf2bfc439cac8061a43f146903","08edc09f4465cd784360c223275c45a5e95d7dc8a5e796537ea5251848b3d2f1","fda3c8fdf7849814e270bbbc00adfa1e15ba8977f5b2508df5febf5dbd3075b2","b3690b3b013ac60752a6d05c3f53ea1f3e844d4603c5b90d258a30c596d0691b","ebcca22b96f7a30ae155efa2f25af29a369c6e9cfc99cb3bb0b72f35bc5528ed","42be8f18d6006ca092de191331d38e70a0d8383db701a759466dec59a0986135","7830ce3c3222dd9b25a77a16116dcf832a24b4b9a0bc998501e12415a828fb42","d4011b684ba389bf0b2dd8ded74fe8a4729b1cad4e6c18cfd928cb99a625a6e4","cd8ef4ba20823b926b45a04946f24e45a7bcd4bf2bfc439cac8061a43f146903","331d3a1cf85656c3657e97bab6f15b6e4ce30bf319069b22e8356dccac230321","d3b94a74121e885bc698c8f56b9433247139be29b40ae1d0655dd558ecf5f9fa","e2bfca7225af84f116de7ed10e4ad425d0ebfd6e19903d226b9768282865700f","d48cffc6d7e7c06f2d3db34ce6d4a53d5c25636179b7087a1e762f5d6bfa07f5","d3b94a74121e885bc698c8f56b9433247139be29b40ae1d0655dd558ecf5f9fa","69116e8f681ea312e7e9e3a8a436f66b3e98566c621412599ecaaa25348daadb","f2ed4a40fbb21d0560e82bdd2e85e825970d32052348241b487dd93191ebef2a","f2ed4a40fbb21d0560e82bdd2e85e825970d32052348241b487dd93191ebef2a","f2ed4a40fbb21d0560e82bdd2e85e825970d32052348241b487dd93191ebef2a","d48cffc6d7e7c06f2d3db34ce6d4a53d5c25636179b7087a1e762f5d6bfa07f5","8cb62b3a9b74ca8b907aef7d83fee65f3ab80e0f4acbf4b2415ea1c2a6caf796","a63757715b35ddd99916b63a1354de1ec05ac5855a480fe9a547b002e2091dcb","701f57169f3968bf412d33ec09fa6f2c11ece632aed9f44efa38eaf4fa2e08c6","f2ed4a40fbb21d0560e82bdd2e85e825970d32052348241b487dd93191ebef2a","9e18c113eb8d2ba813199c7f90e26d80af3124d871fc31eea7253319a8406e8e","742b7ad8b95d4e0784c914f2b84706124f5a86a404e0fd479a0a97a784c2bb9e","a6c7ef9b6d5277dada145361164ff79e1e6c6be1cd28f6739113c72ee30ea4cc","ff96f093bbac32654db62ebb33276c64cd30eb25a0bc11e66608ca40efb1bbdc","71f52519aae77fb20448ea065caa55750bcd73cf425aab203277032e260a1981")